Acer Predator W6 with OpenWrt

For Developers
292

Does anyone have the original factory.bin dump file of the Acer Predator W6 6E router that they could share with me?

293

Hey Valentijn any success with sysupgrade from stock Acer firmware ?

294

In case it helps someone, I’ve been flashing W6D today…

Got stuck at setting up the serial, as I was following the W6 doc and only after found the TX and RX are flipped on (at least this) w6d.

Had to set boot timeout to be able to get to uboot console (mt7986> prompt) from the stock fw:

fw_setenv bootmenu_delay 1
fw_setenv bootdelay 1
reboot

In U-boot console:

# Skip signature verification
setenv bootcmd 'mmc read 0x40000000 0x00004400 0x0010000; fdt addr $(fdtcontroladdr); fdt rm /signature; bootm 0x40000000'
saveenv

# Set IPs for tftp transfer (doesn't need to be specific IP)
setenv serverip 192.168.2.2
setenv ipaddr 192.168.2.1
tftpboot 0x46000000 predator.bin

# Boot into the copied image
fdt addr $(fdtcontroladdr)
fdt rm /signature
bootm

From there I used scp -0 from my PC to copy the sysupgrade image to /tmp and then ran sysupgrade /tmp/openwrt-....

No luck marking the boot slots as invalid. As per Xyz00777 and blocktrron, wiping the partitions does the trick.

# optional backup (scp the .bak files)
dd if=/dev/mmcblk0p5 of=/tmp/mmcblk0p5.bak
dd if=/dev/mmcblk0p7 of=/tmp/mmcblk0p7.bak

# wipe headers
dd if=/dev/zero of=/dev/mmcblk0p5 bs=1 count=128
dd if=/dev/zero of=/dev/mmcblk0p7 bs=1 count=128

sysupgrade /tmp/openwrt-*-sysupgrade.bin

I've also mounted the 2G flash storage (verify the device name):

# Format the partition
mkfs.ext4 /dev/mmcblk0p12

# Create mount point and mount
mkdir -p /mnt/data
mount /dev/mmcblk0p12 /mnt/data

# Make it persistent
echo '/dev/mmcblk0p12 /mnt/data ext4 defaults 0 0' >> /etc/fstab
295

Hi, I'm looking for almost the same thing, recovery data from an original Acer Predator Connect W6.

This is the original W6 on MT7986, not the W6d, W6x, or Vero W6m.

Bootloader details from serial log:

  • U-Boot 2023.04
  • build date: Jan 15 2024 - 14:30:51 +0800
  • build string: jenkins-YX6ES_mesh-187
  • board/model shown by U-Boot:
    • CPU: MediaTek MT7986
    • Model: mt7986-rfb
    • (mediatek,mt7986-emmc-rfb)

What happened:

  • I TFTP-booted the OpenWrt initramfs image successfully
  • I then booted OpenWrt in RAM and ran sysupgrade
  • after that I made a bad boot choice and then tried to recover from U-Boot
  • I mistakenly used U-Boot "Upgrade single image" with the initramfs image (chose the choice 7 without realising that there are boot menus with differing numbers of options, 7 was in the instructions)

The exact images I used were:

  • openwrt-24.10.4-mediatek-filogic-acer_predator-w6-initramfs-kernel.bin
  • openwrt-24.10.4-mediatek-filogic-acer_predator-w6-squashfs-sysupgrade.bin

I had renamed them locally to:

  • predator.bin = openwrt-24.10.4-mediatek-filogic-acer_predator-w6-initramfs-kernel.bin
  • sysupgrade.bin = openwrt-24.10.4-mediatek-filogic-acer_predator-w6-squashfs-sysupgrade.bin

The fatal mistake appears to have been this U-Boot action:

  • Boot Menu -> Upgrade single image
  • TFTP file selected: predator.bin

That resulted in a raw write like this in the serial log:

Writing from 0x46000000 to 0x0, size 0x910000 ... OK

So it looks like the initramfs image was written at eMMC offset 0, which likely destroyed the GPT and early boot area.

Before the final brick, I still had U-Boot and could TFTP-boot the initramfs image. After the mistaken "Upgrade single image" write, the partition layout was no longer sane.

Relevant symptoms from the logs:

  • earlier, Linux still saw mmcblk0 partitions and reported GPT problems
  • later, OpenWrt reported:
    • partition u-boot-env not found!
  • after reboot, the board only prints BootROM lines ending with Jump to BL

Current serial output ends with:

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 103F 0000
F3: 1006 0033 [0200]
F3: 4001 00E0 [0200]
F3: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [2000]
T0: 0000 027A [010F]
Jump to BL

What I need from someone with a working original Predator W6:

  1. mmcblk0boot0
  2. mmcblk0boot1
  3. the first 32 MiB of /dev/mmcblk0
  4. ideally also the partition table output:
    • sgdisk -p /dev/mmcblk0
    • or parted -s /dev/mmcblk0 print

If 32 MiB feels too large to share, even the first 16 MiB may already help.

I am specifically trying to restore:

  • the early boot-critical area
  • GPT / partition layout
  • whatever the stock boot chain expects in the initial eMMC region

Important:

  • I need dumps from the original W6 only
  • dumps from W6d, W6x, or Vero W6m are probably not safe substitutes
  • I am not asking for a full user-data dump, only the minimum boot-relevant regions

Commands on a working original W6 that would help:

dd if=/dev/mmcblk0boot0 of=mmcblk0boot0.bin bs=1M
dd if=/dev/mmcblk0boot1 of=mmcblk0boot1.bin bs=1M
dd if=/dev/mmcblk0 of=w6-first-32MiB.bin bs=1M count=32
sgdisk -p /dev/mmcblk0 > w6-partitions.txt

If access to mmcblk0boot0/1 is restricted, even just the first 32 MiB plus the partition table would still be useful.

I can provide the full serial log if needed.

Thanks.

296

Is it like me, where the machine's programmer needs backup data to be saved?

297

Hi, I'm not sure what you mean by the machine's programmer (I'm guessing you're using automatic translation and it's coming out a bit strange in English).
But if what you mean is that you need a backup of the "stock" (also named "factory") (ACER-provided) firmware in order to unbrick the device, then more or less yes.

Effectively, there are two ways to go about this:

  1. What I asked, some dumps of specific partitions + the GPT table, OR
  2. A full stock image, which should normally contain all this and more. There was someone (@rethesis) before in this thread that was looking for ways to download these images from the ACER servers, but they had a working STOCK (i.e. not flashed with OpenWrt) router, and it was not the W6 but the W6x. Still, it's not clear for me if he managed to download anything. On the wiki for the W6x there is no factory image posted.

Maybe I'm missing something though.

Have a nice day!

1 Like
298

Hello! Thank you for mentioning me and yes I managed to get firmware images(updates) / can still get for

  • Acer Predator Connect W6x (W6x)
  • Acer Connect X6E (X6E)
  • Acer Wave 7 (T7c)
  • Acer Predator 7 (T7)
  • Acer predator connect X7 (X7)
  • Acer Connect Ovia T360 (T360)

Unfortunately I've been unable to get the firmwares for W6, W6d, W6m and other models that are missing from the list. The information I need to obtain the firmwares are as follow:

  • Model name (e.g W6x or T360)
  • A firmware version number that is not the most recent one
  • SKUname, it is GBL for all the ones I've obtained

The information needed can be obtained from system/system information on most routers.

Example of Acer Predator Connect W6x:
image

As seen in the image the needed information is present there. I'm assuming the model name and versions I have are correct for W6 and other variants, which leaves the SKUname for them that I haven't figured out.

If the SKUname is not present in the system information, I should be able to get it from the fota or similarly named binary from the target system (if someone would find it / send the binary/partition dump to me) At least on W6x the SKUname was hardcoded in the binary itself.

I can also send the firmware images(updates) from the Acer servers if anyone wants them.

299

Hi!

Thanks a lot for your response.
Unfortunately, I do not have a my W6 working ATM nor did I take screenshots when it was still on stock (my bad, I know).

I have found that on the official manual for the W6, page 33, there are screenshots with all these.
(I'm not sure I can post a link. I'll put it here hoping it works, otherwise you can search the ACER support website for the Product Number "FF.G22WW.001" and you'll get the manual.)
Manual URL: https://global-download.acer.com/GDFiles/Document/User%20Manual/User%20Manual_Acer_2.3_A_A.pdf?acerid=638320968190867705&Step1=&Step2=&Step3=PREDATOR%20CONNECT%20W6%20WI-FI%206E%20ROUTER&OS=ALL&LC=en&BC=ACER&SC=PA_6

From the screenshot, it seems to me that there is no equivalent to the "GBL" SKU for the W6.

The elements, transcribed to reduce your effort are:
System->System Information:

  • Device name: Predator Connect W6
  • Serial number: FFG22AA0012310002A69E1 (this is from the manual, not my own serial number)
  • Firmware version: W6_2.05.327511D

There is also a separate knowledgebase article on community.acer.com with the firmware changelog.
In this article the versions identified are:

  • W6_2.15.402116 (seems to be the latest)
  • W6_1.30.30851
  • W6_2.11.340516
  • W6_1.04.246515
  • W6_1.30.308516

KB article URL: https://community.acer.com/en/kb/articles/16173-predator-connect-w6-router-firmware-improvements-and-change-log

All the firmware names/versions do not seems to have an SKU, so I don't know what to do about that. Maybe you could try with an empty string, but I guess you probably have tried that already.

If these elements might be enough that would be fantastic.
Also, I am also a developer, if you share exactly how you are downloading the update images, I could try on my own.
Finally, but I can imagine you may not be willing to make the effort for a stranger online :slight_smile: , but bruteforcing (slowly) the SKU could also work (assuming 3 capital letters => 26^3=17576 tries, but it would be a fair guess to start with "GAA", instead of "AAA").

In any case, thanks a lot for the help and your contributions.

Take care!

300

Yes, I used machine translation to translate this. Perhaps it should be called Firmware for programming device—extracting the partition file separately and flashing it back is not feasible; it must be a full firmware backup of the entire machine, removing the flash memory. So, I’m wondering if I have to buy another identical device, remove its flash memory, back up the entire firmware, and then flash it into the bricked device? Maybe someone could crack the key used in secure boot? — The text above was also translated by machine translation.

301

Hello!
Thank you for your suggestions, but the firmware versions shown in almost all manuals seem to be development versions (D at the end) which are not available from the update server. Additionally the development firmware version strings don't contain the SKU in the manuals. I've gotten the versions and the SKU from youtube and article reviews of the routers / educated guessing.

The script included requires the hardcoded AES key&iv found in the fota binary which act as the credentials, for which reason it is questionable to share them publicly. I'll dm them to anyone interested though.

The easiest approach would be to get the fota (or similarly named) binary / partition dump from someone with W6 / W6d / W6m rather than bruteforcing the SKU as there may be something else wrong with the request. (And bruteforcing against a server is questionable)

getFirmware.py 
#!/bin/python
#-----------------------------------------
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad,unpad
from base64 import b64decode, b64encode
import requests
import time
#-----------------------------------------
# ----USAGE-----
# Uncomment the PROJECT, DEVICE_ID, SKU_NAME and VERSION
# variables for which you want the firmware.
# The latest firmware can be obtained by following the firmware versions
# (VERSION=1.01.000015 -> returns version 2.00.000005)
# (VERSION=2.00.000005 -> returns version 2.00.000008)
# (VERSION=2.00.000008 -> returns success True, but empty -> it is the latest firmware OR something is wrong with project/skuname)

# GOT:
# W6x, T7c, T7, X7, T360
# NOT IN APP: X6E

# MISSING:
# X5, W6, W6d, W6m

# --------WORKING------------
# Acer Predator Connect W6x
#PROJECT     = "W6x"
#DEVICE_ID   = "FFG2TTA002421001CA69M1"
#SKU_NAME    = "GBL"
#VERSION     = "1.01.000015"
#VERSION     = "2.00.000005"
#VERSION     = "2.00.000008"
#SKU_NAME    = "WifiConfig"
#VERSION     = "0.00.000000"

# Acer Connect X6E
#PROJECT     = "X6E"
#DEVICE_ID   = "FFG2FTA002319000366PE1"
#SKU_NAME    = "GBL"
#VERSION     = "1.02.000037"

# Acer Wave 7 
#PROJECT     = "T7c"
#DEVICE_ID   = "FFG2FTA0034543554343PB2"
#SKU_NAME    = "GBL"
#VERSION     = "1.01.000031"

# Acer Predator 7 
#PROJECT     = "T7"
#DEVICE_ID   = "FFG2FTA0034543554343PB2"
#SKU_NAME    = "GBL"
#VERSION     = "1.01.000007"
#VERSION     = "1.01.000008"
#VERSION     = "1.01.000009"
#VERSION     = "1.01.000027"

# Acer predator connect X7
#PROJECT     = "X7"
#DEVICE_ID   = "FFG2FTA002319000362PE1"
#SKU_NAME    = "GBL"
#VERSION     = "1.01.000010"
#VERSION     = "1.01.000045"
#VERSION     = "1.01.000046"

# Acer Connect Ovia T360
#PROJECT     = "T360" 
#DEVICE_ID   = "FFG2FTA000300382000PE1"
#SKU_NAME    = "GBL"
#VERSION     = "1.00.000000"
#VERSION     = "1.01.000001"

# NOT WORKING
#PROJECT    = "W6"
#DEVICE_ID  = "FFG22AA001301001CA69M1"
#SKU_NAME   = "GBL"
#VERSION	= "1.30.308516"
#VERSION	= "2.11.340516"
#VERSION	= "1.04.246515"
#VERSION	= "1.04.246514"
#VERSION	= "1.30.308516"
#VERSION 	= "1.30.308510"
#VERSION	= "2.11.340516"
#VERSION	= "2.15.402116"
#VERSION	= "1.42.319315"
#VERSION	= "0.00.000000"

#PROJECT     = "W6m"
#DEVICE_ID   = "FFG2FTA002319000362PE1"
#SKU_NAME    = "GBL"
#VERSION     = "1.01.332423"

#PROJECT     = "X5"
#DEVICE_ID   = "FFG2FTA002319000362PE1"
#SKU_NAME    = "GBL"
#SKU_NAME    = "V1"
#VERSION     = "V1.04.1_137008"
#VERSION     = "20.8_313207"

#PROJECT     = "W6d"
#DEVICE_ID   = "FFG22AA0012310002A69E1"
#SKU_NAME    = "GBL"
#VERSION     = "1.00.000000"
#VERSION     = "2.11.340516"
#VERSION     = "2.15.402114"






#-----------------------------------------
def decode(data, key, iv):
	cipher = AES.new(key, AES.MODE_CBC, iv)
	data_bytes = b64decode(data)
	dec_data = cipher.decrypt(data_bytes)
	unpadded_data = unpad(dec_data, AES.block_size)
	return unpadded_data.decode('utf-8')

def encode(data, key, iv):
	cipher = AES.new(key, AES.MODE_CBC, iv)
	pad_data = pad(data.encode('utf-8'), AES.block_size)
	enc_data = cipher.encrypt(pad_data)
	return b64encode(enc_data).decode('utf-8')

# DM for these / decompile the update (fota) binary
fota_key_update = "BLANK".encode('utf-8')
fota_iv_update = "BLANK".encode('utf-8')
update_url = "https://connect-ota.acervcon.com/updateVersion" # now & updateVersion

# The server only actually requires the time parameter
auth_header_template = '{{"project":"'+PROJECT+'", "deviceId":"'+DEVICE_ID+'", "time":{0}}}'
auth_header_template = '{{"time":{0}}}'

request_body = { "projectName": PROJECT,
 "SKUName": SKU_NAME,
 "version": VERSION,
 "deviceId": DEVICE_ID}

auth_token = encode(auth_header_template.format(int(time.time())), fota_key_update, fota_iv_update)
headers = {"auth-token": auth_token}

#NEEDS CONTENT TYPE application/json HEADER, OTHERWISE ERROR 900
login_request = requests.post(update_url, headers=headers, json=request_body)

login_response = login_request.text
print(login_response)
#print(login_request.headers)

#Error Code 900 = invalid paramenters
#login_response_json = json.loads(login_response_json_string)

Correct response looks like

{
  "success": true,
  "firmware": {
    "project": "T7",
    "sku": "GBL",
    "version": "1.01.000008",
    "releaseDate": "2024-04-15",
    "changeNotes": "1, update to 1.01.000008",
    "FirmwareName": "nand-4k-ipq5332-single_101000008.img",
    "size": 58784032,
    "checksum": "55065f6821cfa2223d5aa81569b56e3e",
    "firmwareUrl": "https://URL..."
  }
}
W6 hidden pages

From a quick look a publicly accesible W6, the frontend seems to contain two "hidden" locations at /Jr8tYS6gkxaQ (debug) and /Kq41uIxme0q5 (local update). If the page is the same as on W6x, there should be a button to enable "debug mode" and get the debug logs from the server, which should contain the header & body included in the update request.

302

I have backups of several partitions in W 6; I can provide them if needed.

2 Likes
303

Sharing anything you have would be absolutely fantastic. Please do if you can.

304

Hello,
So I gave it try with my own device ID as well a cornucopia of guesstimated SKU_NAMES, but I got nothing.
Maybe if @zow2023 can share their partitions I/we could identify the needed info.
Thanks again for everything.

1 Like
305

The partition dump from @zow2023 did not contain the update binary/mechanism or at least I couldn't find it. It didn't contain the web gui or the mqtt daemon either, so in case anyone has backups of the partitions for W6, W6d or W6m and is willing, please send them to me.

306

Ah, that's unfortunate, but thanks @zow2023 for trying!

307

Here is the firmware version number for the Predator Connect W6: W6_2.15.402115
The firmware was updated once about 2.5 years ago.
I hope this helps you when downloading the original version.

1 Like
308

Hi, thanks a lot ! Maybe it'll turn out to be helpful :slightly_smiling_face:

309

The W6D is the unloved sibling of the Flint2.

Can all the improvements from the Flint2 be transferred to the W6?

Especially the CPU load balancing script.

1 Like
310

It would be great if someone could provide a Predator W6 eMMC dump.