Comfast E393AX & E935AX

I don't see anything discernable between the two models specifications.
Only they describe the E395 as "Full Gigabyte Ethernet"

I tried to use the E393AX factory image via the 395AX setup, but gives me a "SET Error"

Anyway to get the E393AX image to install?

E393AX

E395AX

E395AX

Chips are:
MT7531AE - MediaTek
2xG2474CG
MT7976DAN - MediaTek under heatsink
MT7981AA - MediaTek under heatsink
W632GU8NB - WinBond under heatsink

so is serial, perhaps it's easier to access from the other side of the PCB.

I don't have the requisite knowledge, but I can try under instruction to extract any info that is required to help provide a build and can test the build

you own the device, it'll be up to you to get it supported, unfortunately ...

1 Like

i managed to get SSH to the box.

BusyBox v1.33.2 (2023-07-14 03:55:24 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 21.02-SNAPSHOT, r0-7a78a51
 -----------------------------------------------------
root@COMFAST:/# ls
bin          lib          proc         sys          www
dev          lib64        rom          tmp          www-comfast
etc          mnt          root         usr
init         overlay      sbin         var
root@COMFAST:/# df
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/root                13824     13824         0 100% /rom
tmpfs                   115520       280    115240   0% /tmp
/dev/ubi0_2              38416       172     36244   0% /overlay
overlayfs:/overlay       38416       172     36244   0% /
tmpfs                      512         0       512   0% /dev
root@COMFAST:/# df -kh
Filesystem           1K-blocks      Used Available Use% Mounted on
df: �-kh: can't find mount point
root@COMFAST:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 08000000 00020000 "spi0.0"
mtd1: 00100000 00020000 "BL2"
mtd2: 00080000 00020000 "u-boot-env"
mtd3: 00200000 00020000 "Factory"
mtd4: 00200000 00020000 "FIP"
mtd5: 04000000 00020000 "ubi"
root@COMFAST:/# 

can anyone help me to build a factory image install please?

developer has kindly added the E395AX but I don't have the skills to create the build so i can test it.

https://openwrt.org/docs/guide-developer/toolchain/beginners-build-guide might provide some guidance.

I'm such the committer that got this to work.
The E395AX is basically the same board as its bigger brother, they have just cost reduced the casing.
Everything else is the same.

1 Like

I am getting the same error on this device when trying to flash factory bin image via the stock GUI, and im getting Failed set error. Now that its officially supported...How can i install openwrt on this?

https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=d8f4453bf2de9fd9baf3d660ed12e0797ff2cfdb

the SET error maybe related to the file name. I noted if the backup.file is not named like that for the restore config, it also gives a set error.

In any case, on my 2x 395ax devices; first one, i tried to load the factory image via xmodem / serial and bricked the device. second one i got the set error when trying to upload via factory gui, so went strait to the recovery process i used for the first one.

  • take the heatsink off, the serial connection (labels) are under that.
  • i used right angle molex connectors under the circuit board to allow easy reconnection in future.
  • in any case, to get under the circuitboard you have to take the heatsink off as there is a screw underneath. (so no avoiding the removal)
  • connect 3.3v serial to usb device
  • xmodem the raminitfs version to memory and run from memory
  • use the sysupgrade version from the gui to upgrade

that's how I recovered the first one, and did the second one.
I found it much quicker that mucking around with TFTP servers, certificates, etc.

Thanks @frollic, i followed this procedure, but unfortunately the root password was not being accepted as a blank or "enter".
I must note however that i edited the shadow file via the Archive program with a text file, and re-saved it. Even though it saved it, and after i uploaded the new settings, it did not accept a blank root password. it says its incorrect.

Just wondering how important it is to use "fakeroot" ?

@GwaiTsi is there an easier way? i really do not have the knowledge and especially pressed for time.

Is it possible to upload the sysupgrade via the GUI or will it brick it?

I tried @frollic 's link where the user says he disables root password, i tried, fakeroot way, i tried to re-compress the etc/ and it gives a permission error:

tar -zcf backup-ssh.tar.gz etc/
tar: etc/wireless/mediatek/DBDC_card0.dat: Cannot open: Permission denied
tar: Exiting with failure status due to previous errors

I then did chmod -R a+x etc/ and then re-compressed without errors, however after uploading the backup.file, i still cannot login via ssh. it gives the same errors:

root@192.168.1.1's password: 
debug2: we sent a password packet, wait for reply
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
root@192.168.1.1's password: 
debug2: we sent a password packet, wait for reply
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
root@192.168.1.1's password:

and also:

scp -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa openwrt-23.05.4-mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin root@192.168.1.1:/tmp/
root@192.168.1.1's password: 
Permission denied, please try again.

blank password = ENTER, right? how hard can this be? What am i doing wrong?

your help is much appreciated

Hi David, I see E393AX made it into 23.05.5 but there is no E395AX. Do you know if the E393AX sysupgrade can be used? thanks

sorry m8, I couldn't get the 395AX to work without doing it via the serial. Maybe you can ask the guy who made the build @db260179

Factory image is only via the ssh method not the oem ui, they use a tar.gz image that is not in openwrt format. the reason for factory is to format the ubi partitions so that openwrt can boot.

Fakeroot is used to set the permissions as root otherwise you could edit the shadow file with the wrong permissions and it won't work.

If you rename the file from backup.file to backup.file.tar.gz then open with a archiver program, edit within there the etc/shadow file that would work. then rename back to its original filename. then upload via the oem ui. The router will reboot if successful, keep trying until the router reboots

You have to use an old ssh client to connect as newer versions will not connect that is another gotcha

No you have to wait for official support or force the upgrade but be prepared for bricked update if you do.

I confirm the same OpenWrt images of 393 work on 395. I was unsure I'm cutting down some specs by using an image not actually made for it (you know, maybe different RAM/ROM sizes) but I see you actually checked by opening it the specs are the same. How should we handle such duplication? Maybe we should just have a common wiki page for both.

The committed procedure for 393 has two issues.

One is just a mild misleading command example, i.e. you cannot use wildcards in sysupgrade command, you have to specify the full correct firmware filename. I was fooled because it suggested to me that a wildcard would have worked in case there was actually a single /tmp/*.bin file.

The second issue is a typo in the /etc/shadow contents, there is a missing semicolon in the pattern, so it will not accept it as a blanked root password if you directly copy-paste from the instructions. Just blank the existing one you see in the backup.