Hi All,
Today I started to fight with my WL-500gP V2 router. When I discovered, that this is V2, my first thought was to bring it back, to get the older version, however, when I studied the specs, I've decided to try to get it running with Kamikaze.
After disassembling, I have discovered, that it has nice pins for soldering of serial connector (3,3V, so you need a level converter, however I use the USB-RS cable for old Siemens mobile) (the pin layout is as follows: 1: +3.3V, 2: RX, 3: TX, 4: GND - however double check it in your hardware!!!).
I'll publish the pictures of the disassembled device, as soon as I find good method for placing of relatively big images on this forum.
I succesfully flashed the device with the Kamikaze, using the diagnostic mode, however the router didn't start, or at least I was not able to communicate with it.
My serial console has displayed (I've changed the MAC number and DEVICE PIN for privacy reasons):
Decompressing..........done
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Apr 16 14:41:05 CST 2007 (root@localhost.localdomain)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
Initializing Arena
Initializing Devices.
Boot partition size = 131072(0x20000)
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.130.23.0
CPU type 0x29029: 240MHz
Total memory: 32768 KBytes
Total memory used by CFE: 0x80400000 - 0x8049A790 (632720)
Initialized Data: 0x80430720 - 0x80432D10 (9712)
BSS Area: 0x80432D10 - 0x80434790 (6784)
Local Heap: 0x80434790 - 0x80498790 (409600)
Stack Area: 0x80498790 - 0x8049A790 (8192)
Text (code) segment: 0x80400000 - 0x80430720 (198432)
Boot area (physical): 0x0049B000 - 0x004DB000
Relocation Factor: I:00000000 - D:00000000
Device eth0: hwaddr 00-32-CA-D6-A3-CD, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Null Rescue Flag.
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: TFTP Server.
Failed.
Could not load :: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3732 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
So it seems, that the start address was not correct, or the flashed system (openwrt-brcm-2.4-squashfs.trx) didn't support the serial console available in the Asus WL-500gP V2...
However I,ve not bricked the device. It has successfully entered the diagnostic mode:
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Apr 16 14:41:05 CST 2007 (root@localhost.localdomain)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
Initializing Arena
Initializing Devices.
Boot partition size = 131072(0x20000)
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.130.23.0
CPU type 0x29029: 240MHz
Total memory: 32768 KBytes
Total memory used by CFE: 0x80400000 - 0x8049A790 (632720)
Initialized Data: 0x80430720 - 0x80432D10 (9712)
BSS Area: 0x80432D10 - 0x80434790 (6784)
Local Heap: 0x80434790 - 0x80498790 (409600)
Stack Area: 0x80498790 - 0x8049A790 (8192)
Text (code) segment: 0x80400000 - 0x80430720 (198432)
Boot area (physical): 0x0049B000 - 0x004DB000
Relocation Factor: I:00000000 - D:00000000
Device eth0: hwaddr 00-1B-34-D4-A3-1B, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Null Rescue Flag.
Hello!! Enter Rescue Mode: (by Force)
Reading :: TFTP Server.
Failed.: Timeout occured
Reading :: TFTP Server.
And then downloaded and booted the original firmware (obtained from Asus WWW)
Failed.: Timeout occured
Reading :: TFTP Server.
TFTP_BLKLEN!!
Done. 7438336 bytes read
Download of 0x718000 bytes completed
Write kernel and filesystem binary to FLASH (0xbfc20000)
Programming...
copysize=7438336, amtcopy=7438336
done. 7438336 bytes written
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Apr 16 14:41:05 CST 2007 (root@localhost.localdomain)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
Initializing Arena
Initializing Devices.
Boot partition size = 131072(0x20000)
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.130.23.0
CPU type 0x29029: 240MHz
Total memory: 32768 KBytes
Total memory used by CFE: 0x80400000 - 0x8049A790 (632720)
Initialized Data: 0x80430720 - 0x80432D10 (9712)
BSS Area: 0x80432D10 - 0x80434790 (6784)
Local Heap: 0x80434790 - 0x80498790 (409600)
Stack Area: 0x80498790 - 0x8049A790 (8192)
Text (code) segment: 0x80400000 - 0x80430720 (198432)
Boot area (physical): 0x0049B000 - 0x004DB000
Relocation Factor: I:00000000 - D:00000000
Device eth0: hwaddr 00-32-D4-E3-4F-B5, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Null Rescue Flag.
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: TFTP Server.
Failed.
Could not load :: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .... 1777664 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00029029
Primary instruction cache 16kb, linesize 16 bytes (4 ways)
Primary data cache 16kb, linesize 16 bytes (2 ways)
Linux version 2.4.20 (root@localhost.localdomain) (gcc version 3.2.3 with Broad7
Setting the PFC to its default value
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
On node 0 totalpages: 8192
zone(0): 8192 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200
CPU: BCM5354 rev 2 at 240 MHz
Calibrating delay loop... 237.56 BogoMIPS
Memory: 30436k/32768k available (1535k kernel code, 2332k reserved, 116k data, )
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
Checking for 'wait' instruction... unavailable.
POSIX conformance testing by UNIFIX
PCI: no core
PCI: Fixing up bus 0
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
NTFS driver v1.1.22 [Flags: R/O]
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI ed
ttyS00 at 0xb8000300 (irq = 3) is a 16550A
ttyS01 at 0xb8000400 (irq = 0) is a 16550A
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
Amd/Fujitsu Extended Query Table v1.1 at 0x0040
MFR: c2 ID cb
number of CFI chips: 1
Flash device: 0x800000 at 0x1c000000
Physically mapped flash: cramfs filesystem found at block 881
Creating 4 MTD partitions on "Physically mapped flash":
0x00000000-0x00020000 : "boot"
0x00020000-0x007f0000 : "linux"
0x000dc6cc-0x007f0000 : "rootfs"
0x007f0000-0x00800000 : "nvram"
sflash: found no supported devices
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
ip_conntrack version 2.1 (256 buckets, 2048 max) - 344 bytes per conntrack
ip_conntrack_pptp version 1.9 loaded
ip_nat_pptp version 1.5 loaded
ip_tables: (C) 2000-2002 Netfilter core team
ipt_time loading
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
802.1Q VLAN Support v1.7 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (cramfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 64k freed
Algorithmics/MIPS FPU Emulator v1.5
eth0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.130.23.0
eth1: Broadcom BCM4318 802.11 Wireless Controller 4.130.25.0
vlan0: dev_set_promiscuity(master, 1)
device eth0 entered promiscuous mode
device vlan0 entered promiscuous mode
eth1: Invalid argument
device eth1 entered promiscuous mode
br0: port 2(eth1) entering listening state
br0: port 1(vlan0) entering listening state
br0: port 2(eth1) entering learning state
br0: port 2(eth1) entering forwarding state
br0: topology change detected, propagating
br0: port 1(vlan0) entering learning state
br0: port 1(vlan0) entering forwarding state
br0: topology change detected, propagating
info, udhcp server (v0.9.8) started
usb.c: registered new driver usbdevfs
usb.c: registered new driver hub
No interface specified. Quitting...
usb-ohci.c: USB OHCI at membase 0xb8003000, IRQ 6
usb-ohci.c: usb-00:03.0, PCI device 14e4:471a
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
uhci.c: USB Universal Host Controller Interface driver v1.1
ehci_hcd 00:03.1: PCI device 14e4:471a
ehci_hcd 00:03.1: irq 6, pci mem b8003800
usb.c: new USB bus registered, assigned bus number 2
ehci_hcd 00:03.1: illegal capability!
ECHI PCI device 471a14e4 found.
PCI: 00:03.1 PCI cache line size set incorrectly (0 bytes) by BIOS/FW, correcti2
ehci_hcd 00:03.1: USB 0.0 enabled, EHCI 1.00, driver 2003-Dec-29/2.4
hub.c: USB hub found
hub.c: 2 ports detected
usb.c: registered new driver usblp
printer.c: v0.13: USB Printer Device Class driver
hub.c: connect-debounce failed, port 1 disabled
hub.c: new USB device 00:03.1-1, assigned address 2
hub.c: USB hub found
hub.c: 2 ports detected
Linux video capture interface: v1.00
SCSI subsystem driver Revision: 1.00
Initializing USB Mass Storage driver...
usb.c: registered new driver usb-storage
USB Mass Storage support registered.
br0: port 1(vlan0) entering disabled state
vlan0: dev_set_promiscuity(master, 1)
br0: port 1(vlan0) entering listening state
br0: port 1(vlan0) entering learning state
br0: port 1(vlan0) entering forwarding state
br0: topology change detected, propagating
info, udhcp client (v0.9.8) started
No interface specified. Quitting...
eth0: No such process
PCI devices found:
Class 0501: PCI device 14e4:0800 (rev 2).
Class 0200: PCI device 14e4:4713 (rev 2).
Class 0b30: PCI device 14e4:0816 (rev 2).
Class 0c03: PCI device 14e4:471a (rev 2).
Class 0c03: PCI device 14e4:471a (rev 2).
Class 0500: PCI device 14e4:080f (rev 2).
Class 0280: PCI device 14e4:4318 (rev 2).
Class 0280: PCI device 14e4:4719 (rev 2).
echo for PaN ::: &&&PaN
*********************************************
Wi-Fi Simple Config Application - Intel Corp.
Version: Build 1.0.5, November 19 2006
*********************************************
Initializing stack... OK
Now starting stack
Info::NW_KEY ramdon generated is
get mac = 00 5E 13 C4 3D 6E
DEVICE PIN: 83465433
******* MODE: Access Point *******
DEVICE PIN: 83465433
WSC: In unconfiged AP mode, wait for start command....
Waiting for Registrar to connect...
If anybody has obtained any usefull information regarding running of Kamikaze on WL500gP V2 from my "serial dumps", please provide suggestions...
I'll continue my tests in my spare time, and if I'll get something usefull, I'll let you know.
--
Cheers,
WZab
(Last edited by wzab on 12 Mar 2008, 20:38)