The router provided by my ISP runs a very minimalistic version of Openwrt/LEDE. It's unuseable.
I accessed uboot and extracted the entire firmware. So, I have access to the filesystem, which includes the kernel.config among other relevant files.
I've tried loading few LEDE images through tftp, but u-boot keeps telling me "Wrong Image Format for bootm command. Error: can't get kernel image!"
Attempts at building my own image were also a unsuccessful.
No. This is about creating a new openwrt image. The other thread is about accessing the serial console and getting the original firmware. I don't want to merge these two topics as the one is very Hardware related and this one only software.
Because these cover potential development questions/work for the same device, the two threads in question will be merged. I'll merge the UART topic into this one since the topic title here is more broad.
recently I decided to switch to the 5G home internet solution of my ISP. Up until now I was using a very slow xDSL connection, which makes the new faster data rates even better. But that's about it. Unsurprisingly, the router that's included in the contract is worse than you could ever imagine. (no support for wifi mesh; can't limit internet access for individual clients; frequent IP distribution problems; ...). Since the router is legally speaking mine now, I decided, I want to flash it.
Yes, the router is not officially supported by openwrt. BUT, I searched online and found routers with basically the exact same chips, which are in fact supported. Hardware:
The label on the packaging and the MAC address point toward "Winstron Neweb Corp." Unfortunately their website has no information about this product. I also went through public WiFi certifications of their products, but without any luck (https://device.report/Wistron/)
As you can tell, I already messed around with JX1 on the front of the board which wasn't a success at all. (I swear I can solder better than that). And I know, it wouldn't make sense for that to be UART, just had to try it since the rest of the board doesn't look any better.
I would really appreciate if some of you could give me some tips as to which part of this board could be used to create a serial connection. Doesn't matter how destructive, it doesn't have any value to me with that terrible firmware on it.
I can't see anything that makes it definitely not a UART. Other than one might prefer a line driver / buffer to protect the CPU? I might be missing something though so please let me know =/
Only other thing I can think of is somehow remove the cans safely and try to trace the traces and/or try to look at the vias, hook up test points to logic analyser, refer to mt7622 pinout and keep going with reverse engineering...
Only other advice I can think of is try to get root shell on the device and see if it's just something silly like it's an actual serial port but it's disabled....
To sanity check :
Is there solder mask over the pins and you're just not making a good electrical connection? Similarly if you don't have a good ground because of no preheat, I'd just find a ground elsewhere....
Did you try to see if the (potential) serial lines are actually pulled up?
Do you have your serial device configured for no flow control and at the right baud rate?
(Access to a logic analyser?)
is your serial device the correct voltage, or did you just accidentally blow up the TTL connection into the CPU directly?
I'd try using a DMM if not already tried and see what sort of continuity you're getting with those resistors near JX1?
If it is bad electrical connection. Get some 30AWG / 0.3mm wire and solder directly onto the resistors hahahaha. Or scrape off the solder mask....
I can't see anything that makes it definitely not a UART. Other than one might prefer a line driver / buffer to protect the CPU? I might be missing something though so please let me know =/
Honestly, I was just assuming, that every serial connector should consist of only 4 pins. silly me
Only other thing I can think of is somehow remove the cans safely and try to trace the traces and/or try to look at the vias, hook up test points to logic analyser, refer to mt7622 pinout and keep going with reverse engineering...
That's an amazing recommendation. I am new to this board stuff as you can tell so I didn't even think about going at it like that.
Using a DMM, but analog (yeah my DMM just fell apart), I found the following values of these six pins:
pin
ohm
voltage
1
0
0
2
3999
3.9-5.9
3
-
-
4
4100
0
5
-
-
6
0
6.1
- means no connection
Pin 2 is fluctuating only shortly (2sec) after boot and at most 4 times.
Videos on the internet show that Rx should be fluctuating like hundreds of times, but maybe its also just my DMM.
Yeah no worries. A least a datasheet / pinout is available for mt7622. I'm reasonably happy with mediatek over the other chip manufacturers because of this.
Usually at the point where bootloader is locked or there's no serial port etc I give up though =P Slowly with a pair of side cutters it's possible. Desoldering one I wouldn't attempt.
Lol. I think we call that an analog multimeter not a digital multimeter =P
That voltage is quite high =(
Anyway as long as you found a good ground.
Regarding the timing. A couple seconds might be enough for a bootloader to do its thing. I'd guess the kernel isn't outputting much to the serial port then but I have no idea.
No connection to what?
To just make sure, this is resistance and voltage to a known ground?
Three pins are sufficient. But there's plenty of reasons for an engineer to use more.... But yeah this could also be something completely different.
Regarding logic analysers:
There's saleae USB logic analyser clones that can run on open firmware and open gui. Or you can get the USB FIFO chip to get a 16 channel version if you want to take that path. But I'd try to sure up the electrical connection to those ports after checking the voltage for the serial pins once you get a DMM again.
No connection to what?
To just make sure, this is resistance and voltage to a known ground?
Oh, I thought I had escaped that. I was referring to the character - in the table.
And yes, all of it is through a "known" ground, aka the metall can thingy around the chips, which I hope is a valid choice.
There's saleae USB logic analyser clones that can run on open firmware and open gui.
Yeah only hope there is to see whether those traces go into the board and come out the other side. If they end up as internal traces only hope then is that there's vias on the back near the serial pins and then scrape off solder mask and trace them out. And that still won't help with 100% certainty that those are actually the serial pins if there's something nearby that it could also be.
Anyway. No point with this rabbit hole until we get a good visualisation on what's going on electrically with those pins. Either with a better electrical connection and trying baud rates, or with the logic analyser etc.
Might be worthwhile investing in a test fixture or pogo pins or some way to be able to connect without soldering to test points but that's trading a soldering problem for a mechanical fixturing problem. Or getting a second pair of hands =P.
Don't worry about it.
I would say inexperience if anything. Everyone starts from somewhere =) Competency is earned. You're earning competency right now =)
Yeah no worries. I had to do some reading to make sure.
Comes from RS232 with mark being high and space being low. But now it's logic levels of 0v and 5v instead of the normal RS232 logic levels?
I haven't found the best reference to explain yet though so I'm not going to link anything yet.
