I'm exploring a way to install OpenWrt into WRC-X1800GS2. Does anyone have good info about this device?
Left chip
RTL8198D
04AE2P2
G015G3 TAIWAN
Upper chip
RTL8192XBR
MC145P1 G023
Lower chip
RTL8832CR
03EL8E9 G036D
Serial access: 115200 / 8N1
|o|ooo|
|||
||L- GND
|L-- To host's TXD
L--- To host's RXD
Edited: The boot message was replaced with the pastebin link.
Thanks for the info, I could understand about current support of this kind of device.
I'll play around with some things with this device for a while.
fyi: It seems to be encrypted with RSA + AES-256 about the router's firmware update.
(Edited: fix text cut by 80 chars)
$ strings r0/bin/mtn_hota | grep "openssl"
/etc/openssl/public-mtn.pem
openssl rsautl -verify -pubin -inkey %s -in %s > /tmp/.fwimg/decrypted_common_key
/etc/openssl/public-mtn-local.pem
openssl enc -d -aes-256-cbc -md md5 -in %s -out /tmp/.fwimg/decrypted_firmware_file -k $(cat /tmp/.fwimg/decrypted_common_key)
openssl enc -d -aes-256-cbc -pbkdf2 -in %s -out /tmp/.fwimg/decrypted_firmware_file -k $(cat /tmp/.fwimg/decrypted_common_key)
openssl dgst -sha1 -verify %s -signature %s /tmp/.fwimg/decrypted_firmware_file > /tmp/.fwimg/firmware_decrypt_result
$ tail -c +65 wrc-x1800gs2_v1.2.2.bin | tar -tv
-rw-r--r-- root/root 26091584 2025-03-27 21:08 encrypt_firmware.enc
-rw-r--r-- root/root 256 2025-03-27 21:08 encrypt_firmware.sign
-rw-r--r-- root/root 256 2025-03-27 21:08 commonkey-elecom.txt.sign
Interesting sight to see Realtek device with a relatively "recent" kernel of Linux version 5.10.70. They are usually based on very old like 2.x or 3.x.
RAM and Flash size seems to be on a good end but adding a support is a tough order because its Realtek.
/sys/firmware/fdt extracted.
# ls /sys/firmware/fdt -l
-r-------- 1 root root 4343 Jan 1 09:09 /sys/firmware/fdt
ku@debian:~$ dtc -I dtb ./fdt > fdt.dts
<stdout>: Warning (reg_format): /ethernet@0/gmac0:reg: property has invalid length (8 bytes) (#address-cells == 2, #size-cells == 1)
<stdout>: Warning (reg_format): /ethernet@0/gmac1:reg: property has invalid length (8 bytes) (#address-cells == 2, #size-cells == 1)
<stdout>: Warning (reg_format): /ethernet@0/gmac2:reg: property has invalid length (8 bytes) (#address-cells == 2, #size-cells == 1)
<stdout>: Warning (unit_address_vs_reg): /cpuintc@0: node has a unit name, but no reg or ranges property
<stdout>: Warning (unit_address_vs_reg): /switch@0: node has a unit name, but no reg or ranges property
<stdout>: Warning (unit_address_vs_reg): /ethernet@0: node has a unit name, but no reg or ranges property
<stdout>: Warning (unit_address_vs_reg): /ethernet@0/gmac0: node has a reg or ranges property, but no unit name
<stdout>: Warning (unit_address_vs_reg): /ethernet@0/gmac1: node has a reg or ranges property, but no unit name
<stdout>: Warning (unit_address_vs_reg): /ethernet@0/gmac2: node has a reg or ranges property, but no unit name
<stdout>: Warning (unit_address_vs_reg): /usb@0: node has a unit name, but no reg or ranges property
<stdout>: Warning (unit_address_vs_reg): /usb@1: node has a unit name, but no reg or ranges property
<stdout>: Warning (unit_address_vs_reg): /usb@2: node has a unit name, but no reg or ranges property
<stdout>: Warning (pci_device_reg): Failed prerequisite 'reg_format'
<stdout>: Warning (pci_device_bus_num): Failed prerequisite 'reg_format'
<stdout>: Warning (simple_bus_reg): Failed prerequisite 'reg_format'
<stdout>: Warning (i2c_bus_reg): Failed prerequisite 'reg_format'
<stdout>: Warning (spi_bus_reg): Failed prerequisite 'reg_format'
<stdout>: Warning (avoid_default_addr_size): /ethernet@0/gmac0: Relying on default #address-cells value
<stdout>: Warning (avoid_default_addr_size): /ethernet@0/gmac0: Relying on default #size-cells value
<stdout>: Warning (avoid_default_addr_size): /ethernet@0/gmac1: Relying on default #address-cells value
<stdout>: Warning (avoid_default_addr_size): /ethernet@0/gmac1: Relying on default #size-cells value
<stdout>: Warning (avoid_default_addr_size): /ethernet@0/gmac2: Relying on default #address-cells value
<stdout>: Warning (avoid_default_addr_size): /ethernet@0/gmac2: Relying on default #size-cells value
<stdout>: Warning (avoid_unnecessary_addr_size): Failed prerequisite 'avoid_default_addr_size'
<stdout>: Warning (unique_unit_address): Failed prerequisite 'avoid_default_addr_size'
<stdout>: Warning (interrupt_provider): /ictl@1f000000: Missing #address-cells in interrupt provider
<stdout>: Warning (interrupt_provider): /gic@1fbc0000: Missing #address-cells in interrupt provider
<stdout>: Warning (interrupt_provider): /gpio-controller@1b000038/bank@0: Missing #address-cells in interrupt provider
<stdout>: Warning (interrupt_provider): /gpio-controller@1b000038/bank@1: Missing #address-cells in interrupt provider
<stdout>: Warning (interrupt_provider): /gpio-controller@1b000038/bank@2: Missing #address-cells in interrupt provider
fdt.dts
Finally, I could get serial output from the kernel, with this WIP branch, https://github.com/kenjiuno/openwrt-rtl8198d/commit/8383d86285e6123806d540e9a22d96b3703041ac
tftp ${freeAddr} openwrt-realtek-rtl8198d-elecom_wrc-x1800gs2-initramfs-kernel.bin && setenv root_mtd 31:7 && run ubipart && run setmoreargs setbootargs && bootm
swcore_init
Using LUNA GMAC device
TFTP from server 192.168.1.7; our IP address is 192.168.1.3
Filename 'openwrt-realtek-rtl8198d-elecom_wrc-x1800gs2-initramfs-kernel.bin'.
Load address: 0x83000000
Loading: T #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##############
536.1 KiB/s
done
Bytes transferred = 5916188 (5a461c hex)
ubi0: attaching mtd5
ubi0: scanning is finished
ubi0: attached mtd5 (name "ubi_device", size 124 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 995, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 8, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 6/2, WL threshold: 4096, image sequence number: 1275106322
ubi0: available PEBs: 4, total reserved PEBs: 991, PEBs reserved for bad PEB handling: 20
## Booting kernel from Legacy Image at 83000000 ...
Image Name: Linux-5.10.70
Image Type: MIPS Linux Kernel Image (gzip compressed)
Data Size: 5916124 Bytes = 5.6 MiB
Load Address: 80100000
Entry Point: 80100000
Verifying Checksum ... OK
Uncompressing Kernel Image
[ 0.000000] Linux version 6.6.93 (ku@debian) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r29979-7a2174f4a3) 14.3.0, GNU ld (GNU Binutils) 2.42) #0 Mon Jun 9 01:28:24 2025
[ 0.000000] RTL838X model is 0
[ 0.000000] RTL839X model is bad0bad0
[ 0.000000] RTL93XX model is 43a400
[ 0.000000] SoC Type: DEFAULT
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 0001a120 (MIPS interAptiv (multi))
[ 0.000000] MIPS: machine is ELECOM WRC-X1800GS2
[ 0.000000] earlycon: ns16550a0 at MMIO 0x18002000 (options '115200n8')
[ 0.000000] printk: bootconsole [ns16550a0] enabled
[ 0.000000] Kernel sections are not in the memory maps
[ 0.000000] Wasting 9216 bytes for tracking 256 unused pages
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Using appended Device Tree.
[ 0.000000] Kernel panic - not syncing: early_init_dt_alloc_memory_arch: Failed to allocate 4413 bytes align=0x40
[ 0.000000] Rebooting in 1 seconds..
[ 0.000000] Reboot failed -- System halted
I could extract kallsyms from /proc/kallsyms. This helps me to invest kernel functions (and associated hardware registers) with analysis tools like Ghidra.
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.