Hello,
Is LEDE supported for AP Tp-link EAP110-Outdoor ?
with regards
MM
At the moment unfortunately no, I hope however that someone can open the device.
Unfortunately the firmware is signed (TL-EAP110-OUTDOORv1_1.0.0_[20161109-rel58182]_up_signed.bin).
extract Firmware:
root@kali:~/Downloads/EAP110-Outdoor(EU)_V1_161109_1479956047621i# binwalk TL-EAP110-OUTDOORv1_1.0.0_\[20161109-rel58182\]_up_signed.bin`
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
8751 0x222F ELF, 32-bit MSB MIPS64 executable, MIPS, version 1 (SYSV)
40831 0x9F7F LZMA compressed data, properties: 0x6D, dictionary size: 1048576 bytes, uncompressed size: -1 bytes
820335 0xC846F Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 5850285 bytes, 553 inodes, blocksize: 131072 bytes, created: 2016-11-09 08:09:36
#############
root@kali:~/Downloads/EAP110-Outdoor(EU)_V1_161109_1479956047621i# dd if=TL-EAP110-OUTDOORv1_1.0.0_\[20161109-rel58182\]_up_signed.bin bs=1 skip=820335 count=5850285 of=eap110.squashfs
5850285+0 records in
5850285+0 records out
5850285 bytes (5.9 MB, 5.6 MiB) copied, 7.86167 s, 744 kB/s
#############
root@kali:~/Downloads/EAP110-Outdoor(EU)_V1_161109_1479956047621i# unsquashfs eap110.squashfs
Parallel unsquashfs: Using 2 processors
lzma uncompress failed with error code 0
read_block: failed to read block @0x593f04
read_fragment_table: failed to read fragment table index
FATAL ERROR:failed to read fragment table
#############
https://github.com/devttys0/sasquatch
$ sudo apt-get install build-essential liblzma-dev liblzo2-dev zlib1g-dev
root@kali:~/Downloads# git clone https://github.com/devttys0/sasquatch.git
$ ./build.sh
root@kali:~/Downloads/EAP110-Outdoor(EU)_V1_161109_1479956047621i# sasquatch eap110.squashfs
SquashFS version [4.0] / inode count [553] suggests a SquashFS image of the same endianess
Parallel unsquashfs: Using 1 processor
Trying to decompress using default lzma decompressor...
Successfully decompressed with default lzma decompressor
501 inodes (637 blocks) to write
[===========================================================/ ] 406/637 63%
Trying to decompress with gzip...
Trying to decompress with lzma-adaptive...
Detected lzma-adaptive compression
[==============================================================================================/] 637/637 100%
created 371 files
created 52 directories
created 89 symlinks
created 41 devices
created 0 fifos
#############
root@kali:~/Downloads/EAP110-Outdoor(EU)_V1_161109_1479956047621i# ls -al squashfs-root/
Device Info:
$ cat /proc/cmdline
console=ttyS0,115200 root=31:04 rootfstype=squashfs init=/init mtdparts=ath-nor0:128k(u-boot),64k(pation-table),64k(product-info),1536k(kernel),6144k(rootfs),192k(config),64k(ART) mem=64M
$ cat /proc/cpuinfo
system type : QCA953x
processor : 0
cpu model : MIPS 24Kc V7.4
BogoMIPS : 432.12
wait instruction : yes
microsecond timers : yes
tlb_entries : 16
extra interrupt vector : yes
hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0ff8, 0x0ff8]
ASEs implemented : mips16
shadow register sets : 1
core : 0
VCED exceptions : not available
VCEI exceptions : not available
$ cat /proc/meminfo
MemTotal: 62676 kB
MemFree: 17636 kB
Buffers: 4324 kB
Cached: 16540 kB
SwapCached: 0 kB
Active: 15480 kB
Inactive: 16444 kB
Active(anon): 11060 kB
Inactive(anon): 0 kB
Active(file): 4420 kB
Inactive(file): 16444 kB
Unevictable: 0 kB
Mlocked: 0 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 0 kB
Writeback: 0 kB
AnonPages: 11080 kB
Mapped: 4624 kB
Slab: 9784 kB
SReclaimable: 632 kB
SUnreclaim: 9152 kB
PageTables: 284 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 31336 kB
Committed_AS: 24236 kB
VmallocTotal: 1048404 kB
VmallocUsed: 2744 kB
VmallocChunk: 1036512 kB
$ cat /proc/devices
Character devices:
1 mem
4 ttyS
5 /dev/tty
5 /dev/console
5 /dev/ptmx
10 misc
77 ATH_GPIOC
90 mtd
108 ppp
128 ptm
136 pts
238 ar7100_gpio_chrdev
239 ar7240_flash_chrdev
251 tp_domain
Block devices:
259 blkext
31 mtdblock
$ ls /sys/devices/platform
ls: /sys/devices/platform: No such file or directory
$ cat /proc/mtd
dev: size erasesize name
mtd0: 00020000 00010000 "u-boot"
mtd1: 00010000 00010000 "pation-table"
mtd2: 00010000 00010000 "product-info"
mtd3: 00180000 00010000 "kernel"
mtd4: 00600000 00010000 "rootfs"
mtd5: 00030000 00010000 "config"
mtd6: 00010000 00010000 "ART"
$ cat /sys/class/mtd/mtd*/offset
cat: /sys/class/mtd/mtd*/offset: No such file or directory
$ ifconfig -a
ath0 Link encap:Ethernet HWaddr 50:C7:BF:50:YY:XX
UP BROADCAST RUNNING MULTICAST MTU:2290 Metric:1
RX packets:246563 errors:12 dropped:12 overruns:0 frame:0
TX packets:345909 errors:0 dropped:86866 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:56343108 (53.7 MiB) TX bytes:345899446 (329.8 MiB)
br0 Link encap:Ethernet HWaddr 50:C7:BF:50:YY:XX
inet addr:192.168.1.3 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:237029 errors:0 dropped:0 overruns:0 frame:0
TX packets:193340 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:26971073 (25.7 MiB) TX bytes:70760925 (67.4 MiB)
eth0 Link encap:Ethernet HWaddr 50:C7:BF:50:YY:XX
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
eth1 Link encap:Ethernet HWaddr 50:C7:BF:50:YY:XX
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:545791 errors:0 dropped:863 overruns:0 frame:0
TX packets:437936 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:357556779 (340.9 MiB) TX bytes:122225334 (116.5 MiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:4324380 errors:0 dropped:0 overruns:0 frame:0
TX packets:4324380 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:298711078 (284.8 MiB) TX bytes:298711078 (284.8 MiB)
wifi0 Link encap:UNSPEC HWaddr 50-C7-BF-50-YY-XX-00-46-00-00-00-00-00-00-00-00
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:11162898 errors:0 dropped:0 overruns:0 frame:0
TX packets:4931126 errors:4350 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1297601409 (1.2 GiB) TX bytes:368022605 (350.9 MiB)
Interrupt:2 Memory:b8100000-b811ffff
$ ls /sys/class/net
ls: /sys/class/net: No such file or directory
$ brctl show
bridge name bridge id STP enabled interfaces
br0 8000.50c7bf50YYxx no eth0
eth1
ath0
$ dmesg
S. Miller <davem@redhat.com>
athwdt_init: Registering WDT success
athwdt_timer_init: Starting WDT.
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 112k freed
xt_time: kernel timezone is -0000
nf_conntrack version 0.5.0 (1024 buckets, 30720 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
---portal module open ok
Register vlan_manage hooks success.
qca953x_GMAC: Length per segment 1536
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps CHECK DMA STATUS
mac:0 Registering S27....
qca953x_GMAC: RX TASKLET - Pkts per Intr:18
qca953x_GMAC: RX TASKLET - Timer Freq r:376
qca953x_GMAC: RX TASKLET - Rx Desc :128
qca953x_GMAC: Mac address for unit 0:bfff0000
qca953x_GMAC: ff:ff:ff:ff:ff:ff
qca953x_GMAC: Max segments per packet : 1
qca953x_GMAC: Max tx descriptor count : 128
qca953x_GMAC: Max rx descriptor count : 128
qca953x_GMAC: Mac capability flags : 3581
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps CHECK DMA STATUS
mac:1 Registering S27....
qca953x_GMAC: RX TASKLET - Pkts per Intr:18
qca953x_GMAC: RX TASKLET - Timer Freq r:376
qca953x_GMAC: RX TASKLET - Rx Desc :128
qca953x_GMAC: Mac address for unit 1:bfff0006
qca953x_GMAC: ff:ff:ff:ff:ff:ff
qca953x_GMAC: Max segments per packet : 1
qca953x_GMAC: Max tx descriptor count : 128
qca953x_GMAC: Max rx descriptor count : 128
qca953x_GMAC: Mac capability flags : 3D81
device eth0 entered promiscuous mode
device eth1 entered promiscuous mode
athr_gmac_ring_alloc Allocated 2048 at 0x83a63000
athr_gmac_ring_alloc Allocated 2048 at 0x83ab4800
HONEYBEE ----> S27 PHY MDIO
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
enet1 port4 up 100Mbps Full duplex
athr_gmac_ring_alloc Allocated 2048 at 0x83b2d000
athr_gmac_ring_alloc Allocated 2048 at 0x83a7a800
HONEYBEE ----> S27 PHY MDIO
ATHRS27: resetting s27
ATHRS27: s27 reset done
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
enet1 port4 up 100Mbps Full duplex
953x_GMAC: Enet Unit:1 PHY:4 is UP eth1 RGMII 1000Mbps full duplex
953x_GMAC: done cfg2 0x7215 ifctl 0x0 miictrl
Setting Drop CRC Errors, Pause Frames and Length Error frames
br0: port 2(eth1) entering forwarding state
br0: port 2(eth1) entering disabled state
br0: port 2(eth1) entering forwarding state
Disable VlanManage, data.enable(0), data.vid(1)
br_dhcp_filter: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
dhcp_filter: started sta0="ath7" sta1="".
command not supported
CJ++ for mspi_read_id get id=0xc2
ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_spectral: Version 2.0.0
Copyright (c) 2005-2009 Atheros Communications, Inc. All Rights Reserved
SPECTRAL module built on Nov 9 2016 16:07:26
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 10.2-00082-4 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
*** All the minfree values should be <= ATH_TXBUF-32, otherwise default value will be used instead ***
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
ATH_TXBUF=512
Enterprise mode: 0x03fc0000
Restoring Cal data from Flash
4646, ar9300_eeprom_restore_from_flash, ant_ctrl_chain = 0x1000:0x1000:0x1000
4650, ar9300_eeprom_restore_from_flash, xatten1_margin = 0x9:0x9:0x9
4654, ar9300_eeprom_restore_from_flash, xatten1_db = 0x1f:0x1f:0x1f
SPECTRAL : get_capability not registered
HAL_CAP_PHYDIAG : Capable
SPECTRAL : Need to fix the capablity check for RADAR (spectral_attach : 231)
SPECTRAL : get_capability not registered
HAL_CAP_RADAR : Capable
SPECTRAL : Need to fix the capablity check for SPECTRAL
(spectral_attach : 236)
SPECTRAL : get_capability not registered
HAL_CAP_SPECTRAL_SCAN : Capable
SPECTRAL : get_tsf64 not registered
spectral_init_netlink 52 NULL SKB
SPECTRAL : No ADVANCED SPECTRAL SUPPORT
SPECTRAL :----- module attached
ath_get_caps[6180] rx chainmask mismatch actual 3 sc_chainmak 0
ath_get_caps[6155] tx chainmask mismatch actual 3 sc_chainmak 0
ath_attach_dfs[12619] dfsdomain 1
SPECTRAL : module already attached
****************************************************
maclimit init
****************************************************
ATH_RESERVED_TXBUF = 1000
ath_tx_paprd_init sc 82558000 PAPRD disabled in HAL
wifi0: Atheros ???: mem=0xb8100000, irq=2
ath_pci: 10.2-00082-4 (Atheros/multi-bss)
ath_attach_dfs[12619] dfsdomain 1
wlan_vap_create : enter. devhandle=0x824302c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x824302c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created
ath_attach_dfs[12619] dfsdomain 2
DES SSID SET=WLAN-XX-2.4GHz
device ath0 entered promiscuous mode
VAP device ath1 created
ath_attach_dfs[12619] dfsdomain 2
DES SSID SET=WLAN-XX-2
device ath1 entered promiscuous mode
ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1
ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1
DES SSID SET=WLAN-XX-2.4GHz
br0: port 3(ath0) entering forwarding state
DES SSID SET=WLAN-XX-2
br0: port 4(ath1) entering forwarding state
CJ++ for mspi_read_id get id=0xc2
dhcp_filter: stoped.
br0: port 3(ath0) entering disabled state
br0: port 4(ath1) entering disabled state
device ath1 left promiscuous mode
br0: port 4(ath1) entering disabled state
ieee80211_ioctl_siwmode: imr.ifm_active=393856, new mode=3, valid=1
br0: port 3(ath0) entering forwarding state
DES SSID SET=WLAN-XX-2.4GHz
br0: port 3(ath0) entering disabled state
DEVICE IS DOWN ifname=ath0
br0: port 3(ath0) entering forwarding state
br0: port 3(ath0) entering disabled state
DEVICE IS DOWN ifname=ath0
br0: port 3(ath0) entering forwarding state
br0: port 3(ath0) entering disabled state
DEVICE IS DOWN ifname=ath0
br0: port 3(ath0) entering forwarding state
br0: port 3(ath0) entering disabled state
DEVICE IS DOWN ifname=ath0
br0: port 3(ath0) entering forwarding state
br0: port 3(ath0) entering disabled state
DEVICE IS DOWN ifname=ath0
br0: port 3(ath0) entering forwarding state
br0: port 3(ath0) entering disabled state
br0: port 3(ath0) entering forwarding state
br0: port 3(ath0) entering disabled state
VAP device ath1 created
ath_attach_dfs[12619] dfsdomain 2
BusyBox v1.01 (2016.05.23-08:15+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
1 Like
Hello,
Does anybody knows the way how to install unsigned firmware on this device without acces to UART pins?
LEDE is already ported and working well on it.
With regards.
Is there any available firmware lede / openwrt for device eap110-outdoor ?
Do you have firmware for eap110-outdoor? i need it please give link to download that firmware
There no eap110-outdoor firmware yet because luck of this hardware. But as I was told it is very similar to eap115 so i can prepare eap110-outdoor one for you to test. If you are interested to do testings - drop me a message.
1 Like
Hey!
I've ordered two used ones and as soon as the PoE injectors arrive, I'd love to give it a shot! Is it possible to have "network console" with the images so I can see error messages during boot?
Most problem with eap110-outdoor is to bypass rsa sign check and flash unsigned custom image. Are you ready for that? Or you have to open device case.
Sir yes sir 
I have plenty usb2ttl interfaces here, bluetooth serial interfaces and could even program an arduino board to get things done if necessary. The EAP110s are used not new. No warranties to void (that's the odd part ;-))
But I will have to wait till the power sources are there. I've become cheap at that part and AliExpress.com wares tend to ship 2-4 weeks.
Thanks!
I've had a whole lot of problems with one of the EAPs. The previous owner has drilled a hole not just into the case but the pcb also (DoubleWTF?). I'm sending it in and hope to get a replacement device. But luckily there's a second device and the power source should arrive within the next 5-7 days (knocking on wood). Is it possible to upload unsigned firmware images via website or should I use JTAG or whatever this thing uses? And which chip should be wired up then?
Post pics!
2 Likes
yo nerds
The FakePoE power sources arrived. The undrilled one booted up, accepted a config and a stock firmware update. I guess I'll be able to install the untested firmware images, soon and will report if it worked or not 
The drilled one will be replaced by the trader. He was kinda shocked, too (how could this happen where we test the hardware??? haha)
Hi, could you please upload the beta image again?
I have to compile one... Here they are https://fex.net/935690171910/653350316
Any chance for a web-flashable image? My AP is still under warranty, don't want to void it..
Images are already web-flashable but has no RSA sign, so you need to ask your Tp-link representative for RSA-signed transient firmware without RSA check. This is common issue for whole Tp-link EAP product line. AFAIK there is no other way to broke this RSA check and flash unsigned firmwares on this devices directly. I'll be glad if somebody can correct me.
And that transient firmware, it does exist? Maybe you have one?
Hi, I have tried to access the device using usb to serial and rs232 to ttl but did not get any results other than a blank screen, i have tried using putty and minicom with different baudrates but nothing worked, could anyone help me ?? is there another way to install openwrt firmware ??
