Add Support for WAVLINK WL-WN532N2

For Developers
1

Dear OpenWrt World!
I recently bought a WAVLINK WL-WN532N2 wifi router ( https://www.wavlink.com/en_us/product/WL-WN532N2.html ).

It's dart cheap, but the specifications are awesome:
Flash: 32MB
RAM: 256MB
Processor: MediaTek MT7628N

Unfortunately, the web interface is a joke. No Parental control, for example.

Fortunately, it already runs on a custom OpenWrt. I tried to connect to TELNET running at port 2323. No luck, though.

I got the following command_log from the device (EDITED):
#############################################

ps
  PID USER       VSZ STAT COMMAND
    1 root      1352 S    /sbin/procd
    2 root         0 SW   [kthreadd]
    3 root         0 SW   [ksoftirqd/0]
    4 root         0 RW   [kworker/0:0]
    5 root         0 SW<  [kworker/0:0H]
    6 root         0 SW   [kworker/u2:0]
    7 root         0 SW   [watchdog/0]
    8 root         0 SW<  [khelper]
    9 root         0 SW   [kworker/u2:1]
   68 root         0 SW<  [writeback]
   70 root         0 SW<  [bioset]
   72 root         0 SW<  [kblockd]
   87 root         0 SW   [kworker/0:1]
   92 root         0 SW   [kswapd0]
   93 root         0 SW<  [crypto]
  218 root         0 SW<  [deferwq]
  262 root         0 SWN  [jffs2_gcd_mtd6]
  415 root       884 S    /sbin/ubusd
  416 root       768 S    /sbin/askfirst ttyS1 /bin/ash --login
  735 root      1152 S    /usr/bin/resetd 38
  742 root      1292 S    cloud_client
  748 root         0 SW<  [kworker/0:1H]
  774 root      1852 S    telnetd -p 2323 -F -l /bin/login.sh
  791 http      3248 S    /usr/sbin/lighttpd -f /etc/lighttpd/lighttpd.conf -l
  853 root      1680 S    mu
  878 root         0 SW   [RtmpCmdQTask]
  879 root         0 SW   [RtmpWscTask]
  880 root         0 SW   [RtmpMlmeTask]
  886 root         0 SW   [kworker/0:2]
  889 root      1452 S    /bin/ioos 81
  981 root      1228 S    miniupnpd -i eth0.2 -a 192.168.10.1 -f /tmp/miniupnp
  990 root      1360 S    dnsmasq -C /tmp/dnsmasq.conf -8 /tmp/dnsmasq_log -q
 1024 root      1852 S    /bin/sh -c command_log.sh /tmp/command_log
 1025 root      1852 S    {command_log.sh} /bin/sh /bin/command_log.sh /tmp/co
 1027 root      1856 R    ps
#############################################
ifconfig -a
apcli0    Link encap:Ethernet  HWaddr 82:3F:5D:03:68:E7  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

apcli1    Link encap:Ethernet  HWaddr 82:3F:5D:03:68:E8  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

br-lan    Link encap:Ethernet  HWaddr 80:3F:5D:53:68:E5  
          inet addr:192.168.10.1  Bcast:192.168.10.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:485 errors:0 dropped:0 overruns:0 frame:0
          TX packets:843 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:76893 (75.0 KiB)  TX bytes:904213 (883.0 KiB)

eth0      Link encap:Ethernet  HWaddr 80:3F:5D:53:68:E5  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:806 errors:0 dropped:0 overruns:0 frame:0
          TX packets:224 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:117485 (114.7 KiB)  TX bytes:55976 (54.6 KiB)
          Interrupt:3 

eth0.1    Link encap:Ethernet  HWaddr 80:3F:5D:53:68:E5  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:28 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:8687 (8.4 KiB)

eth0.2    Link encap:Ethernet  HWaddr 80:3F:5D:53:68:E6  
          inet addr:103.111.224.82  Bcast:103.111.224.95  Mask:255.255.255.224
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:763 errors:0 dropped:328 overruns:0 frame:0
          TX packets:196 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:86204 (84.1 KiB)  TX bytes:46186 (45.1 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:280 errors:0 dropped:0 overruns:0 frame:0
          TX packets:280 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:36723 (35.8 KiB)  TX bytes:36723 (35.8 KiB)

ra0       Link encap:Ethernet  HWaddr 80:3F:5D:53:68:E7  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:533 errors:0 dropped:0 overruns:0 frame:0
          TX packets:818 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:117835 (115.0 KiB)  TX bytes:886491 (865.7 KiB)
          Interrupt:4 

ra1       Link encap:Ethernet  HWaddr 82:3F:5D:53:68:E7  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

vir1      Link encap:Point-to-Point Protocol  
          inet addr:1.127.127.253  P-t-P:1.127.127.253  Mask:255.255.255.252
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

#############################################
route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         103.111.224.65  0.0.0.0         UG    0      0        0 eth0.2
1.127.127.252   *               255.255.255.252 U     0      0        0 vir1
103.111.224.64  *               255.255.255.224 U     0      0        0 eth0.2
192.168.10.0    *               255.255.255.0   U     0      0        0 br-lan
#############################################
free
             total         used         free       shared      buffers
Mem:         28312        18672         9640            0         1504
-/+ buffers:              17168        11144
Swap:            0            0            0
#############################################
lsmod
fill                    1585  0 [permanent]
fp                    140837  0 
l7                     58232  0 
safe                   15683  0 
sqos                   16019  0 [permanent]
tracert                 5349  0 [permanent]
wguest                   784  0 
#############################################
cat /proc/slabinfo
slabinfo - version: 2.1
# name            <active_objs> <num_objs> <objsize> <objperslab> <pagesperslab> : tunables <limit> <batchcount> <sharedfactor> : slabdata <active_slabs> <num_slabs> <sharedavail>
l7_dns                 0      0     96   40    1 : tunables  120   60    0 : slabdata      0      0      0
l7_dns_rep_hs          0      0      8  339    1 : tunables  120   60    0 : slabdata      0      0      0
http_cache             0      0     72   53    1 : tunables  120   60    0 : slabdata      0      0      0
l7_http                0      0     48   78    1 : tunables  120   60    0 : slabdata      0      0      0
l7_conn               12     22    176   22    1 : tunables  120   60    0 : slabdata      1      1      0
l7_rule                0      0     64   59    1 : tunables  120   60    0 : slabdata      0      0      0
fp                     9     44     88   44    1 : tunables  120   60    0 : slabdata      1      1      0
tracert                0      0     24  145    1 : tunables  120   60    0 : slabdata      0      0      0
bridge_fdb_cache       4     59     64   59    1 : tunables  120   60    0 : slabdata      1      1      0
dns_rep_hs             0      0      8  339    1 : tunables  120   60    0 : slabdata      0      0      0
nf_http                8     53     72   53    1 : tunables  120   60    0 : slabdata      1      1      0
nf_trie              512    546     48   78    1 : tunables  120   60    0 : slabdata      7      7      0
host_app               3     30    128   30    1 : tunables  120   60    0 : slabdata      1      1      0
nf_conntrack_803bb3e8     81     81    440    9    1 : tunables   54   27    0 : slabdata      9      9      0
nf_conntrack_expect      0      0    160   24    1 : tunables  120   60    0 : slabdata      0      0      0
jffs2_xattr_ref        6    113     32  113    1 : tunables  120   60    0 : slabdata      1      1      0
jffs2_xattr_datum      1     67     56   67    1 : tunables  120   60    0 : slabdata      1      1      0
jffs2_inode_cache     61    113     32  113    1 : tunables  120   60    0 : slabdata      1      1      0
jffs2_node_frag       14    145     24  145    1 : tunables  120   60    0 : slabdata      1      1      0
jffs2_refblock        22     32    248   16    1 : tunables  120   60    0 : slabdata      2      2      0
jffs2_tmp_dnode        0      0     32  113    1 : tunables  120   60    0 : slabdata      0      0      0
jffs2_raw_inode        0      0     96   40    1 : tunables  120   60    0 : slabdata      0      0      0
jffs2_raw_dirent       0      0     64   59    1 : tunables  120   60    0 : slabdata      0      0      0
jffs2_full_dnode      37    203     16  203    1 : tunables  120   60    0 : slabdata      1      1      0
jffs2_i               29     36    312   12    1 : tunables   54   27    0 : slabdata      3      3      0
squashfs_inode_cache    352    352    352   11    1 : tunables   54   27    0 : slabdata     32     32      0
dio                    0      0    320   12    1 : tunables   54   27    0 : slabdata      0      0      0
fasync_cache           0      0     24  145    1 : tunables  120   60    0 : slabdata      0      0      0
posix_timers_cache      0      0    152   26    1 : tunables  120   60    0 : slabdata      0      0      0
uid_cache              1     59     64   59    1 : tunables  120   60    0 : slabdata      1      1      0
UNIX                   9      9    448    9    1 : tunables   54   27    0 : slabdata      1      1      0
UDP-Lite               0      0    544    7    1 : tunables   54   27    0 : slabdata      0      0      0
tcp_bind_bucket       50    113     32  113    1 : tunables  120   60    0 : slabdata      1      1      0
inet_peer_cache        3     30    128   30    1 : tunables  120   60    0 : slabdata      1      1      0
ip_fib_trie           16    113     32  113    1 : tunables  120   60    0 : slabdata      1      1      0
ip_fib_alias          17    145     24  145    1 : tunables  120   60    0 : slabdata      1      1      0
ip_dst_cache          30     30    128   30    1 : tunables  120   60    0 : slabdata      1      1      0
PING                   0      0    512    7    1 : tunables   54   27    0 : slabdata      0      0      0
RAW                    1      7    512    7    1 : tunables   54   27    0 : slabdata      1      1      0
UDP                    7      7    544    7    1 : tunables   54   27    0 : slabdata      1      1      0
tw_sock_TCP           60     60    128   30    1 : tunables  120   60    0 : slabdata      2      2      0
request_sock_TCP       2     40     96   40    1 : tunables  120   60    0 : slabdata      1      1      0
TCP                   22     27   1184    3    1 : tunables   24   12    0 : slabdata      9      9      0
eventpoll_pwq         14     92     40   92    1 : tunables  120   60    0 : slabdata      1      1      0
eventpoll_epi         14     40     96   40    1 : tunables  120   60    0 : slabdata      1      1      0
blkdev_queue          23     24    936    4    1 : tunables   54   27    0 : slabdata      6      6      0
blkdev_requests       30     38    208   19    1 : tunables  120   60    0 : slabdata      2      2      0
blkdev_ioc             6     59     64   59    1 : tunables  120   60    0 : slabdata      1      1      0
bio-0                 42     90    128   30    1 : tunables  120   60    0 : slabdata      3      3      0
biovec-256             2      2   3072    1    1 : tunables   24   12    0 : slabdata      2      2      0
biovec-128             0      0   1536    2    1 : tunables   24   12    0 : slabdata      0      0      0
biovec-64              0      0    768    5    1 : tunables   54   27    0 : slabdata      0      0      0
biovec-16              0      0    192   20    1 : tunables  120   60    0 : slabdata      0      0      0
sock_inode_cache      48     48    320   12    1 : tunables   54   27    0 : slabdata      4      4      0
skbuff_fclone_cache     30     70    544    7    1 : tunables   54   27    0 : slabdata     10     10      0
skbuff_head_cache    555    555    256   15    1 : tunables  120   60    0 : slabdata     37     37      0
file_lock_cache        0      0    112   35    1 : tunables  120   60    0 : slabdata      0      0      0
shmem_inode_cache    229    234    304   13    1 : tunables   54   27    0 : slabdata     18     18      0
pool_workqueue         4     15    256   15    1 : tunables  120   60    0 : slabdata      1      1      0
taskstats              0      0    328   12    1 : tunables   54   27    0 : slabdata      0      0      0
proc_inode_cache     198    208    304   13    1 : tunables   54   27    0 : slabdata     16     16      0
sigqueue               8     27    144   27    1 : tunables  120   60    0 : slabdata      1      1      0
bdev_cache             8      9    416    9    1 : tunables   54   27    0 : slabdata      1      1      0
sysfs_dir_cache     2744   2773     64   59    1 : tunables  120   60    0 : slabdata     47     47      0
mnt_cache             20     24    160   24    1 : tunables  120   60    0 : slabdata      1      1      0
filp                 264    264    160   24    1 : tunables  120   60    0 : slabdata     11     11      0
inode_cache          896    896    272   14    1 : tunables   54   27    0 : slabdata     64     64      0
dentry              2059   2059    136   29    1 : tunables  120   60    0 : slabdata     71     71      0
names_cache            3      3   4096    1    1 : tunables   24   12    0 : slabdata      3      3      0
buffer_head         1507   1541     56   67    1 : tunables  120   60    0 : slabdata     23     23      0
nsproxy                0      0     24  145    1 : tunables  120   60    0 : slabdata      0      0      0
vm_area_struct       441    572     88   44    1 : tunables  120   60    0 : slabdata     13     13      0
mm_struct             20     20    384   10    1 : tunables   54   27    0 : slabdata      2      2      0
fs_cache              26    113     32  113    1 : tunables  120   60    0 : slabdata      1      1      0
files_cache           20     20    192   20    1 : tunables  120   60    0 : slabdata      1      1      0
signal_cache          42     42    576    7    1 : tunables   54   27    0 : slabdata      6      6      0
sighand_cache         35     35   3104    1    1 : tunables   24   12    0 : slabdata     35     35      0
task_struct           39     39   1176    3    1 : tunables   24   12    0 : slabdata     13     13      0
cred_jar             100    160     96   40    1 : tunables  120   60    0 : slabdata      4      4      0
anon_vma_chain       382    565     32  113    1 : tunables  120   60    0 : slabdata      5      5      0
anon_vma             336    435     24  145    1 : tunables  120   60    0 : slabdata      3      3      0
pid                   59     59     64   59    1 : tunables  120   60    0 : slabdata      1      1      0
radix_tree_node       99    104    296   13    1 : tunables   54   27    0 : slabdata      8      8      0
idr_layer_cache       47     51   1080    3    1 : tunables   24   12    0 : slabdata     17     17      0
kmalloc-4194304        0      0 4194304    1 1024 : tunables    1    1    0 : slabdata      0      0      0
kmalloc-2097152        0      0 2097152    1  512 : tunables    1    1    0 : slabdata      0      0      0
kmalloc-1048576        0      0 1048576    1  256 : tunables    1    1    0 : slabdata      0      0      0
kmalloc-524288         0      0 524288    1  128 : tunables    1    1    0 : slabdata      0      0      0
kmalloc-262144         0      0 262144    1   64 : tunables    1    1    0 : slabdata      0      0      0
kmalloc-131072         0      0 131072    1   32 : tunables    8    4    0 : slabdata      0      0      0
kmalloc-65536          5      5  65536    1   16 : tunables    8    4    0 : slabdata      5      5      0
kmalloc-32768          2      2  32768    1    8 : tunables    8    4    0 : slabdata      2      2      0
kmalloc-16384          5      5  16384    1    4 : tunables    8    4    0 : slabdata      5      5      0
kmalloc-8192           3      3   8192    1    2 : tunables    8    4    0 : slabdata      3      3      0
kmalloc-4096         281    281   4096    1    1 : tunables   24   12    0 : slabdata    281    281      0
kmalloc-2048         454    480   2048    2    1 : tunables   24   12    0 : slabdata    235    240      0
kmalloc-1024         136    136   1024    4    1 : tunables   54   27    0 : slabdata     34     34      0
kmalloc-512          208    208    512    8    1 : tunables   54   27    0 : slabdata     26     26      0
kmalloc-256          270    270    256   15    1 : tunables  120   60    0 : slabdata     18     18      0
kmalloc-128         6570   6570    128   30    1 : tunables  120   60    0 : slabdata    219    219      0
kmem_cache           100    120    128   30    1 : tunables  120   60    0 : slabdata      4      4      0
#############################################
cat /etc/firmware
CURVER=1.26.8
VENDOR=WAVLINK
CURFILE=WAVLINK
PRODUCT=W32N
DATE=2018-05-08 16:20
WANPID=4
RESET=38
RESET_TIME=6
LANIP=192.168.10.1
DOMAIN=wifi.wavlink.com
SSID=WAVLINK_
FIRMWARE=/dev/mtd4
TELNET_PORT=2323
LOGIN_USER=admin
LOGIN_PWD=admin
REGION=32
AREGION=7
TIMEZONE=CST-8
MODEL=W32N
RUSER=
RPWD=
WUSER=
WPWD=
GPIO_POWER=
GPIO_WAN=39
GPIO_LAN1=40
GPIO_LAN2=41
GPIO_LAN3=42
GPIO_LAN4=43
GPIO_INTERNET=
GPIO_WIFI24G=44
GPIO_WIFI5G=
GPIO_WPS=44
GPIO_USB=
RETIME=
#############################################
cat /proc/igd/stat
host_live=1
host_all=1
drop sip invalid=0
drop wan2wan=0
alloc failed=0
l7=8
l7_http=0
tb=0
host app=3
http=6
skb_http=0
ct_rate=0
ct_rate_mx=130
conn_cnt=24
qos_skip_priv=1
fp=47-43
tcp tt=0
http rebuild=0
dns_cnt=0
dns_addr=0
tracert=0
online=0
in:0 out:0
in:1 out:0
4, 1, 3, 3, 3, 4, 5, 4, 3, 4, 4, 4, 4, 4, 4, 
#############################################
cat /proc/igd/filter
mid-id-prio-matchs-protocol---host(type)xxxxxx---l3(type)xxxxxx---l4(type)xxxxxx---l7(type)xxxxx---target(type)xxxxxx
0-2-0-0-0---host(none)---l3(dns):type 0:len 17:wifi.wavlink.com---l4(none)---l7(none) map:0 target(redirect):type 1 len 4:{192.168.10.1-}
#############################################
cat /proc/igd/host
addr-mac-ugrp-name os-vender-vport-con_cnt uptime-send-rcv flags-ref-age [appid con_cnt up_speed down_speed seconds]
192.168.10.210-0:72:63:ad:7:9c-b  1-0-129-24 37-0-0 1-25-0 [{3 1 0 0 36}{4 9 0 0 16}]
#############################################
cat /proc/igd/url_match
mid-id-period-times-prio-host-url-data-match_list
#############################################
cat /proc/net/sched/host
hid addr tcp_update {[entry_len wait_len lan_len enqueue_mx tb_limit wd_pkts drop <qtr_len>].. } ref timeout
#############################################
cat /proc/net/sched/ifinfo
host cnt=0
{ rate=0
rate avg=0
quantum=0
tb mx=0
tb min=0
entry len mx=0
enqueue mx=0
ip cnt=0
qlen=0
}
#############################################
df -h
Filesystem                Size      Used Available Use% Mounted on
rootfs                  768.0K    228.0K    540.0K  30% /
/dev/root                 1.8M      1.8M         0 100% /rom
tmpfs                    13.8M    100.0K     13.7M   1% /tmp
/dev/mtdblock6          768.0K    228.0K    540.0K  30% /overlay
overlayfs:/overlay      768.0K    228.0K    540.0K  30% /
tmpfs                   512.0K         0    512.0K   0% /dev
#############################################
du -h /tmp 
0	/tmp/dnsmasq.d
0	/tmp/fwdir
0	/tmp/l7_tmp
0	/tmp/ioos
0	/tmp/alone
12.0K	/tmp/rconf
0	/tmp/.uci
4.0K	/tmp/log/lighttpd
4.0K	/tmp/log
0	/tmp/overlay
0	/tmp/extroot
8.0K	/tmp/sysinfo
0	/tmp/state
0	/tmp/lock
16.0K	/tmp/run
100.0K	/tmp/

#############################################

Dear OpenWrt World, will you release a full-fledged OpenWrt build for this device, Please?

With best regards forever,

1 Like
2

I don't see either telnet nor ssh (dropbear) in the list of running processes. Then again, I don't see hostapd either, so that may not be a full list.

I'd try SSH, or seeing if a hack like https://github.com/Hack-Hut/WLN300-Exploit-and-patch can gain you shell access without cracking the case and connecting over serial.

3

Thanks Jeff for stretching helping hands first.
It looks like, telnet dies after several login attempts.

Look here:

ps
  PID USER       VSZ STAT COMMAND
    1 root      1352 S    /sbin/procd
    2 root         0 SW   [kthreadd]
    3 root         0 SW   [ksoftirqd/0]
    4 root         0 RW   [kworker/0:0]
    5 root         0 SW<  [kworker/0:0H]
    6 root         0 SW   [kworker/u2:0]
    7 root         0 SW   [watchdog/0]
    8 root         0 SW<  [khelper]
    9 root         0 SW   [kworker/u2:1]
   68 root         0 SW<  [writeback]
   70 root         0 SW<  [bioset]
   72 root         0 SW<  [kblockd]
   87 root         0 SW   [kworker/0:1]
   92 root         0 SW   [kswapd0]
   93 root         0 SW<  [crypto]
  218 root         0 SW<  [deferwq]
  262 root         0 SWN  [jffs2_gcd_mtd6]
  415 root       884 S    /sbin/ubusd
  416 root       768 S    /sbin/askfirst ttyS1 /bin/ash --login
  735 root      1152 S    /usr/bin/resetd 38
  742 root      1292 S    cloud_client
  748 root         0 SW<  [kworker/0:1H]
  774 root      1852 S    telnetd -p 2323 -F -l /bin/login.sh
  791 http      3248 S    /usr/sbin/lighttpd -f /etc/lighttpd/lighttpd.conf -l
  853 root      1680 S    mu
  878 root         0 SW   [RtmpCmdQTask]
  879 root         0 SW   [RtmpWscTask]
  880 root         0 SW   [RtmpMlmeTask]
  886 root         0 SW   [kworker/0:2]
  889 root      1452 S    /bin/ioos 81
  981 root      1228 S    miniupnpd -i eth0.2 -a 192.168.10.1 -f /tmp/miniupnp
  990 root      1360 S    dnsmasq -C /tmp/dnsmasq.conf -8 /tmp/dnsmasq_log -q
 1024 root      1852 S    /bin/sh -c command_log.sh /tmp/command_log
 1025 root      1852 S    {command_log.sh} /bin/sh /bin/command_log.sh /tmp/co
 1027 root      1856 R    ps
#############################################
ifconfig -a
apcli0    Link encap:Ethernet  HWaddr 82:3F:5D:03:68:E7  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

apcli1    Link encap:Ethernet  HWaddr 82:3F:5D:03:68:E8  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

br-lan    Link encap:Ethernet  HWaddr 80:3F:5D:53:68:E5  
          inet addr:192.168.10.1  Bcast:192.168.10.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:485 errors:0 dropped:0 overruns:0 frame:0
          TX packets:843 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:76893 (75.0 KiB)  TX bytes:904213 (883.0 KiB)

eth0      Link encap:Ethernet  HWaddr 80:3F:5D:53:68:E5  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:806 errors:0 dropped:0 overruns:0 frame:0
          TX packets:224 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:117485 (114.7 KiB)  TX bytes:55976 (54.6 KiB)
          Interrupt:3 

eth0.1    Link encap:Ethernet  HWaddr 80:3F:5D:53:68:E5  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:28 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:8687 (8.4 KiB)

eth0.2    Link encap:Ethernet  HWaddr 80:3F:5D:53:68:E6  
          inet addr:103.111.224.82  Bcast:103.111.224.95  Mask:255.255.255.224
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:763 errors:0 dropped:328 overruns:0 frame:0
          TX packets:196 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:86204 (84.1 KiB)  TX bytes:46186 (45.1 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:280 errors:0 dropped:0 overruns:0 frame:0
          TX packets:280 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:36723 (35.8 KiB)  TX bytes:36723 (35.8 KiB)

ra0       Link encap:Ethernet  HWaddr 80:3F:5D:53:68:E7  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:533 errors:0 dropped:0 overruns:0 frame:0
          TX packets:818 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:117835 (115.0 KiB)  TX bytes:886491 (865.7 KiB)
          Interrupt:4 

ra1       Link encap:Ethernet  HWaddr 82:3F:5D:53:68:E7  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

vir1      Link encap:Point-to-Point Protocol  
          inet addr:1.127.127.253  P-t-P:1.127.127.253  Mask:255.255.255.252
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

#############################################
route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         103.111.224.65  0.0.0.0         UG    0      0        0 eth0.2
1.127.127.252   *               255.255.255.252 U     0      0        0 vir1
103.111.224.64  *               255.255.255.224 U     0      0        0 eth0.2
192.168.10.0    *               255.255.255.0   U     0      0        0 br-lan
#############################################
free
             total         used         free       shared      buffers
Mem:         28312        18672         9640            0         1504
-/+ buffers:              17168        11144
Swap:            0            0            0
#############################################
lsmod
fill                    1585  0 [permanent]
fp                    140837  0 
l7                     58232  0 
safe                   15683  0 
sqos                   16019  0 [permanent]
tracert                 5349  0 [permanent]
wguest                   784  0 
#############################################
cat /proc/slabinfo
slabinfo - version: 2.1
# name            <active_objs> <num_objs> <objsize> <objperslab> <pagesperslab> : tunables <limit> <batchcount> <sharedfactor> : slabdata <active_slabs> <num_slabs> <sharedavail>
l7_dns                 0      0     96   40    1 : tunables  120   60    0 : slabdata      0      0      0
l7_dns_rep_hs          0      0      8  339    1 : tunables  120   60    0 : slabdata      0      0      0
http_cache             0      0     72   53    1 : tunables  120   60    0 : slabdata      0      0      0
l7_http                0      0     48   78    1 : tunables  120   60    0 : slabdata      0      0      0
l7_conn               12     22    176   22    1 : tunables  120   60    0 : slabdata      1      1      0
l7_rule                0      0     64   59    1 : tunables  120   60    0 : slabdata      0      0      0
fp                     9     44     88   44    1 : tunables  120   60    0 : slabdata      1      1      0
tracert                0      0     24  145    1 : tunables  120   60    0 : slabdata      0      0      0
bridge_fdb_cache       4     59     64   59    1 : tunables  120   60    0 : slabdata      1      1      0
dns_rep_hs             0      0      8  339    1 : tunables  120   60    0 : slabdata      0      0      0
nf_http                8     53     72   53    1 : tunables  120   60    0 : slabdata      1      1      0
nf_trie              512    546     48   78    1 : tunables  120   60    0 : slabdata      7      7      0
host_app               3     30    128   30    1 : tunables  120   60    0 : slabdata      1      1      0
nf_conntrack_803bb3e8     81     81    440    9    1 : tunables   54   27    0 : slabdata      9      9      0
nf_conntrack_expect      0      0    160   24    1 : tunables  120   60    0 : slabdata      0      0      0
jffs2_xattr_ref        6    113     32  113    1 : tunables  120   60    0 : slabdata      1      1      0
jffs2_xattr_datum      1     67     56   67    1 : tunables  120   60    0 : slabdata      1      1      0
jffs2_inode_cache     61    113     32  113    1 : tunables  120   60    0 : slabdata      1      1      0
jffs2_node_frag       14    145     24  145    1 : tunables  120   60    0 : slabdata      1      1      0
jffs2_refblock        22     32    248   16    1 : tunables  120   60    0 : slabdata      2      2      0
jffs2_tmp_dnode        0      0     32  113    1 : tunables  120   60    0 : slabdata      0      0      0
jffs2_raw_inode        0      0     96   40    1 : tunables  120   60    0 : slabdata      0      0      0
jffs2_raw_dirent       0      0     64   59    1 : tunables  120   60    0 : slabdata      0      0      0
jffs2_full_dnode      37    203     16  203    1 : tunables  120   60    0 : slabdata      1      1      0
jffs2_i               29     36    312   12    1 : tunables   54   27    0 : slabdata      3      3      0
squashfs_inode_cache    352    352    352   11    1 : tunables   54   27    0 : slabdata     32     32      0
dio                    0      0    320   12    1 : tunables   54   27    0 : slabdata      0      0      0
fasync_cache           0      0     24  145    1 : tunables  120   60    0 : slabdata      0      0      0
posix_timers_cache      0      0    152   26    1 : tunables  120   60    0 : slabdata      0      0      0
uid_cache              1     59     64   59    1 : tunables  120   60    0 : slabdata      1      1      0
UNIX                   9      9    448    9    1 : tunables   54   27    0 : slabdata      1      1      0
UDP-Lite               0      0    544    7    1 : tunables   54   27    0 : slabdata      0      0      0
tcp_bind_bucket       50    113     32  113    1 : tunables  120   60    0 : slabdata      1      1      0
inet_peer_cache        3     30    128   30    1 : tunables  120   60    0 : slabdata      1      1      0
ip_fib_trie           16    113     32  113    1 : tunables  120   60    0 : slabdata      1      1      0
ip_fib_alias          17    145     24  145    1 : tunables  120   60    0 : slabdata      1      1      0
ip_dst_cache          30     30    128   30    1 : tunables  120   60    0 : slabdata      1      1      0
PING                   0      0    512    7    1 : tunables   54   27    0 : slabdata      0      0      0
RAW                    1      7    512    7    1 : tunables   54   27    0 : slabdata      1      1      0
UDP                    7      7    544    7    1 : tunables   54   27    0 : slabdata      1      1      0
tw_sock_TCP           60     60    128   30    1 : tunables  120   60    0 : slabdata      2      2      0
request_sock_TCP       2     40     96   40    1 : tunables  120   60    0 : slabdata      1      1      0
TCP                   22     27   1184    3    1 : tunables   24   12    0 : slabdata      9      9      0
eventpoll_pwq         14     92     40   92    1 : tunables  120   60    0 : slabdata      1      1      0
eventpoll_epi         14     40     96   40    1 : tunables  120   60    0 : slabdata      1      1      0
blkdev_queue          23     24    936    4    1 : tunables   54   27    0 : slabdata      6      6      0
blkdev_requests       30     38    208   19    1 : tunables  120   60    0 : slabdata      2      2      0
blkdev_ioc             6     59     64   59    1 : tunables  120   60    0 : slabdata      1      1      0
bio-0                 42     90    128   30    1 : tunables  120   60    0 : slabdata      3      3      0
biovec-256             2      2   3072    1    1 : tunables   24   12    0 : slabdata      2      2      0
biovec-128             0      0   1536    2    1 : tunables   24   12    0 : slabdata      0      0      0
biovec-64              0      0    768    5    1 : tunables   54   27    0 : slabdata      0      0      0
biovec-16              0      0    192   20    1 : tunables  120   60    0 : slabdata      0      0      0
sock_inode_cache      48     48    320   12    1 : tunables   54   27    0 : slabdata      4      4      0
skbuff_fclone_cache     30     70    544    7    1 : tunables   54   27    0 : slabdata     10     10      0
skbuff_head_cache    555    555    256   15    1 : tunables  120   60    0 : slabdata     37     37      0
file_lock_cache        0      0    112   35    1 : tunables  120   60    0 : slabdata      0      0      0
shmem_inode_cache    229    234    304   13    1 : tunables   54   27    0 : slabdata     18     18      0
pool_workqueue         4     15    256   15    1 : tunables  120   60    0 : slabdata      1      1      0
taskstats              0      0    328   12    1 : tunables   54   27    0 : slabdata      0      0      0
proc_inode_cache     198    208    304   13    1 : tunables   54   27    0 : slabdata     16     16      0
sigqueue               8     27    144   27    1 : tunables  120   60    0 : slabdata      1      1      0
bdev_cache             8      9    416    9    1 : tunables   54   27    0 : slabdata      1      1      0
sysfs_dir_cache     2744   2773     64   59    1 : tunables  120   60    0 : slabdata     47     47      0
mnt_cache             20     24    160   24    1 : tunables  120   60    0 : slabdata      1      1      0
filp                 264    264    160   24    1 : tunables  120   60    0 : slabdata     11     11      0
inode_cache          896    896    272   14    1 : tunables   54   27    0 : slabdata     64     64      0
dentry              2059   2059    136   29    1 : tunables  120   60    0 : slabdata     71     71      0
names_cache            3      3   4096    1    1 : tunables   24   12    0 : slabdata      3      3      0
buffer_head         1507   1541     56   67    1 : tunables  120   60    0 : slabdata     23     23      0
nsproxy                0      0     24  145    1 : tunables  120   60    0 : slabdata      0      0      0
vm_area_struct       441    572     88   44    1 : tunables  120   60    0 : slabdata     13     13      0
mm_struct             20     20    384   10    1 : tunables   54   27    0 : slabdata      2      2      0
fs_cache              26    113     32  113    1 : tunables  120   60    0 : slabdata      1      1      0
files_cache           20     20    192   20    1 : tunables  120   60    0 : slabdata      1      1      0
signal_cache          42     42    576    7    1 : tunables   54   27    0 : slabdata      6      6      0
sighand_cache         35     35   3104    1    1 : tunables   24   12    0 : slabdata     35     35      0
task_struct           39     39   1176    3    1 : tunables   24   12    0 : slabdata     13     13      0
cred_jar             100    160     96   40    1 : tunables  120   60    0 : slabdata      4      4      0
anon_vma_chain       382    565     32  113    1 : tunables  120   60    0 : slabdata      5      5      0
anon_vma             336    435     24  145    1 : tunables  120   60    0 : slabdata      3      3      0
pid                   59     59     64   59    1 : tunables  120   60    0 : slabdata      1      1      0
radix_tree_node       99    104    296   13    1 : tunables   54   27    0 : slabdata      8      8      0
idr_layer_cache       47     51   1080    3    1 : tunables   24   12    0 : slabdata     17     17      0
kmalloc-4194304        0      0 4194304    1 1024 : tunables    1    1    0 : slabdata      0      0      0
kmalloc-2097152        0      0 2097152    1  512 : tunables    1    1    0 : slabdata      0      0      0
kmalloc-1048576        0      0 1048576    1  256 : tunables    1    1    0 : slabdata      0      0      0
kmalloc-524288         0      0 524288    1  128 : tunables    1    1    0 : slabdata      0      0      0
kmalloc-262144         0      0 262144    1   64 : tunables    1    1    0 : slabdata      0      0      0
kmalloc-131072         0      0 131072    1   32 : tunables    8    4    0 : slabdata      0      0      0
kmalloc-65536          5      5  65536    1   16 : tunables    8    4    0 : slabdata      5      5      0
kmalloc-32768          2      2  32768    1    8 : tunables    8    4    0 : slabdata      2      2      0
kmalloc-16384          5      5  16384    1    4 : tunables    8    4    0 : slabdata      5      5      0
kmalloc-8192           3      3   8192    1    2 : tunables    8    4    0 : slabdata      3      3      0
kmalloc-4096         281    281   4096    1    1 : tunables   24   12    0 : slabdata    281    281      0
kmalloc-2048         454    480   2048    2    1 : tunables   24   12    0 : slabdata    235    240      0
kmalloc-1024         136    136   1024    4    1 : tunables   54   27    0 : slabdata     34     34      0
kmalloc-512          208    208    512    8    1 : tunables   54   27    0 : slabdata     26     26      0
kmalloc-256          270    270    256   15    1 : tunables  120   60    0 : slabdata     18     18      0
kmalloc-128         6570   6570    128   30    1 : tunables  120   60    0 : slabdata    219    219      0
kmem_cache           100    120    128   30    1 : tunables  120   60    0 : slabdata      4      4      0
#############################################
cat /etc/firmware
CURVER=1.26.8
VENDOR=WAVLINK
CURFILE=WAVLINK
PRODUCT=W32N
DATE=2018-05-08 16:20
WANPID=4
RESET=38
RESET_TIME=6
LANIP=192.168.10.1
DOMAIN=wifi.wavlink.com
SSID=WAVLINK_
FIRMWARE=/dev/mtd4
TELNET_PORT=2323
LOGIN_USER=admin
LOGIN_PWD=admin
REGION=32
AREGION=7
TIMEZONE=CST-8
MODEL=W32N
RUSER=
RPWD=
WUSER=
WPWD=
GPIO_POWER=
GPIO_WAN=39
GPIO_LAN1=40
GPIO_LAN2=41
GPIO_LAN3=42
GPIO_LAN4=43
GPIO_INTERNET=
GPIO_WIFI24G=44
GPIO_WIFI5G=
GPIO_WPS=44
GPIO_USB=
RETIME=
#############################################
cat /proc/igd/stat
host_live=1
host_all=1
drop sip invalid=0
drop wan2wan=0
alloc failed=0
l7=8
l7_http=0
tb=0
host app=3
http=6
skb_http=0
ct_rate=0
ct_rate_mx=130
conn_cnt=24
qos_skip_priv=1
fp=47-43
tcp tt=0
http rebuild=0
dns_cnt=0
dns_addr=0
tracert=0
online=0
in:0 out:0
in:1 out:0
4, 1, 3, 3, 3, 4, 5, 4, 3, 4, 4, 4, 4, 4, 4, 
#############################################
cat /proc/igd/filter
mid-id-prio-matchs-protocol---host(type)xxxxxx---l3(type)xxxxxx---l4(type)xxxxxx---l7(type)xxxxx---target(type)xxxxxx
0-2-0-0-0---host(none)---l3(dns):type 0:len 17:wifi.wavlink.com---l4(none)---l7(none) map:0 target(redirect):type 1 len 4:{192.168.10.1-}
#############################################
cat /proc/igd/host
addr-mac-ugrp-name os-vender-vport-con_cnt uptime-send-rcv flags-ref-age [appid con_cnt up_speed down_speed seconds]
192.168.10.210-0:72:63:ad:7:9c-b  1-0-129-24 37-0-0 1-25-0 [{3 1 0 0 36}{4 9 0 0 16}]
#############################################
cat /proc/igd/url_match
mid-id-period-times-prio-host-url-data-match_list
#############################################
cat /proc/net/sched/host
hid addr tcp_update {[entry_len wait_len lan_len enqueue_mx tb_limit wd_pkts drop <qtr_len>].. } ref timeout
#############################################
cat /proc/net/sched/ifinfo
host cnt=0
{ rate=0
rate avg=0
quantum=0
tb mx=0
tb min=0
entry len mx=0
enqueue mx=0
ip cnt=0
qlen=0
}
#############################################
df -h
Filesystem                Size      Used Available Use% Mounted on
rootfs                  768.0K    228.0K    540.0K  30% /
/dev/root                 1.8M      1.8M         0 100% /rom
tmpfs                    13.8M    100.0K     13.7M   1% /tmp
/dev/mtdblock6          768.0K    228.0K    540.0K  30% /overlay
overlayfs:/overlay      768.0K    228.0K    540.0K  30% /
tmpfs                   512.0K         0    512.0K   0% /dev
#############################################
du -h /tmp 
0	/tmp/dnsmasq.d
0	/tmp/fwdir
0	/tmp/l7_tmp
0	/tmp/ioos
0	/tmp/alone
12.0K	/tmp/rconf
0	/tmp/.uci
4.0K	/tmp/log/lighttpd
4.0K	/tmp/log
0	/tmp/overlay
0	/tmp/extroot
8.0K	/tmp/sysinfo
0	/tmp/state
0	/tmp/lock
16.0K	/tmp/run
100.0K	/tmp/
#############################################
1 Like
4

I further investigated that the said exploit url does not work with WN532N2 device.

5

try this, go to http://192.168.10.1/webcmd.shtml. should bring up a hidden web page in the router called system command. type telnet or telnetd into the command box and apply. when it works nothing will appear in the window below but should enable the telnet server on 192.168.10.1:2323.

6

Thanks @vwnut8392. Tried. No luck.

I already gave up on it. Switched to Netgear R6120. Works like charm.

7

Hi @vwnut8392, I thing I thought worth noting. I always could telnet to 2323. It asks for OpenWrt Login: ____ and Password ________.

Have you any known u/p pair?

8

i discovered after i posted this not all firmware versions have webcmd.shtml. i guess i got lucky and ended up with a version that has it. did you try admin-admin for login and password? seems like thats the common default on all wavlink devices.

9

I also bought this router, access it via serial console. it has OpenWRT 14.07 installed already, but web interface isn't Luci.

10

Dear Dev Community,
I found this router with great specs for such a low price, It already runs OpenWRT 14.07 BARRIER BREAKER, will you release a full-fledged OpenWrt build for this device, Please?

image
image580×506 15.2 KB

I got the following command log from the serial console:

  1. dmesg
Linux version 3.10.14+ (root@ubuntu) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 unknown) ) #846 Tue May 8 16:21:20 CST 2018

 The CPU feqenuce set to 575 MHz
CPU0 revision is: 00019655 (MIPS 24KEc)
Software DMA cache coherency
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone ranges:
  Normal   [mem 0x00000000-0x01ffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00000000-0x01ffffff]
On node 0 totalpages: 8192
free_area_init_node: node 0, pgdat 803c0eb0, node_mem_map 81000000
  Normal zone: 64 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 8192 pages, LIFO batch:0
Primary instruction cache 64kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
pcpu-alloc: [0] 0
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock5 rootfstype=squashfs,jffs2
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Writing ErrCtl register=00059d30
Readback ErrCtl register=00059d30
Memory: 28128k/32768k available (3047k kernel code, 4640k reserved, 797k data, 184k init, 0k highmem)
NR_IRQS:128
console [ttyS1] enabled
Calibrating delay loop... 382.46 BogoMIPS (lpj=764928)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
Switching to clocksource MIPS
NET: Registered protocol family 2
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) (SUMMARY)  (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 54
io scheduler noop registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
Ralink gpio driver initialized
brd: module loaded
flash manufacture id: c8, device id 40 16
GD25Q32B(c8 40160000) (4096 Kbytes)
mtd .name = raspi, .size = 0x00400000 (4M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 5 MTD partitions on "raspi":
0x000000000000-0x000000400000 : "ALL"
0x000000000000-0x000000030000 : "Bootloader"
0x000000030000-0x000000040000 : "Config"
0x000000040000-0x000000050000 : "Factory"
0x000000050000-0x0000007f0000 : "firmware"
mtd: partition "firmware" extends beyond the end of device "raspi" -- size truncated to 0x3b0000
0x0000001a5743-0x000000400000 : "rootfs"
mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
mtd: partition "rootfs_data" created automatically, ofs=0x340000, len=0xc0000
0x000000340000-0x000000400000 : "rootfs_data"
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
NET: Registered protocol family 24
rdm_major = 253
netif_napi_add() called with weight 128 on device eth0
GMAC1_MAC_ADRH -- : 0x0000803f
GMAC1_MAC_ADRL -- : 0x5d536a0e
Ralink APSoC Ethernet Driver Initilization. v3.1  384 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, Tx Ring = 384, Rx Ring = 384
GMAC1_MAC_ADRH -- : 0x0000803f
GMAC1_MAC_ADRL -- : 0x5d536a0e
PROC INIT OK!
u32 classifier
nf_conntrack version 0.5.0 (439 buckets, 1756 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
Type=Linux
----------------------------
--------igd inited----------
----------------------------
TCP: cubic registered
NET: Registered protocol family 17
8021q: 802.1Q VLAN Support v1.8
registered taskstats version 1
VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
Freeing unused kernel memory: 184K (803c2000 - 803f0000)
Raeth v3.1 (NAPI
,SkbRecycle)

phy_tx_ring = 0x01588000, tx_ring = 0xa1588000

phy_rx_ring0 = 0x0158a000, rx_ring0 = 0xa158a000
GMAC1_MAC_ADRH -- : 0x0000803f
GMAC1_MAC_ADRL -- : 0x5d536a0e
RT305x_ESW: Link Status Changed
RT305x_ESW: Link Status Changed
RT305x_ESW: Link Status Changed
jffs2: notice: (260) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 6 of xref (0 dead, 0 orphan) found.
jffs2: notice: (257) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 6 of xref (0 dead, 0 orphan) found.
ra2880stop()...Done
Free TX/RX Ring Memory!
safe: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
regiester url hooks finish
l7 inited
Raeth v3.1 (NAPI
,SkbRecycle)

phy_tx_ring = 0x01660000, tx_ring = 0xa1660000

phy_rx_ring0 = 0x01662000, rx_ring0 = 0xa1662000
GMAC1_MAC_ADRH -- : 0x0000803f
GMAC1_MAC_ADRL -- : 0x5d536a0e
RT305x_ESW: Link Status Changed
device eth0.1 entered promiscuous mode
device eth0 entered promiscuous mode
-------->fdb_create, 470!!!
nl socket is null !
br-lan: port 1(eth0.1) entered forwarding state
br-lan: port 1(eth0.1) entered forwarding state
efuse_probe: efuse = 10000012
tssi_1_target_pwr_g_band = 35
device ra0 entered promiscuous mode
br-lan: port 2(ra0) entered forwarding state
br-lan: port 2(ra0) entered forwarding state
-------->fdb_create, 470!!!
nl socket is null !
device ra1 entered promiscuous mode
-------->fdb_create, 470!!!
nl socket is null !
RT305x_ESW: Link Status Changed
-------->fdb_create, 470!!!
nl socket is null !
RT305x_ESW: Link Status Changed
RT305x_ESW: Link Status Changed
RT305x_ESW: Link Status Changed
host_ugrp_update[1344]port id err 8, need fix
nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead.
br-lan: port 1(eth0.1) entered forwarding state
br-lan: port 2(ra0) entered forwarding state
  1. cat /proc/cmdline
console=ttyS1,57600n8 root=/dev/mtdblock5 rootfstype=squashfs,jffs2
  1. cat /proc/cpuinfo
system type             : MT7628
machine                 : Unknown
processor               : 0
cpu model               : MIPS 24KEc V5.5
BogoMIPS                : 382.46
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp
shadow register sets    : 1
kscratch registers      : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available
  1. cat /proc/meminfo
MemTotal:          28312 kB
MemFree:           11420 kB
Buffers:            1396 kB
Cached:             3868 kB
SwapCached:            0 kB
Active:             4348 kB
Inactive:           2608 kB
Active(anon):       1724 kB
Inactive(anon):       60 kB
Active(file):       2624 kB
Inactive(file):     2548 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          1708 kB
Mapped:             1660 kB
Shmem:                92 kB
Slab:               5600 kB
SReclaimable:        844 kB
SUnreclaim:         4756 kB
KernelStack:         256 kB
PageTables:          160 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       14156 kB
Committed_AS:       3676 kB
VmallocTotal:    1048372 kB
VmallocUsed:        2736 kB
VmallocChunk:    1045260 kB
  1. cat /proc/devices
Character devices:
  1 mem
  2 pty
  3 ttyp
  4 ttyS
  5 /dev/tty
  5 /dev/console
  5 /dev/ptmx
 10 misc
 90 mtd
108 ppp
128 ptm
136 pts
252 gpio
253 rdm0

Block devices:
  1 ramdisk
259 blkext
 31 mtdblock
  1. ls /sys/devices/platform
alarmtimer  serial8250  uevent
  1. cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00400000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 003b0000 00010000 "firmware"
mtd5: 0025a8bd 00010000 "rootfs"
mtd6: 000c0000 00010000 "rootfs_data"
  1. cat /sys/class/mtd/mtd/offset*
cat: can't open '/sys/class/mtd/mtd*/offset': No such file or directory
  1. ifconfig -a
apcli0    Link encap:Ethernet  HWaddr 82:3F:5D:03:6A:10
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

apcli1    Link encap:Ethernet  HWaddr 82:3F:5D:03:6A:11
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

br-lan    Link encap:Ethernet  HWaddr 80:3F:5D:53:6A:0E
          inet addr:192.168.10.1  Bcast:192.168.10.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:16532 errors:0 dropped:242 overruns:0 frame:0
          TX packets:317230 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2970841 (2.8 MiB)  TX bytes:413784185 (394.6 MiB)

eth0      Link encap:Ethernet  HWaddr 80:3F:5D:53:6A:0E
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:457228 errors:0 dropped:17 overruns:0 frame:0
          TX packets:452551 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:439676728 (419.3 MiB)  TX bytes:438139389 (417.8 MiB)
          Interrupt:3

eth0.1    Link encap:Ethernet  HWaddr 80:3F:5D:53:6A:0E
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:16542 errors:0 dropped:10 overruns:0 frame:0
          TX packets:317230 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2971301 (2.8 MiB)  TX bytes:413784185 (394.6 MiB)

eth0.2    Link encap:Ethernet  HWaddr 80:3F:5D:53:6A:0F
          inet addr:2.3.43.30  Bcast:2.3.43.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:10962 errors:0 dropped:2 overruns:0 frame:0
          TX packets:135321 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2261501 (2.1 MiB)  TX bytes:22531323 (21.4 MiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:36 errors:0 dropped:0 overruns:0 frame:0
          TX packets:36 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2712 (2.6 KiB)  TX bytes:2712 (2.6 KiB)

ra0       Link encap:Ethernet  HWaddr 80:3F:5D:53:6A:10
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:4

ra1       Link encap:Ethernet  HWaddr 82:3F:5D:53:6A:10
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

vir1      Link encap:Point-to-Point Protocol
          inet addr:1.127.127.253  P-t-P:1.127.127.253  Mask:255.255.255.252
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
  1. ls /sys/class/net
apcli0  apcli1  br-lan  eth0    eth0.1  eth0.2  lo      ra0     ra1     vir1
  1. brctl show
bridge name     bridge id               STP enabled     interfaces
br-lan          8000.803f5d536a0e       no              eth0.1
                                                        ra0
                                                        ra1

Bootlog

[04030D08][04030D09][8A890000][24234746][00242345]
DU Setting Cal Done


U-Boot 1.1.3 (Jan 31 2018 - 16:51:42)

Board: Ralink APSoC DRAM:  32 MB
relocate_code Pointer at: 81fa0000
flash manufacture id: c8, device id 40 16
find flash: GD25Q32B
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 256 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 32 MBytes
Flash component: SPI Flash
Date:Jan 31 2018  Time:16:51:42
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =32 Mbytes
RESET MT7628 PHY!!!!!!
Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
default: 3                                                          0

3: System Boot system code via Flash.
## Booting image at bc050000 ...
   Image Name:   WAVLINK_W32N
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1398531 Bytes =  1.3 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 32

Starting kernel ...


LINUX started...

 THIS IS ASIC
Linux version 3.10.14+ (root@ubuntu) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 unknown) ) #846 Tue May 8 16:21:20 CST 2018

 The CPU feqenuce set to 575 MHz
CPU0 revision is: 00019655 (MIPS 24KEc)
Software DMA cache coherency
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone ranges:
  Normal   [mem 0x00000000-0x01ffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00000000-0x01ffffff]
Primary instruction cache 64kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock5 rootfstype=squashfs,jffs2
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Writing ErrCtl register=00000008
Readback ErrCtl register=00000008
Memory: 28128k/32768k available (3047k kernel code, 4640k reserved, 797k data, 184k init, 0k highmem)
NR_IRQS:128
console [ttyS1] enabled
Calibrating delay loop... 382.46 BogoMIPS (lpj=764928)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
Switching to clocksource MIPS
NET: Registered protocol family 2
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) (SUMMARY)  (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 54
io scheduler noop registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
Ralink gpio driver initialized
brd: module loaded
flash manufacture id: c8, device id 40 16
GD25Q32B(c8 40160000) (4096 Kbytes)
mtd .name = raspi, .size = 0x00400000 (4M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 5 MTD partitions on "raspi":
0x000000000000-0x000000400000 : "ALL"
0x000000000000-0x000000030000 : "Bootloader"
0x000000030000-0x000000040000 : "Config"
0x000000040000-0x000000050000 : "Factory"
0x000000050000-0x0000007f0000 : "firmware"
mtd: partition "firmware" extends beyond the end of device "raspi" -- size truncated to 0x3b0000
0x0000001a5743-0x000000400000 : "rootfs"
mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
mtd: partition "rootfs_data" created automatically, ofs=0x340000, len=0xc0000
0x000000340000-0x000000400000 : "rootfs_data"
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
NET: Registered protocol family 24
rdm_major = 253
netif_napi_add() called with weight 128 on device eth0
GMAC1_MAC_ADRH -- : 0x0000803f
GMAC1_MAC_ADRL -- : 0x5d536a0e
Ralink APSoC Ethernet Driver Initilization. v3.1  384 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, Tx Ring = 384, Rx Ring = 384
GMAC1_MAC_ADRH -- : 0x0000803f
GMAC1_MAC_ADRL -- : 0x5d536a0e
PROC INIT OK!
u32 classifier
nf_conntrack version 0.5.0 (439 buckets, 1756 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
Type=Linux
----------------------------
--------igd inited----------
----------------------------
TCP: cubic registered
NET: Registered protocol family 17
8021q: 802.1Q VLAN Support v1.8
registered taskstats version 1
VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
Freeing unused kernel memory: 184K (803c2000 - 803f0000)
procd: Console is alive
procd: - preinit -
Raeth v3.1 (NAPI
,SkbRecycle)

phy_tx_ring = 0x01588000, tx_ring = 0xa1588000

phy_rx_ring0 = 0x0158a000, rx_ring0 = 0xa158a000
GMAC1_MAC_ADRH -- : 0x0000803f
GMAC1_MAC_ADRL -- : 0x5d536a0e
RT305x_ESW: Link Status Changed
/etc/preinit: line 1: netmsg: not found
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
kmod: ran 1 iterations
jffs2: notice: (260) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 6 of xref (0 dead, 0 orphan) found.
block: extroot: no root or overlay mount defined
jffs2 is ready
jffs2 is ready
jffs2: notice: (257) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 6 of xref (0 dead, 0 orphan) found.
switching to overlay
ra2880stop()...Done
Free TX/RX Ring Memory!
procd: - early -
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
safe: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
regiester url hooks finish
l7 inited
Raeth v3.1 (NAPI
,SkbRecycle)

phy_tx_ring = 0x01662000, tx_ring = 0xa1662000

phy_rx_ring0 = 0x01664000, rx_ring0 = 0xa1664000
GMAC1_MAC_ADRH -- : 0x0000803f
GMAC1_MAC_ADRL -- : 0x5d536a0e
RT305x_ESW: Link Status Changed
device eth0.1 entered promiscuous mode
device eth0 entered promiscuous mode
-------->fdb_create, 470!!!
nl socket is null !
br-lan: port 1(eth0.1) entered forwarding state
br-lan: port 1(eth0.1) entered forwarding state
efuse_probe: efuse = 10000012
tssi_1_target_pwr_g_band = 35
procd: - init complete -
device ra0 entered promiscuous mode
br-lan: port 2(ra0) entered forwarding state
br-lan: port 2(ra0) entered forwarding state
-------->fdb_create, 470!!!
nl socket is null !
device ra1 entered promiscuous mode
-------->fdb_create, 470!!!
nl socket is null !
RT305x_ESW: Link Status Changed
-------->fdb_create, 470!!!
nl socket is null !
RT305x_ESW: Link Status Changed
RT305x_ESW: Link Status Changed
nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead.
Jan  1 00:00:05 miniupnpd[994]: HTTP listening on port 8556
Jan  1 00:00:05 miniupnpd[994]: Listening for NAT-PMP traffic on port 5351
RT305x_ESW: Link Status Changed
nf_host_forward[1549]drop invalid ip: 169.254.19.155-52.40.23.79
nf_host_forward[1549]drop invalid ip: 169.254.19.155-52.197.92.219
host_ugrp_update[1344]port id err 8, need fix
br-lan: port 1(eth0.1) entered forwarding state
main[113]:reset start
wps_init[15]:wps init
resetd_init[29]:flag:38
main[136]:reset_time: 60
br-lan: port 2(ra0) entered forwarding state
procd: Instance log::instance1 s in a crash loop 6 crashes, 0 seconds since last crash



BusyBox v1.22.1 (2017-11-14 14:30:02 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 BARRIER BREAKER (14.07, unknown)
 -----------------------------------------------------
  * 1/2 oz Galliano         Pour all ingredients into
  * 4 oz cold Coffee        an irish coffee mug filled
  * 1 1/2 oz Dark Rum       with crushed ice. Stir.
  * 2 tsp. Creme de Cacao
 -----------------------------------------------------
[root@OpenWrt]
[root@OpenWrt]
11

is tftp an available command on the device? I have seen routers that do not have ssh or telnet but have tftp

This is useful, along with /proc/mtd and bootlog / kernel log, but everything else is useless information....

You guys are welcome to build your own test image
follow the guide for building images, but in make menuconfig select
Target Images --> ramdisk
building will give you a initramfs-kernel.bin
https://openwrt.org/docs/guide-developer/quickstart-build-images

first you have to set up a profile for the board

use DTS file from other MT7628 based boards as examples
the DTS file goes in the folder
https://github.com/openwrt/openwrt/tree/master/target/linux/ramips/dts

add a simple profile to the makefile
https://github.com/openwrt/openwrt/blob/master/target/linux/ramips/image/mt76x8.mk

load this image over TFTP using serial console:
option 1 I think? or do option 4 and help to figure out the right commands

12

OK, I think I'm going to try and do this. I'll setup my dev box. I'm no dev but I have compiled kernels before.... years ago..... when we had to compile modules just ot make ethernet cards and modems work lol... so I'll have many questions if you are kind enough please... :slight_smile:

13

A. Did it work?
B. The supported devices page now lists the wn532n2 but says its an external image and has no link to downaload.

14

Note: This model is a 4/32 device.

Total memory: 32 MBytes
...
flash manufacture id: c8, device id 40 16
GD25Q32B(c8 40160000) (4096 Kbytes)
mtd .name = raspi, .size = 0x00400000 (4M) .erasesize = 0x00010000 (64K) .numeraseregions = 0