Adding OpenWrt support for Ancatus a6 wifi 6 ax1800 ax3

The SoC I never heard of, but the switch and wireless (at least one wireless chip) seem to be MediaTek (both supported by OpenWrt already I think).

The 'Econet' doesn't ring a bell but it seems there has been some work on some of their SoCs being upstreamed, see here, by @blogic.

1 Like

SoC boots on linus HEAD, basic drivers have been rewritten but we are still missing the whole networking part


Looks like this SoC

CPU: MIPS 1004Kc (Dual-core) • Clock rate: @900MHz
1 Like

found SNANDER Windows Utility for flash SPI with CH341A programmer

  1. XTX XT26G02B
    059. XTX XT26G01A
  2. XTX XT26G02A

with original firmware

no exFat, NTFS
no dlna , relayd / repeater , vlan possibility ., bridge wan with lan's , ..

for the moment not usable , do not buy this product

I soldered some wires on the flash memory after read the flash memory

link for SPI FLASH CONTENT ( use https )

i have found infos in the bootloader

login: telecomadmin
password: nE7jA%5m

firmware is HDR2 : 80000 to 41529D ( extraction ? ) not found solution for SSH

  GE Rext AnaCal Done! (1)(0x1f)
Press any key in 8 secs to enter boot command mode.
UserName: telecomadmin
Password: ********

bldr> help

?                                   Print out help messages.
help                                Print out help messages.
go                                  Booting the linux kernel.
decomp                              Decompress kernel image to ram.
memrl <addr>                        Read a word from addr.
memwl <addr> <value>                Write a word to addr.
dump <addr> <len>                   Dump memory content.
jump <addr>                         Jump to addr.
flash <dst> <src> <len> <oob>       Write to flash from src to dst(oob: write nand oob if 1).
imginfo                             Show images info.
spinand_rwtest                      Flash Test
bdstore <flash dst> <bin src>       Do backdoor config store
bdshow                              Show backdoor config
bdswitch[1|0]                       Enable or disable backdoor function
ddrcalswitch[1|0]                   Enable or disable ddr calibration funciton
drambistswitch[0|1|2]               disable or enable, and quick or normal test
xmdm <addr> <len>                   Xmodem receive to addr.
miir <phyaddr> <reg>                Read ethernet phy reg.
miiw <phyaddr> <reg> <value>        Write ethernet phy reg.
cpufreq <freq num> / <m> <n>        Set CPU Freq <156~450>(freq has to be multiple of 6)
ipaddr <ip addr>                    Change modem's IP.
httpd                               Start Web Server
bldr> bdshow
back door config is not support NAND Flash
bldr> miir
Usage: miir <phyaddr> <reg>
bldr> http
Local Port = 0
tcp_bind: bind to port 80
bldr> http start
Local Port = 0
tcp_bind: bind to port 80
bldr> ipaddr
Change IP address to
bldr> mtd
0x00000000-0x00040000 : "bootloader"
0x00040000-0x00080000 : "romfile"
0x00080000-0x0041529d : "kernel"
0x0041529d-0x0130529d : "rootfs"
0x00080000-0x01980000 : "tclinux"
0x01980000-0x01d1529d : "kernel_slave"
0x01d1529d-0x02c0529d : "rootfs_slave"
0x01980000-0x03280000 : "tclinux_slave"
0x06dc0000-0x07000000 : "reservearea"

1 Like

first its not antacus)) i know real provider for this router

second i already see hash for login_pass ,but need your help, can you read full flash via asprogrammer ?

Full Flash with SNANDer


replace xx by tt


admin:$1$$iC.dUsGpxNNJGeOm1dFio/:0:0:root:/:/bin/sh ???

I think admin:1234 but ssh forbidden???


login - admin
pass - Um_rbr1234

real provider CM = china mobile

model UNR030N

You have in your router customized firmware.

Your firmware broken,maybe SNANDer not can read full firmware if you compare images you see this , can you read full firmware via asprogrammer ? here link asprogramer

The firmware read with SNander is correct
I read again several times and compared the data with HexEdit
Moreover I manage to read the files after extraction with 7Z
I used SNAnder because the Detected SPI NAND memory
XTX XT26G01A is not in the ASProgrammer database
If you tell me how can i connect with WIN SCP ( SSH ? )or transfet files to PC Computer, telnet
I will be able to read the partitions with cat /dev/mtd0 > mtd0.bin
cat /dev/mtd1 > mtd1.bin .... and rebuild full firmware with cat /dev/mtd0 > backup_fullflash.bin
cat /dev/mtd1 >> backup_fullflash.bin ....

I have tested with WIndows tftp server and ftpput mtd0.bin mtd0.bin -u ADMIN -p ADMIN -P 5555
but i have ftpput: CWD error: Permission Denied.

No problem, give me id in asprogrammer i add your flash to database )

Datashhet for XTX XT26G01A

ReadId Table:
Byte 0: 0BH
Byte 1: E1H

But sure Snander read correctly the data

I do not see why it would be necessary to use ASProgrammer which would force me to solder again the 8 wires on the memory whereas I am certain that the content which was read with SNander will be exactly the same I had checked several times If you have been able to look in the files put at you will see that the contents of the partitions extracted with 7 zip contain the same files that I have when looking in the OS with the console connected to the serial port
I had also used the -v command with SNander which makes it possible to verify that the content is correct

Now if you find the firmware is not correct it may be that the manufacturer's firmware is not good if you have another one i can try flashing it to see if it works better

it would be much easier if I could recover the contents of mtdxxx to my computer

Found solution with a USB key

cd /tmp/mnt/usb1_1

All mtd0,1,2, ...
cat /dev/mtdx > mtdx.bin



any update on this for openwrt support

no update at this time

good hardware , poor software

pls reupload

I did some work on en7512, it is far from complete:

With the patch, you can compile linux 5 for it, serial communication works, there is simple ethernet driver. But in the driver, I do not see which port the packet came from. The packet looks no different is it from WAN or LAN port. There is "port" field in the ring structure, but it was not useful for incoming packets. So since I could not find programmers manual for the SoC, I've stopped working.

This SoC is based on the TrendChip platform later acquired by Ralink, which was then acquired by Mediatek. There is a tool called tcrevenge to unpack firmware files, not sure if this is applicable for this device as well. But the tclinux toolchain is probably no longer maintained, and due to the lack of documentation there probably will never be official OpenWrt support, yet Mediatek/EcoNet still sell these chips for VDSL routers.