a it didn't get finished last time with others you should start again
capture a copy of the boot log
compare the flash layout with the one for the DIR-1960 / DIR-2660
get the initramfs image for the DIR-1960
upload this into its RAM via uboot's menu
backup store you originally flash content
while in the initramfs image you can have a quick & limited test of wifi etc
see if the wifi works & it the buttons & led are configured the same etc
1 Like
Thanks! I never though of compiling the SDK with a custom password. I'll do it as soon as I can
Okay, no problem!
Is there any resource about those things? Specially about comparing the Layout (i.e. where do I get mine) and making a backup of the flash continence (what is a "Flash Continence" in a first place? like, the flash image itself?).
I'm open to do anything that I can do, but please note this is my first time doing reverse engineer in a router, so please, bear with me.
sorry was a type o
just the current flash image
just while the unit is boot the current OEM firmware
capture the text coming out of the serial console
at some point it will shore the current flash layout
& other information you will draw on later
also current DIR-1960 Openwrt layout from it's DTS
https://git.openwrt.org/?p=openwrt/openwrt.git;a=blob;f=target/linux/ramips/dts/mt7621_dlink_dir-xx60-a1.dtsi;h=e194592b572e9f5eb94089bd225721ff05a7d497;hb=11bff24b3e1b10088bf6832447d18a9c9b17ef25
It'll take me some time for dumping the OEM firmware and booting with the DIR-1960's one, but for now I extracted the boot output: UBoot log and Complete log (UBoot + Linux).
From what I can understand, there're just slights differences in the partition layout comparing to DIR-1960:
- Bootloader, Config, Factory, Config2, Firmware, Private, Firmware2 and mydlink are exactly the same (same start address and same length for each).
- Rootfs and Rootfs_data are missing from DIR-1960 and they're also inside Firmware's partition
- The Reserved partition is "longer" in DIR-2150 (0x900000), but it's also being truncated to 0x800000 while in DIR-1960 it's 0x880000.
You can find the layout at the line 624 of the complete log.
it look's the same
this is a different PCB
https://fccid.io/KA2DIR2150A1/Internal-Photos/Internal-Photos-4800884
https://fccid.io/KA2IR1960A1/Internal-Photos/Internal-Photos-4121374
but it has a MT7615 & MT7603
but these are defined in the cal data for each radio
so I think they will just work
if you download the dir-1960-a1 initramfs image
you can run this from RAM so it's non destructive
by hitting 1 for " 1: Load system code to SDRAM via TFTP. "
you will need setup a tftp sever for this
I booted up from TFTP using the DIR-1960 firmware.
The good news is that the lights (at least power and WAN) and the Reset Button work correctly. Also, I have internet connection through all my ethernet ports with the same speed (~670Mpbs DOWN and 230Mbps UP)
The bad news is that there is no option for setting WiFi in LuCi. I don't know if this is normal for a initramfs firmware or if there was a problem loading the drivers.
If I try through terminal, it shows me Uci: Entry not found (here is the complete output for uci show).
Here is the boot log while loading with the DIR-1960 firmware. As you can see, it's so shorter than using the stock firmware.
If you need more information/testing just tell me, no issue switching through Stock and initramfs
oh i do remember this there was a problem with wifi in initramfs
I expect it to work as it once did but last time I tested it it didn't
well if you have used the initramfs to backup your MTD's
and the inframs image boots ok as it seems to
you can try to upload the DIR-1960 factory image into it's flash
you should also have a copy of the OEM firmware in you MTD files you just saved to go back to stock
just a warning tho there is always a risk of things going bad & you end up with a brick
I still don't have any backup from my OEM firmware. Do you know which is the best way for doing it? (and restoring it in case of issues)
The fourth option (Boot CLI) gives me these commands:
4: System Enter Boot Command Line Interface.
U-Boot 1.1.3 (Dec 18 2019 - 16:44:40)
MT7621 # help
? - alias for 'help'
bootm - boot application image from memory
go - start application at address 'addr'
help - print online help
loadb - load binary file over serial line (kermit mode)
mcmp - memory compare
md - memory display
mdio - Ralink PHY register R/W command !!
mm - memory modify (auto-incrementing)
nand - nand command
nm - memory modify (constant address)
printenv- print environment variables
reset - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
MT7621 # help md
md [.b, .w, .l] address [# of objects]
- memory display
MT7621 # md 0 8
00000000: 00000000 00ff0000 ff000000 f7ff0800 ................
00000010: 00000800 00ff0000 ff200020 ffff0020 ........ . . ...
For now I'll leave it making a backup with md 0 900000 as last time I did that it took an entire day (it was with another router), but if you know a better way please let me know
to backup while you are in the initramfs image
go System > Backup / Flash Firmware > Save mtdblock contents >
and save each of the MTD entry's you have
your main firmware is call firmware
this should be flash-able via the recover interface
tho I do remove all the extra FF's my self
the only bad thing is it you kill "u-boot / boot loader" and have a brick
& will need a flash programmer & soldering skills to fix it
note I'm thinking you are using the 12.01 DIR-1960-A1 initramfs image with luci
I didn't know about that option there. I'll do it after md finishes its job (it's on 0x500000 of 0x900000) just in case, and then I will try to flash using a Factory Image.
Also, I'm using the latest version available: 21.02.1 (the .bin file is called openwrt-21.02.1-ramips-mt7621-dlink_dir-1960-a1-initramfs-kernel.bin)
I flashed with openwrt-21.02.1-ramips-mt7621-dlink_dir-1960-a1-squashfs-factory.bin and it boot almost immediately, but it has some issues:
- There is no 2.4GHz WiFi device anywhere, just 5GHz (which works perfectly)
- I cannot save any settings nor file. Any changes that I made in both LuCi and CLI are reverted after a reboot, that also includes for any new file that I made.
- Sometimes the router doesn't boot at all. It happened rarely tho
At least I can confirm the lights seems to work fine. Now the 5GHz has turned on when I enabled the 5GHz WiFi. I haven't tested the 2.4GHz light as I cannot enable that network.
Also, internet speeds stills being the same as before with initramfs and stock.
Edit: By the way, I had to flash it through Serial/TFTP (option 2 in UBoot) as the D-Link panel didn't allow me to flash with that image. The terminal printed something about header corrupted or something like that, so I don't know if even using a DIR-2150 firmware will be allowed there.
the later DIR-2660 is checking for the model number in the header so this may be the same
the 2.4G wifi just may need the module to be loaded
but the settings thing i'm not sure why the setting don't save
witch means you may not be able to load the module
a compiled master version
this should flash from the recovery interface
http://luckys.onmypc.net:81/openwrt/2021-11-05/targets/ramips/mt7621/openwrt-snapshot-r18012-9f90a89655-ramips-mt7621-dlink_dir-2150-a1-squashfs-factory.bin
http://luckys.onmypc.net:81/openwrt/2021-11-05/targets/ramips/mt7621/openwrt-snapshot-r18012-9f90a89655-ramips-mt7621-dlink_dir-2150-a1-squashfs-sysupgrade.bin
http://luckys.onmypc.net:81/openwrt/2021-11-05/targets/ramips/mt7621/openwrt-snapshot-r18012-9f90a89655-ramips-mt7621-dlink_dir-2150-a1-initramfs-kernel.bin
Good news. Now it works perfectly.
With initramfs now the Wireless is working completely, both 2.4GHz and 5GHz. Also, both speeds are the same between having Stock and OpenWRT (287/~215 from 5GHz, and 19/~30 from 2.4GHz)
And now the squashfs-factory is saving the settings (and even the extra files that I made) correctly. I did a reboot within LuCi, and a hard reset from the switch behind, both booting without any issue. All lights, buttons, wireless and ports are working correctly. Software things like firewall and DHCP are also working correctly.
I haven't found any issues regarding OpenWRT yet.
But, the Stock firmware didn't let me install OpenWRT from its updater. I tried only with factory.bin because you suppose to use that for a first installation, but it failed immediately, and the terminal didn't show me any error message like last time, all I got was this:
filename:/tmp/firmware.img
SERVER_SOFTWARE:(null)
boundary:----WebKitFormBoundaryBbrndOmzHlDGeX76
offset:164
endoffset end:9830610
n :1024
len:42,0x7fd4551a,----WebKitFormBoundaryBbrndOmzHlDGeX76--
len:46,0x7fd45516,
------WebKitFormBoundaryBbrndOmzHlDGeX76--
endoffset:9830564 - offset:164 = 9830400,strlen(p)=46
ftruncate_file,filename:/tmp/firmware.img
But, flashing over TFTP worked perfectly. Aside of setting up a TFTP server, there wasn't any extra step for installing OpenWRT.
Now, I'll be stuck with OpenWRT because, for some weird reason, now the Stock firmware wouldn't maintain the config, just like last time with OpenWRT. Any reboot and it'll go back as if I just brought it from the store. Maybe that's a glitch from the device itself rather than an issue of OpenWRT. Sadly, I don't have any idea about how I did overcome it.
If you want/need me to make some test, just let me know. I'll let you know if I found some bug or something that is not working correctly (I used to have OpenWRT before, so I'm used to it)
it's good to hear it all works
thing to check tho
wps reset buttons & led's
the only thing is to see if it will flash from the recovery interface
so you don't have to have a serial cable
current testing version
1 Like
WPS, Reset works perfectly
Power, WAN, 2.4GHz and 5GHz indicators also work perfectly all of them (in fact, they work even better than with stock firmware. In OpenWRT they flash on activity, while in stock they were always on)
Do you know how can I enter to the recovery interface?
I read that it has a special IP, but the default subnet for my router is 192.168.0.0/24, so 192.168.0.1 is the admin page, not the recovery one.
you have to manually put you pc's network ip in the 192.168.0.x range so 192.168.0.2
then power up you router while holding the reset button down
it will change it flash after a bit
and in a browser you log on to 192.168.0.1
oh i hope you are using windows cos Linux had problems with this
I finally managed to enter into recovery mode (the IP was changed when I used the TFTP and I didn't know that back then) and I was able to flash using the factory.bin while running on stock without any issue.
It took longer than doing through TFTP (and by a lot), but at the end everything worked correctly.
Everything from buttons, light, wireless and settings are working as they supposed to be, just like before.
As before, I didn't find any issues for now and I'll let the router running with OpenWRT flashed through recovery.
Do you need any more tests?
it sounds like it's all working 
if it's to make it into openwrt someone now need to submit it as a pull request
it's better it's it's someone who owns the device and can do some final polishing
so if you or anyone want to take what's there and go for it
but i believe you could get away with using the DIR-1960-A1 or DIR-2660-A1
versions & just adding the 2.4G wifi MT7603 via software update
2 Likes