E4200 V2 help! Can't login to Linksys GUI using default user, pass

I recently aquired a Linksys E4200 V2 on freegle.
I connected it directly to my Windows computer and I held the reset button for 10 seconds to reset it to factory defaults, the IP setting is set to "Obtain an IP automatically" and it gave me 192.168.1.101 with a default gateway of 192.168.1.1

But i can't login to the Linksys GUI using the default username (blank or admin) and password (admin).

So soldered a header to the serial port and I can access the serial console via PuTTy with my USB to TTL adaptor. When it says "Hit any key to stop autoboot", I can stop the boot process and it gives me a Viper>> prompt.

This is what ive done:
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.2
Manually set the IP address of my computer to 192.168.1.2
Ive installed Tftpd32 and downloaded
openwrt-19.07.7-kirkwood-linksys_viper-squashfs-factory.bin
from https://openwrt.org/toh/linksys/ea4500 page to the Tftpd32 folder.

In the "Older builds (deprecated): Installation using Serial" section I modified the tftpboot command to use the file i downloaded so it looks like this:

Viper» tftpboot ${loadaddr} openwrt-19.07.7-kirkwood-linksys_viper-squashfs-factory.bin; setenv bootargs $(console) root=/dev/ram rw; bootm ${loadaddr}`

The E4200 successfully downloads the openwrt-19.07.7-kirkwood-linksys_viper-squashfs-factory.bin file and starts loading it

Bytes transferred = 6291456 (600000 hex)
## Booting image at 02000000 ...
   Image Name:   ARM OpenWrt Linux-4.14.221
   Created:      2021-02-15  15:22:37 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2085446 Bytes =  2 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK

Starting kernel ...

After lots of messages I get the following errors quite a long way down in the console:

VFS: Cannot open root device "ram" or unknown-block(1,0): error -6
[    1.018365] Please append a correct "root=" boot option; here are the available partitions:
[    1.026776] 1f00             512 mtdblock0
[    1.026780]  (driver?)
[    1.033359] 1f01             128 mtdblock1
[    1.033363]  (driver?)
[    1.039923] 1f02             128 mtdblock2
[    1.039926]  (driver?)
[    1.046500] 1f03            2688 mtdblock3
[    1.046503]  (driver?)
[    1.053074] 1f04           23936 mtdblock4
[    1.053077]  (driver?)
[    1.059639] 1f05            2688 mtdblock5
[    1.059642]  (driver?)
[    1.066215] 1f06           23936 mtdblock6
[    1.066218]  (driver?)
[    1.072795] 1f07           75776 mtdblock7
[    1.072798]  (driver?)
[    1.079364] 1f08            1280 mtdblock8
[    1.079367]  (driver?)
[    1.085940] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(1,0)
[    1.095007] Rebooting in 1 seconds..

I don't understand why there are so many partitions. Then it just reboots into the existing firmware.
What do i do? How do i get the OpenWRT firmware into the NAND (and which partition) and make it boot it
Alternatively, maybe there a way to just reset the existing username and password from the serial console-maybe by deleting the file that holds the config?
Be aware that i don't have any experience of linux. Just tell me exactly what to do.

Read the instructions, again, and carefully.

You're booting the wrong image.

https://downloads.openwrt.org/releases/19.07.7/targets/kirkwood/generic/

Try reading the rest of the page, too.

ok, ive booted the openwrt-19.07.7-kirkwood-linksys_viper-initramfs-uImage now and it
boots successfully. i get a root@OpenWrt:~# prompt in the console.

The wiki page says

Now in booted OpenWrt, we need to flash OpenWrt into NAND.
You need to get the network working first. Then you do:

cd /tmp
wget http://yourserver/openwrt-kirkwood-ea4500-rootfs.ubi
wget http://yourserver/openwrt-kirkwood-ea4500-uImage
ubiformat /dev/mtd3
ubiformat /dev/mtd3 -f openwrt-kirkwood-ea4500-rootfs.ubi
mtd erase kernel
mtd write openwrt-kirkwood-ea4500-uImage kerne

So ive downloaded
openwrt-15.05-kirkwood-ea4500-rootfs.ubi and
openwrt-15.05-kirkwood-ea4500-uImage
to the tftpd32 folder.

ive installed a Python http.server and ive configured it to point to the tftpd32 folder.
My ip is manually set to 192.168.1.101. When i type 192.168.1.101:80 into the URL bar of my browser i see a listing of all the files in the tftpd32 folder and i can open/save them.
So the http server is definitely working.

The computer is directly connected to ethernet port 1 of the E4200.

"You need to get the network working first." Well, how? The page doesn't say.
Ive tried using set ipaddr 192.168.1.2 and ive found the ip command.
When i type ip, i get this:

BusyBox v1.30.1 () multi-call binary.

 ip [OPTIONS] address|route|link|neigh|rule [ARGS]

OPTIONS := -f[amily] inet|inet6|link | -o[neline]

ip addr add|del IFADDR dev IFACE | show|flush [dev IFACE] [to PREFIX]
ip route list|flush|add|del|change|append|replace|test ROUTE
ip link set IFACE [up|down] [arp on|off] [multicast on|off]
        [promisc on|off] [mtu NUM] [name NAME] [qlen NUM] [address MAC]
        [master IFACE | nomaster]
ip neigh show|flush [to PREFIX] [dev DEV] [nud STATE]
ip rule [list] | add|del SELECTOR ACTION

When i type ip addr, I get a list of the interfaces:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 58:6d:8f:f7:bb:b4 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.2/32 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::5a6d:8fff:fef7:bbb4/64 scope link
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 58:6d:8f:f7:bb:b5 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.2/32 scope global eth1
       valid_lft forever preferred_lft forever
    inet6 fe80::5a6d:8fff:fef7:bbb5/64 scope link
       valid_lft forever preferred_lft forever
4: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether 58:6d:8f:f7:bb:b4 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
       valid_lft forever preferred_lft forever
    inet6 fdab:f022:787b::1/60 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::5a6d:8fff:fef7:bbb4/64 scope link
       valid_lft forever preferred_lft forever
5: eth0.1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether 58:6d:8f:f7:bb:b4 brd ff:ff:ff:ff:ff:ff
6: eth1.2@eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether 58:6d:8f:f7:bb:b5 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::5a6d:8fff:fef7:bbb5/64 scope link
       valid_lft forever preferred_lft forever

I don't understand that. I assume i need to type a long command/multiple commands, specifying the interface (eth0, eth1?), ip address and enable it.

Surely there must be a way to reset/delete the password of the stock firmware in the console, then i could just login to the Linksys GUI and flash OpenWRT from there.
It would be so much easier.

It has an IP on the LAN side - 192.168.1.1, and it should be able to grab those files directly from the pc, if it uses a static IP, using wget.
If you connect the pc to the any of the 4200s LAN ports.

If your main router and this device aren't on the same subnet, just connect the WAN, and use wget to DL the files directly over internet to /tmp on the E4200.

I'm sure there is, just ask Linksys.

Disgard all that above. Its ok now. I rebooted it and stopped uboot
Then typed in these commands from the Alternative method section of the wiki.

Viper» tftpboot 0x2000000 FW_EA4500_2.1.41.164606.img
Viper» nand erase 0x200000 0x1500000
Viper» nand write 0x2000000 0x200000 0x1500000
Viper» resetenv
Viper» reset

It successfully downloaded the stock Linksys image via tftp and restarted.
Once booted, i still couldn't login with the default password so i turned it off and on 4 times to simulate at least 3 failed reboots so it booted from the backup partition.

I assumed the FW_EA4500_2.1.41.164606.img contained both the main and backup partitions since it is over 20MB.

I logged into the Linksys smart wifi GUI with password admin and it f***ing worked! Yes!
i found the firmware upgrade page and uploaded openwrt-19.07.7-kirkwood-linksys_viper-squashfs-factory.bin

I then upgraded to openwrt-19.07.7-kirkwood-linksys_viper-squashfs-sysupgrade.bin, which worked as well! It is now running OpenWRT. I just have to configure the settings now, static IP's, Wifi, PPoE, etc...

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.