I received these two new boxes today
USB WAN 3 * LAN Gigabits
:https://fr.aliexpress.com/item/1005003032025489.html?spm=a2g0s.9042311.0.0.6d876c37knSLBd
Buy Ancatus-WiFi 6 Router AX1800, 1.8Gbps Speed, Gigabit, Ethernet, MU-MIMO, OFDMA, 802.11ax, Dual Band, WPA3, Firewall, Ipv6, Covers 2100 sq.ft, Connects 40+devices: Routers - Amazon.com ✓ FREE DELIVERY possible on eligible purchases
If i have a little time i post boot log
Since the topic title is not clear about this: What is the intention of your posting? Why have you created it?
Original software is very poor by exemple:
-> i cannot bridge wan & lan ( i have a fiber box )
-> not support for ntfs
My intention is find a solution for build a Openwrt version for this
first problem with a serial console:
UBoot is login/password protected
second problem
OS is also with login & password unknow
7528DRAMC V1.6 (0)
Press 'x' or 'b' key in 1 secs to enter or skip bootloader upgrade.
EN7528 at Wed Apr 21 09:40:45 CST 2021 version 1.1 free bootbase
Set SPI Clock to 50 Mhz
spi_nand_probe: mfr_id=0xb, dev_id=0xe1
Using Flash ECC.
Detected SPI NAND Flash : _SPI_NAND_DEVICE_ID_XT26G01A, Flash Size=0x8000000
bmt pool size: 81
BMT & BBT Init Success
GE Rext AnaCal Done! (1)(0x1f)
Press any key in 8 secs to enter boot command mode.
.................................................................
KGD IC
Xtal:1
DDR3 init.
DRAMC init done.
Calculate size.
DRAM size=256MB
7528DRAMC V1.6 (0)
Press 'x' or 'b' key in 1 secs to enter or skip bootloader upgrade.
EN7528 at Wed Apr 21 09:40:45 CST 2021 version 1.1 free bootbase
Set SPI Clock to 50 Mhz
spi_nand_probe: mfr_id=0xb, dev_id=0xe1
Using Flash ECC.
Detected SPI NAND Flash : _SPI_NAND_DEVICE_ID_XT26G01A, Flash Size=0x8000000
bmt pool size: 81
BMT & BBT Init Success
GE Rext AnaCal Done! (1)(0x1f)
Press any key in 8 secs to enter boot command mode.
................................................................................
==> boot flag = 0
Decompress to 80002000 free_mem_ptr=80E00000 free_mem_ptr_end=807B0000
from main
Uncompressing [LZMA] ... done.
Linux version 3.18.21 (root@8952ff2bbc3b) (gcc version 4.6.3 (Buildroot 2015.08.1) ) #6 SMP Wed Apr 21 09:42:04 CST 2021
__l2cmem:0x807782a0, _l2cmem_end:0x807782a0, l2cmem_size:0 Bytes
memsize:256MB
EcoNet EN7528 SOC prom init
bootconsole [early0] enabled
CPU0 revision is: 0001992f (MIPS 1004Kc)
Determined physical RAM map:
memory: 0fffe000 @ 00002000 (usable)
Wasting 64 bytes for tracking 2 unused pages
MIPS: machine is econet,en751221
Zone ranges:
Normal [mem 0x00002000-0x0fffffff]
Movable zone start for each node
Early memory node ranges
node 0: [mem 0x00002000-0x0fffffff]
Initmem setup node 0 [mem 0x00002000-0x0fffffff]
Detected 3 available secondary CPU(s)
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
PERCPU: Embedded 9 pages/cpu @81204000 s6080 r8192 d22592 u36864
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 65022
Kernel command line:
log_buf_len individual max cpu contribution: 4096 bytes
log_buf_len total cpu_extra contributions: 12288 bytes
log_buf_len min size: 16384 bytes
log_buf_len: 32768 bytes
early log buf free: 14328(87%)
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Writing ErrCtl register=0001de9d
Readback ErrCtl register=0001de9d
nmi base is 8126c200
Memory: 244560K/262136K available (7640K kernel code, 4018K rwdata, 1748K rodata, 208K init, 1358K bss, 17576K reserved)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:64
tc3162_time_init: Init bus timeout and watchdog
set rbus timeout as NMI then enable it
CPU frequency 900.00 MHz
plat_time_init: Entered, mips_timer_ack ptr is [800079dc]
Using 200.000 MHz high precision timer.
r4k_clockevent_init: setup_irq OK, irq is [52]
console [ttyS0] enabled
console [ttyS0] enabled
bootconsole [early0] disabled
bootconsole [early0] disabled
Calibrating delay loop... 591.87 BogoMIPS (lpj=2959360)
pid_max: default: 32768 minimum: 301
Security Framework initialized
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
34K sync es set to 0.
Config7: 0x80090500
launch: starting cpu1
launch: cpu1 gone!
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
CPU1 revision is: 0001992f (MIPS 1004Kc)
Synchronize counters for CPU 1: done.
launch: starting cpu2
launch: cpu2 gone!
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
CPU2 revision is: 0001992f (MIPS 1004Kc)
Synchronize counters for CPU 2: done.
launch: starting cpu3
launch: cpu3 gone!
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
CPU3 revision is: 0001992f (MIPS 1004Kc)
Synchronize counters for CPU 3: done.
Brought up 4 CPUs
NET: Registered protocol family 16
PCIe 7528 PHY init
PCIe driver version: 7528.1.20181122
EN7528 pcie_init
check pcie link up status:
isRC0_LINKUP=1
isRC1_LINKUP=1
registering PCI controller with io_map_base unset
Initializing Ecnt Event Netlink Socket
Initializing Econet Event Netlink Socket nl_sk = 8fd1ac00
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
pci_bus 0000:00: root bus resource [io 0x1f600000-0x1f61ffff]
pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
pci 0000:00:01.0: BAR 8: assigned [mem 0x20200000-0x203fffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
pci 0000:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
pci 0000:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
pci 0000:00:00.0: PCI bridge to [bus 01]
pci 0000:00:00.0: bridge window [mem 0x20000000-0x201fffff]
pci 0000:02:00.0: BAR 0: assigned [mem 0x20200000-0x202fffff 64bit pref]
pci 0000:02:00.0: BAR 2: assigned [mem 0x20300000-0x20303fff 64bit pref]
pci 0000:02:00.0: BAR 4: assigned [mem 0x20304000-0x20304fff 64bit pref]
pci 0000:00:01.0: PCI bridge to [bus 02]
pci 0000:00:01.0: bridge window [mem 0x20200000-0x203fffff]
Switched to clocksource MIPS
NET: Registered protocol family 2
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
NET: Registered protocol family 1
mt7512_pcie_fixup: 0x1438 = 20000015
mt7512_pcie_rc0_retrain: 80 = 0145dc12 80 = 01608c12
RC0 Link Traing Result: 10110008
mt7512_pcie_fixup: 0x3438 = 20200015
mt7512_pcie_rc1_retrain: 80 = 0145dc12 80 = 01608c12
RC1 Link Traing Result: 10120008
TC3162 hardware watchdog module loaded.
futex hash table entries: 1024 (order: 4, 65536 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
ntfs: driver 2.1.31 [Flags: R/W DEBUG].
jffs2: version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.23)
msgmni has been set to 477
io scheduler noop registered (default)
ttyS0 at I/O 0xbfbf0003 (irq = 5, base_baud = 7200) is a TC3162
ECNT ring buffer init success
brd: module loaded
SPI Flash Init Start
Found no SPI flash device
IS_SPIFLASH=0x0, IS_NANDFLASH=0x1, (0xBFA10114)=0x6)
Set SPI Clock to 50 Mhz
spi_nand_probe: mfr_id=0xb, dev_id=0xe1
Using Flash ECC.
Detected SPI NAND Flash : _SPI_NAND_DEVICE_ID_XT26G01A, Flash Size=0x8000000
spi nand flash
tc3162: flash device 0x01000000 at 0x1c000000
EN7512 mtd init: spi nand probe enter
[spi_nand_setup] : Enter
nand: device found, Manufacturer ID: 0x0b, Chip ID: 0xe1
nand: Unknown _SPI_NAND_DEVICE_ID_XT26G01A
nand: 128MiB, SLC, page size: 2048, OOB size: 64
nand_scan_ident ok
[spi_nand_setup]: chip size = 0x8000000, erase_shift=0x11
bmt pool size: 81
BMT & BBT Init Success
parsing <0[bootloader],0[romfile],25m[tclinux],25m[tclinux_slave]>
partition 7: name <tclinux_slave>, offset ffffffff, size 1900000, mask flags 0
partition 4: name <tclinux>, offset ffffffff, size 1900000, mask flags 0
partition 1: name <romfile>, offset ffffffff, size fffffffe, mask flags 0
partition 0: name <bootloader>, offset ffffffff, size fffffffe, mask flags 0
Creating 9 MTD partitions on "EN7512-SPI_NAND":
0x000000000000-0x000000040000 : "bootloader"
0x000000040000-0x000000080000 : "romfile"
0x000000080000-0x00000041529d : "kernel"
mtd: partition "kernel" doesn't end on an erase block -- force read-only
0x00000041529d-0x00000130529d : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x000000080000-0x000001980000 : "tclinux"
0x000001980000-0x000001d1529d : "kernel_slave"
mtd: partition "kernel_slave" doesn't end on an erase block -- force read-only
0x000001d1529d-0x000002c0529d : "rootfs_slave"
mtd: partition "rootfs_slave" doesn't start on an erase block boundary -- force read-only
0x000001980000-0x000003280000 : "tclinux_slave"
0x000006dc0000-0x000007000000 : "reservearea"
rootfs
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
NET: Registered protocol family 24
register rtpci
PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
<--mt7916_hif_init()
Rx[0] Ring: total 24576 bytes allocated
Rx[1] Ring: total 16384 bytes allocated
<-- pci_alloc_tx_rx_ring_mem, Status=0
PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
PCI: Enabling device 0000:02:00.0 (0000 -> 0002)
=== pAd = c0301000, size = 11482176 ===
<-- RTMPAllocAdapterBlock, Status=0
PCI CSRBaseAddress =0xc0200000, csr_addr=0xc0200000!
RTMPInitPCIeDevice():device_id=0x7915
mt7915_init()-->
Use the default iPAiLNA bin image!
<--mt7915_init()
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
Rx[0] Ring: total 24576 bytes allocated
Rx[1] Ring: total 24576 bytes allocated
Rx[2] Ring: total 8192 bytes allocated
Rx[3] Ring: total 16384 bytes allocated
Rx[4] Ring: total 8192 bytes allocated
<-- pci_alloc_tx_rx_ring_mem, Status=0
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
USB driver version: 7528.2.20181130
7528 USB PHY config, enable port0 port1
port 0 u2_slew_rate_cal_7528
FM_OUT value = 133(0x00000085)
SR calibration value = 4
port 1 u2_slew_rate_cal_7528
FM_OUT value = 133(0x00000085)
SR calibration value = 4
xhci-hcd xhci-hcd.0: xHCI Host Controller
xhci-hcd xhci-hcd.0: new USB bus registered, assigned bus number 1
xhci-hcd xhci-hcd.0: irq 10, io mem 0x1fb90000
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
xhci-hcd xhci-hcd.0: xHCI Host Controller
xhci-hcd xhci-hcd.0: new USB bus registered, assigned bus number 2
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
....
I have updated the topic title accordingly.
The SoC I never heard of, but the switch and wireless (at least one wireless chip) seem to be MediaTek (both supported by OpenWrt already I think).
The 'Econet' doesn't ring a bell but it seems there has been some work on some of their SoCs being upstreamed, see here, by @blogic.
SoC boots on linus HEAD, basic drivers have been rewritten but we are still missing the whole networking part
Looks like this SoC
CPU: MIPS 1004Kc (Dual-core) • Clock rate: @900MHzfound SNANDER Windows Utility for flash SPI with CH341A programmer
with original firmware
no exFat, NTFS
no dlna , relayd / repeater , vlan possibility ., bridge wan with lan's , ..
for the moment not usable , do not buy this product
I soldered some wires on the flash memory after read the flash memory
link for SPI FLASH CONTENT ( use https )
hxxps://mega.nz/file/zSg2SJLA#VDXYqKMkh5t7nQ3oFou5bQMAwtajMebOuEYkJWnYSwA
i have found infos in the bootloader
Bootloader
login: telecomadmin
password: nE7jA%5m
firmware is HDR2 : 80000 to 41529D ( extraction ? ) not found solution for SSH
GE Rext AnaCal Done! (1)(0x1f)
Press any key in 8 secs to enter boot command mode.
...
UserName: telecomadmin
Password: ********
bldr> help
? Print out help messages.
help Print out help messages.
go Booting the linux kernel.
decomp Decompress kernel image to ram.
memrl <addr> Read a word from addr.
memwl <addr> <value> Write a word to addr.
dump <addr> <len> Dump memory content.
jump <addr> Jump to addr.
flash <dst> <src> <len> <oob> Write to flash from src to dst(oob: write nand oob if 1).
imginfo Show images info.
spinand_rwtest Flash Test
bdstore <flash dst> <bin src> Do backdoor config store
bdshow Show backdoor config
bdswitch[1|0] Enable or disable backdoor function
ddrcalswitch[1|0] Enable or disable ddr calibration funciton
drambistswitch[0|1|2] disable or enable, and quick or normal test
xmdm <addr> <len> Xmodem receive to addr.
miir <phyaddr> <reg> Read ethernet phy reg.
miiw <phyaddr> <reg> <value> Write ethernet phy reg.
cpufreq <freq num> / <m> <n> Set CPU Freq <156~450>(freq has to be multiple of 6)
ipaddr <ip addr> Change modem's IP.
httpd Start Web Server
mtd
bldr> bdshow
back door config is not support NAND Flash
bldr> miir
Usage: miir <phyaddr> <reg>
bldr> http
PBUF_POOL_BUFSIZE = 256
tcp_bind()
Local Port = 0
tcp_bind: bind to port 80
bldr> http start
PBUF_POOL_BUFSIZE = 256
tcp_bind()
Local Port = 0
tcp_bind: bind to port 80
bldr> ipaddr 192.168.1.152
Change IP address to 192.168.1.152
bldr> mtd
0x00000000-0x00040000 : "bootloader"
0x00040000-0x00080000 : "romfile"
0x00080000-0x0041529d : "kernel"
0x0041529d-0x0130529d : "rootfs"
0x00080000-0x01980000 : "tclinux"
0x01980000-0x01d1529d : "kernel_slave"
0x01d1529d-0x02c0529d : "rootfs_slave"
0x01980000-0x03280000 : "tclinux_slave"
0x06dc0000-0x07000000 : "reservearea"
bldr>
first its not antacus)) i know real provider for this router
second i already see hash for login_pass ,but need your help, can you read full flash via asprogrammer ?
Full Flash with SNANDer
hxxps://mega.nz/file/zSg2SJLA#VDXYqKMkh5t7nQ3oFou5bQMAwtajMebOuEYkJWnYSwA
replace xx by tt
passwd
admin:$1$$iC.dUsGpxNNJGeOm1dFio/:0:0:root:/:/bin/sh ???
I think admin:1234 but ssh forbidden???
login - admin
pass - Um_rbr1234
real provider CM = china mobile
model UNR030N
You have in your router customized firmware.
Your firmware broken,maybe SNANDer not can read full firmware if you compare images you see this , can you read full firmware via asprogrammer ? here link asprogramer
The firmware read with SNander is correct
I read again several times and compared the data with HexEdit
Moreover I manage to read the files after extraction with 7Z
I used SNAnder because the Detected SPI NAND memory
XTX XT26G01A is not in the ASProgrammer database
If you tell me how can i connect with WIN SCP ( SSH ? )or transfet files to PC Computer, telnet
I will be able to read the partitions with cat /dev/mtd0 > mtd0.bin
cat /dev/mtd1 > mtd1.bin .... and rebuild full firmware with cat /dev/mtd0 > backup_fullflash.bin
cat /dev/mtd1 >> backup_fullflash.bin ....
I have tested with WIndows tftp server and ftpput 192.168.1.10 mtd0.bin mtd0.bin -u ADMIN -p ADMIN -P 5555
but i have ftpput: CWD error: Permission Denied.
Datashhet for XTX XT26G01A
ReadId Table:
Byte 0: 0BH
Byte 1: E1H
But sure Snander read correctly the data
I do not see why it would be necessary to use ASProgrammer which would force me to solder again the 8 wires on the memory whereas I am certain that the content which was read with SNander will be exactly the same I had checked several times If you have been able to look in the files put at mega.nz you will see that the contents of the partitions extracted with 7 zip contain the same files that I have when looking in the OS with the console connected to the serial port
I had also used the -v command with SNander which makes it possible to verify that the content is correct
Now if you find the firmware is not correct it may be that the manufacturer's firmware is not good if you have another one i can try flashing it to see if it works better
it would be much easier if I could recover the contents of mtdxxx to my computer
Found solution with a USB key
cd /tmp/mnt/usb1_1
All mtd0,1,2, ...
cat /dev/mtdx > mtdx.bin
All MTD for 2 * BOX_ANCATUS
hxxps://mega.nz/file/6PIykLLD#RCPZvgKq4fKusqiP7UipuZMZMiJmdliNNz7Aq_F1m34
