This thread was created for discussions and posting information, on the way to official support routers for OpenWRT and full functionality.
Description:
These devices are manufactured by OEM/ODM SerComm Corporation. The production common name is Sercomm S1500:
Other
There is unconfirmed information about the existence:
General specification:
SoC Type: MediaTek MT7621AT (880 MHz, 2 cores)
Switch: MediaTek MT7530 (via SoC MT7621AT)
Ethernet: 5 ports - 5×GbE (WAN, LAN1-4)
Wireless 2.4 GHz (MT7602EN): b/g/n, 2x2
Wireless 5 GHz (MT7612EN): a/n/ac, 2x2
Mini PCIe (via J2 on PCB, Not soldered on the board)
BootLoader: U-Boot SerComm/Mediatek
PCB: AWI00E-1.6
RAM (Nanya NT5CB128M16FP): 256 MiB
NAND-Flash (ESMT F59L2G81A): 256 MiB
USB ports: 2xUSB2.0
Buttons: 2 button (RESET, WPS), 1 switch-button (ROUT<->REP)
Power: 12 VDC, 1.5 A
PCB Sticker: 970AWI0QW00N256SMT Ver. 1.0
CSN: SG15********
MAC LAN: 94:4A:0C:**:**:**
Manufacturer's code: 0AWI0500QW1
WiFire S1500.NBN specification:
RAM (Nanya NT5CC64M16GP): 128 MiB
NAND-Flash (ESMT F59L1G81MA): 128 MiB
USB ports: 1xUSB2.0
Buttons: 2 button (RESET, WPS)
Power: 12 VDC, 1.0 A
PCB Sticker: 970BUC0RW00N128SMT Ver. 1.0
CSN: MH16********
MAC WAN: E0:60:66:**:**:**
Manufacturer's code: 0BUC0500RW1
Related Topics:
Hide
SerComm S2
SerComm S3
Status OpenWRT:
PRO & NBN
Almost everything works
Wi-Fi modules not always initialized
P.S.: For active communication in Russian
Mainly in the SmartBox Giga Telegram, indicate the device hashtag in the message:
#SmartBoxPro - Beeline SmartBox Pro
#S1500 .NBN - WiFire S1500.NBN
OpenWRT RU .
OpenWRT RU Dev for developers.
SmartBOX Pro / SmartBOX Turbo+ – обсуждение | [wifirouter] : 300Mb\s - 1200Mb\s + 5x1Gb | x1
2 Likes
Photo PCB Beeline SmartBox PRO
Thanks to APToni [1] [2] .
Ver. 1.0
Ver. Q
1 Like
Photo PCB WiFire S1500.NBN
Thanks to serj-47 [1] [2] .
Ver.1.0
1 Like
OEM layout factory image Beeline SmartBox Pro:
Start Adress
Size Partition
Label
1
0x0
0x200
Tag Header Factory
2
0x200
0x100
Tag Header Kernel Slot1
3
0x300
0x100
Tag Header Kernel Slot2
4
0x400
SIZE_KERNEL
Kernel
5
0x400+ SIZE_KERNEL
SIZE_ROOTFS
RootFS(UBI)
6
0x400+ SIZE_KERNEL+ SIZE_ROOTFS
0x10
Tag Footprint
Tag Footprint
❯ hexdump -s $((0x164722e)) -C SmartboxPro2015.img
0164722e 11 22 33 44 55 66 77 88 99 00 11 22 33 44 55 66 |."3DUfw...."3DUf|
❯ binwalk SmartboxPro2015.img
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
1024 0x400 uImage header, header size: 64 bytes, header CRC: 0x373D87ED, created: 2016-01-08 07:52:23, image size: 2518510 bytes, Data Address: 0x80001000, Entry Point: 0x8000F500, data CRC: 0xE9A294A2, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
1088 0x440 LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 7486272 bytes
2519598 0x26722E UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x800, data offset: 0x1000
MaxS0niX:
URLs
1 Like
Tag Header Factory - factory image - Beeline SmartBox Pro:
❯ hexdump -C -n $((0x200)) SmartboxPro2015.img
00000000 30 30 30 31 30 30 30 30 34 31 35 37 34 39 30 30 |0001000041574900|
00000010 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 |0000000000000000|
*
00000060 30 30 30 30 32 30 31 35 30 30 30 30 30 30 30 30 |0000201500000000|
00000070 32 35 31 38 35 37 34 00 00 00 00 00 00 00 00 00 |2518574.........|
00000080 32 30 38 34 30 34 34 38 00 00 00 00 00 00 00 00 |20840448........|
00000090 31 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |16..............|
000000a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
000001e0 39 34 33 34 33 30 63 35 37 38 66 37 33 30 37 37 |943430c578f73077|
000001f0 64 65 61 66 38 31 63 33 38 61 65 30 36 65 32 63 |deaf81c38ae06e2c|
00000200
Start
Size
Value (ASCII)
Description
0x0
0x4
1
Hardware version?
0x8
0x8
415749 (->AWI in ASCII)
Hardware ID
0x64
0x4
2015
Software version
0x70
0x10
2518574
Size Kernel
0x80
0x10
20840448
Size RootFS
0x90
0x10
16
Size footprint tag
0x1e0
0x20
943430c578f73077deaf81c38ae06e2c
MD5(kernel+rootfs+footprint)
1 Like
Tag Header Kernel - factory image - Beeline SmartBox Pro:
Start
Size
Value(HEX)
Value
Description
0x0
0x4
53657200
Ser(ASCII)
Signature Sercomm*
0x4
0x4
2e6f9601
01966f2e(LE)
Start address Kernel + Size Kernel
0x8
0x4
002031e2
CRC32 Tag Header Kernel*
0xC
0x4
02ffffff
Constant (Number of slots?)
0x10
0x4
00017001
01700100(LE)
Start address Kernel (0x1700100 - Slot1)
0x14
0x4
2e6e2600
00266e2e(LE)
Size Kernel (HEX)
0x18
0x4
639d177c
CRC32 Kernel
0x1c
0x4
00000000
Zeros
0x20
0x4
ffffffff
0xFFFFFFFF
0x24
0x4
ffffffff
0xFFFFFFFF
0x28
0x4
0000f001
01f00000(LE)
Start address RootFS (0x1f00000 - Slot1)
0x2c
0x4
00003e01
013e0000(LE)
Size RootFS (HEX)
0x30
0x4
7ca3482c
CRC32 RootFS
0x34
0x4
00000000
Zeros
0x38
0x4
ffffffff
0xFFFFFFFF to end of file
*
At the time of calculation, CRC32 Tag Header Kernel, Signature Sercomm (0x0) & CRC32 Tag Header Kernel (0x4) are filled with 0xFFFFFFFF.
LE - Little Endian
Tag Header Kernel for Slot 1
xxd -c 4 -s $((0x200)) -l $((0x100)) SmartboxPro2015.img
00000200: 5365 7200 Ser.
00000204: 2e6f 9601 .o..
00000208: 0020 31e2 . 1.
0000020c: 02ff ffff ....
00000210: 0001 7001 ..p.
00000214: 2e6e 2600 .n&.
00000218: 639d 177c c..|
0000021c: 0000 0000 ....
00000220: ffff ffff ....
00000224: ffff ffff ....
00000228: 0000 f001 ....
0000022c: 0000 3e01 ..>.
00000230: 7ca3 482c |.H,
00000234: 0000 0000 ....
00000238: ffff ffff ....
*
000002fc: ffff ffff ....
hexdump -C -s $((0x200)) -n $((0x100)) SmartboxPro2015.img
00000200 53 65 72 00 2e 6f 96 01 00 20 31 e2 02 ff ff ff |Ser..o... 1.....|
00000210 00 01 70 01 2e 6e 26 00 63 9d 17 7c 00 00 00 00 |..p..n&.c..|....|
00000220 ff ff ff ff ff ff ff ff 00 00 f0 01 00 00 3e 01 |..............>.|
00000230 7c a3 48 2c 00 00 00 00 ff ff ff ff ff ff ff ff ||.H,............|
00000240 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
00000300
Tag Header Kernel for Slot 2
xxd -c 4 -s $((0x300)) -l $((0x100)) SmartboxPro2015.img
00000300: 5365 7200 Ser.
00000304: 2e6f d601 .o..
00000308: faa9 c143 ...C
0000030c: 02ff ffff ....
00000310: 0001 b001 ....
00000314: 2e6e 2600 .n&.
00000318: 639d 177c c..|
0000031c: 0000 0000 ....
00000320: ffff ffff ....
00000324: ffff ffff ....
00000328: 0000 d003 ....
0000032c: 0000 3e01 ..>.
00000330: 7ca3 482c |.H,
00000334: 0000 0000 ....
00000338: ffff ffff ....
*
000003fc: ffff ffff ....
hexdump -C -s $((0x300)) -n $((0x100)) SmartboxPro2015.img
00000300 53 65 72 00 2e 6f d6 01 fa a9 c1 43 02 ff ff ff |Ser..o.....C....|
00000310 00 01 b0 01 2e 6e 26 00 63 9d 17 7c 00 00 00 00 |.....n&.c..|....|
00000320 ff ff ff ff ff ff ff ff 00 00 d0 03 00 00 3e 01 |..............>.|
00000330 7c a3 48 2c 00 00 00 00 ff ff ff ff ff ff ff ff ||.H,............|
00000340 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
00000400
Differences between slots
Thanks for the help @kar200
1 Like
Serial Console - UART - Beeline SmartBox Pro & WiFire S1500.NBN
[J4] on PCB - Baud rate 57600 8n1
GND
TX
VCC (3.3V) - Don't connect
RX
URLs
1 Like
Layout factory-data (Factory, RF-EEPROM) - mtd2 - SmartBox PRO
Name
Length
Offset1
Offset2
Offset3
Offset4
Offset5
calibration 2.4 GHz
0x200
0x0
0x20000
0x30850
calibration 5 GHz
0x200
0x8000
0x28000
0x38850
MAC (LAN, label)
0x6
0x1000
0x21000
0x31850
0x10758
0x30758
CSN
0xC
0x1010
0x21010
0x31860
0x1075F
0x3075F
Domain ID?
0x4
0x1050
0x21050
0x318A0
0x1079B
0x3079B
PCBASN
0xC
0x1060
0x21060
0x318B0
SSID (WiFi 2.4 GHz)
0x11
0x1080
0x21080
0x318D0
0x107AD
0x307B0
Passphrase (Wi-Fi)
0xA
0x10a0
0x210A0
0x318F0
0x107C0
0x307C0
MAC addresses PRO as verified by OEM firmware:
use
address
source
LAN
*:23
factory 0x21000 (label)
WAN
*:24
factory $label +1
2g
*:23
factory $label
5g
*:25
factory $label +2
Layout factory-data (Factory, RF-EEPROM) - S1500.NBN
Name
Length
Offset1
Offset2
calibration 2.4 GHz
0x200
0x0
0x10000
calibration 5 GHz
0x200
0x8000
0x18000
MAC (LAN, label-1)
0x6
0x1000
0x11000
CSN
0xC
0x1010
0x11010
PCBASN
0xC
0x1060
0x11060
SSID (WiFi 2.4 GHz)
0x11
0x1080
Passphrase (Wi-Fi)
0xA
0x10A0
Passphrase (admin)
0xA
0x10E0
MAC addresses NBN as verified by OEM firmware:
use
address
source
LAN
*:0e
factory 0x1000
WAN
*:0f
LAN +1 (label)
2g
*:0f
LAN +1
5g
*:10
LAN +2
URL
Device Support: MAC address setup
1 Like
Bootstrapping Pins
CHIP_MODE[3:0]
Default Mode 1 - Boot from ROM (NAND page 2k+64 bytes)
1 = 0001
#
0 - GND
1 - VCC
Pin Name
3*
R155
<-
R154
*
2*
R151
<-
R150
*
1
R157
<-
R156
TXD1
0
R136
->
R145
GPIO#0
*Either RTS2_N or RTS3_N
Description from MT7621 DATASHEET
A vector to set chip function/debug/ATPG/FT modes
Mode
Note
0
N/A
1
Normal
Boot from ROM (NAND page 2k+64 bytes)
2
Normal
Boot from SPI 3-byte address
3
Normal
Boot from SPI 4-byte address
4
iNIC RGMII
Boot from ROM
5
iNIC MII
Boot from ROM
6
iNIC RVMII
Boot from ROM
7
iNIC PHY
Boot from ROM
8
N/A
9
Normal
Boot from internal SRAM
10
Normal
Boot from ROM (NAND page 2k+128 bytes)
11
Normal
Boot from ROM (NAND page 4k+128 bytes)
12
Normal
Boot from ROM (NAND page 4k+224 bytes)
13
Debug
14
ATPG
Scan test
15
FT
Final test
Example SPI - Boot from SPI 3-byte address
2 = 0010
R155<-R154
R151<-R150
R157->R156 - TXD1
R136<-R145 - GPIO#0
Example eJTAG - Debug
13 = 1101
R155->R154
R151->R150
R157<-R156 - TXD1
R136->R145 - GPIO#0
URLs
1 Like
A few sercomm-recovery images for WiFire S1500.NBN:
recovery_wifire-s1500.nbn_1st-v2.0.12_2nd-v2.0.14.bin:
- Slot1:
S1500-v2.0.12
- Slot2 (default):
S1500-v2.0.14
recovery_wifire-s1500.nbn_1st-owrt-snapshot-5.15_2nd-v2.0.14.bin:
- Slot1 (default):
* OpenWrt SNAPSHOT r19537+73-c283defa88
LuCI Master git-22.126.42175-8583efb
Kernel Version: 5.15.35
* For breed lovers: the mtd-rw module is present, so you can play your favorite games :) (squeeze a "rooter", "padavan", fight against the bad blocks, etc.)
* Switch to Slot2 from OpenWrt:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock4
- Slot2:
S1500-v2.0.14
2 Likes
slh
May 26, 2022, 7:58pm
20
You are missing the most obvious choise, neither.
Someone will have to do the hands-on development - if no one does the work, there won't be any kind of support for either.