FirstTime Installation on W504V

Installing and Using OpenWrt
1

Hello openWRTs.

First of all, i have to say that i am totaly surprised, about the complexity of this topic.
Although i am a Linux user since many years, i got lost in my first attempt.

How far i got:
I managed to open the box, connected a Serial2USB adapter, and i was able to enter the administrative CommandLine ( 123! ). Today i used brntool.py and luckily i created two backups of the origin firmware.

As i am following these instructions

This done i reached " U-boot noninvasive (serial)" and here i am stuck at step 5.

Besides i read forward, but i can't identify the correct path to follow.
Additionally i have to say, that these tools are complete new for me.
Example: I don't know how to transfer u-boot.bin to the device.

My question is : Can anybody provide a list with the next steps ?

Thx in advance

2
1 Like
3

You need to install a program to do X-Modem transfers over the Serial2USB. The example uses sz, which is available in the package manager of every linux. You can also use other tools, there are many, but then you have to adapt the syntax example to your case.
(@ulmwind beat me by a few seconds :slight_smile: )

4

For Debian/ Ubuntu, this would be:

$ dpkg -S /usr/bin/sx 
lrzsz: /usr/bin/sx
1 Like
5

Hello again

During the last days i got a bit more familiar with the general handling of my W504V and sx etc.

Nevertheless the device is doing nothing more than looping around. Somehow i changed ( tried to ) the password which is prompted after entering the 3 spacetabs ( 123 ).

Now the box always denies the password entry. That means i can't get any further. Please have a look at my putty.log file. Is there still a chance ?

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2019.09.19 11:32:01 =~=~=~=~=~=~=~=~=~=~=~=
ROM VER: 1.0.3
CFG 01
Read EEPROM.



=======================================================================
Wireless ADSL IAD DANUBE Loader v1.01.06 build Oct 14 2009 11:46:45
                    Arcadyan Technology Corporation
=======================================================================
MXIC MX29LV640EB bottom boot 16-bit mode found

Copying boot params.....DONE

Press Space Bar 3 times to enter command mode ...
Get Primary to 0.....
Flash Checking  Passed.

Unzipping firmware at 0x80002000 ... with AREA[2][ZIP 1]  done
Ready to run firmware


======================
2nd Loader running ...
======================
MXIC MX29LV640EB bottom boot 16-bit mode found

Copying boot params.....DONE

Get Primary to 0.....
Flash Checking  Passed.

Unzipping firmware at 0x80002000 ... with AREA[2][ZIP 3] 
[ZIP Extra] [ZIP 1]  done
Ready to run firmware

In c_entry() function ...
install_exception 
Co config = 80008483
[INIT] Interrupt ...
##### _ftext      = 0x80002000
##### _fdata      = 0x809103D0
##### __bss_start = 0x809A408C
##### end         = 0x83A485BC
allocate_memory_after_end: alloc from 83A505C0 to 83AE4290, length=605372
##### Backup Data from 0x809103D0 to 0x83A505BC~0x83AE4278 len 605372
##### Backup Data completed
##### Backup Data verified

========== ADSL Modem initialization OK ! ======

RUNTASK id=25 dhcp_daemon...
RUNTASK id=26 dhcp_clt...on interface 14
main()> usb:1, ftp:0
Primary image: 0, flash area 2
---[ ZIP1 head start in 0xFFFFFFFFB0070000 ]---
found signature: 78h 56h 34h 12h
ulImgLens=2222060, LENGTH[2]-12=3932148
length checking OK
[0] find End at 0xFFFFFFFFB0293400 len=2222060
found signature: 78h 56h 34h 12h
ulImgLens=333804, LENGTH[2]-12=3932148
length checking OK
[1] find End at 0xFFFFFFFFB02E4C00 len=333804
---[ ZIP1 head start in 0xFFFFFFFFB02E5000 ]---
found signature: 78h 56h 34h 12h
ulImgLens=163864, LENGTH[2]-12=3932148
length checking OK
[2] find End at 0xFFFFFFFFB030D000 len=163864
---[ ZIP1 head start in 0xFFFFFFFFB030D400 ]---
found signature: 78h 56h 34h 12h
ulImgLens=464876, LENGTH[2]-12=3932148
length checking OK
[3] find End at 0xFFFFFFFFB037E800 len=464876
Image[1] at 0xB0070000, len = 2222060
Image[2] at 0xB0293800, len = 333804
Image[3] at 0xB02E5000, len = 163864
Image[4] at 0xB030D400, len = 464876
unzip for U/I from 0xb0293800 size 333804
Unzipping from B0293800 to 83C00000 ... unzip_address sig f0ac6812 pre
unzip_address sig 1268acf0 end
[ZIP 3] unzip_address sig 1aaaa2aa pre
unzip_address sig aaa2aa1a end
[ZIP 0] 
[ZIP Extra] unzip_address sig 5d000080 pre
unzip_address sig 8000005d end
[ZIP 1] [ZIP 1 2f534650] done
Uncompressed size = 2568359
drive start addr[0]=ffffffff83c00000, [1]=ffffffff83e730b0
httpd: listen at 192.168.2.1:80
httpd: listen at 192.168.2.1:443
RUNTASK httpd...
RUNTASK id=30 SSLClient ...
g_Client_Cert_Array=0x81cb854c
RUNTASK id=31 dnsproxy...
RUNTASK id=32 padmin_task_entry...
RUNTASK id=33 dhcpd_mgmt_task...
UPnP is enabled
UPNP Device initialize success! slot=34
TR64 init is taken care by UPnP.
Register StorageService Successful
[0] Allocate mailbox 6
[0] Allocate mailbox 7
FirstUseDate:0000-00-00T00:00:00
RUNTASK id=37 wscmain...
RUNTASK id=38 wsc_Send_eap_packet...
RUNTASK id=39 wsc_Send_UPNP_packet...
RUNTASK id=40 WSC_WaitUserAction_Task...
Starting Multitask...
run_project_task
RUNTASK id=41 CMV_task...
RUNTASK id=42 ds_tcp_policing...
[0] Allocate resource 111, FreeResource = 1
dma_device_register: no system buffer.

call ifx_ssc_init() = 0
call ifx_ssc_open() = 25
SPI_Init!
ifx_sscAllocConnection: device ISDN register sucessfully!
ISDN ResetInit: SPI INIT first now iISDNID -2117368740 iISDNCS 0
ifx_sscAllocConnection: device Proslic register sucessfully!
ProDAAInitialize: SPI INIT first now ProSlicID -2117368828 ProSlicCS 2
gptu: totally 6 16-bit timers/counters
cgu_get_fpi_bus_clock(2) = 83250000, clock_divider = 1
request_timer(4, 0x0000010D, 5203124)
Init timer (4) - OK
T_WLAN_INT=2
gSetting.CountryCode=0x8114
gSetting.Interface[T_WLAN_INT].Link_Type=1
RUNTASK id=44 apAppInit...
RUNTASK id=47 ScanMIH_task...

--> [is_power_on_reboot] reset_status = 0x80260000

[USB] UsbSPoolArray: 8381E744H ~ 8391F543, UsbSPool:8381E760
[USB] UsbMPoolArray: 8381C3D8H ~ 8381E2F7, UsbMPool:8381C3E0
[USB] UsbLPoolArray: 83925B74H ~ 8397DB93, UsbLPool:83925B80
[USB] Small  Un-Cached Memory(5977): 8381E760 ~ 8391F48F
[USB] Medium Un-Cached Memory(30): 8381C3E0 ~ 8381E1DF
[USB] Large  Un-Cached Memory(21): 83925B80 ~ 83979B7F
setUsbPciInfo() cpu_to_usb_addr_shift[3]:0x00000000, usb_to_cpu_addr_shift[3]:0x00000000
usb_pci_probe() Found Synopsis OTG, baseAddr:0xbe101000
usb_power_set() Previous power off:0, current time:0
usb_power_set(1) min time delay:6000, current delay:0
usb_power_set() Need delay:6500 **********
init psock cnt=16
COSIC Not Ready..558
COSIC Not Ready..1058
COSIC Not Ready..1558
COSIC Not Ready..2058
COSIC Not Ready..2558
COSIC Not Ready..3058
COSIC Not Ready..3558
COSIC Not Ready..4058
COSIC Not Ready..4558
COSIC Not Ready..5058
>>>0<<< DHCP DNS Server 0 0 (5058) (192.168.2.1)
COSIC Not Ready..5558
COSIC Not Ready..6058
COSIC Not Ready..6558
usb_power_set(2) min time delay:6000, current delay:6717
usb_hcd_init() func(0):0
usb_hcd_init() func(1):0
usb_hcd_init() func(2):0
usb_hcd_init() func(3):1
localhc_init() install otg driver(self->driver = 0x80986474, otg_driver=0x80986474).
usb_hcd_init() func(4):0
usb_hcd_init(): succ.
xSpeedtsk priority is 80
[HWLAN] [1] rapi_tmr_task running 
ifno2dot1x_if[2]=0
ifno2dot1x_if[12]=81
ifno2dot1x_if[8]=82
ifno2dot1x_if[9]=83
ifno2dot1x_if[10]=84
ifno2dot1x_if[11]=85
dot1x_wireless_if_mask=0x1f04
[main_8021x] dot1x_build_if_mapping() completed.
apAppInit called ????
init rand with sys_time=6765
ath_create_vap: ifr.ifr_name = wifi0 (before ioctl)
alloc_etherdev: name = wlan0
GetWdsIfno: name = wlan0
GetWdsIfno : return 2 , T_WDS_INT 8
alloc_etherdev> dev->priv = 0x810A6B40 **********
should asigned hard_start_xmit and open in dev structure ???
ReleaseWDS_ni : cnt 0
ath_create_vap: ifr.ifr_name = wlan0 (after ioctl)
apAppInit: ath_create_ap, T_WLAN_INT done
apAppInit> if_table[T_WIFI_INT]=0x0
wlan_confree_do> start ...
[HWLAN] gSetting.Wireless_mode=9 
Wireless Mode 9, Mixed 802.11n, 802.11g and 802.11b
wlan_confree_do> start ...
in wlan_confree_do_setmode,
------------------->change mode to  11NG ,OK
wlan_confree_do> start ...
------------------->change nohtie to 0 ,OK
------------------->change pureb to  0 ,OK
wlan_confree_do> start ...
ath_getchannels> nchan=50
ath_getchannels> nchan=50
ath_getchannels> nchan=50 match:9
------------------->change pureb to  0 ,OK
wlan_confree_do> start ...
------------------->change pureg to 0 ,OK
wlan_confree_do> start ...
------------------->change puren to 0 ,OK
wlan_confree_do> start ...
------------------->set mcast rate to 22 ,OK
wlan_confree_do> start ...
------------------->change cwmmode to 2 ,OK
wlan_confree_do> start ...
------------------->change extoffset to -1 ,OK
wlan_confree_do> start ...
wlan_confree_do> start ...
set amdulimit to 50000,OK!
wlan_confree_do> start ...
Set essid to WLAN-CA5759 , OK!
wlan_confree_do> start ...
Set mode to Master , OK!
wlan_confree_do> start ...
now in ieee80211_ioctl_siwfreq
Set channel to 9 , OK!
wlan_confree_do> start ...
Set country ie to 1 , OK!
wlan_confree_do> start ...
Set country ie to 0 , OK!
wlan_confree_do> start ...
Set tx_chainmask to 3 , OK!
wlan_confree_do> start ...
Set rx_chainmask to 3 , OK!
wlan_confree_do> start ...
set hide ssid = 0, OK
init_lx_acl>
init_lx_acl> acl=NULL
wlan_confree_do> start ...
open wds function , OK
apAppInit : ifno:2 dev->flags  00000000
[HWLAN]: dev->open = 801911d0, dev->name = wlan0
[HWLAN]: dev->open = 80118534, dev->name = wifi0
ar5416CheckChan: channel 2412/0x90080; HT configuration meet regulatory
ar5416CheckChan: phy mode 0, ext offset 0
ANI: capability: 9
ar5416CheckChan: channel 2452/0xf0080; HT configuration meet regulatory
ar5416CheckChan: phy mode 1, ext offset -1
ANI: capability: 9
>>>>>>>>>>>>>>>> DECT Driver: dect_drv_open() Reset COSIC DECT again...
>>>>>>>>>>>>>>>>>>>>>>>>>>>SPI_access_wait set to on
Wait VOIP_Init() finished...apAppInit : dev->flags  00001001
Init_SSLServer> input listen_protocol=6, nListenPort=443
[29] ssld_conf_init> ssl server info:
[29] PrivateKey=
[29] MyCertificate=
[29] CaCertificate=
[29] SSL_method=31
[29] verify_mode=0
[29] cipher_suites=ALL:@STRENGTH:!kEDH
[29] tftp_server_ip=140.92.61.131
[29] fn_myCerttificate=ServCert.pem
[29] fn_privateKey=PrivKey.pem
[29] fn_caCertificate=CaCert.pem
[29] ssld_conf_init> ssl server info end:
[29] pCtx=0x81cb58c0 in ssld_conf_init
ssld_ctx_reset_cert> this is pkcs12 type certificate

[29] ssld_ctx_reset_cert : re-LoadServerCertAndKey() ok!!

[29] ssld_ctx_reset_cert> re-LoadCACertificate( 1stCA ) ok!![29] ssld_conf_init> ssld_conf_init() ok
[dhcp_clt] enable dhcp client in interface THS[14]
[30] SSLClient> SSLClient() run
[30] sslc_conf_init> ssl client info:
[30] PrivateKey=
[30] MyCertificate=
[30] CaCertificate=
[30] SSL_method=31
[30] verify_mode=1
[30] cipher_suites=ALL:@STRENGTH:!kEDH
[30] tftp_server_ip=140.92.61.131
[30] fn_myCerttificate=ServCert.pem
[30] fn_privateKey=PrivKey.pem
[30] fn_caCertificate=CaCert.pem
[30] sslc_conf_init> ssl client info end:
[30] sslc_conf_init> pCtx=0x81c9e7a0 in ssld_conf_init

[30] [sslc_ctx_reset_cert] re-LoadCACertificate( 5thCA ) ok!!
[30] [sslc_ctx_reset_cert] re-LoadCACertificate( 4thCA ) ok!!
[30] sslc_ctx_reset_cert> re-LoadCACertificate( 3rdCA ) ok!!
[30] sslc_ctx_reset_cert> re-LoadCACertificate( 2ndCA ) ok!!
[30] sslc_ctx_reset_cert> re-LoadCACertificate( 1stCA ) ok!!sslc_ctx_reset_cert> this is pkcs12 type certificate

[30] sslc_ctx_reset_cert : re-LoadServerCertAndKey() ok!!
[30] sslc_conf_init> sslc_conf_init() ok
[30] SSLClient> want to bind socket for client application!
[USBLPT] Printer Initialize Fail : Plug Out !!
padmin_task_entry() task running

.......................
..........................

FWCAP: nPCM: 8  nALM: 2  nSIG: 5  nCOD: 5  nDECT: 6
FWCAP: nNLEC: 4 nWLEC: 4 nES: 4   nAGC: 5  nFAX: 5
FWCAP: nUTG:16  UTG/CH: 2 nMFTD: 5 nLIN: 2
FWCAP: nDTMFR: 5 nDTMFG: 5 nCIDS: 5 nCIDR: 5
VMMC_AddCaps: CODECS = 7df
IFXOS_EventWait: -20
.IFXOS_EventWait: -20
COSIC Not Ready..13058
IFXOS_EventWait: -20
IFXOS_EventWait: -20
COSIC Not Ready..13558
IFXOS_EventWait: -20
>>>>>>>>>>>>>>>>>>>>>>>>> IFXOS_EventInit event number 12 
[45] Allocate resource 151, FreeResource = 41
>>>>>>>>>>>>>>>>>>>>>>>>> IFXOS_EventInit event number 13 
[45] Allocate resource 152, FreeResource = 42
[reset_802dot1x] wireless module ready
[init_wpa] dot1x_ready[0]=3
[dot1x] : func blob_portstatus_set_global   <---------------------
gtk reKeyTime set to 86400
gtk reKeyPackets set to 0
[dot1x] : func blob_set_bcast_key   <---------------------
wlan_confree_do> start ...
[dot1x] : func blob_set_bcast_keyid   <---------------------
[dot1x] : func blob_get_mcast_packets   <---------------------
[dot1x] : func blob_deauthenticate_all   <---------------------
[init_wpa] dot1x_ready[1]=3
[init_wpa] dot1x_ready[2]=1
[init_wpa] dot1x_ready[3]=1
[init_wpa] dot1x_ready[4]=1
[init_wpa] dot1x_ready[5]=1
[reset_802dot1x] 802.1Xv2 ready
ifno2dot1x_if[2]=0
ifno2dot1x_if[12]=81
ifno2dot1x_if[8]=82
ifno2dot1x_if[9]=83
ifno2dot1x_if[10]=84
ifno2dot1x_if[11]=85
dot1x_wireless_if_mask=0x1f04
[main_8021x] dot1x_build_if_mapping() completed.
IFXOS_EventWait: -20
USR.Response dropped
Response dropped
Response dropped
$$$$$$$$$$IFXOS_EventWait: -20
$COSIC Not Ready..14058
$$$$$$$$$$$$$$$IFXOS_EventWait: -20
$$$$$$$$$$$$$$$$IFXOS_EventWait: -20
$$$$$$$$COSIC Not Ready..14558
$$$$$$$IFXOS_EventWait: -20
$$$$$$$$$$$$$$$$IFXOS_EventWait: -20
IFX_TAPI_Phone_Init: TAPI BBD_Dnld 0
===> 
Set PCM I/F 0 VMMC_handle:81c2ac80
IFX_TAPI_Phone_Init: TAPI FW_Start 0
$===> 
 VMMC_Ioctl: Phone 1 IFX_TAPI_LINE_TYPE ok!
 VMMC_Ioctl: Phone 1 IFXPHONE_SET_LINEFEED ok!
Set PCM I/F 1 VMMC_handle:81c2ac64
$IFX_TAPI_Phone_Init: TAPI FW_Start 0
===> 
 VMMC_Ioctl: Phone 2 IFX_TAPI_LINE_TYPE ok!
. VMMC_Ioctl: Phone 2 IFXPHONE_SET_LINEFEED ok!
Set PCM I/F 2 VMMC_handle:81c2ac48
$IFX_TAPI_Phone_Init: TAPI FW_Start 0
===> 
Set PCM I/F 3 VMMC_handle:81c2ac2c
IFX_TAPI_Phone_Init: TAPI FW_Start 0
$===> 
Set PCM I/F 4 VMMC_handle:81c2ac10
IFX_TAPI_Phone_Init: TAPI FW_Start 0
===> 
Set PCM I/F 5 VMMC_handle:81c2abf4
IFX_TAPI_Phone_Init: TAPI FW_Start 0
$===> 
Set PCM I/F 6 VMMC_handle:81c2abd8
IFX_TAPI_Phone_Init: TAPI FW_Start 0
===> 
Set PCM I/F 7 VMMC_handle:81c2abbc
$IFX_TAPI_Phone_Init: TAPI FW_Start 0
===> 
Set PCM I/F 8 VMMC_handle:81c2aba0
$Setting HOOK Related Parameters 0
Setting HOOKFLASH_TIME min 75 ms max 310 ms
Setting HOOKON_TIME min 320 max 320
Setting HOOK Related Parameters 1
Setting HOOKFLASH_TIME min 75 ms max 310 ms
$Setting HOOKON_TIME min 320 max 320
Setting HOOK Related Parameters 2
Setting HOOK Related Parameters 3
$RUNTASK id=37 VINETIC_DRV_Task...
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!RUNTASK VINETIC_T38_Task fails, ret -10
RUNTASK VOICE_API_task fails, ret -10
 TEL_DRV_Init
 TEL_DRV_StartDetVOIPHook
 TEL_DRV_StartDetDTMF
 TEL_DRV_StartDetCEDTone
 TEL_DRV_StartDetVOIPHook
 TEL_DRV_StartDetDTMF
 TEL_DRV_StartDetCEDTone
 TEL_DRV_StartDetVOIPHook
 TEL_DRV_StartDetDTMF
 TEL_DRV_StartDetCEDTone
 TEL_DRV_StartDetVOIPHook
 TEL_DRV_StartDetDTMF
 TEL_DRV_StartDetCEDTone
 TEL_DRV_StartDetVOIPHook
 TEL_DRV_StartDetDTMF
 TEL_DRV_StartDetCEDTone
 TEL_DRV_StartDetVOIPHook
 TEL_DRV_StartDetDTMF
 TEL_DRV_StartDetCEDTone
 TEL_DRV_StartDetVOIPHook
 TEL_DRV_StartDetDTMF
 TEL_DRV_StartDetCEDTone
 TEL_DRV_StartDetVOIPHook
 TEL_DRV_StartDetDTMF
 TEL_DRV_StartDetCEDTone
 TEL_DRV_InitTone
When * the value is 60000
When * the value is 60000
sys_voip_cfg->cpt.reorder = 425@-230;60(0.24/0.24/1)
TEL_DRV_TONE_REORDER  duration = 480
$ TEL_DRV_InitRing

>>>> STUN Setting <<<<
stun Enable : 0
stun Test Enable : 0
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
[45] Allocate resource 153, FreeResource = 43
[45] Allocate mailbox 28
COSIC Not Ready..15151
 VOICE_DRV_SetRxDataHookFunc
 VOICE_DRV_SetRxDataHookFunc
TEL_MGR_Init
[45] Allocate resource 154, FreeResource = 44
tel_mgr_mutex=154
[45] Allocate mailbox 29
 TEL_DM_Init
[45] Allocate resource 155, FreeResource = 45
******** TEL_LOG_UpdateCallRecord: No CallRecord Update, recNum:0 !!
[45] Allocate resource 156, FreeResource = 46
 TEL_DRV_SetPhoneEvtHookFunc
 TEL_DRV_SetLineEvtHookFunc
 TEL_MGR_VoiceChannelInit
Create task ISDN_GetCCBSCFStatus -10
SIP_CALLBACK_EnableDebug
SIP_CORE_EnableDebug
SIP_CORE_Init
[45] Allocate resource 157, FreeResource = 47
[45] Allocate mailbox 30
SIP_CORE_SetSipStatus
SIP_CORE_CreateTask
!SIP_CORE_CreateTask: SYS_TASK_Create fail
[45] Allocate resource 158, FreeResource = 48
COSIC Not Ready..15558
 OK.
RUNTSK l2s3 45
RUNTSK l3l2 -10
RUNTSK lll2 -10
RUNTSK decrTout -10
ISDN: Q_L2S3:3, Q_L3L2:4, Q_LLL2:5
X (15889)cosic_int_cnt 12000 1324/1000 spitaskchk 284
X (15889)cosic_int_cnt 24000 0/1000 spitaskchk 284

ROM VER: 1.0.3
CFG 01
Read EEPROM.



=======================================================================
Wireless ADSL IAD DANUBE Loader v1.01.06 build Oct 14 2009 11:46:45
                    Arcadyan Technology Corporation
=======================================================================
MXIC MX29LV640EB bottom boot 16-bit mode found

Copying boot params.....DONE

Press Space Bar 3 times to enter command mode ...
Get Primary to 0.....123
Please Enter Password:*
Flash Checking  Passed.

Unzipping firmware at 0x80002000 ... with AREA[2][ZIP 1]  done
Ready to run firmware
6

Hi all

Unfortunately i haven't made any progress with my W504V.
The box is only looping, because it doesn't accept any character as password.
( right after 1,2,3 spaces )
Can anybody tell me how to get the device again ?
I tried different key,reset,power combinations but i got no luck.

The reason why i am hanging at this step is: I played around with the administrative commands while i was there to get more familiar with that stuff.

Please - someone having a hint for me ? Thx in advance

7

In my Case, it's the Gerätepasswort(Device Password) standing on the back of the Router(first 4 digits).

8

Hello Kim
Thx for your hint, but it's not that easy. In my case the codeload continues right after typing the first character ( no matter which key i pressed ). Even worse, it continues after 2 seconds when i enter nothing.

I guess the W504V is in a loop, because it runs in a special mode, from where i don't know the way out.

The question is how to force it back to normal behaviour. I tried the 30/30/30 method already.

Would be great if anyone might know a trick - otherwise W504V >>> Wastebasket !!

9

Weird, i flashed the Speedport yesterday and had exactly the same behavour(Enter password, wrong key->boot continues; Waiting->boot continues).
Try pressing every digit and if it does not directly tries to boot after keypress-> remember and try the second. Theres only 4 digits, so you can brute force it.
Did you already flash something or have you ever managed to type the password in?

10

Hello Kim

No, i haven't flashed any system(router) so far. What i can tell you is that i managed once to get into the command menu. Being there i played around a bit, to get familiar with the menus, and to see/learn what there is inside. I remember that i ran a kind of "...environment" from one of the menus. And there i am right now.

Do you own a W504V, and do you have a screenshot from the command menue ? Do you know any other way, to get back into normal operating mode ?

Thx in advance

11

Hello Hartmut,
yes i own one. My menu looked exactly like this:

image
image531Ă—540 111 KB

The only thing i can think of, is to try to bruteforce the password(press one key, if it tries to boot, powercycle and try another key. If it doesn't boot after the keypress, the character is the right one)
I have now u-boot installed, so i can't try anything on the original menu.

12

Hello Kim

Thx for your reply.

Your JPG shows two things.

1st: You get 4 "stars" as an echo to the four digits you entered.

I get only one, and then the input sequence ends. ( the W504v boots )

2nd: As i have written, i was once in the command mode menu.

And maybe i wanted to leave it, by pressing Ctrl-C, and may be i mishapped

that i entered a capital "C" , leading to a new default password!?!?!?

Your hint to try it via brutforce was a good idea, but unfortunately w/o success.

Thinking about further opportunities .

Rgds Hartmut

13

This is exactly what happened to me, when i entered a wrong digit.
It validates the password per character, not with the whole pass. You dont even have to press enter to get it validated.

That sounds possible. Maybe you entered CTRL-C or something else as password.
I think, every ASCII character may be possible but sadly i can't try anymore what is possible to set.

You could try the unbrick mode to boot u-boot and then flash u-boot and openwrt after that.

https://openwrt.org/toh/t-com/spw504v#debricking

Boot partition is from 0xB0000000-0xB0029999
I didn't try it, but it should work like this, if you manage to get in u-boot:
flinfo
look if the boot partition is marked with (RO). If not, you should be able to do this
loadx
send u-boot image
now there should be an text like Total size: 0xXXXXXXXX The XXXXXXXX is the count for the copy command

erase B0000000 B0029999
cp.b 0x81000000 0xB0000000 count

now u-boot should be flashed
Again, i did not test it.