Seems to be an upgraded version of the WR3000 but with a change to 128 MB Flash instead of the 16 MB of the WR3000 and 1 additional Ethernet port. SOC is the same as the WR3000.
Worth trying to support? I don't see any Cudy firmware to remove signature check.
If you have debice ssh to it, get mtd partitions, boot messages, lspici etc. In the easiest event partitions are lightly skewed and one netvard generationally improved.
Hey, I actually got one of these today. It refuses SSH attempts - is there some kind of standard trick to get CLI access on Cudy devices? Happy to go collect any information desired, as long as I can figure out how.
e: I was able to find the system log at least, so here's that: https://pastebin.com/0G7JX82Z
I have no idea why it makes reference to eth1 coming up at 2.5Gbps/Full; even if the WR3000S supported 2.5G, the switch I have mine connected to does not.
web form - boot log?
web interfaces - start stop services?
Right, I looked around the web interface but there's no reference to SSH anywhere. "Diagnostic tools" has ping, traceroute, nslookup, and the log I put in Pastebin. "Advanced Settings" has a bunch of options but the only stuff I see related to admin access is the option to make the web interface HTTPS-only and the ability to reset the admin password. I am not sure if I have any ideas other than opening it up and looking for a serial header.
Mon Jul 15 11:59:10 2024 kern.notice kernel: [ 0.731639] 6 fixed-partitions partitions found on MTD device nmbm_spim_nand
Mon Jul 15 11:59:10 2024 kern.notice kernel: [ 0.738689] Creating 6 MTD partitions on "nmbm_spim_nand":
Mon Jul 15 11:59:10 2024 kern.notice kernel: [ 0.744168] 0x000000000000-0x000000100000 : "BL2"
Mon Jul 15 11:59:10 2024 kern.notice kernel: [ 0.749387] 0x000000100000-0x000000180000 : "u-boot-env"
Mon Jul 15 11:59:10 2024 kern.notice kernel: [ 0.755181] 0x000000180000-0x000000380000 : "Factory"
Mon Jul 15 11:59:10 2024 kern.notice kernel: [ 0.760717] 0x000000380000-0x0000003c0000 : "bdinfo"
Mon Jul 15 11:59:10 2024 kern.notice kernel: [ 0.766184] 0x0000003c0000-0x0000005c0000 : "FIP"
Mon Jul 15 11:59:10 2024 kern.notice kernel: [ 0.771366] 0x0000005c0000-0x0000045c0000 : "ubi"
Mon Jul 15 11:59:10 2024 kern.info kernel: [ 0.777056] [mtk_hw_init] reset_lock:0, force:0
not v1, dont attempt to cross-flash
Oh yeah, I very much figured that the old image would not work when I saw they expanded the flash from 16MB to 512MB.
I got it open hoping to see something familiar like a TTL header, but no luck so far. Not really sure if there's anything I can do with it: https://imgur.com/a/AqWecLU
I guess I need to take the heatspreader off and see what's under that to be sure, though.
If you feel fine about it breaking 
ok ....
@brada4 - Eh, I think it's fine - the heatspreader has three smaller heatspreaders under it, and thermal grease in between so I can fix that much.
@frollic - Yeah that's it, I didn't recognize them without the labels. The labels are on the other side though... Tx is square, then the round ones are Rx, GND, VCC in that order. I suck at soldering, but I might have to give it a try here.
e: Yeah, I have a suitable pin connector already so I just need to solder that on, then I can monitor the console while booting up and report back.
I got some pins soldered on but am not having much luck figuring out the baud rate. I tried 9600-8-N-1 and got nothing; 115200 gets me a garbled stream. I don't have an oscilloscope so I will probably need to figure this out through trial and error unless someone knows the magic combination.
Don't connect Vcc, use 8N1, speed's usually 115200, or 57600.
Check if it's using 3.3v, or 1.8v.
I've tried both 1.8V and 3.3V with 57600, 115200, 9600, and pretty much anything else I can think of but have not had any luck getting clear output yet. Feels like I'm missing something. This is my TTL adapter: https://www.amazon.com/gp/product/B07TXVRQ7V/
The level jumpers do seem to be working because if I set to to 5V I get nothing, but I can't tell a difference in behavior between 1.8V and 3.3V. I'm guessing that means 3.3V is right, since if it was only going to 1.8V I would expect to see nothing when set to 3.3V as well, but maybe I am misunderstanding how it works.
Probably best to just skip this the more I think about it but good luck if you do continue @cmhughes
Cudy want double the money (atleast in my country) for the S version compared to the normal WR3000. I don't see double the features. I could somewhat understand if they put a higher tier chip or something.
Eh, I got this free to review and I don't have any particular use for it - especially if it's running the locked down stock firmware. I might as well try to figure it out, I just am not sure if I have any better way to do that than buying a cheap oscilloscope.
e: Bought a cheap oscilloscope, should be here tomorrow on the 17th.
Do you have the manufacturer's source code for the firmware?
If not, please request it: the GPL says they have to provide it to you (at least for the GPL-covered code, such as the kernel).
I'm going to guess that's this link which is already on the product support page, under "GPL": https://drive.google.com/file/d/1und0klzZ22tw4VvS7hxvMr5BmfwD-o0m/view?usp=drive_link
e: Yeah, definitely looks like a source tree and has build instructions for several models - presumably all MT7981-based.
Likely based on mtk sdk, goid news you find dts in source.
Cudy had other board that have only test points (TR3000)
This might be the case as well here . Also is possible that there is missing resistor / pull up resistor for UART. Can You share better quality pictures or link to them (without heatsink) ?
dts can be easily extracted from firmware so no worry here
