[bloodblight]

I have a box of these Aruba AP61 that I got for free, but you can find them cheap on eBay.

They run on an Atheros chip, and appear to have a JTAG port (bottom right of the first pic).

Chipset: AR2313A-001
RAM?: 48LC16M16A2 (I think this is 16MBs)
Flash?: T061121
Flash Sticker: U11 1110010

I am handy with the sodering iron and would LOVE to turn these into APs/Clients!!!!

They are supposed to connect into a management console, but I don't have it, and Aruba is being an ass about it. So there is no interface on the unit it self. I would need to JTAG each one.

Ideas? First steps?

[remaker]

I think the AR430W and DIR-300 are based on an AP61 reference design; start with the hardware hacking notes 9and firmware loads) about those. i also think at least one of the F*nera devices are also based on that design.

The JTAG and Serial header pins should be common among the Atheros designs. The serial connections are 3.3V,so you cannot connect direct to a PC serial port; you need a way to step down the voltage. The serial-to-cellphone adapters (cheap!) can generally be hacked for that job.

[bloodblight]

Excellent!

I saw that those where using an "AP61.rom" file and wondered. Ok, I do have an extra USB to Cell phone cable that I'm not using, but I also saw a design for a JTAG that used a few OHM resisters.

To be honest I prefer that design if it works just as well (easier for me, don't mind the slight cost). It was even give me an excuse to go to Norvac. ^__^

Doing my homework...

Thanks remaker!

[bloodblight]

No go on the pin out. Nothing out there seems to have the same pinout config. Is there any way to determine what the pinout is without reference docs? Or would I need an oscilloscope and a degree?

[bloodblight]

Sorry, I know, to many posts in a row. But thought I would share this.

http://blog.makezine.com/archive/2007/10/jtag_pinout_detector.html

Anyone have one?

[Sash]

ok get us the flsh size plz

[bloodblight]

The second number on the flash is 29LV320CTTC-90G. I THINK this is a 4MB.

[Sash]

http://www.alldatasheet.com/datasheet-pdf/pdf/143118/MCNIX/MX29LV320CTTC-70.html

JEP...4MB

it has only one lan port and no switch. which cpu is mounted?
we have to find out which .bin fits best

[bloodblight]

There is Atheros AR2313A-001 Chip. But I don't see anything else that I would classify as a CPU. If that isn't it, what should I be looking for (one or two examples)?

[Sash]

ok i see

can u plz try to acces the redboot using the install instruction for the dir300

but a serial connection would be recommend.

[bloodblight]

There is no reset button, no web interface, nothin'.

This thing is kinda locked down.

There is nothing on the WIKI site that has a similar pin out. I only have 8 pin header.
http://www.dd-wrt.com/wiki/index.php/JTAG_pinouts


And the JTAG instructions don't list a wattage rating.
http://www.dd-wrt.com/wiki/index.php/JTAG-Adapter

Is a 1/8 watt rating for the 100 ohm resister, maybe a 1/4 or 1/2 watt?
http://www.radioshack.com/search/index.jsp?kwCatId=&kw=100%20ohm&origkw=100%20ohm&sr=1



Just as an FYI this is what I have learned about its bootup (from sniffing it).

1 - Power On - About 10 Seconds.
2 - Sends out a DHCP request.
3 - Will connect to either it's currently programmed master server, or will use the "aruba-master" from the DHCP response.
4 - Attempts to "join" a virtual network at 240.x.x.x.

I am going to move it over to my primary network and using my DC to send it the "aruba-master" value. See what I can get out of that.

[bloodblight]

I might be willing to part with one of these if one of the hardware dev folks want to take a crack at it.

[Sash]

i would say thet the 8pin header is serial cause its far away from the flash and beside the cpu.

so plz add some pins and get a serial converter

[antonvp]

[antonvp]