D-Link DIR-1260 Support

Hello,

I have bought this router recently. DIR-1260 AC1200 MU-MIMO Wi-Fi Gigabit Router | D-Link (dlink.com)

I am not able to identify which processor is there in this router. I have some technical information form the data sheet. https://in.dlink.com/-/media/global-pdfs/global-datasheets/dir/dir1260a1datasheetv100ww.pdf

880Mhz Dual Core Processor (Looks like to be MTK)
128MB Ram
128MB Flash Memory.

Same specs are common for many D-Link Routers. I wonder if OpenWRT support can come to this router.

The source tarball provided by D-Link might help (I have not looked inside):
https://tsd.dlink.com.tw/gpl

1 Like

Thanks. Direct Link to the latest firmware for the router. https://dlink-gpl.s3.amazonaws.com/GPL2100008/DIR1260_A1_V1.01B01_GPLCode_20201222.tar.gz

see if you can find some photos of the internals at https://fccid.io/
if not, then you need to open it up, if the chip markings are covered/wiped, serial console would be required.

then again serial console would be required anyway, when adding support for it.

1 Like

Thanks for pointing me to the right direction. Here are internal photos of the router. ATTACHMENT (fccid.io)

CPU is MT7621. MediaTek MT7621 - DeviWiki (ex WikiDevi)

similar devices https://openwrt.org/toh/views/toh_extended_all?dataflt[CPU*~]=mt7621&dataflt[WLAN+Hardware*~]=7613

1 Like

Thanks! My hopes are bit reduced since this is a MediaTek CPU. Android devices with MediaTek also have less development support compared to Qualcomm based devices.

Any idea what could be the next step from here?

Get serial console access, and compile an initramfs image, based on one of the similar routers, for booting.

1 Like

I was just given two of these. If anyone in USA/Canada has the time/experience to add support for this router, I am happy to mail them to you

Hello all,

I've only just recently started poking around with OpenWrt and am trying to get it up and running on a D-Link DIR-1260 and am hitting a bit of a wall in getting information off of the router and I was hoping some around here might have some suggestions on coming to next steps.

So far I found a version of the device on DeviWiki:

I have been able to crack it open and wire a Raspbery Pi to the serial interface and can get a console.

The console presents me with a login screen for the device and it does not use an empty or generic password for the root user.

I went and grabbed the source for the DIR-1260 from https://tsd.dlink.com.tw/gpl and have been digging through it and found what is most likely the hash value for the default root user and am running that through hashcat now to see if it can be cracked but if it is longer than 15 characters that won't do the trick.

The firmware that D-Link uses for this device is OpenWrt itself (with its own stripped down web interface that doesn't permit me to do the really useful stuff) and most of the pieces are in the tarball... except they appear to have removed the .dts files from the released source.

Also, they have disabled failsafe so I couldn't bypass that login yet.

Currently I'm working the angles of: possibly cracking the password in a few days if I'm lucky or, possibly finding a way to modify the system from the U-Boot to force my way in.

Since it runs OpenWrt out of the factory, I'm fairly confident this shouldn't be terribly difficult to get working so long as I can get the right information so I'm mainly interested if anyone has overcome these hurdles in the past and how they did it, or any recommendations on how to crack this nut open.

Or if anyone knows the default password for D-Link devices like this - I couldn't google my way to an answer over the past two days.

Also, should we get in and get what information we need of the system I may need to beg some assistance with getting all the right files in order and set up since this is my first build but I'll cross that bridge when we get there.

Thank you for any assistance!

1 Like

If you can get to the U-Boot console, you can probably dump the entire contents of the flash with the md utility. This will for sure give you the right password hash (/etc/shadow). You can then try cracking that to see if you can get on the console. Otherwise you’ll still have a whole fw dump of it.

Sometimes there’s other ways to dump via u-boot as well, all depends on what D-Link opts to build in.

do note lots of other dlink models have 2 type of firmware
one for the A1/A2 & another for the R1 they are very different
note what your model is as you didn't state
if you already have a serial cable compare the
flash partition with the DIR-1960/2640/2660
if it's the same layout "shown in the boot logs while booting"
you can try & load the initramfs image in ram "note RAM only" via uboot
this will get you 90% the way there if it boots
but only if the flash & partitions are the same then
it's most likely made by the same vendor as the others
FCC page for DIR-1260-A1 https://fccid.io/KA2IR1260A1

Thanks for the tip! I do have the A1 version.

I took a look at the boot log and compared to the dts for the DIR-xx60 and it looks like it lines up but perhaps you could assist me in confirming or denying my assumption that some of the 'interspersed' partitions that the uboot log mentions (rootfs in particular as well as the All entry that exist in the middle of other partitions) won't disrupt the actual operation if not explicitly mentioned in the dts?

Unless I am looking in the wrong place?

I'll see if I can't figure out how to give the initramfs w/ RAM only via uBoot a shot.

Thanks again!

The logs I'm seeing in case its helpful in to anyone in the future:


[    2.524000] Creating 10 MTD partitions on "MT7621-NAND":
[    2.536000] 0x000000000000-0x000007f80000 : "ALL"
[    2.576000] 0x000000000000-0x000000080000 : "Bootloader"
[    2.588000] 0x000000080000-0x000000100000 : "Config"
[    2.600000] 0x000000100000-0x000000140000 : "Factory"
[    2.612000] 0x000000140000-0x000000180000 : "Config2"
[    2.624000] 0x000000180000-0x000002980000 : "firmware"
[    2.648000] 0x00000045fb99-0x000002980000 : "rootfs"
[    2.656000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    2.704000] mtd: partition "rootfs_data" created automatically, ofs=0xee0000, len=0x1aa0000
[    2.720000] 0x000000ee0000-0x000002980000 : "rootfs_data"
[    2.740000] 0x000002980000-0x000004980000 : "Private"
[    2.756000] 0x000004980000-0x000007180000 : "firmware2"
[    2.780000] 0x000007180000-0x000007780000 : "mydlink"
[    2.792000] 0x000007780000-0x000008080000 : "Reserved"
[    2.800000] mtd: partition "Reserved" extends beyond the end of device "MT7621-NAND" -- size truncated to 0x800000

And relevant DIR-xx60 dts snippet

&nand {
	status = "okay";

	partitions {
		compatible = "fixed-partitions";
		#address-cells = <1>;
		#size-cells = <1>;

		partition@0 {
			label = "Bootloader";
			reg = <0x0 0x80000>;
			read-only;
		};

		partition@80000 {
			label = "config";
			reg = <0x80000 0x80000>;
			read-only;
		};

		factory: partition@100000 {
			label = "factory";
			reg = <0x100000 0x40000>;
			read-only;
		};

		partition@140000 {
			label = "config2";
			reg = <0x140000 0x40000>;
			read-only;
		};

		partition@180000 {
			label = "firmware";
			compatible = "sge,uimage";
			reg = <0x180000 0x2800000>;
		};

		partition@2980000 {
			label = "private";
			reg = <0x2980000 0x2000000>;
			read-only;
		};

		partition@4980000 {
			label = "firmware2";
			compatible = "sge,uimage";
			reg = <0x4980000 0x2800000>;
		};

		partition@7180000 {
			label = "mydlink";
			reg = <0x7180000 0x600000>;
			read-only;
		};

		partition@7780000 {
			label = "reserved";
			reg = <0x7780000 0x880000>;
			read-only;
		};
	};
};

Thanks! I'm going to take some time to figure out how to run that. Is there anything in particular that you know would be exceptionally helpful from the fw dump once I get it downloaded?

look's the same
you should be able via the serial console in uboot
to run the initramfs image in ram for say DIR-1960-A1 via tftp
this should run and allow you to save all the MTD's
and the current unencrypted firmware
this image should mostly work as a test
but you will then have to sort out the led's & button assignments
and make a DTS with the DIR-1260's ID etc

Edit 2: I'm a big dumb dumb - ignore all below. I was loading to the wrong address (needed 0x84000000) and it all worked. Thanks again for the help.

Edit: I'm going to edit this because I almost immediately after posting spotted an error in the logs after the bootm command (sorry):

Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover

If it is clear that I did something wrong in my steps below I'd appreciate any additional guidance to get me back on path, otherwise I'll be googling my way through that error above.

Original:

Thanks for the help with this, could you assist me a little further in understanding what I should be expecting or seeing happen with the initramfs:

Here is what I have been doing:

  1. I built openwrt-ramips-mt7621-dlink_dir-1960-a1-initramfs-kernel.bin and put it on the tftp server plugged into the router.
  2. Boot into u boot
  3. set serverip 192.168.0.10
  4. tftpboot 0x8000 openwrt-ramips-mt7621-dlink_dir-1960-a1-initramfs-kernel.bin
  5. (console outputs)
Got it
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ##############################################################
done
Bytes transferred = 5637201 (560451 hex)
LoadAddr=8000 NetBootFileXferSize= 00560451
  1. bootm 0x8000

From this point it boots up and runs completely as it normally does. The serial console gives me the same prompt / login as before (dlinkrouter77 login:, i.e) and the usual D-Link web interface is accessible through the previously configured SSID

My question then is: is this considered a successful test and I properly loaded that initramfs and now just need to figure out the GPIO led/button situation?

Or was I supposed to see some different behavior and I have made some errors in my execution?

Thanks a million for everything so far, this has been very helpful (and fun).

you could have just used the normal per compiled initramfs image btw

it should have booted the openwrt image
and you should have been able to login to
i would have expected it to run or crash
maybe it's crashing & then booting as normal

maybe try the initramfs image from 21.02.3
https://downloads.openwrt.org/releases/21.02.3/targets/ramips/mt7621/openwrt-21.02.3-ramips-mt7621-dlink_dir-1960-a1-initramfs-kernel.bin

Thanks Lucky! It is working now booted into the 1960 initramfs.

from there save all you MTD'S
System > Backup / Flah Firmware > Save mtdblock contents