Adding support for Comfast CF-WR758AC(AKA Joowin JW-WR758AC)

Comfast WR758AC ships with firmware based on openwrt. However, vendor does not provide the source code and has not answered my queries for it either. I am able to login to the device after resetting the root password of the device. Used firmware-mod-kit to extract and modify the firmware.

cat /proc/cpuinfo
system type : Ralink MT7628AN ver:1 eco:2
machine : Comfast JW-WR758AC
processor : 0
cpu model : MIPS 24KEc V5.5

oot@COMFAST:/etc/wireless# ls -l
drwxr-xr-x 1 root root 0 Jan 6 2020 mt7612e
drwxr-xr-x 1 root root 0 Jan 6 2020 mt7628
root@COMFAST:/etc/wireless# find
.
./mt7612e
./mt7612e/mt7612e.dat
./mt7612e/version
./mt7628
./mt7628/mt7628.dat
./mt7628/mt7628.eeprom.bin
./mt7628/version

Can the information in the firmware used to add official support for the device?

Thanks.

Yes, and no. Having the OEM source surely helps, but for very common and well supported SOCs, it's not as necessary as for newer/ less common ones. You can derive a lot of information from the running system and slowly adapt OpenWrt to what you need for your device, once you have serial console access and can test-drive new firmware builds safely via tftpboot. But it will require time, effort quite some experience and some trial and error.

Hi.

Did you ever went on with more experiences with this device? Do you know if it's possible to debrick if anything goes wrong?

Hey there!
Following op's hints I was able to change the default root password in 'root'.
Here is my modded firmware based on 2021-04-07 version https://mega.nz/file/3U9FnCKJ#d3tOtiVRb5YCuxZlDCnM4a5htRudbmc7a50z3Eq3rZM

Hi. I'm trying to add support for this repeater but i already bricked one. i recovered it flashing a unlocked bootloader and using the uart i've put a comfast firmware with the root account activated.
But don´t boot correctly.
Now i'm trying to build a openwrt custom version for it but it's a little hard. Can you anybody send me a dump of the dmesg log for a comfast firmware that runs ok?
Thanks in advance.

PD: Sorry for my bad english.

Hello elmismo,
i have a stock jw-wr758ac when you can explane how i get this log i can send it to you.

Hi. Nice to meet you. A question, do you have any linux skills? Do you speak spanish (it's my language)?
Thanks in advance.

no only english and german, sorry :wink:
what i need to know is how can i login with ssh to the WR758AC, i don´t try it. is ssh allready start and i need only the root password? do you have this?

Hi. First all, can you say me the firmware version of you repeater? For the root password problem there is two solutions: 1- Try to decript the passwd and shadow files of the firmware and 2- Flash a firmware with theses two files with the root password changed to permit the ssh access.
The first i don´t try it (but i can try it in one of my linux boxes) but the second i try it and it's ok. For the second option i found in the web a process to decompress the firmware, then i changed these two files and compress again to obtain a new file to flash the repeater.
Have you a linux box or virtual machine with linux? If yes, i can explain you how to do the process (and you learn how to do9 or if you prefer i can modify the firmware for you and send it.
Sorry if i don´t explain well, my english is not very good.

Hello, if you like, please explane what i must do to decrompress/compress the firmware.
But i also need the firmware file. on the site form Joowin i don´t find a firmware download

My current version is JW-WR758AC-V1.0.0.6

As long as the device can boot in recovery mode, you can flash the original firmware again.

I used the following steps to update the firmware.

Tool/utility needed:  firmware-mod-kit

•	I used debian and it was available from software repository 
o	sudo apt-get install firmware-mod-kit

•	copy vendor firmware to tmp directory
o	/tmp/JW-WR758AC-V1.0.0.6.bin

•	extract firmware content
o	~/tmp$ /opt/firmware-mod-kit/trunk/extract-firmware.sh JW-WR758AC-V1.0.0.6.bin

•	-~/tmp$ ls -l
o	total 6408
o	drwxr-xr-x 5 kali kali    4096 Sep 27 15:03 fmk
o	-rw-r--r-- 1 kali kali 6553604 Sep 27 14:15 JW-WR758AC-V1.0.0.6.bin



•	fmk directory contains the extracted files

•	fmk/rootfs/ directory is where we need to modify files

•	Changing root passwd
o	file to edit rootfs/etc/shadow
o	I used the information from the following two links to create a new password and change it in shadow file.  
o	https://www.shellhacks.com/linux-generate-password-hash/
o	https://unix.stackexchange.com/questions/81240/manually-generate-password-for-etc-shadow
o	~/tmp/fmk/rootfs/etc$ openssl passwd -1

•	Add authorized_key in dropbear (used for ssh with key) using the information from this page:
o	Add ssh key to dropper https://www.ct-networks.io/community/tutorials/setting-up-dropbear-public-key-authentication.html
•	For security, I disabled login with password and use ssh-key instead

•	I also change the model name to be able to see if my custom firmware loaded correctly
o	sudo vi rootfs/etc/defconfig/jw-wr758ac/version

•	build new firmware by going back to tmp directory and running the command:
o	~/tmp$ /opt/firmware-mod-kit/trunk/build-firmware.sh

•	Successful build will show output like the following:
o	New firmware image has been saved to: /home/....../tmp/fmk/new-firmware.bin

•	Rename and copy new-firmware.bin to a new location and used that to flash the device.

•	Hope this helps.

thank you for the explanation
do you have the firmware JW-WR758AC-V1.0.0.6.bin?

I think the firmware.bin file from https://github.com/cfpublish/JW-WR758AC should work.

Also, the "firmware" link is in the original post. It will give you JW-WR758AC-V1.0.0.9.bin.

Thank you for the link. I will try it. But when you allready changed the root password, then you can provide elmismo the dmesg log? (this is the only reason why i try this :wink:

Sorry, I had not been paying attention to the thread for some time and had stopped using the device. I can certainly try to get the dmesg output later today.

BusyBox v1.26.2 () built-in shell (ash)

root@COMFAST:~# dmesg
[    0.000000] Linux version 3.18.9 (qian@qian-virtual-machine) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 unknown) ) #119 Wed Apr 15 14:50:20 HKT 2020
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: Ralink MT7628AN ver:1 eco:2
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] MIPS: machine is Comfast JW-WR758AC
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Initmem setup node 0 [mem 0x00000000-0x03ffffff]
[    0.000000] On node 0 totalpages: 16384
[    0.000000] free_area_init_node: node 0, pgdat 802ffdd0, node_mem_map 81000000
[    0.000000]   Normal zone: 128 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 16384 pages, LIFO batch:3
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00057227
[    0.000000] Readback ErrCtl register=00057227
[    0.000000] Memory: 61364K/65536K available (2522K kernel code, 124K rwdata, 516K rodata, 156K init, 186K bss, 4172K reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:256
[    0.000000] intc: using register map from devicetree
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksource_of_init: no matching clocksources found
[    0.050000] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.060000] pid_max: default: 32768 minimum: 301
[    0.060000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.070000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.070000] pinctrl core: initialized pinctrl subsystem
[    0.080000] NET: Registered protocol family 16
[    0.090000] rt2880-pinmux pinctrl: try to register 53 pins ...
[    0.090000] pinctrl core: registered pin 0 (io0) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 1 (io1) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 2 (io2) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 3 (io3) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 4 (io4) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 5 (io5) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 6 (io6) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 7 (io7) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 8 (io8) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 9 (io9) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 10 (io10) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 11 (io11) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 12 (io12) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 13 (io13) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 14 (io14) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 15 (io15) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 16 (io16) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 17 (io17) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 18 (io18) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 19 (io19) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 20 (io20) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 21 (io21) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 22 (io22) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 23 (io23) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 24 (io24) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 25 (io25) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 26 (io26) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 27 (io27) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 28 (io28) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 29 (io29) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 30 (io30) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 31 (io31) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 32 (io32) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 33 (io33) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 34 (io34) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 35 (io35) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 36 (io36) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 37 (io37) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 38 (io38) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 39 (io39) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 40 (io40) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 41 (io41) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 42 (io42) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 43 (io43) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 44 (io44) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 45 (io45) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 46 (io46) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 47 (io47) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 48 (io48) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 49 (io49) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 50 (io50) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 51 (io51) on rt2880-pinmux
[    0.090000] pinctrl core: registered pin 52 (io52) on rt2880-pinmux
[    0.090000] pinctrl core: add 4 pinmux maps
[    0.090000] rt2880-pinmux pinctrl: invalid group "wled_an" for function "gpio"
[    0.090000] rt2880-pinmux pinctrl: found group selector 7 for wdt
[    0.090000] rt2880-pinmux pinctrl: found group selector 5 for refclk
[    0.090000] rt2880-pinmux pinctrl: found group selector 14 for gpio
[    0.090000] rt2880-pinmux pinctrl: request pin 15 (io15) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 16 (io16) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 17 (io17) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 18 (io18) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 19 (io19) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 20 (io20) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 21 (io21) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 22 (io22) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 23 (io23) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 24 (io24) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 25 (io25) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 26 (io26) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 27 (io27) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 28 (io28) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 29 (io29) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 30 (io30) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 31 (io31) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 32 (io32) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 33 (io33) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 34 (io34) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 35 (io35) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 36 (io36) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 37 (io37) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 38 (io38) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 39 (io39) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 40 (io40) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 41 (io41) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 42 (io42) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 43 (io43) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 44 (io44) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 45 (io45) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 46 (io46) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 47 (io47) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 48 (io48) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 49 (io49) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 50 (io50) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 51 (io51) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 52 (io52) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 36 (io36) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: request pin 11 (io11) for pinctrl
[    0.090000] rt2880-pinmux pinctrl: failed to lookup the sleep state
[    0.200000] mt7620-pci 10140000.pcie: Port 0 N_FTS = 1b105000
[    0.350000] PCI host bridge /pcie@10140000 ranges:
[    0.360000]  MEM 0x0000000020000000..0x000000002fffffff
[    0.360000]   IO 0x0000000010160000..0x000000001016ffff
[    0.380000] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.380000] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.390000] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.390000] PCI host bridge to bus 0000:00
[    0.400000] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.400000] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    0.410000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.410000] pci 0000:00:00.0: [14c3:0801] type 01 class 0x060400
[    0.410000] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    0.410000] pci 0000:00:00.0: reg 0x14: [mem 0x00000000-0x0000ffff]
[    0.410000] pci 0000:00:00.0: supports D1
[    0.410000] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.410000] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.420000] pci 0000:01:00.0: [14c3:7662] type 00 class 0x028000
[    0.420000] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit]
[    0.420000] pci 0000:01:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    0.420000] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
[    0.420000] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    0.420000] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
[    0.420000] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    0.420000] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    0.430000] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[    0.430000] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
[    0.440000] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    0.440000] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
[    0.450000] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
[    0.450000] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.460000] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
[    0.460000] pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
[    0.470000] pci 0000:00:00.0: card - bus=0x0, slot = 0x0 irq=0
[    0.470000] pci 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
[    0.480000] Switched to clocksource MIPS
[    0.480000] NET: Registered protocol family 2
[    0.490000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.490000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.500000] TCP: Hash tables configured (established 1024 bind 1024)
[    0.500000] TCP: reno registered
[    0.510000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.510000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.520000] NET: Registered protocol family 1
[    0.520000] PCI: CLS 80 bytes, default 32
[    0.520000] alarmtimer alarmtimer: no of_node; not parsing pinctrl DT
[    0.530000] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.550000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.560000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.570000] msgmni has been set to 119
[    0.570000] io scheduler noop registered
[    0.570000] io scheduler deadline registered (default)
[    0.580000] drivers/phy/phy-ralink-usb.c:ralink_usb_phy_probe[147]
[    0.590000] drivers/phy/phy-ralink-usb.c:ralink_usb_phy_probe[161]
[    0.590000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.600000] serial8250 serial8250: no of_node; not parsing pinctrl DT
[    0.600000] pinctrl core: add 1 pinmux maps
[    0.600000] pinmux core: rt2880-pinmux does not support function uart0
[    0.610000] rt2880-pinmux pinctrl: invalid function uart0 in map table
[    0.610000] console [ttyS0] disabled
[    0.620000] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud = 2500000) is a 16550A
[    0.620000] console [ttyS0] enabled
[    0.630000] bootconsole [early0] disabled
[    0.640000] pinctrl core: add 1 pinmux maps
[    0.640000] pinmux core: rt2880-pinmux does not support function uart1
[    0.650000] rt2880-pinmux pinctrl: invalid function uart1 in map table
[    0.650000] of_serial 10000d00.uart1: clk or clock-frequency not defined
[    0.660000] of_serial: probe of 10000d00.uart1 failed with error -2
[    0.670000] pinctrl core: add 1 pinmux maps
[    0.670000] rt2880-pinmux pinctrl: found group selector 8 for spi
[    0.670000] rt2880-pinmux pinctrl: request pin 7 (io7) for 10000b00.spi
[    0.670000] rt2880-pinmux pinctrl: request pin 8 (io8) for 10000b00.spi
[    0.670000] rt2880-pinmux pinctrl: request pin 9 (io9) for 10000b00.spi
[    0.670000] rt2880-pinmux pinctrl: request pin 10 (io10) for 10000b00.spi
[    0.670000] spi-mt7621 10000b00.spi: sys_freq: 193333333
[    0.680000] m25p80 spi32766.0: en25qh64a (8192 Kbytes)
[    0.680000] m25p80 spi32766.0: using chunked io
[    0.690000] 5 ofpart partitions found on MTD device spi32766.0
[    0.690000] Creating 5 MTD partitions on "spi32766.0":
[    0.700000] 0x000000000000-0x000000030000 : "u-boot"
[    0.700000] 0x000000030000-0x000000040000 : "u-boot-env"
[    0.710000] 0x000000040000-0x000000050000 : "factory"
[    0.720000] 0x000000050000-0x0000007b0000 : "firmware"
[    0.760000] 2 uimage-fw partitions found on MTD device firmware
[    0.770000] 0x000000050000-0x00000016a127 : "kernel"
[    0.770000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.790000] 0x00000016a127-0x0000007b0000 : "rootfs"
[    0.790000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.800000] mtd: device 5 (rootfs) set to be root filesystem
[    0.810000] 1 squashfs-split partitions found on MTD device rootfs
[    0.820000] 0x0000006b0000-0x0000007b0000 : "rootfs_data"
[    0.820000] 0x0000007b0000-0x0000007f0000 : "configs"
[    0.840000] ralink_soc_eth 10100000.ethernet eth0: ralink at 0xb0100000, irq 5
[    0.850000] mt7621_wdt 10000120.watchdog: Initialized
[    0.850000] TCP: cubic registered
[    0.860000] NET: Registered protocol family 17
[    0.860000] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    0.870000] Bridge firewalling registered
[    0.880000] 8021q: 802.1Q VLAN Support v1.8
[    0.900000] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    0.900000] Freeing unused kernel memory: 156K (80319000 - 80340000)
[    2.950000] init: Console is alive
[    2.950000] init: - watchdog -
[    5.780000] SCSI subsystem initialized
[    5.960000] init: - preinit -
[    7.310000] rt305x-esw 10110000.esw: link changed 0x00
[    7.490000] random: mktemp urandom read with 11 bits of entropy available
[    9.920000] jffs2: notice: (383) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found.
[    9.940000] mount_root: switching to jffs2 overlay
[    9.980000] procd: - early -
[    9.980000] procd: - watchdog -
[   10.730000] procd: - ubus -
[   11.100000] rt305x-esw 10110000.esw: link changed 0x10
[   11.740000] procd: - init -
[   13.520000] i2c /dev entries driver
[   13.530000] u32 classifier
[   13.540000]     input device check on
[   13.540000]     Actions configured
[   13.550000] Mirror/redirect action on
[   13.580000] nf_conntrack version 0.5.0 (961 buckets, 3844 max)
[   13.640000] Netfilter messages via NETLINK v0.30.
[   13.720000] xt_time: kernel timezone is -0000
[   13.730000] Ebtables v2.0 registered
[   13.740000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   13.760000] ctnetlink v0.93: registering with nfnetlink.
[   13.780000] PPP generic driver version 2.4.2
[   13.790000] PPP MPPE Compression module registered
[   13.790000] NET: Registered protocol family 24
[   17.800000] rt305x-esw 10110000.esw: link changed 0x00
[   21.560000] rt305x-esw 10110000.esw: link changed 0x10
[   22.390000] device eth0.1 entered promiscuous mode
[   22.400000] device eth0 entered promiscuous mode
[   22.430000] br-lan: port 1(eth0.1) entered forwarding state
[   22.430000] br-lan: port 1(eth0.1) entered forwarding state
[   22.510000] device eth0.2 entered promiscuous mode
[   22.540000] br-wan: port 1(eth0.2) entered forwarding state
[   22.540000] br-wan: port 1(eth0.2) entered forwarding state
[   24.430000] br-lan: port 1(eth0.1) entered forwarding state
[   24.540000] br-wan: port 1(eth0.2) entered forwarding state
[   27.700000] register rt2860
[   27.700000] rt2860 0000:01:00.0: no of_node; not parsing pinctrl DT
[   27.800000] 
[   27.800000] 
[   27.800000] === pAd = c0781000, size = 2104944 ===
[   27.800000] 
[   27.810000] <-- RTMPAllocTxRxRingMemory, Status=0
[   27.810000] <-- RTMPAllocAdapterBlock, Status=0
[   27.820000] pAd->CSRBaseAddress =0xc0680000, csr_addr=0xc0680000!
[   27.820000] device_id =0x7662
[   27.830000] ==>rlt_wlan_chip_onoff(): OnOff:1, Reset= 1, pAd->WlanFunCtrl:0x0, Reg-WlanFunCtrl=0x20a
[   27.840000] chip_id1=, chip_id2=7612, pAd->MACVersion=0x76623000
[   27.840000] chip_id1=0x0, chip_id2=0x7612, pAd->MACVersion=0x76623000
[   27.850000] RtmpChipOpsEepromHook::e2p_type=0, inf_Type=5
[   27.850000] RtmpEepromGetDefault::e2p_dafault=2
[   27.860000] NVM is efuse and the information is too less to bring up the interface
[   27.870000] Force to use Flash mode
[   27.870000] NVM is FLASH mode (pAd->flash_offset = 0x48000)
[   27.880000] get_dev_name_prefix(): dev_idx = 1, dev_name_prefix=rai
[   27.950000] build time = 
[   27.950000] 20141115060606a
[   27.950000] rom patch for E3 IC
[   27.960000] 
[   27.960000] platform = 
[   27.960000] ALPS
[   27.960000] hw/sw version = 
[   27.970000] ??
[   27.970000] patch version = 
[   27.970000] 
[   27.990000] FW Version:0.0.00 Build:1
[   27.990000] Build Time:201607111443____
[   27.990000] fw for E3 IC
[   28.040000] RX[0] DESC a203a000 size = 4096
[   28.050000] RX[1] DESC a203b000 size = 4096
[   28.160000] E2pAccessMode=2
[   28.160000] cfg_mode=14
[   28.160000] cfg_mode=14
[   28.160000] wmode_band_equal(): Band Not Equal!
[   28.170000] APSDCapable[0]=0
[   28.180000] APSDCapable[1]=0
[   28.180000] APSDCapable[2]=0
[   28.180000] APSDCapable[3]=0
[   28.190000] APSDCapable[4]=0
[   28.190000] APSDCapable[5]=0
[   28.190000] APSDCapable[6]=0
[   28.190000] APSDCapable[7]=0
[   28.200000] APSDCapable[8]=0
[   28.200000] APSDCapable[9]=0
[   28.200000] APSDCapable[10]=0
[   28.210000] APSDCapable[11]=0
[   28.210000] APSDCapable[12]=0
[   28.210000] APSDCapable[13]=0
[   28.210000] APSDCapable[14]=0
[   28.220000] APSDCapable[15]=0
[   28.220000] default ApCliAPSDCapable[0]=0
[   28.420000] Key1Str is Invalid key length(0) or Type(1)
[   28.420000] Key2Str is Invalid key length(0) or Type(1)
[   28.430000] Key3Str is Invalid key length(0) or Type(1)
[   28.440000] Key4Str is Invalid key length(0) or Type(1)
[   28.630000] d1:f8:4f:2b:2c:07:ae:b7:b9:53:93:e1:c0:8e:9c:b0:
[   28.640000] 4f:16:19:f9:f3:e8:40:00:40:28:d9:a4:1d:ee:e5:5a:
[   28.650000] 
[   28.680000] 1. Phy Mode = 49
[   28.700000] get_chl_grp:illegal channel (167)
[   28.710000] get_chl_grp:illegal channel (167)
[   28.710000] get_chl_grp:illegal channel (169)
[   28.720000] get_chl_grp:illegal channel (169)
[   28.720000] get_chl_grp:illegal channel (171)
[   28.720000] get_chl_grp:illegal channel (171)
[   28.730000] /home/qian/hc/OPENWRT/trunk/build_dir/target-mipsel_24kec+dsp_uClibc-0.9.33.2/linux-ramips_mt7628/mt76x2e-3.0.4.0/rlt_wifi_ap/../rlt_wifi/chips/mt76x2.c:2899 assert (ad->TxPower[choffset].Channel == 42)failed
[   28.750000] Country Region from e2p = ffff
[   28.750000] mt76x2_read_temp_info_from_eeprom:: is_temp_tx_alc=0, temp_tx_alc_enable=0
[   28.760000] mt76x2_read_tx_alc_info_from_eeprom:: is_ePA_mode=0, ePA_type=3
[   28.770000] mt76x2_read_tx_alc_info_from_eeprom:: [5G band] high_temp_slope=0, low_temp_slope=0
[   28.780000] mt76x2_read_tx_alc_info_from_eeprom:: [2G band] high_temp_slope=0, low_temp_slope=0
[   28.790000] mt76x2_read_tx_alc_info_from_eeprom:: [5G band] tc_lower_bound=0, tc_upper_bound=0
[   28.790000] mt76x2_read_tx_alc_info_from_eeprom:: [2G band] tc_lower_bound=0, tc_upper_bound=0
[   28.800000] mt76x2_get_external_lna_gain::LNA type=0x11, BLNAGain=0x0, ALNAGain0=0x0, ALNAGain1=0x0, ALNAGain2=0x0
[   28.810000] 2. Phy Mode = 49
[   28.820000] 3. Phy Mode = 49
[   28.820000] andes_pci_fw_init
[   28.820000] 0x1300 = 00073200
[   28.850000] AntCfgInit: primary/secondary ant 0/1
[   28.860000] andes_load_cr:cr_type(2)
[   28.870000] ChipStructAssign(): MT76x2 hook !
[   28.870000] @@@ BuildChannel # 36 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   28.870000]  @@@ BuildChannel # 40 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   28.870000]  @@@ BuildChannel # 44 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   28.870000]  @@@ BuildChannel # 48 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   28.870000]  @@@ BuildChannel # 52 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   28.870000]  @@@ BuildChannel # 56 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   28.870000]  @@@ BuildChannel # 60 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   28.870000]  @@@ BuildChannel # 64 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   28.870000]  @@@ BuildChannel # 100 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   28.870000]  @@@ BuildChannel # 104 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   28.870000]  @@@ BuildChannel # 108 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   28.950000]  @@@ BuildChannel # 112 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   28.950000]  @@@ BuildChannel # 116 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   28.950000]  @@@ BuildChannel # 120 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   28.950000]  @@@ BuildChannel # 124 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   28.950000]  @@@ BuildChannel # 128 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   28.950000]  @@@ BuildChannel # 132 :: Pwr0 = 30, Pwr1 =30, Flags = 40, RemainingTimeForUse=0
[   28.950000]  @@@ BuildChannel # 136 :: Pwr0 = 30, Pwr1 =30, Flags = 40, RemainingTimeForUse=0
[   28.950000]  @@@ BuildChannel # 140 :: Pwr0 = 30, Pwr1 =30, Flags = 0, RemainingTimeForUse=0
[   28.950000]  @@@ BuildChannel # 149 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   28.950000]  @@@ BuildChannel # 153 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   29.020000]  @@@ BuildChannel # 157 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   29.020000]  @@@ BuildChannel # 161 :: Pwr0 = 30, Pwr1 =30, Flags = c0, RemainingTimeForUse=0
[   29.020000]  @@@ BuildChannel # 165 :: Pwr0 = 30, Pwr1 =30, Flags = 0, RemainingTimeForUse=0
[   29.020000]  MCS Set = ff ff 00 00 01
[   29.240000] mt76x2_bbp_adjust():rf_bw=2, ext_ch=1, PrimCh=157, HT-CentCh=159, VHT-CentCh=155
[   29.350000] TX0 power compensation = 0x38
[   29.350000] TX1 power compensation = 0x38
[   29.360000] APStartUp(): AP Set CentralFreq at 155(Prim=157, HT-CentCh=159, VHT-CentCh=155, BBP_BW=2)
[   29.380000] mt76x2_calibration(channel = 155)
[   29.770000] Main bssid = 20:0d:b0:d3:75:28
[   29.770000] mt76x2_reinit_agc_gain:original agc_vga0 = 0x5c, agc_vga1 = 0x5c
[   29.780000] mt76x2_reinit_agc_gain:updated agc_vga0 = 0x5c, agc_vga1 = 0x5c
[   29.780000] mt76x2_reinit_hi_lna_gain:original hi_lna0 = 0x27, hi_lna1 = 0x27
[   29.790000] mt76x2_reinit_hi_lna_gain:updated hi_lna0 = 0x27, hi_lna1 = 0x27
[   29.800000] original vga value(chain0) = 5c
[   29.800000] original vga value(chain1) = 5c
[   29.810000] <==== rt28xx_init, Status=0
[   29.810000] get_dev_name_prefix(): dev_idx = 1, dev_name_prefix=apclii
[   29.900000] RTMPDrvOpen(1):Check if PDMA is idle!
[   29.900000] RTMPDrvOpen(2):Check if PDMA is idle!
[   31.580000] device rai0 entered promiscuous mode
[   31.590000] br-lan: port 2(rai0) entered forwarding state
[   31.590000] br-lan: port 2(rai0) entered forwarding state
[   33.590000] br-lan: port 2(rai0) entered forwarding state
[   37.060000] 
[   37.060000] 
[   37.060000] === pAd = c0b49000, size = 1232360 ===
[   37.060000] 
[   37.070000] <-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
[   37.080000] <-- RTMPAllocAdapterBlock, Status=0
[   37.080000] RtmpChipOpsHook(492): Not support for HIF_MT yet!
[   37.090000] mt7628_init()-->
[   37.090000] mt7628_init(FW(8a00), HW(8a01), CHIPID(7628))
[   37.100000] e2.bin mt7628_init(1166)::(2), pChipCap->fw_len(63888)
[   37.100000] mt_bcn_buf_init(218): Not support for HIF_MT yet!
[   37.110000] <--mt7628_init()
[   37.140000] TX_BCN DESC a15f6000 size = 320
[   37.150000] RX[0] DESC a15f9000 size = 1024
[   37.150000] RX[1] DESC a15fa000 size = 1024
[   37.240000] E2pAccessMode=0
[   37.240000] cfg_mode=9
[   37.240000] cfg_mode=9
[   37.240000] wmode_band_equal(): Band Equal!
[   37.250000] AndesSendCmdMsg: Could not send in band command due to diable fRTMP_ADAPTER_MCU_SEND_IN_BAND_CMD
[   37.260000] APSDCapable[0]=1
[   37.260000] APSDCapable[1]=1
[   37.270000] APSDCapable[2]=1
[   37.270000] APSDCapable[3]=1
[   37.270000] APSDCapable[4]=1
[   37.280000] APSDCapable[5]=1
[   37.280000] APSDCapable[6]=1
[   37.280000] APSDCapable[7]=1
[   37.280000] APSDCapable[8]=1
[   37.290000] APSDCapable[9]=1
[   37.290000] APSDCapable[10]=1
[   37.290000] APSDCapable[11]=1
[   37.300000] APSDCapable[12]=1
[   37.300000] APSDCapable[13]=1
[   37.300000] APSDCapable[14]=1
[   37.310000] APSDCapable[15]=1
[   37.310000] default ApCliAPSDCapable[0]=1
[   37.510000] Key1Str is Invalid key length(0) or Type(1)
[   37.520000] Key2Str is Invalid key length(0) or Type(1)
[   37.530000] Key3Str is Invalid key length(0) or Type(1)
[   37.530000] Key4Str is Invalid key length(0) or Type(1)
[   37.570000] RTMPSetDefaultChannel() : default channel to 1 
[   37.570000] load fw image from fw_header_image
[   37.580000] AndesMTLoadFwMethod1(2190)::pChipCap->fw_len(63888)
[   37.580000] FW Version:20151201
[   37.590000] FW Build Date:20151201183641
[   37.610000] CmdAddressLenReq:(ret = 0)
[   37.610000] CmdFwStartReq: override = 1, address = 1048576
[   37.620000] CmdStartDLRsp: WiFI FW Download Success
[   37.620000] MtAsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
[   37.630000] efuse_probe: efuse = 10000002
[   37.630000] RtmpChipOpsEepromHook::e2p_type=0, inf_Type=4
[   37.640000] RtmpEepromGetDefault::e2p_dafault=2
[   37.640000] RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2
[   37.650000] NVM is FLASH mode
[   37.650000] 1. Phy Mode = 14
[   37.840000] Country Region from e2p = ffff
[   37.840000] tssi_1_target_pwr_g_band = 32
[   37.850000] 2. Phy Mode = 14
[   37.850000] 3. Phy Mode = 14
[   37.850000] NICInitPwrPinCfg(11): Not support for HIF_MT yet!
[   37.860000] NICInitializeAsic(651): Not support rtmp_mac_sys_reset () for HIF_MT yet!
[   37.870000] mt_mac_init()-->
[   37.870000] MtAsicInitMac()-->
[   37.880000] mt7628_init_mac_cr()-->
[   37.880000] MtAsicSetMacMaxLen(1281): Set the Max RxPktLen=1024!
[   37.880000] <--mt_mac_init()
[   37.890000] 	WTBL Segment 1 info:
[   37.890000] 		MemBaseAddr/FID:0x28000/0
[   37.900000] 		EntrySize/Cnt:32/128
[   37.900000] 	WTBL Segment 2 info:
[   37.900000] 		MemBaseAddr/FID:0x40000/0
[   37.910000] 		EntrySize/Cnt:64/128
[   37.910000] 	WTBL Segment 3 info:
[   37.910000] 		MemBaseAddr/FID:0x42000/64
[   37.920000] 		EntrySize/Cnt:64/128
[   37.920000] 	WTBL Segment 4 info:
[   37.920000] 		MemBaseAddr/FID:0x44000/128
[   37.930000] 		EntrySize/Cnt:32/128
[   37.930000] AntCfgInit(2940): Not support for HIF_MT yet!
[   37.940000] MCS Set = ff ff 00 00 00
[   37.940000] MtAsicSetChBusyStat(866): Not support for HIF_MT yet!
[   38.520000] CmdSlotTimeSet:(ret = 0)
[   40.260000] [PMF]ap_pmf_init:: apidx=0, MFPC=0, MFPR=0, SHA256=0
[   40.260000] [PMF]RTMPMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
[   40.270000] MtAsicSetRalinkBurstMode(3052): Not support for HIF_MT yet!
[   40.270000] MtAsicSetPiggyBack(801): Not support for HIF_MT yet!
[   40.300000] reload DPD from flash , 0x9F = [c600] doReload bit7[0]
[   40.310000] CmdLoadDPDDataFromFlash: Channel = 7, DoReload = 0
[   40.320000] MtAsicSetTxPreamble(3031): Not support for HIF_MT yet!
[   40.330000] MtAsicAddSharedKeyEntry(1348): Not support for HIF_MT yet!
[   40.330000] The 2-BSSID mode is enabled, the BSSID byte5 MUST be the multiple of 2
[   40.340000] MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
[   40.350000] Main bssid = 20:0d:b0:d3:75:27
[   40.350000] <==== rt28xx_init, Status=0
[   40.360000] @@@ ed_monitor_exit : ===>
[   40.360000] @@@ ed_monitor_exit : <===
[   40.360000] mt7628_set_ed_cca: TURN OFF EDCCA  mac 0x10618 = 0xd7083f0f
[   40.370000] WiFi Startup Cost (ra0): 3.230s
[   41.000000] device ra0 entered promiscuous mode
[   41.010000] br-lan: port 3(ra0) entered forwarding state
[   41.010000] br-lan: port 3(ra0) entered forwarding state
[   43.010000] br-lan: port 3(ra0) entered forwarding state
[   57.590000] random: nonblocking pool is initialized
[  668.320000] nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead.
[  875.740000] update_associated_mac_entry(): Peer's PhyCap=>Mode:VHT, BW:80M
[  875.940000] AP SETKEYS DONE - WPA2, AuthMode(7)=WPA2PSK, WepStatus(6)=AES, GroupWepStatus(4)=TKIP
[  875.940000] 
[  876.270000] Rcv Wcid(1) AddBAReq
[  876.270000] Start Seq = 00000000
[  881.100000] Rcv Wcid(1) AddBAReq
[  881.100000] Start Seq = 00000002
[  883.290000] Rcv Wcid(1) AddBAReq
[  883.300000] Start Seq = 00000000
[  898.040000] 7d3, flush one!
root@COMFAST:~# 

Ok, thanks guys. Zenseeker, that is the method that i use to change the root password. My repeaters are Comfast not Joowin but are the same model with different brand. But the only thing to watch out for is the hardware version of the repeater. By example, i have one Comfast CF-WR758AC with version 1 and other with version 2. At the moment i don´t know what is the difference, i still have not been to play with the second.
By the way, what is your version Zenseeker?
I ask to the guys of Joowin for the firmware and they ask me for the hardware version to give me the correct firmware.
I will try to decrypt the root password with John The Ripper.
We will keep in touch.

To me it looked like same hardware with different branding. I am currently running CF-WR758AC-V2.3.0.1.bin on my Joowin device with no issues.

How did you confirm the model version? Btw, as I mentioned earlier, click on the "firmware" link in my first post. It will download the firmware from joowin site.

No need to waste time trying to decrypt root password. Instructions I provided will produce faster results without changing anything else.

I also want to mention that pressing and holding the lowest button while AP is booting will force to start openwrt recovery mode. You should be able to connect to 192.168.1.1 and upload the vendor firmware. I did direct ethernet connection from laptop to AP, manually configure IP address on laptop to 192.168.1.2 for this to work.