Joined: 08 May 2018 Posts: 14208 Location: Texas, USA
Posted: Sun Feb 14, 2021 10:17 Post subject:
It could be some kind of oddball rate, such as: 19200, 28800, 38400, 48000, 67200, 76800, 86400, 96000, 105600. I don't think it would be faster than 115200. Those holes on the back look like they could be for JTAG, but I am not 100% sure. This device is definitely curious. Those solder pads without holes, were those the ones you tested? _________________ "Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT Pogo - A minimal level of ability is expected and needed... DD-WRT Releases 2023 (PolitePol)
DD-WRT Releases 2023 (RSS Everything)
----------------------
Linux User #377467 counter.li.org / linuxcounter.net
It could be some kind of oddball rate, such as: 19200, 28800, 38400, 48000, 67200, 76800, 86400, 96000, 105600. I don't think it would be faster than 115200. Those holes on the back look like they could be for JTAG, but I am not 100% sure. This device is definitely curious. Those solder pads without holes, were those the ones you tested?
I think that baud rate is Ok.......even if is not, you can see some information on the Putty's screen but is not readable until you not set it correct.
These 3 small pads are very difficult to solder, but I think I was able to measure them with a multimeter and the values are very close to those of RX and TX.The midle one is very changable until thee router boot and then is constantly 3.3V...this one is TX I think. The other one(the biger one) is nothing, which I think is RX. Now I'm going to my father to solder with his thiner soldering tool and than test it again.
##### The CPU freq = 320 MHZ ####
estimate memory size =32 Mbytes
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
7: Load Boot Loader code then write to Flash via Serial.
8: Load Boot Loader code to SDRAM via TFTP.
9: Load Boot Loader code then write to Flash via TFTP.
raspi_read: from:40028 len:6
.
Init GPIO for EMG.
3: System Boot system code via Flash.
## Booting image at bf050000 ...
raspi_read: from:50000 len:40
. Image Name: WR-150N
Created: 2012-05-16 20:54:16 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 2801433 Bytes = 2.7 MB
Load Address: 80000000
Entry Point: 8000c1f0
raspi_read: from:50040 len:2abf19
........................................... Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8000c1f0) ...
## Giving linux memsize in MB, 32
Starting kernel ...
Linux version 2.6.21.15 (debian-kernel@lists.debian.org) (gcc version 4.6.3 (GCC) ) #0 Wed May 16 23:35:03 EEST 2012
ASIC mode LINUX started...
The CPU frequency set to 380 MHz
CPU revision is: 0001964c (MIPS 24K)
DetectRAMsequence
MAX memory:[67108864]
RAM size detected:[33554432]
FullviewRAM:[33554432]
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock4 ro
start_kernel(): bug: interrupts were enabled *very* early, fixing it
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized clear page handler (25 instructions).
Synthesized copy page handler (44 instructions).
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = c0808018, status = 11000000
PID hash table entries: 1024 (order: 0, 4096 bytes)
calculating r4koff... 0004e200(320000)
CPU frequency 380.00 MHz
Using 160.000 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 30044k/32768k available (64k kernel code, 2724k reserved, 1916k data, 288k init, 0k highmem)
Mount-cache hash table entries: 512
softirq RT prio: 24.
NET: Registered protocol family 16
Time: MIPS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
deice id : c2 20 16 c2 20 (2016c220)
MX25L3205D(c2 2016c220) (4096 Kbytes)
mtd .name = raspi, .size = 0x00400000 (4M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 7 MTD partitions on "raspi":
0x00000000-0x00030000 : "uboot"
0x00030000-0x00040000 : "uboot-config"
0x00040000-0x00050000 : "factory-defaults"
0x00050000-0x000fff59 : "linux"
0x000fff59-0x003f0000 : "rootfs"
0x003f0000-0x00400000 : "nvram"
0x00050000-0x003f0000 : "Kernel_RootFS"
Load Timer Module(Wdg/Soft)
squashfs: version 3.4 (2008/08/26) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
io scheduler noop registered (default)
Ralink gpio driver initialized
Number of GPIO=52
Generic RTC Driver v1.07
Ralink APSoC Hardware Watchdog Timer
Serial: 8250/16550 driver $Revision: 1.6 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
Ralink APSoC Ethernet Driver Initilization. v2.1 512 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, weight = 64, Tx Ring = 512, Rx Ring = 512
PROC INIT OK!
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
block2mtd: version $Revision: 1.1.1.1 $
nf_conntrack version 0.5.0 (2048 buckets, 4096 max)
TCP cubic registered
ip_tables: (C) 2000-2006 Netfilter Core Team, <6>NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
NAT Fastpath init.
VFS: Mounted root (squashfs filesystem) readonly.
mount /proc file system ok!
mount /sys file system ok!
mount /dev file system ok!
mount /tmp file system ok!
Freeing unused kernel memory: 288k freed
Build the /dev/console node.
Algorithmics/MIPS FPU Emulator v1.5
phy_tx_ring = 0x0070e000, tx_ring = 0xa070e000
phy_rx_ring0 = 0x00710000, rx_ring0 = 0xa0710000
GDMA1_MAC_ADRH -- : 0x0000000f
GDMA1_MAC_ADRL -- : 0x021200dd
CDMA_CSG_CFG = 81000007
GDMA1_FWD_CFG = 790000
vlan1: Setting MAC address to 00 0f 02 12 00 de.
device eth2 entered promiscuous mode
vlan2: Setting MAC address to 00 0f 02 12 00 df.
[74] cron started
/etc/cron.d: Can't open
Must specify a key filename
Usage: dropbearkey -t <type> -f <filename> [-s bits]
Options are:
-t type Type of key to generate. One of:
rsa
dss
-f filename Use filename for the secret key
-s bits Key size in bits, should be a multiple of 8 (optional)
(DSS has a fixed size of 1024 bits)
-y Just print the publickey and fingerprint for the
private key in <filename>.
0x1300 = 00064380
vlan1: Setting MAC address to 00 0f 02 12 00 de.
device ra0 entered promiscuous mode
br0: topology change detected, propagating
br0: port 1(ra0) entering forwarding state
br0: topology change detected, propagating
br0: port 2(vlan2) entering forwarding state
May 16 20:54:08 dnsmasq[134]: started, version 2.61 cachesize 100
May 16 20:54:08 dnsmasq[134]: compile time options: no-IPv6 GNU-getopt no-RTC no-DBus no-i18n no-IDN DHCP no-DHCPv6 no-scripts no-TFTP no-conntrack
May 16 20:54:08 dnsmasq-dhcp[134]: DHCP, IP range 192.168.1.100 -- 192.168.1.149, lease time 15m
May 16 20:54:08 dnsmasq[134]: failed to load names from /etc/hosts: No such file or directory
[152] cron started
WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
^@coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: cWISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: coova-chilli[156]: options.c: 18WISPR - NET1 v2.44
Release: May 16 2012 (SVN revision: 7300)
▒
WR150 login: coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
tftp: sendto: Network is unreachable
coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
coova-chilli[156]: options.c: 181: could not generate configuration (/tmp/run/chilli.156.cfg.bin), sleeping one second
c
Joined: 08 May 2018 Posts: 14208 Location: Texas, USA
Posted: Mon Feb 15, 2021 0:07 Post subject:
Glad you got serial access. What is needed is the contents of the flash chip. Not entirely sure if the commands are available to do it, but I emailed BrainSlayer to update him on this. _________________ "Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT Pogo - A minimal level of ability is expected and needed... DD-WRT Releases 2023 (PolitePol)
DD-WRT Releases 2023 (RSS Everything)
----------------------
Linux User #377467 counter.li.org / linuxcounter.net
Joined: 06 Jun 2006 Posts: 7492 Location: Dresden, Germany
Posted: Mon Feb 15, 2021 5:20 Post subject:
so now copy the flash
this can be done with
cat /dev/mtdblock0 > /tmp/mtd.bin
(copy all mtd devs you find except for nvram, since i dont need your private config data)
a full list of mtd partitions can be reviewed if you do
cat /proc/mtd
after you have done this, use scp and copy the data to a external ssh server or if you get ssh to run on that device. use winscp to copy it out from it. from the log file i have seen that it contains the dropbear ssh server and scp _________________ "So you tried to use the computer and it started smoking? Sounds like a Mac to me.." - Louis Rossmann https://www.youtube.com/watch?v=eL_5YDRWqGE&t=60s
this can be done with
cat /dev/mtdblock0 > /tmp/mtd.bin
(copy all mtd devs you find except for nvram, since i dont need your private config data)
a full list of mtd partitions can be reviewed if you do
cat /proc/mtd
after you have done this, use scp and copy the data to a external ssh server or if you get ssh to run on that device. use winscp to copy it out from it. from the log file i have seen that it contains the dropbear ssh server and scp
I have to login first...but I don't know the username and password(i've tried:root,admin,1234).Also this message is constantly displayed
Code:
coova-chilli[298]: options.c: 181: could not generate configuration (/tmp/run/chilli.298.cfg.bin), sleeping one second
coova-chilli[298]: options.c: 181: could not generate configuration (/tmp/run/chilli.298.cfg.bin), sleeping one second
coova-chilli[298]: options.c: 181: could not generate configuration (/tmp/run/chilli.298.cfg.bin), sleeping one second
coova-chilli[298]: options.c: 181: could not generate configuration (/tmp/run/chilli.298.cfg.bin), sleeping one second
coova-chilli[298]: options.c: 181: could not generate configuration (/tmp/run/chilli.298.cfg.bin), sleeping one second
coova-chilli[298]: options.c: 181: could not generate configuration (/tmp/run/chilli.298.cfg.bin), sleeping one second
coova-chilli[298]: options.c: 181: could not generate configuration (/tmp/run/chilli.298.c
Default username and password should be root / admin. Did you do a full reset of the router? May need to do that.
Yes I did factory reset first and then I tried many different combination.Also I created a user/pass for Web GUI and used them for SSH but without any success.
The ssh username is *always* root. Not sure you need a username or password on serial console.
No way to login....I tried so many atempts
What can I do next?Can I flash some image without information from flashdump?I don't care at all if I brick the router.
Joined: 08 May 2018 Posts: 14208 Location: Texas, USA
Posted: Mon Feb 15, 2021 17:28 Post subject:
Were you able to login via the serial console connection and create flash dumps and download them? If you have no way to enable telnet or ssh access via ethernet, then that is the only way you're going to be able to do anything. _________________ "Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT Pogo - A minimal level of ability is expected and needed... DD-WRT Releases 2023 (PolitePol)
DD-WRT Releases 2023 (RSS Everything)
----------------------
Linux User #377467 counter.li.org / linuxcounter.net
Were you able to login via the serial console connection and create flash dumps and download them? If you have no way to enable telnet or ssh access via ethernet, then that is the only way you're going to be able to do anything.
I'am not able to login by serial conection.I think the password is not the default one......It's changed from ISP. As I also said.....no tabs in WebGUI to enable SSH/Telnet services.Is that mean......no way to flash DD-WRT?How the ISP did it?The stock firmware is limited DD-WRT version?
Joined: 08 May 2018 Posts: 14208 Location: Texas, USA
Posted: Mon Feb 15, 2021 22:27 Post subject:
The login username should be root. Normally, the password is the same as the webUI, but they may have created a separate login as you said. Did you try admin/password or admin/admin? _________________ "Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT Pogo - A minimal level of ability is expected and needed... DD-WRT Releases 2023 (PolitePol)
DD-WRT Releases 2023 (RSS Everything)
----------------------
Linux User #377467 counter.li.org / linuxcounter.net
