i could break into failsafe mode by pushing the wps button as the 'press f' prompt appeared on the terminal.
however, the console was disabled in failsafe mode, and 192.168.1.1 was not active.
i'm stumped....
I looked in Google Chrome through "CTRL + U" the source code of the Advanced > Admin > System page and found commented out lines regarding the password change for the root user. I tried to uncomment these lines in the console, after which it became possible to change the root password. However, when saving changes, an error occurs and the root password is not saved. I think I'm on the right track, but unfortunately my knowledge of HTML is not enough to move on 
<!--root login-->
<!--<tr>-->
<!--<td class="info-item">-->
<!--<label for="loginName" data-lang-tx="tx_loginName"></label>-->
<!--</td>-->
<!--<td class="info-content">-->
<!--<input disabled id="rootName" value="root" type="text">-->
<!--</td>-->
<!--</tr>-->
<!--<tr>-->
<!--<td class="info-item">-->
<!--<label for="sysPwd" data-lang-tx="tx_newPwd"></label>-->
<!--</td>-->
<!--<td class="info-content"><input id="sysRootPwd" type="password"></td>-->
<!--</tr>-->
<!--<tr>-->
<!--<td class="info-item">-->
<!--<label for="repeatPwd" data-lang-tx="tx_rePwd"></label>-->
<!--</td>-->
<!--<td class="info-content">-->
<!--<input id="repeatRootPwd" type="password">-->
<!--<input type="checkbox" id="showRootPwd">-->
<!--<label for="showRootPwd" data-lang-tx="tx_showPwd">Show password</label>-->
<!--</td>-->
<!--</tr>-->
Im not fluent in html either, but will give this a try over the weekend. thanks!
if the FW Version <=1.0.11
you can try this login info to shh
user:4230w
password:admin
or try this way
ADVANCED-Admin-Configuration-save to file
download and edit the “Config.cfg” file
the "Config.cfg" change the file extension name to zip file
open and edit it
and restore from flie to update the Config.cfg file
the info from
https://www.right.com.cn/forum/thread-4018486-1-1.html
I have the same router but the variant that can only be managed through the spectrum app(listed as SAC2V1K but hardware is identical from what I can see. has no web interface, just a page with basic info about the router like ip, qr code on the back that's for the app) and it has a password-less account with root (username is operator) on the serial console. I can interrupt uboot and I can even boot initramfs images for routers with the same cpu, but the most interesting thing is that it's almost completely stock openwrt 15.05. Spectrum partnered with plume so it has their modifications and packages. Any way I can help? I'll upload a boot log later.
Edit: if you want remote root access on this router you can put a script in /www/cgi-bin/ that runs telnetd when you go to that specific url. there's also some very interesting files there but they have some copyright on them so I won't upload them. One more thing, the stock firmware has no support for the usb port but other initramfs images do
Many thanks!
It really works!
I logged in as root under SSH on firmware 1.1.16.
Teardown
2.0MM cable DuPont connect TTL
Boot
F+Enter to safefail
mount rootfs
Edit /etc/config/dropbear
Edit shadow, group, passwd replace root user 4230W (replace user. adduser cannot connect to reboot)
Reboot.
Login web backup configuration
I got root-console without disassembling the router and without connecting via TTL. I restored Config.cfg from the folder 1.1.16. Then I connected to the router via SSH on the LAN- port using the PuTTY utility.
SSH login: 4230w, password: linuxbox
File transfer also works with the SCP-protocol (WinSCP utility). Only first you need to exit the SSH console.
Login and password for WEB-interface: admin / linuxbox
efsg, thanks again for your work!
If you can see output on the serial console but can't type anything, you need to remove the two resistors I circled in red in this image: https://ibb.co/G7cY1fb
They are labelled R415 and R1126. You should be able to knock them off with a pointy object like the tip of a multimeter or a knife, you just have to be careful not to knock anything else off. Also you can interrupt uboot after doing that
Edit: forgot to mention that this is the opposite side of the board under the serial port
3 Likes
All of the stable initramfs images here boot fine but are useless because they don't have compatible ethernet or wifi modules. I'm trying to build my own image but it keeps crashing when it tries to set up power management (I assume). Can anyone help out with this? Here's the boot log. The same also happens with snapshot images.
Apparently booting via initramfs will not work any longer due to this patch:
My Netgear R7800, which is very similar to the Askey RAC2V1K, also could not boot properly. WiFi interfaces will not come up. Even after I reverted the 'offending' patch, the warnings (which you also saw in your posted bootlog) were gone, but the WiFi interfaces are still missing.
I was told the only way to test now is to flash it into the router.
Well I rebuilt openwrt with the 4.19 kernel instead if 5.4 and the pci error is gone now but I still get the regulator errors at the end. Here's the new boot log.
Edit: To use 4.19, edit target/linux/ipq806x/Makefile and change KERNEL_PATCHVER. Also, do you know how to get a dts file from a dtb file?
You need some tools to do that. This link may help:
Alright so I got some device tree files out of it. I uploaded all the dtb files here and converted them to dts files. I think the main thing that's different is the nand. On the wikidev page it says it has Spansion flash but on one of the routers I have it's MXIC flash
Yet another edit: if you run cat /proc/device-tree/model you can see what revision your board is
Alright I got openwrt mostly working on this router. It's on 4.19 kernel because of the issue 4 posts above. Here's a list of things that are working, working but needs more testing / more work, and broken:
Working:
Booting (only over tftp)
Serial console
Reset button
Needs testing:
Networking (I'm not sure if the offsets for the ART partition are consistent across all of these routers and I'm only getting 200mbps wired instead of the 500mbps it's usually capable of on my internet)
WiFi (Same issue as above)
Front LED (Askey uses 3 gpios to do like 7 or 8 different things)
WPS Button (Can't figure out the correct GPIO pin)
Not all the ram is being allocated
Not Working:
Flashing to nand flash (the mtd partition layout is confusing, it looks like it boots from a ubi partition by default, it looks like some routers use different flash chips, and none of the uboot commands have a help)
I'll make another post in a bit with info on how you can help with networking and wifi.
Turning on software flow-offload should help.
Do you need to reboot for that to take affect? I tried enabling it but it didn't help much.
There's no need to reboot. It's odd tho that an ipq8065 board could only do 200mbps. Try setting the CPU governor to performance and try again.