Adding support for Sercomm S1500 clones (Beeline SmartBox PRO, WiFire S1500.NBN)

[MaxS0niX]

This thread was created for discussions and posting information, on the way to official support routers for OpenWRT and full functionality.

Description:

These devices are manufactured by OEM/ODM SerComm Corporation. The production common name is Sercomm S1500:

• ISP Beeline distributes SmartBox Pro.
• ISP WiFire (NetByNet, MegaFon) distributes S1500 NBN.

Other

There is unconfirmed information about the existence:

• S1500.ER (Er-Telecom, Dom.Ru)
• S1500.MGTS (MGTS, MTS)

General specification:

• SoC Type: MediaTek MT7621AT (880 MHz, 2 cores)
• Switch: MediaTek MT7530 (via SoC MT7621AT)
• Ethernet: 5 ports - 5×GbE (WAN, LAN1-4)
• Wireless 2.4 GHz (MT7602EN): b/g/n, 2x2
• Wireless 5 GHz (MT7612EN): a/n/ac, 2x2
• Mini PCIe (via J2 on PCB, Not soldered on the board)
• BootLoader: U-Boot SerComm/Mediatek
• PCB: AWI00E-1.6

Beeline SmartBox PRO specification:

• RAM (Nanya NT5CB128M16FP): 256 MiB
• NAND-Flash (ESMT F59L2G81A): 256 MiB
• USB ports: 2xUSB2.0
• Buttons: 2 button (RESET, WPS), 1 switch-button (ROUT<->REP)
• Power: 12 VDC, 1.5 A
• PCB Sticker: 970AWI0QW00N256SMT Ver. 1.0
• CSN: SG15********
• MAC LAN: 94:4A:0C:**:**:**
• Manufacturer's code: 0AWI0500QW1

WiFire S1500.NBN specification:

• RAM (Nanya NT5CC64M16GP): 128 MiB
• NAND-Flash (ESMT F59L1G81MA): 128 MiB
• USB ports: 1xUSB2.0
• Buttons: 2 button (RESET, WPS)
• Power: 12 VDC, 1.0 A
• PCB Sticker: 970BUC0RW00N128SMT Ver. 1.0
• CSN: MH16********
• MAC WAN: E0:60:66:**:**:**
• Manufacturer's code: 0BUC0500RW1

Related Topics:

Hide

SerComm S2

• Add support for Beeline SmartBox Giga

SerComm S3

• Add support for Sercomm S3 on stock uboot
• Add support for Beeline SmartBox TURBO+
• Beeline SmartBox TURBO

Status OpenWRT:

• PRO & NBN
  • Almost everything works
  • Wi-Fi modules not always initialized

P.S.: For active communication in Russian

Mainly in the SmartBox Giga Telegram, indicate the device hashtag in the message:

• #SmartBoxPro - Beeline SmartBox Pro
• #S1500.NBN - WiFire S1500.NBN

OpenWRT RU.
OpenWRT RU Dev for developers.
SmartBOX Pro / SmartBOX Turbo+ – обсуждение | [wifirouter] : 300Mb\s - 1200Mb\s + 5x1Gb | x1

[MaxS0niX]

Wiki OpenWRT for Sercomm S1500 clones

Beeline SmartBox PRO

https://openwrt.org/toh/beeline/smartbox_pro

WiFire S1500 NBN

[MaxS0niX]

Pull Request

ramips: Add support for Sercomm S1500 clones

[MaxS0niX]

Photo Beeline SmartBox PRO

URLs

• https://moskva.beeline.ru/shop/details/router-bilain-smart-box-pro-black/
• https://mirbeeline.ru/equipments/beeline-smartbox-pro#/opisanie
• Manual user - https://mirbeeline.ru/files/storage/smboxpro.pdf

Real Photo

From bulletin boards

URLs

• https://www.avito.ru/kaliningrad/tovary_dlya_kompyutera/router_bilayn_smartbox_pro_2206481259
• https://www.avito.ru/moskva/tovary_dlya_kompyutera/router_smartbox_pro_2125646923
• https://www.avito.ru/sankt-peterburg/tovary_dlya_kompyutera/router_smartbox_pro_2011492473

[MaxS0niX]

Photo WiFire S1500.NBN

URLs

• https://www.wifire.ru/blog/router-wifire-s1500-nbn
• https://www.wifire.ru/blog/tehnologiya-ethernet

Real Photo

From bulletin boards

URLs

• https://www.avito.ru/moskva/tovary_dlya_kompyutera/wifi_router_s1500.nbn_2223022203
• https://www.avito.ru/moskva/tovary_dlya_kompyutera/besprovodnoy_marshrutizator_wifire_s1500_nbn_1508407838
• https://www.avito.ru/irkutsk/tovary_dlya_kompyutera/router_wifire_s1500_gigabit_24ghz_5ghz_2192413441

[MaxS0niX]

Photo PCB Beeline SmartBox PRO

Thanks to APToni [1] [2].

• AWI00E-1.6

Ver. 1.0

Ver. Q

[MaxS0niX]

Photo PCB WiFire S1500.NBN

Thanks to serj-47 [1] [2].

• AWI00E-1.6

Ver.1.0

[MaxS0niX]

Image's OEM Stock FirmWare

Beeline SmartBox PRO

• v. 2.0.11 - (build @ 2014-11-14, 09:38:48) - No link
• v. 2.0.12 - (build @ 2014-12-09, 11:09:35) - WebArchive
• v. 2.0.15 - (build @ 2016-01-08, 16:12:45) - WebArchive
• v. 2.0.19 - (build @ 2017-11-13, 10:58:05)

Emulator of the web interface PRO

• v. 2.0.11 - SuperUser
• v. 2.0.11 - admin

WiFire S1500.NBN

• v. 2.0.12 - (build @ 2016-04-26, 23:18:10) - transfer.sh, t.me, mega.nz
• v. 2.0.14 - (build @ 2017-03-17, 13:15:30) - No link

Notification of the Eurasian Economic Union

• RU0000022101 - Беспроводные роутеры торговой марки «SERCOMM», модели: S1500.ER, S1500.NBN, S1010.ER, S1010.NBN
• https://portal.eaeunion.org/odata/1135

URLs:

• Thanks to Silver63rus
• http://routers.nvbs.ru/
• http://routers.nvbs.ru/beeline/smart.html
• https://moskva.beeline.ru/customers/pomosh/home/domashnij-internet/nastrojki-s-routerom/beelinesmartboxpro-weblogin/
• https://homenet.beeline.ru/index.php?/topic/321775-билайн-smart-box-pro-новая-модель/&page=10
• https://web.archive.org/web/20150905123744/http://moskva.beeline.ru:80/customers/products/home/home-tariffs/equipment/bilayn-smart-box-pro/

[MaxS0niX]

Repository for ongoing development and testing

OpenWRT Dev RU SmartBox / OpenWRT MT7621 SerComm SmartBox

• Branch - sercomm_s1500

[MaxS0niX]

OEM layout Beeline SmartBox PRO:

MTD	Start Adress	Size Partition	MiB	OEM Label
mtd0	0x0	0xff80000	255,5	ALL
mtd1	0x0	0x100000	1	Bootloader
mtd2	0x100000	0x100000	1	Factory
mtd3	0x200000	0x1400000	20	sys_data
mtd4	0x1600000	0x100000	1	boot_flag
mtd5	0x1700000	0x400000	4	Kernel_1
mtd6	0x1b00000	0x400000	4	Kernel_2
mtd7	0x1f00000	0x1E00000	30	RootFS_1
mtd8	0x3d00000	0x1E00000	30	RootFS_2
mtd9	0x5b00000	0x3200000	50	JVM/OSGI1
mtd10	0x8d00000	0x3200000	50	JVM/OSGI2
mtd11	0xbf00000	0x3C00000	60	OSGI data
mtd12	0xfb00000	0x100000	1	Ftool

Part BootLog

# MTK NAND # : Use HW ECC
NAND ID [C8 DA 90 95 44, 00909544]
Device not found, ID: c8da
Not Support this Device!  chip_mode=00000001
[NAND] pagesz:2048 , oobsz: 288,eccbytes: 32
Support this Device in MTK table! c8da  NAND device: Manufacturer ID: 0xc8, Chip ID: 0xda (Unknown NAND 256MiB 3,3V 8-bit)
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
...
Creating 13 MTD partitions on "MT7621-NAND":
0x000000000000-0x00000ff80000 : "ALL"
0x000000000000-0x000000100000 : "Bootloader"
0x000000100000-0x000000200000 : "Factory"
0x000000200000-0x000001600000 : "sys_data"
0x000001600000-0x000001700000 : "boot_flag"
0x000001700000-0x000001b00000 : "Kernel_1"
0x000001b00000-0x000001f00000 : "Kernel_2"
0x000001f00000-0x000003d00000 : "RootFS_1"
0x000003d00000-0x000005b00000 : "RootFS_2"
0x000005b00000-0x000008d00000 : "JVM/OSGI1"
0x000008d00000-0x00000bf00000 : "JVM/OSGI2"
0x00000bf00000-0x00000fb00000 : "OSGI data"
0x00000fb00000-0x00000fc00000 : "Ftool"
[mtk_nand] probe successfully!

URLs

• Thanks to Zepete - BootLog

[MaxS0niX]

OEM layout factory image Beeline SmartBox Pro:

	Start Adress	Size Partition	Label
1	0x0	0x200	Tag Header Factory
2	0x200	0x100	Tag Header Kernel Slot1
3	0x300	0x100	Tag Header Kernel Slot2
4	0x400	SIZE_KERNEL	Kernel
5	0x400+ SIZE_KERNEL	SIZE_ROOTFS	RootFS(UBI)
6	0x400+ SIZE_KERNEL+ SIZE_ROOTFS	0x10	Tag Footprint

Tag Footprint

❯ hexdump -s $((0x164722e)) -C SmartboxPro2015.img
0164722e  11 22 33 44 55 66 77 88  99 00 11 22 33 44 55 66  |."3DUfw...."3DUf|

❯ binwalk SmartboxPro2015.img

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
1024          0x400           uImage header, header size: 64 bytes, header CRC: 0x373D87ED, created: 2016-01-08 07:52:23, image size: 2518510 bytes, Data Address: 0x80001000, Entry Point: 0x8000F500, data CRC: 0xE9A294A2, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
1088          0x440           LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 7486272 bytes
2519598       0x26722E        UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x800, data offset: 0x1000

@MaxS0niX

• v.2.0.15
• v.2.0.19

URLs

• The table was generated using "Tables Generator " in the markdown.

[MaxS0niX]

Tag Header Factory - factory image - Beeline SmartBox Pro:

❯ hexdump -C -n $((0x200)) SmartboxPro2015.img
00000000  30 30 30 31 30 30 30 30  34 31 35 37 34 39 30 30  |0001000041574900|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000060  30 30 30 30 32 30 31 35  30 30 30 30 30 30 30 30  |0000201500000000|
00000070  32 35 31 38 35 37 34 00  00 00 00 00 00 00 00 00  |2518574.........|
00000080  32 30 38 34 30 34 34 38  00 00 00 00 00 00 00 00  |20840448........|
00000090  31 36 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |16..............|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001e0  39 34 33 34 33 30 63 35  37 38 66 37 33 30 37 37  |943430c578f73077|
000001f0  64 65 61 66 38 31 63 33  38 61 65 30 36 65 32 63  |deaf81c38ae06e2c|
00000200

Start	Size	Value (ASCII)	Description
0x0	0x4	1	Hardware version?
0x8	0x8	415749 (->AWI in ASCII)	Hardware ID
0x64	0x4	2015	Software version
0x70	0x10	2518574	Size Kernel
0x80	0x10	20840448	Size RootFS
0x90	0x10	16	Size footprint tag
0x1e0	0x20	943430c578f73077deaf81c38ae06e2c	MD5(kernel+rootfs+footprint)

Thanks for the help @csharper2005

[MaxS0niX]

Tag Header Kernel - factory image - Beeline SmartBox Pro:

Start	Size	Value(HEX)	Value	Description
0x0	0x4	53657200	Ser(ASCII)	Signature Sercomm*
0x4	0x4	2e6f9601	01966f2e(LE)	Start address Kernel + Size Kernel
0x8	0x4	002031e2		CRC32 Tag Header Kernel*
0xC	0x4	02ffffff		Constant (Number of slots?)
0x10	0x4	00017001	01700100(LE)	Start address Kernel (0x1700100 - Slot1)
0x14	0x4	2e6e2600	00266e2e(LE)	Size Kernel (HEX)
0x18	0x4	639d177c		CRC32 Kernel
0x1c	0x4	00000000		Zeros
0x20	0x4	ffffffff		0xFFFFFFFF
0x24	0x4	ffffffff		0xFFFFFFFF
0x28	0x4	0000f001	01f00000(LE)	Start address RootFS (0x1f00000 - Slot1)
0x2c	0x4	00003e01	013e0000(LE)	Size RootFS (HEX)
0x30	0x4	7ca3482c		CRC32 RootFS
0x34	0x4	00000000		Zeros
0x38	0x4	ffffffff		0xFFFFFFFF to end of file

• * At the time of calculation, CRC32 Tag Header Kernel, Signature Sercomm (0x0) & CRC32 Tag Header Kernel (0x4) are filled with 0xFFFFFFFF.
• LE - Little Endian

Tag Header Kernel for Slot 1

xxd -c 4 -s $((0x200)) -l $((0x100)) SmartboxPro2015.img

00000200: 5365 7200  Ser.
00000204: 2e6f 9601  .o..
00000208: 0020 31e2  . 1.
0000020c: 02ff ffff  ....
00000210: 0001 7001  ..p.
00000214: 2e6e 2600  .n&.
00000218: 639d 177c  c..|
0000021c: 0000 0000  ....
00000220: ffff ffff  ....
00000224: ffff ffff  ....
00000228: 0000 f001  ....
0000022c: 0000 3e01  ..>.
00000230: 7ca3 482c  |.H,
00000234: 0000 0000  ....
00000238: ffff ffff  ....
*
000002fc: ffff ffff  ....

hexdump -C -s $((0x200)) -n $((0x100)) SmartboxPro2015.img

00000200  53 65 72 00 2e 6f 96 01  00 20 31 e2 02 ff ff ff  |Ser..o... 1.....|
00000210  00 01 70 01 2e 6e 26 00  63 9d 17 7c 00 00 00 00  |..p..n&.c..|....|
00000220  ff ff ff ff ff ff ff ff  00 00 f0 01 00 00 3e 01  |..............>.|
00000230  7c a3 48 2c 00 00 00 00  ff ff ff ff ff ff ff ff  ||.H,............|
00000240  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00000300

Tag Header Kernel for Slot 2

xxd -c 4 -s $((0x300)) -l $((0x100)) SmartboxPro2015.img

00000300: 5365 7200  Ser.
00000304: 2e6f d601  .o..
00000308: faa9 c143  ...C
0000030c: 02ff ffff  ....
00000310: 0001 b001  ....
00000314: 2e6e 2600  .n&.
00000318: 639d 177c  c..|
0000031c: 0000 0000  ....
00000320: ffff ffff  ....
00000324: ffff ffff  ....
00000328: 0000 d003  ....
0000032c: 0000 3e01  ..>.
00000330: 7ca3 482c  |.H,
00000334: 0000 0000  ....
00000338: ffff ffff  ....
*
000003fc: ffff ffff  ....

hexdump -C -s $((0x300)) -n $((0x100)) SmartboxPro2015.img

00000300  53 65 72 00 2e 6f d6 01  fa a9 c1 43 02 ff ff ff  |Ser..o.....C....|
00000310  00 01 b0 01 2e 6e 26 00  63 9d 17 7c 00 00 00 00  |.....n&.c..|....|
00000320  ff ff ff ff ff ff ff ff  00 00 d0 03 00 00 3e 01  |..............>.|
00000330  7c a3 48 2c 00 00 00 00  ff ff ff ff ff ff ff ff  ||.H,............|
00000340  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00000400

Differences between slots

Slot	Kernel	RootFS
1	0x01700100	0x01f00000
2	0x01b00100	0x03d00000
Add support for Sercomm S3 on stock uboot - #11 by kar200

Thanks for the help @kar200

[MaxS0niX]

Serial Console - UART - Beeline SmartBox Pro & WiFire S1500.NBN

[J4] on PCB - Baud rate 57600 8n1

1. GND
2. TX
3. VCC (3.3V) - Don't connect
4. RX

URLs

• https://zepete.livejournal.com/129317.html

[MaxS0niX]

Layout factory-data (Factory, RF-EEPROM) - mtd2 - SmartBox PRO

Name	Length	Offset1	Offset2	Offset3	Offset4	Offset5
calibration 2.4 GHz	0x200	0x0	0x20000	0x30850
calibration 5 GHz	0x200	0x8000	0x28000	0x38850
MAC (LAN, label)	0x6	0x1000	0x21000	0x31850	0x10758	0x30758
CSN	0xC	0x1010	0x21010	0x31860	0x1075F	0x3075F
Domain ID?	0x4	0x1050	0x21050	0x318A0	0x1079B	0x3079B
PCBASN	0xC	0x1060	0x21060	0x318B0
SSID (WiFi 2.4 GHz)	0x11	0x1080	0x21080	0x318D0	0x107AD	0x307B0
Passphrase (Wi-Fi)	0xA	0x10a0	0x210A0	0x318F0	0x107C0	0x307C0

MAC addresses PRO as verified by OEM firmware:

use	address	source
LAN	*:23	factory 0x21000 (label)
WAN	*:24	factory $label +1
2g	*:23	factory $label
5g	*:25	factory $label +2

Layout factory-data (Factory, RF-EEPROM) - S1500.NBN

Name	Length	Offset1	Offset2
calibration 2.4 GHz	0x200	0x0	0x10000
calibration 5 GHz	0x200	0x8000	0x18000
MAC (LAN, label-1)	0x6	0x1000	0x11000
CSN	0xC	0x1010	0x11010
PCBASN	0xC	0x1060	0x11060
SSID (WiFi 2.4 GHz)	0x11	0x1080
Passphrase (Wi-Fi)	0xA	0x10A0
Passphrase (admin)	0xA	0x10E0

MAC addresses NBN as verified by OEM firmware:

use	address	source
LAN	*:0e	factory 0x1000
WAN	*:0f	LAN +1 (label)
2g	*:0f	LAN +1
5g	*:10	LAN +2

URL

Device Support: MAC address setup

[MaxS0niX]

Bootstrapping Pins

CHIP_MODE[3:0]

Default Mode 1 - Boot from ROM (NAND page 2k+64 bytes)
1 = 0001

#	0 - GND		1 - VCC	Pin Name
3*	R155	<-	R154	*
2*	R151	<-	R150	*
1	R157	<-	R156	TXD1
0	R136	->	R145	GPIO#0

*Either RTS2_N or RTS3_N

Description from MT7621 DATASHEET

A vector to set chip function/debug/ATPG/FT modes

	Mode	Note
0	N/A
1	Normal	Boot from ROM (NAND page 2k+64 bytes)
2	Normal	Boot from SPI 3-byte address
3	Normal	Boot from SPI 4-byte address
4	iNIC RGMII	Boot from ROM
5	iNIC MII	Boot from ROM
6	iNIC RVMII	Boot from ROM
7	iNIC PHY	Boot from ROM
8	N/A
9	Normal	Boot from internal SRAM
10	Normal	Boot from ROM (NAND page 2k+128 bytes)
11	Normal	Boot from ROM (NAND page 4k+128 bytes)
12	Normal	Boot from ROM (NAND page 4k+224 bytes)
13	Debug
14	ATPG	Scan test
15	FT	Final test

Example SPI - Boot from SPI 3-byte address

2 = 0010
R155<-R154
R151<-R150
R157->R156 - TXD1
R136<-R145 - GPIO#0

Example eJTAG - Debug

13 = 1101
R155->R154
R151->R150
R157<-R156 - TXD1
R136->R145 - GPIO#0

URLs

• MT7621 DATASHEET, p.21
• https://mysku.ru/blog/diy/65019.html
• https://4pda.to/forum/index.php?s=&showtopic=943587&view=findpost&p=93741458
• https://gitlab.com/openwrt-dev-ru-smartbox/openwrt-mt7621-sercomm-smartbox/-/issues/6

[MaxS0niX]

@MaxS0niX

|Start|Size|Value (ASCII)|Description|

|0x0|0x4|1|Hardware version?|
|0x8|0x8|415749 (->AWI in ASCII)|Hardware ID|
|0x64|0x4|2015|Software version|

Sercomm PID descriptions

	Label	HWVER	?str0x4	HWID*	?str0x10	SWVER
	Start adress	0x0	0x4	0x8	0x10	0x64
	Size	0x4	0x4	0x8	0x4	0x4
PRO S1500 AWI	Value	0001	0000	41574900	0000	2012
	Description	1	0	AWI	0	v.2.0.12
NBN S1500 BUC	Value	0001	0000	42554300	0001	2012
	Description	1	0	BUC	1	v.2.0.12
TURBO+ S3 CQR	Value	0001	0000	43515200	0000	1010
	Description	1	0	CQR	0	v.1.0.10
GIGA S2 DBE	Value	0001	0100	44424500	0000	1002
	Description	1	100	DBE	0	v.1.0.02
S3 S3 DDK	Value	0001	0000	44444B00	0000	2005
	Description	1	0	DDK	0	v.2.0.05
TURBO S3 DF3	Value	0001	0200	44463300	0000	1003
	Description	1	200	DF3	0	v.1.0.03
Used as a signature in the factory firmware and is in the stock firmware /etc/pid

Example:

Beeline SmartBox PRO FW v.2.0.12

# hexdump -C /etc/pid
00000000  30 30 30 31 30 30 30 30  34 31 35 37 34 39 30 30  |0001000041574900|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
00000020  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
00000030  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
00000040  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
00000050  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
00000060  30 30 30 30 32 30 31 32  30 30 30 30 30 30 30 30  |0000201200000000|
00000070  0a                                                |.|
# cat /etc/pid
0001000041574900000000000000000000000000000000000000000000000000000000000000000000000000000000000000201200000000

Beeline SmartBox PRO FW v.2.0.19

# hexdump -C /etc/pid
00000000  30 30 30 31 30 30 30 30  34 31 35 37 34 39 30 30  |0001000041574900|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000060  30 30 30 30 32 30 31 39  30 30 30 30 30 30 30 30  |0000201900000000|
00000070  0a                                                |.|

WiFire S1500.NBN FW v.2.0.12

# hexdump -C /etc/pid
00000000  30 30 30 31 30 30 30 30  34 32 35 35 34 33 30 30  |0001000042554300|
00000010  30 30 30 31 30 30 30 30  30 30 30 30 30 30 30 30  |0001000000000000|
00000020  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000060  30 30 30 30 32 30 31 32  30 30 30 30 30 30 30 30  |0000201200000000|
00000070  0a                                                |.|

WiFire S1500.NBN FW v.2.0.14

# hexdump -C /etc/pid
00000000  30 30 30 31 30 30 30 30  34 32 35 35 34 33 30 30  |0001000042554300|
00000010  30 30 30 31 30 30 30 30  30 30 30 30 30 30 30 30  |0001000000000000|
00000020  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000060  30 30 30 30 32 30 31 34  30 30 30 30 30 30 30 30  |0000201400000000|
00000070  0a                                                |.|

Beeline SmartBox TURBO+ FW v.1.0.10

# hexdump -C /etc/pid
00000000  30 30 30 31 30 30 30 30  34 33 35 31 35 32 30 30  |0001000043515200|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000060  30 30 30 30 31 30 31 30  30 30 30 30 30 30 30 30  |0000101000000000|
00000070  0a                                                |.|

Beeline SmartBox TURBO+ FW v.2.0.06

# hexdump -C /etc/pid
00000000  30 30 30 31 30 30 30 30  34 33 35 31 35 32 30 30  |0001000043515200|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000060  30 30 30 30 32 30 30 36  30 30 30 30 30 30 30 30  |0000200600000000|
00000070  0a                                                |.|

Beeline SmartBox GIGA FW v.1.0.02

# hexdump -C /etc/pid
00000000  30 30 30 31 30 31 30 30  34 34 34 32 34 35 30 30  |0001010044424500|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000060  30 30 30 30 31 30 30 32  30 30 30 30 30 30 30 30  |0000100200000000|
00000070  0a                                                |.|

Beeline SmartBox GIGA FW v.1.0.05

# hexdump -C /etc/pid
00000000  30 30 30 31 30 31 30 30  34 34 34 32 34 35 30 30  |0001010044424500|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000060  30 30 30 30 31 30 30 35  30 30 30 30 30 30 30 30  |0000100500000000|
00000070  0a                                                |.|

Etisalat Sercomm S3 FW v.2.0.05

# hexdump -C /etc/pid
00000000  30 30 30 31 30 30 30 30  34 34 34 34 34 42 30 30  |0001000044444B00|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000060  30 30 30 30 32 30 30 35  30 30 30 30 30 30 30 30  |0000200500000000|
00000070  0a                                                |.|

Etisalat Sercomm S3 FW v.3.0.04

# hexdump -C /etc/pid
00000000  30 30 30 31 30 30 30 30  34 34 34 34 34 42 30 30  |0001000044444B00|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000060  30 30 30 30 33 30 30 34  30 30 30 30 30 30 30 30  |0000300400000000|
00000070  0a                                                |.|

Beeline SmartBox TURBO FW v.1.0.03

# hexdump -C /etc/pid
00000000  30 30 30 31 30 32 30 30  34 34 34 36 33 33 30 30  |0001020044463300|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000060  30 30 30 30 31 30 30 33  30 30 30 30 30 30 30 30  |0000100300000000|
00000070  0a                                                |.|

* HWID -> ASCII -> ASCII

❯ printf 435152 | sed 's/../\\x&/g' | xargs -d . printf | hexdump -C
00000000  43 51 52                                          |CQR|

[csharper2005]

A few sercomm-recovery images for WiFire S1500.NBN:

recovery_wifire-s1500.nbn_1st-v2.0.12_2nd-v2.0.14.bin:
	- Slot1: 
		S1500-v2.0.12
	- Slot2 (default):
		S1500-v2.0.14

recovery_wifire-s1500.nbn_1st-owrt-snapshot-5.15_2nd-v2.0.14.bin:
	- Slot1 (default):
		* OpenWrt SNAPSHOT r19537+73-c283defa88
			LuCI Master git-22.126.42175-8583efb
			Kernel Version: 5.15.35
		* For breed lovers: the mtd-rw module is present, so you can play your favorite games :) (squeeze a "rooter", "padavan", fight against the bad blocks, etc.)
		* Switch to Slot2 from OpenWrt:
			printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock4
	- Slot2: 
		S1500-v2.0.14

[MaxS0niX]

For which device do you expect support to be added to OpenWRT?

• Sercomm S1500 AWI - Beeline SmartBox PRO
• Sercomm S1500 BUC - WiFire S1500.NBN

[slh]

You are missing the most obvious choise, neither.

Someone will have to do the hands-on development - if no one does the work, there won't be any kind of support for either.