Adding support for Sercomm S1500 clones (Beeline SmartBox Pro, WiFire S1500.NBN)

This thread was created for discussions and posting information, on the way to official support routers for OpenWRT and full functionality.

Description:

These devices are manufactured by OEM/ODM SerComm Corporation. The production common name is Sercomm S1500:

Other

There is unconfirmed information about the existence:

General specification:

  • SoC Type: MediaTek MT7621AT (880 MHz, 2 cores)
  • Switch: MediaTek MT7530 (via SoC MT7621AT)
  • Ethernet: 5 ports - 5×GbE (WAN, LAN1-4)
  • Wireless 2.4 GHz (MT7602EN): b/g/n, 2x2
  • Wireless 5 GHz (MT7612EN): a/n/ac, 4x4
  • Mini PCIe (via J2 on PCB, Not soldered on the board)
  • BootLoader: U-Boot SerComm/Mediatek
  • PCB: AWI00E-1.6

Beeline SmartBox Pro specification:

  • RAM (Nanya NT5CB128M16FP): 256 MiB
  • NAND-Flash (ESMT F59L2G81A): 256 MiB
  • USB ports: 2xUSB2.0
  • Buttons: 2 button (RESET, WPS), 1 switch-button (ROUT<->REP)
  • Power: 12 VDC, 1.5 A
  • PCB Sticker: 970AWI0QW00N256SMT Ver. 1.0
  • CSN: SG15********
  • MAC LAN: 94:4A:0C:::**
  • Manufacturer's code: 0AWI0500QW1

WiFire S1500.NBN specification:

  • RAM (Nanya NT5CC64M16GP): 128 MiB
  • NAND-Flash (ESMT F59L1G81MA): 128 MiB
  • USB ports: 1xUSB2.0
  • Buttons: 2 button (RESET, WPS)
  • Power: 12 VDC, 1.0 A
  • PCB Sticker: 970BUC0RW00N128SMT Ver. 1.0
  • CSN: MH16********
  • WAN LAN: E0:60:66:::**
  • Manufacturer's code: 0BUC0500RW1

Looking for help:

Hide
S1500.NBN
  • Screenshot of the web interface showing the firmware version.
  • Startup log of the stock firmware (UART/SSH)
  • WiFire Stock Firmware File/URL
  • Backup of the mtd partitions of the stock firmware
    Confidential information can be sent to the PM.
Pro
  • If you have a UART adapter, NAND programmer and desire, we can try OpenWRT factory-image together. Write to me.
Related Topics:
Hide
SerComm S2
SerComm S3

P.S.: Can I get the rights to edit/add information to old messages? So that I can do it in a structured way.

P.S.S.: For active communication in Russian

Mainly in the SmartBox Giga Telegram, indicate the device hashtag in the message:

  • #SmartBoxPro - Beeline SmartBox Pro
  • #S1500.NBN - WiFire S1500.NBN

OpenWRT RU.
OpenWRT RU Dev for developers.
SmartBOX Pro / SmartBOX Turbo+ – обсуждение | [wifirouter] : 300Mb\s - 1200Mb\s + 5x1Gb | x1

1 Like

Blank message to link to Wiki.

Pull Request - Beeline SmartBox Pro

Photo Beeline SmartBox Pro

145457f2-f3e2-40b8-8c72-4e4e7682e6ee 8e039db1-ff50-4beb-8fa5-aec7f9875036
f97e4101-3995-45b6-8826-f39aa3e1d6cc e117c318-1d94-43c7-9a89-d8407486b7b7
b72e723d-b47c-4c04-b039-47085014d608 22bc5f87-ccd9-426a-a917-5eea9ee85a9c

URLs

Real Photo

From bulletin boards



URLs
1 Like

Photo WiFire S1500.NBN

router_S1500

URLs

Real Photo

From bulletin boards




URLs
1 Like

Photo PCB Beeline SmartBox Pro

Thanks to APToni [1] [2].

  • AWI00E-1.6

Ver. 1.0

Ver. Q

1 Like

Photo PCB WiFire S1500.NBN

Thanks to serj-47 [1] [2].

  • AWI00E-1.6

Ver.1.0

1 Like

Image's OEM Stock FirmWare for Beeline SmartBox Pro

Emulator of the web interface

Notification of the Eurasian Economic Union
URLs:

Repository for ongoing development and testing

1 Like

OEM layout Beeline SmartBox Pro:

MTD Start Adress Size Partition MiB OEM Label
mtd0 0x0 0xff80000 255,5 ALL
mtd1 0x0 0x100000 1 Bootloader
mtd2 0x100000 0x100000 1 Factory
mtd3 0x200000 0x1400000 20 sys_data
mtd4 0x1600000 0x100000 1 boot_flag
mtd5 0x1700000 0x400000 4 Kernel_1
mtd6 0x1b00000 0x400000 4 Kernel_2
mtd7 0x1f00000 0x1E00000 30 RootFS_1
mtd8 0x3d00000 0x1E00000 30 RootFS_2
mtd9 0x5b00000 0x3200000 50 JVM/OSGI1
mtd10 0x8d00000 0x3200000 50 JVM/OSGI2
mtd11 0xbf00000 0x3C00000 60 OSGI data
mtd12 0xfb00000 0x100000 1 Ftool
Part BootLog
# MTK NAND # : Use HW ECC
NAND ID [C8 DA 90 95 44, 00909544]
Device not found, ID: c8da
Not Support this Device!  chip_mode=00000001
[NAND] pagesz:2048 , oobsz: 288,eccbytes: 32
Support this Device in MTK table! c8da  NAND device: Manufacturer ID: 0xc8, Chip ID: 0xda (Unknown NAND 256MiB 3,3V 8-bit)
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
...
Creating 13 MTD partitions on "MT7621-NAND":
0x000000000000-0x00000ff80000 : "ALL"
0x000000000000-0x000000100000 : "Bootloader"
0x000000100000-0x000000200000 : "Factory"
0x000000200000-0x000001600000 : "sys_data"
0x000001600000-0x000001700000 : "boot_flag"
0x000001700000-0x000001b00000 : "Kernel_1"
0x000001b00000-0x000001f00000 : "Kernel_2"
0x000001f00000-0x000003d00000 : "RootFS_1"
0x000003d00000-0x000005b00000 : "RootFS_2"
0x000005b00000-0x000008d00000 : "JVM/OSGI1"
0x000008d00000-0x00000bf00000 : "JVM/OSGI2"
0x00000bf00000-0x00000fb00000 : "OSGI data"
0x00000fb00000-0x00000fc00000 : "Ftool"
[mtk_nand] probe successfully!
URLs
1 Like

OEM layout factory image Beeline SmartBox Pro:

Start Adress Size Partition Label
1 0x0 0x200 Tag Header Factory
2 0x200 0x100 Tag Header Kernel Slot1
3 0x300 0x100 Tag Header Kernel Slot2
4 0x400 SIZE_KERNEL Kernel
5 0x400+ SIZE_KERNEL SIZE_ROOTFS RootFS(UBI)
6 0x400+ SIZE_KERNEL+ SIZE_ROOTFS 0x10 Tag Footprint
Tag Footprint
❯ hexdump -s $((0x164722e)) -C SmartboxPro2015.img
0164722e  11 22 33 44 55 66 77 88  99 00 11 22 33 44 55 66  |."3DUfw...."3DUf|
❯ binwalk SmartboxPro2015.img

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
1024          0x400           uImage header, header size: 64 bytes, header CRC: 0x373D87ED, created: 2016-01-08 07:52:23, image size: 2518510 bytes, Data Address: 0x80001000, Entry Point: 0x8000F500, data CRC: 0xE9A294A2, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
1088          0x440           LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 7486272 bytes
2519598       0x26722E        UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x800, data offset: 0x1000
URLs
1 Like

Tag Header Factory - factory image - Beeline SmartBox Pro:

❯ hexdump -C -n $((0x200)) SmartboxPro2015.img
00000000  30 30 30 31 30 30 30 30  34 31 35 37 34 39 30 30  |0001000041574900|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000060  30 30 30 30 32 30 31 35  30 30 30 30 30 30 30 30  |0000201500000000|
00000070  32 35 31 38 35 37 34 00  00 00 00 00 00 00 00 00  |2518574.........|
00000080  32 30 38 34 30 34 34 38  00 00 00 00 00 00 00 00  |20840448........|
00000090  31 36 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |16..............|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001e0  39 34 33 34 33 30 63 35  37 38 66 37 33 30 37 37  |943430c578f73077|
000001f0  64 65 61 66 38 31 63 33  38 61 65 30 36 65 32 63  |deaf81c38ae06e2c|
00000200
Start Size Value (ASCII) Description
0x0 0x4 1 Hardware version?
0x8 0x8 415749 Hardware ID?
0x64 0x4 2015 Software version
0x70 0x10 2518574 Size Kernel
0x80 0x10 20840448 Size RootFS
0x90 0x10 16 Size footprint tag
0x1e0 0x20 943430c578f73077deaf81c38ae06e2c MD5(kernel+rootfs+footprint)

Thanks for the help @csharper2005

1 Like

Tag Header Kernel - factory image - Beeline SmartBox Pro:

Start Size Value(HEX) Value Description
0x0 0x4 53657200 Ser(ASCII) Signature Sercomm*
0x4 0x4 2e6f9601 01966f2e(LE) Start address Kernel + Size Kernel
0x8 0x4 002031e2 CRC32 Tag Header Kernel*
0xC 0x4 02ffffff Constant (Number of slots?)
0x10 0x4 00017001 01700100(LE) Start address Kernel (0x1700100 - Slot1)
0x14 0x4 2e6e2600 00266e2e(LE) Size Kernel (HEX)
0x18 0x4 639d177c CRC32 Kernel
0x1c 0x4 00000000 Zeros
0x20 0x4 ffffffff 0xFFFFFFFF
0x24 0x4 ffffffff 0xFFFFFFFF
0x28 0x4 0000f001 01f00000(LE) Start address RootFS (0x1f00000 - Slot1)
0x2c 0x4 00003e01 013e0000(LE) Size RootFS (HEX)
0x30 0x4 7ca3482c CRC32 RootFS
0x34 0x4 00000000 Zeros
0x38 0x4 ffffffff 0xFFFFFFFF to end of file
  • * At the time of calculation, CRC32 Tag Header Kernel, Signature Sercomm (0x0) & CRC32 Tag Header Kernel (0x4) are filled with 0xFFFFFFFF.
  • LE - Little Endian

Tag Header Kernel for Slot 1

xxd -c 4 -s $((0x200)) -l $((0x100)) SmartboxPro2015.img

00000200: 5365 7200  Ser.
00000204: 2e6f 9601  .o..
00000208: 0020 31e2  . 1.
0000020c: 02ff ffff  ....
00000210: 0001 7001  ..p.
00000214: 2e6e 2600  .n&.
00000218: 639d 177c  c..|
0000021c: 0000 0000  ....
00000220: ffff ffff  ....
00000224: ffff ffff  ....
00000228: 0000 f001  ....
0000022c: 0000 3e01  ..>.
00000230: 7ca3 482c  |.H,
00000234: 0000 0000  ....
00000238: ffff ffff  ....
*
000002fc: ffff ffff  ....
hexdump -C -s $((0x200)) -n $((0x100)) SmartboxPro2015.img
00000200  53 65 72 00 2e 6f 96 01  00 20 31 e2 02 ff ff ff  |Ser..o... 1.....|
00000210  00 01 70 01 2e 6e 26 00  63 9d 17 7c 00 00 00 00  |..p..n&.c..|....|
00000220  ff ff ff ff ff ff ff ff  00 00 f0 01 00 00 3e 01  |..............>.|
00000230  7c a3 48 2c 00 00 00 00  ff ff ff ff ff ff ff ff  ||.H,............|
00000240  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00000300

Tag Header Kernel for Slot 2

xxd -c 4 -s $((0x300)) -l $((0x100)) SmartboxPro2015.img
00000300: 5365 7200  Ser.
00000304: 2e6f d601  .o..
00000308: faa9 c143  ...C
0000030c: 02ff ffff  ....
00000310: 0001 b001  ....
00000314: 2e6e 2600  .n&.
00000318: 639d 177c  c..|
0000031c: 0000 0000  ....
00000320: ffff ffff  ....
00000324: ffff ffff  ....
00000328: 0000 d003  ....
0000032c: 0000 3e01  ..>.
00000330: 7ca3 482c  |.H,
00000334: 0000 0000  ....
00000338: ffff ffff  ....
*
000003fc: ffff ffff  ....
hexdump -C -s $((0x300)) -n $((0x100)) SmartboxPro2015.img
00000300  53 65 72 00 2e 6f d6 01  fa a9 c1 43 02 ff ff ff  |Ser..o.....C....|
00000310  00 01 b0 01 2e 6e 26 00  63 9d 17 7c 00 00 00 00  |.....n&.c..|....|
00000320  ff ff ff ff ff ff ff ff  00 00 d0 03 00 00 3e 01  |..............>.|
00000330  7c a3 48 2c 00 00 00 00  ff ff ff ff ff ff ff ff  ||.H,............|
00000340  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00000400

Differences between slots

Slot Kernel RootFS
1 0x01700100 0x01f00000
2 0x01b00100 0x03d00000

Thanks for the help @kar200

Serial Console - UART - Beeline SmartBox Pro & WiFire S1500.NBN

[J4] on PCB - Baud rate 57600 8n1

  1. GND
  2. TX
  3. VCC (3.3V) - Don't connect
  4. RX

Снимок экрана_2021-11-05_23-10-46

URLs