WRTU54G-TM for $19.99

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Goto page 1, 2, 3  Next
Author Message
azilber
DD-WRT Novice


Joined: 06 Jan 2008
Posts: 17

PostPosted: Fri Jan 02, 2009 20:45    Post subject: WRTU54G-TM for $19.99 Reply with quote
Just saw this on http://www.1saleaday.com/
$19.99 (today only) for a the WRTU54G-TM which should be able to eventually run DD-WRT.

Specs seem to be ( http://openwrt.org/logs/openwrt-devel.log.20081006 ) :
Quote:

[10:06] <sn9> sure there is exotic hardware more important than the WRTU54G-TM, but that does not make the WRTU54G-TM unimportant, especially since the only other readily available consumer device TMK with 64M ram now is the WRT610N, which is $200 when it's on sale at Fry's
[10:09] <sn9> wrtu54g-tm = 8M flash, 64M ram, 5-port 10/100 switch, rt61 wifi, 2 fxs ports, 2 smartcard readers, and a cpu not yet supported

And it's running Linux:

http://www.linksys.com/servlet/Satellite?c=L_CASupport_C2&childpagename=US%2FLayout&cid=1175241074265&pagename=Linksys%2FCommon%2FVisitorWrapper&lid=JavaScript-1175241074265#versiondetail[/quote]
Sponsor
KeithB
DD-WRT User


Joined: 22 Jun 2008
Posts: 489

PostPosted: Fri Jan 02, 2009 22:18    Post subject: Reply with quote
At least the processor appears to be a MIPS 4K core, and the bootloader is U-boot. That's half the battle. The ADM8668 multi-purpose chip might be a bit of work, though. It appears to provide serial ports, USB, and network switch(es). Why does this thing have 64MB of RAM (big*ss VOIP load?) and built-in storage card slots Question
_________________
2x Asus RT-AC68U
agentsmith23
DD-WRT User


Joined: 03 Jul 2007
Posts: 69

PostPosted: Fri Jan 02, 2009 22:45    Post subject: Reply with quote
I don't know if I would trust that website. http://www.resellerratings.com/store/1_Sale_a_Day
KeithB
DD-WRT User


Joined: 22 Jun 2008
Posts: 489

PostPosted: Fri Jan 02, 2009 23:09    Post subject: Reply with quote
Yeah, some of these sites are better than others. woot.com never ripped me off, neither did buy.com, or geeks.com. I figure for $20, I'll take my chances. ;)

Incidentally, this appears to be pre-configured as a T-mobile hotspot.

_________________
2x Asus RT-AC68U
KeithB
DD-WRT User


Joined: 22 Jun 2008
Posts: 489

PostPosted: Sun Jan 04, 2009 15:25    Post subject: Reply with quote
I downloaded the 1.0.15 firmware for this router from Linksys, and the .BIN file contains a file header and two binary blobs. The header contains 64 bytes. The first blob is a Gzipped Linux kernel. Then after a large expanse of null bytes, the SquashFS file system begins. Other than snipping it out with a hex editor, I haven't mounted and dumped it (yet).

Meister_SD at dslreports.com has been picking it apart already. He's included a copy of the serial console output.

:!: Exclamation Let's all remember how great it is to have Open Source Software and the GPL working for us Exclamation Exclamation
This router runs U-Boot 2.1.4, an ADM8668 Linux 2.4.31 kernel, and the console log confirms it's got 64MB RAM. Very Happy
Code:

LINUX/8668 started...
CPU revision is: 0001800b
Primary instruction cache 8kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 8kB, 2-way, linesize 16 bytes.
Linux version 2.4.31-ADM8668 (root@porter-vmware.net) (gcc version 3.3.6) #1.00.04 03:00:59 CST 04/10/2008
Can't analyze prologue code at 8001f824
adm8668_setup() starts.
System has PCI BIOS
Determined physical RAM map:
 memory: 03d8a000 @ 00276000 (usable)
On node 0 totalpages: 16384
zone(0): 16384 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: rootfstype=squashfs root=/dev/mtdblock1 console=/dev/ttyS0
CPU clock: 200 MHz
Using 100.000 MHz high precision timer.
Syam before calibrate_delay
Calibrating delay loop...
199.47 BogoMIPS
Syam after calibrate_delay
MIPS CPU counter frequency is fixed at 100000000 Hz
Memory: 62304k/63016k available (2158k kernel code, 712k reserved, 124k data, 104k init, 0k highmem)
Dentry cache hash table entries: 8192 (order: 4, 65536 bytes)
Inode cache hash table entries: 4096 (order: 3, 32768 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 4096 (order: 2, 16384 bytes)
Page-cache hash table entries: 16384 (order: 4, 65536 bytes)


The wireless driver is an RaLink RT61. Here are relevant portions of the console boot log:
Code:

*RT61*<7>===> RT61_init_one
*RT61*<7>Driver version-1.1.0.0
*RT61*<7>ra0: at 0x16000000, VA 0xb6000000, IRQ 14.
*RT61*<7><=== RT61_init_one
. . .
. . .
*RT61*<7>===> NICLoadFirmware
*RT61*<7>NICLoadFirmware: CRC ok, ver=1.2
*RT61*<7><=== NICLoadFirmware (src=/etc/Wireless/RT61AP/RT2561S.bin, status=0)

_________________
2x Asus RT-AC68U


Last edited by KeithB on Sun Jan 04, 2009 19:42; edited 1 time in total
KeithB
DD-WRT User


Joined: 22 Jun 2008
Posts: 489

PostPosted: Sun Jan 04, 2009 19:40    Post subject: Reply with quote
Here's a hex dump of the 64-byte header for Linksys firmware 1.00.15. The first 32 bytes need to be identified. The last 32 bytes are simply an ASCII description of the Linux firmware image that follows.


WRTU54G-TM_Firmware_Header.png
 Description:
WRTU54G-TM Firmware 1.00.15 Header
 Filesize:  32.29 KB
 Viewed:  20204 Time(s)

WRTU54G-TM_Firmware_Header.png



_________________
2x Asus RT-AC68U
KeithB
DD-WRT User


Joined: 22 Jun 2008
Posts: 489

PostPosted: Wed Jan 07, 2009 12:50    Post subject: Reply with quote
I received a USPS tracking number overnight. Hopefully, it's on its way to me now...
_________________
2x Asus RT-AC68U
azilber
DD-WRT Novice


Joined: 06 Jan 2008
Posts: 17

PostPosted: Sat Jan 17, 2009 5:32    Post subject: Just got mine today. Reply with quote
I've been ordering stuff from that site for a while, they haven't let me down yet. My WRTU45G-TM arrived today. It looked like maybe it was a refurb or return... it looked brand new but someone had put the sim card in the router.

KeithB wrote:
I received a USPS tracking number overnight. Hopefully, it's on its way to me now...


I figured since it's a router running linux already, it should be easier to get it ported. I love the specs on the sucker. Don't care if the sim cards don't get supported.
slimey
DD-WRT User


Joined: 14 Feb 2007
Posts: 330
Location: Texas

PostPosted: Sat Jan 17, 2009 7:50    Post subject: Reply with quote
What is the name of that hex editor or a url for it?
KeithB
DD-WRT User


Joined: 22 Jun 2008
Posts: 489

PostPosted: Sat Jan 17, 2009 18:30    Post subject: Reply with quote
The hex editor is Raihan Kibria's frhed, the 'free hex editor'.

My WRTU54G arrived Friday evening. It was practically new, except the seals on the original T-Mobile outer box were broken and the SIM card was inserted in the unit. Seals on the CD and over the RJ-45 ports were still intact.

I finally extracted the SquashFS file system contents today, after determining a valid Linux executable of unsquashfs for SquashFS 2.2 w/LZMA is included in Jeremy Collake's firmware modification kit. Here is the first line from the /etc/passwd file, containing the hashed root password:
Code:
root:$1$$oQoSkI0acntd1ifGxMHvp0:0:0:root:/:/bin/sh

I'm currently running John The Ripper against it, but rcilink and meister_sd at the dslreports.com VOIP form started this a while back, and a power fail delayed their attempts. Sad Hopefully my power is holding out and my UPS will live long enough if the power does fail. ;)

EDIT: I spent this afternoon reviewing meister_sd's 8-megabyte dump of the Flash RAM and documented it on the dslreports.com thread. Maybe it will help others?

_________________
2x Asus RT-AC68U
KeithB
DD-WRT User


Joined: 22 Jun 2008
Posts: 489

PostPosted: Mon Jan 19, 2009 15:58    Post subject: Reply with quote
KeithB wrote:
Here's a hex dump of the 64-byte header for Linksys firmware 1.00.15. The first 32 bytes need to be identified. The last 32 bytes are simply an ASCII description of the Linux firmware image that follows.


After reviewing meister_sd's dump of the flash RAM, it appears the first four bytes of that firmware are header bytes for a compressed filesystem partition. There are two kernel and two SquashFS filesystem partitions on the flash, and they all begin with the same four-byte header. That leaves 28 bytes to decode, or seven (7) 32-bit values. One might be the data length and another should be a checksum, so that leaves five (5) 32-bit values to identify.

Anyone else interested in hacking DD-WRT onto this 8-Meg Flash / 64-Meg RAM MIPs device?

_________________
2x Asus RT-AC68U
jmh9072
DD-WRT Guru


Joined: 04 Sep 2007
Posts: 800
Location: Ohio

PostPosted: Mon Jan 19, 2009 17:58    Post subject: Reply with quote
Linksys has posted the source code in their GPL Code Center.

You'll probably find some answers there.

_________________
WRT54G v3 - v24 r14471M NEWD Eko - AP
WRT350N v1.0
WRT600N v1.1 - halfway there!
Se7en is Darker...
KeithB
DD-WRT User


Joined: 22 Jun 2008
Posts: 489

PostPosted: Mon Jan 19, 2009 18:14    Post subject: Reply with quote
At the dslreports forums, meister_sd and rcilink were starting to build the firmware from Linksys's source tarballs before the holidays, but haven't said anything else since then. Sad I suspect they need to identify and rebuild the 32-byte partition headers necessary for the firmware, but the programs to do that aren't included in the sources. It's similar to what open source developers experienced with Broadcom and their .TRX and .CHK headers over the last several years: Dig, guess, guess again, and just hold out hope someone finds or figures out something, eventually.
_________________
2x Asus RT-AC68U
jmh9072
DD-WRT Guru


Joined: 04 Sep 2007
Posts: 800
Location: Ohio

PostPosted: Mon Jan 19, 2009 18:21    Post subject: Reply with quote
KeithB wrote:
At the dslreports forums, meister_sd and rcilink were starting to build the firmware from Linksys's source tarballs before the holidays, but haven't said anything else since then. Sad I suspect they need to identify and rebuild the 32-byte partition headers necessary for the firmware, but the programs to do that aren't included in the sources. It's similar to what open source developers experienced with Broadcom and their .TRX and .CHK headers over the last several years: Dig, guess, guess again, and just hold out hope someone finds or figures out something, eventually.

I've built Linksys's sources before, and they've all done everything necessary to create a flashable image automatically (build the sources, build the cram/squashfs image, append it to the linux kernel, and add the header/trailer). Those units had CFEs, though, not U-boot. I'm not familiar with U-boot and its bootstrap procedure, though, so I'm not qualified to speak about it.

I might take a look at the sources when I get a chance. Now I'm interested. Smile

_________________
WRT54G v3 - v24 r14471M NEWD Eko - AP
WRT350N v1.0
WRT600N v1.1 - halfway there!
Se7en is Darker...
KeithB
DD-WRT User


Joined: 22 Jun 2008
Posts: 489

PostPosted: Mon Jan 19, 2009 22:37    Post subject: Reply with quote
U-boot is really full-featured IMHO Very Happy Netgear used it on their Marvell-based WNR854T router. I'll have to accept your experience (Thanks!) and make an attempt at building the firmware. It's wireless-G (non-MIMO), but with 8 meg Flash, 64 meg DRAM, two SIM card slots (USB-connected, I believe) and two RJ-11 UMA ports, it's got plenty of room for DD-WRT Mega. (The ADM8668 Wildpass SoC is MIPS R4000-based) Linksys/T-Mobile currently stores two separate copies of the Linux kernel and SquashFS partitions in the Flash. I guess one of those pairs is either their fall-back/recovery or a scratchpad area for live upgrades. I haven't powered it up or connected yet, but will probably open it up and install a console port soon.
_________________
2x Asus RT-AC68U
Goto page 1, 2, 3  Next Display posts from previous:    Page 1 of 3
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum