Generic China "on-wall" router YTXC-958K 7628N

JRD_McLAREN · December 8, 2019, 10:15pm

Hello,

I bought this "on wall" router from china.
It has Mediatek MT7628NN processor, 64MB RAM and 8MB flash
one USB port, 2x 100M LAN and 300Mbps wifi with 2 internals antennas
..same as many "cheap" routers...

But this device have OpenWrt inside "directly from manufacturer" ...

Is "any" kind of support from OpenWrt community ..??
cause USB port is unusable, no needed software inside.

I can build new firmware for this device, but I have no enough experiences with this (mean OpenWrt).
Backup of original firmware is not possible - from U-boot or web interface.
(it is needed for reverse engineering, dtb fetch

Is able build kernel and boot or mount rootfs from USB drive .?
(kernel from build directory "mt7628-kernel.bin" can boot from tftp with no problem)

Thanks.

EDITED:
IP address of my server was changed..
actual one is http://89.173.96.22/dohc/ostatne/YTXC-985K/

JRD_McLAREN · December 8, 2019, 10:22pm

some pics ..
http://195.28.90.62/dohc/ostatne/YTXC-985K/DSCN4973.JPG

http://195.28.90.62/dohc/ostatne/YTXC-985K/DSCN4974.JPG

and boot-log

`[04030C0B][04030C0A]
DDR Calibration DQS reg = 00008687


U-Boot 1.1.3 (Dec 25 2017 - 22:59:38)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Dec 25 2017  Time:22:59:38
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
default: 3
 0
  
3: System Boot system code via Flash.
## Booting image at bc050000 ...
   Image Name:   OpenWrt Linux-3.10.14-p112871
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1279471 Bytes =  1.2 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...


LINUX started...

 THIS IS ASIC
[    0.000000] Linux version 3.10.14 (tonnyy@ubuntu) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 unknown) ) #56 Tue May 7 10:54:03 CST 2019
[    0.000000]
[    0.000000]  The CPU feqenuce set to 575 MHz
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] Software DMA cache coherency
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 64kB, 4-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock5 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=000414d1
[    0.000000] Readback ErrCtl register=000414d1
[    0.000000] Memory: 61020k/65536k available (2851k kernel code, 4476k reserved, 679k data, 180k init, 0k highmem)
[    0.000000] NR_IRQS:128
[    0.000000] console [ttyS1] enabled
[    0.096000] Calibrating delay loop... 382.46 BogoMIPS (lpj=764928)
[    0.128000] pid_max: default: 32768 minimum: 301
[    0.132000] Mount-cache hash table entries: 512
[    0.136000] NET: Registered protocol family 16
[    0.140000] RALINK_GPIOMODE = 54050404
[    0.144000] RALINK_GPIOMODE = 54040404
[    0.244000] ***** Xtal 40MHz *****
[    0.248000] start PCIe register access
[    0.748000] RALINK_RSTCTRL = 2400000
[    0.752000] RALINK_CLKCFG1 = fdbfffc0
[    0.756000]
[    0.756000] *************** MT7628 PCIe RC mode *************
[    1.256000] PCIE0 no card, disable it(RST&CLK)
[    1.284000] bio: create slab <bio-0> at 0
[    1.288000] usbcore: registered new interface driver usbfs
[    1.292000] usbcore: registered new interface driver hub
[    1.296000] usbcore: registered new device driver usb
[    1.300000] cfg80211: Calling CRDA to update world regulatory domain
[    1.304000] Switching to clocksource MIPS
[    1.308000] NET: Registered protocol family 2
[    1.320000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    1.332000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    1.344000] TCP: Hash tables configured (established 512 bind 512)
[    1.356000] TCP: reno registered
[    1.364000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    1.376000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.388000] NET: Registered protocol family 1
[    1.396000] MTK/Ralink EHCI/OHCI init.
[    1.408000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.420000] jffs2: version 2.2. (NAND) (SUMMARY)  (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.440000] msgmni has been set to 119
[    1.448000] io scheduler noop registered (default)
[    1.468000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.480000] serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
[    1.492000] serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
[    1.508000] Ralink gpio driver initialized
[    1.516000] flash manufacture id: ef, device id 40 17
[    1.528000] get_flash_id: ret: 0
[    1.532000] W25Q64BV(ef 40170000) (8192 Kbytes)
[    1.544000] mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
[    1.560000] Creating 5 MTD partitions on "raspi":
[    1.572000] 0x000000000000-0x000000800000 : "ALL"
[    1.584000] 0x000000000000-0x000000030000 : "Bootloader"
[    1.596000] 0x000000030000-0x000000040000 : "Config"
[    1.604000] 0x000000040000-0x000000050000 : "Factory"
[    1.616000] 0x000000050000-0x000000800000 : "firmware"
[    1.628000] 0x00000018862f-0x000000800000 : "rootfs"
[    1.640000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    1.668000] mtd: partition "rootfs_data" created automatically, ofs=0x450000, len=0x3b0000
[    1.684000] 0x000000450000-0x000000800000 : "rootfs_data"
[    1.696000] GMAC1_MAC_ADRH -- : 0x0000e043
[    1.704000] GMAC1_MAC_ADRL -- : 0xa505cc72
[    1.712000] Ralink APSoC Ethernet Driver Initilization. v3.1  256 rx/tx descriptors allocated, mtu = 1500!
[    1.732000] GMAC1_MAC_ADRH -- : 0x0000e043
[    1.740000] GMAC1_MAC_ADRL -- : 0xa505cc72
[    1.748000] PROC INIT OK!
[    1.752000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    1.768000] ehci-pci: EHCI PCI platform driver
[    1.776000] ehci-platform: EHCI generic platform driver
[    1.808000] ******MT7628 mtk phy
[    1.812000] *****run project phy.
[    1.828000] FM_OUT value: u4FmOut = 0(0x00000000)
[    1.844000] FM_OUT value: u4FmOut = 130(0x00000082)
[    1.852000] FM detection done! loop = 1
[    1.868000] SR calibration value u1SrCalVal = 6
[    1.876000] *********Execute mt7628_phy_init!!
[    1.884000] ehci-platform ehci-platform: EHCI Host Controller
[    1.896000] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1
[    1.912000] ehci-platform ehci-platform: irq 18, io mem 0x101c0000
[    1.936000] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00
[    1.948000] hub 1-0:1.0: USB hub found
[    1.956000] hub 1-0:1.0: 1 port detected
[    1.964000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    1.996000] *********Execute mt7628_phy_init!!
[    2.004000] ohci-platform ohci-platform: Generic Platform OHCI Controller
[    2.020000] ohci-platform ohci-platform: new USB bus registered, assigned bus number 2
[    2.036000] ohci-platform ohci-platform: irq 18, io mem 0x101c1000
[    2.108000] hub 2-0:1.0: USB hub found
[    2.116000] hub 2-0:1.0: 1 port detected
[    2.124000] TCP: cubic registered
[    2.132000] NET: Registered protocol family 10
[    2.140000] NET: Registered protocol family 17
[    2.148000] 8021q: 802.1Q VLAN Support v1.8
[    2.188000] registered taskstats version 1
[    2.204000] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    2.216000] Freeing unused kernel memory: 180K (80373000 - 803a0000)
procd: Console is alive
procd: - preinit -
[    4.520000] Raeth v3.1 (Tasklet,SkbRecycle)
[    4.528000]
[    4.528000] phy_tx_ring = 0x03f95000, tx_ring = 0xa3f95000
[    4.544000]
[    4.544000] phy_rx_ring0 = 0x03f96000, rx_ring0 = 0xa3f96000
[    4.572000] GMAC1_MAC_ADRH -- : 0x0000e043
[    4.580000] GMAC1_MAC_ADRL -- : 0xa505cc72
[    4.588000] RT305x_ESW: Link Status Changed
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
kmod: ran 1 iterations
4[    8.180000] jffs2: notice: (237) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (1 unchecked, 1 orphan) and 22 of xref (0 dead, 11 orphan) found.
block: extroot: no root or overlay mount defined
jffs2 is ready
jffs2 is ready
[    8.276000] jffs2: notice: (234) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (1 unchecked, 1 orphan) and 22 of xref (0 dead, 11 orphan) found.
switching to overlay
[    8.320000] ra2880stop()...Done
[    8.324000] Free TX/RX Ring Memory!
procd: - early -
procd: - ubus -
procd: - init -

MT7628 login: [   10.120000] l2tp_core: L2TP core driver, V2.0
[   10.132000] l2tp_netlink: L2TP netlink interface
[   10.160000] nf_conntrack version 0.5.0 (956 buckets, 3824 max)
[   10.188000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   10.236000] u32 classifier
[   10.244000]     input device check on
[   10.248000]     Actions configured
[   10.276000] Mirror/redirect action on
[   11.044000]
[   11.044000]
[   11.044000] === pAd = c0503000, size = 1476032 ===
[   11.044000]
[   11.064000] <-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
[   11.076000] <-- RTMPAllocAdapterBlock, Status=0
[   11.088000] RtmpChipOpsHook(492): Not support for HIF_MT yet!
[   11.100000] mt7628_init()-->
[   11.104000] mt7628_init(FW(8a00), HW(8a01), CHIPID(7628))
[   11.116000] e2.bin mt7628_init(1117)::(2), pChipCap->fw_len(63056)
[   11.128000] mt_bcn_buf_init(218): Not support for HIF_MT yet!
[   11.140000] <--mt7628_init()
[   11.152000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   11.164000] Type=Linux
[   11.220000] Ralink APSoC Hardware Watchdog Timer
[   11.232000] rdm_major = 253
[   11.276000] xt_time: kernel timezone is -0000
[   11.296000] PPP generic driver version 2.4.2
[   11.308000] NET: Registered protocol family 24
[   11.320000] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[   16.468000] Raeth v3.1 (Tasklet,SkbRecycle)
[   16.476000]
[   16.476000] phy_tx_ring = 0x0296f000, tx_ring = 0xa296f000
[   16.492000]
[   16.492000] phy_rx_ring0 = 0x02970000, rx_ring0 = 0xa2970000
[   16.520000] GMAC1_MAC_ADRH -- : 0x0000e043
[   16.528000] GMAC1_MAC_ADRL -- : 0xa505cc72
[   16.536000] RT305x_ESW: Link Status Changed
[   16.548000] TX_BCN DESC a310a000 size = 320
[   16.556000] RX[0] DESC a310c000 size = 2048
[   16.568000] RX[1] DESC a310d000 size = 1024
[   16.612000] E2pAccessMode=2
[   16.620000] cfg_mode=9
[   16.624000] cfg_mode=9
[   16.628000] wmode_band_equal(): Band Equal!
[   16.644000] APSDCapable[0]=1
[   16.648000] APSDCapable[1]=1
[   16.652000] APSDCapable[2]=1
[   16.660000] APSDCapable[3]=1
[   16.664000] APSDCapable[4]=1
[   16.672000] APSDCapable[5]=1
[   16.676000] APSDCapable[6]=1
[   16.684000] APSDCapable[7]=1
[   16.688000] APSDCapable[8]=1
[   16.696000] APSDCapable[9]=1
[   16.700000] APSDCapable[10]=1
[   16.704000] APSDCapable[11]=1
[   16.712000] APSDCapable[12]=1
[   16.716000] APSDCapable[13]=1
[   16.724000] APSDCapable[14]=1
[   16.728000] APSDCapable[15]=1
[   16.736000] default ApCliAPSDCapable[0]=1
[   16.744000] default ApCliAPSDCapable[1]=1
[   16.756000] Key1Str is Invalid key length(0) or Type(0)
[   16.768000] Key1Str is Invalid key length(0) or Type(0)
[   16.780000] Key2Str is Invalid key length(0) or Type(0)
[   16.788000] Key2Str is Invalid key length(0) or Type(0)
[   16.800000] Key3Str is Invalid key length(0) or Type(0)
[   16.812000] Key3Str is Invalid key length(0) or Type(0)
[   16.820000] Key4Str is Invalid key length(0) or Type(0)
[   16.832000] Key4Str is Invalid key length(0) or Type(0)
[   16.900000] RTMPSetDefaultChannel() : default channel to 1
[   16.908000] load fw image from fw_header_image
[   16.920000] AndesMTLoadFwMethod1(2174)::pChipCap->fw_len(63056)
[   16.932000] FW Version:_e2_mp
[   16.936000] FW Build Date:20150211175503
[   16.944000] CmdAddressLenReq:(ret = 0)
[   16.952000] CmdFwStartReq: override = 1, address = 1048576
[   16.964000] CmdStartDLRsp: WiFI FW Download Success
[   17.128000] MtAsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
[   17.140000] efuse_probe: efuse = 10000012
[   17.148000] RtmpChipOpsEepromHook::e2p_type=2, inf_Type=4
[   17.160000] RtmpEepromGetDefault::e2p_dafault=2
[   17.168000] RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2
[   17.184000] NVM is FLASH mode
[   17.192000] 1. Phy Mode = 14
[   17.356000] Country Region from e2p = ffff
[   17.364000] tssi_1_target_pwr_g_band = 39
[   17.372000] 2. Phy Mode = 14
[   17.380000] 3. Phy Mode = 14
[   17.384000] NICInitPwrPinCfg(11): Not support for HIF_MT yet!
[   17.396000] NICInitializeAsic(651): Not support rtmp_mac_sys_reset () for HIF_MT yet!
[   17.412000] mt_mac_init()-->
[   17.416000] MtAsicInitMac()-->
[   17.424000] mt7628_init_mac_cr()-->
[   17.432000] MtAsicSetMacMaxLen(1241): Set the Max RxPktLen=1024!
[   17.444000] <--mt_mac_init()
[   17.448000]  WTBL Segment 1 info:
[   17.456000]          MemBaseAddr/FID:0x28000/0
[   17.464000]          EntrySize/Cnt:32/128
[   17.468000]  WTBL Segment 2 info:
[   17.476000]          MemBaseAddr/FID:0x40000/0
[   17.484000]          EntrySize/Cnt:64/128
[   17.492000]  WTBL Segment 3 info:
[   17.496000]          MemBaseAddr/FID:0x42000/64
[   17.504000]          EntrySize/Cnt:64/128
[   17.512000]  WTBL Segment 4 info:
[   17.520000]          MemBaseAddr/FID:0x44000/128
[   17.528000]          EntrySize/Cnt:32/128
[   17.532000] AntCfgInit(2876): Not support for HIF_MT yet!
[   17.544000] MCS Set = ff ff 00 00 01
[   17.552000] MtAsicSetChBusyStat(826): Not support for HIF_MT yet!
[   17.828000] CmdSlotTimeSet:(ret = 0)
[   20.216000] [PMF]ap_pmf_init:: apidx=0, MFPC=0, MFPR=0, SHA256=0
[   20.228000] [PMF]ap_pmf_init:: apidx=1, MFPC=0, MFPR=0, SHA256=0
[   20.240000] MtAsicSetRalinkBurstMode(2919): Not support for HIF_MT yet!
[   20.252000] MtAsicSetPiggyBack(763): Not support for HIF_MT yet!
[   20.284000] MtAsicSetTxPreamble(2898): Not support for HIF_MT yet!
[   20.296000] MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
[   20.308000] Main bssid = e0:43:a5:05:cc:70
[   20.316000] <==== rt28xx_init, Status=0
[   20.336000] RT28xx_Monitor_Init: 764 !!!!####!!!!!!
[   20.352000] mt7628_set_ed_cca: TURN OFF EDCCA  mac 0x10618 = 0xd7083f0f
[   20.364000] WiFi Startup Cost (ra0): 3.816s
[   20.376000] device eth0.1 entered promiscuous mode
[   20.388000] device eth0 entered promiscuous mode
[   20.476000] br-lan: port 1(eth0.1) entered forwarding state
[   20.484000] br-lan: port 1(eth0.1) entered forwarding state
[   22.136000] device ra0 entered promiscuous mode
[   22.144000] br-lan: port 2(ra0) entered forwarding state
[   22.156000] br-lan: port 2(ra0) entered forwarding state
[   22.488000] br-lan: port 1(eth0.1) entered forwarding state
[   24.160000] br-lan: p[04030C0A][04030C0A]`

JRD_McLAREN · December 8, 2019, 10:25pm

inside ..

http://195.28.90.62/dohc/ostatne/YTXC-985K/DSCN4975.JPG

http://195.28.90.62/dohc/ostatne/YTXC-985K/DSCN4976.JPG

slh · December 8, 2019, 11:24pm

There is no such thing as a generic router, embedded devices all come with their own peculiarities that need to be accounted for in device tree, network setup and image recipes. So your device will require its own, dedicated firmware image - for some devices this is easier than for others (ramips is generally towards the slightly easier side), but it will have to be done.

JRD_McLAREN · December 9, 2019, 8:46am

Hello, thanks for your post, but it is not answer for my question.

I know all of that things, as you talking about it.

.. and try to find any "homepage" for this router ..

mk24 · December 9, 2019, 2:11pm

That stock firmware looks like a manufacturer SDK build, the wifi drivers are not the open ones.

Are the SoC data lines connected to the USB port, or is it only for charging?

JRD_McLAREN · December 9, 2019, 8:38pm

USB port is connected to SOC ...
kernel recognize any usb device

I have no shell via ttl line, ... (cause is missing in firmware)
Default username is root and password is admin ..
..but after successful login it do nothing ..

[ 2.352000] usb 1-1: new high-speed USB device number 2 using ehci-platform

duo8 · December 10, 2019, 7:05am

Does the manufacturer provide any source for it?

JRD_McLAREN · December 10, 2019, 8:52am

I can't find any manufacter website..
I can't find real manufacter of this one..

Try to open aliexperess or alibaba and you can see many versions of one product.
it could be Outenga, Bcsongben, Wallpad or Waizmann

JRD_McLAREN · December 11, 2019, 4:51pm

So .. U-boot command do something

MT7628 # spi read 0x0 0x500 
read len: 1280
ff 0 0 10 0 0 0 0 fd 0 0 10 0 0 0 0 12 3 0 10 0 0 0 0 10 3 0 10 0 0 0 0 e 3 0 10 0 0 0 0 c 3 0 10 0 0 0 0 a 3 0 10 0 0 0 0 8 3 0 10 0 0 0 0 6 3 0 10 0 0 0 0 4 3 0 10 0 0 0 0 2 3 0 10 0 0 0 0 0 3 0 10 0 0 0 0 fe 2 0 10 0 0 0 0 fc 2 0 10 0 0 0 0 fa 2 0 10 0 0 0 0 f8 2 0 10 0 0 0 0 f6 2 0 10 0 0 0 0 f4 2 0 10 0 0 0 0 f2 2 0 10 0 0 0 0 f0 2 0 10 0 0 0 0 ee 2 0 10 0 0 0 0 ec 2 0 10 0 0 0 0 ea 2 0 10 0 0 0 0 e8 2 0 10 0 0 0 0 e6 2 0 10 0 0 0 0 e4 2 0 10 0 0 0 0 e2 2 0 10 0 0 0 0 e0 2 0 10 0 0 0 0 de 2 0 10 0 0 0 0 dc 2 0 10 0 0 0 0 da 2 0 10 0 0 0 0 d8 2 0 10 0 0 0 0 d6 2 0 10 0 0 0 0 d4 2 0 10 0 0 0 0 d2 2 0 10 0 0 0 0 d0 2 0 10 0 0 0 0 ce 2 0 10 0 0 0 0 cc 2 0 10 0 0 0 0 ca 2 0 10 0 0 0 0 c8 2 0 10 0 0 0 0 c6 2 0 10 0 0 0 0 c4 2 0 10 0 0 0 0 c2 2 0 10 0 0 0 0 c0 2 0 10 0 0 0 0 be 2 0 10 0 0 0 0 bc 2 0 10 0 0 0 0 ba 2 0 10 0 0 0 0 b8 2 0 10 0 0 0 0 b6 2 0 10 0 0 0 0 b4 2 0 10 0 0 0 0 b2 2 0 10 0 0 0 0 b0 2 0 10 0 0 0 0 ae 2 0 10 0 0 0 0 ac 2 0 10 0 0 0 0 aa 2 0 10 0 0 0 0 a8 2 0 10 0 0 0 0 a6 2 0 10 0 0 0 0 a4 2 0 10 0 0 0 0 a2 2 0 10 0 0 0 0 a0 2 0 10 0 0 0 0 9e 2 0 10 0 0 0 0 9c 2 0 10 0 0 0 0 9a 2 0 10 0 0 0 0 98 2 0 10 0 0 0 0 97 2 0 10 0 2 1a 24 94 2 0 10 0 0 0 0 92 2 0 10 0 0 0 0 90 2 0 10 0 0 0 0 8e 2 0 10 0 0 0 0 8c 2 0 10 0 0 0 0 8a 2 0 10 0 0 0 0 88 2 0 10 0 0 0 0 86 2 0 10 0 0 0 0 84 2 0 10 0 0 0 0 82 2 0 10 0 0 0 0 80 2 0 10 0 0 0 0 7e 2 0 10 0 0 0 0 7c 2 0 10 0 0 0 0 7a 2 0 10 0 0 0 0 78 2 0 10 0 0 0 0 77 2 0 10 80 2 1a 24 74 2 0 10 0 0 0 0 72 2 0 10 0 0 0 0 70 2 0 10 0 0 0 0 6e 2 0 10 0 0 0 0 6c 2 0 10 0 0 0 0 6a 2 0 10 0 0 0 0 68 2 0 10 0 0 0 0 66 2 0 10 0 0 0 0 64 2 0 10 0 0 0 0 62 2 0 10 0 0 0 0 60 2 0 10 0 0 0 0 5e 2 0 10 0 0 0 0 5c 2 0 10 0 0 0 0 5a 2 0 10 0 0 0 0 58 2 0 10 0 0 0 0 57 2 0 10 0 3 1a 24 54 2 0 10 0 0 0 0 52 2 0 10 0 0 0 0 50 2 0 10 0 0 0 0 4e 2 0 10 0 0 0 0 4c 2 0 10 0 0 0 0 4a 2 0 10 0 0 0 0 48 2 0 10 0 0 0 0 46 2 0 10 0 0 0 0 44 2 0 10 0 0 0 0 42 2 0 10 0 0 0 0 40 2 0 10 0 0 0 0 3e 2 0 10 0 0 0 0 3c 2 0 10 0 0 0 0 3a 2 0 10 0 0 0 0 38 2 0 10 0 0 0 0 37 2 0 10 80 3 1a 24 34 2 0 10 0 0 0 0 32 2 0 10 0 0 0 0 30 2 0 10 0 0 0 0 2e 2 0 10 0 0 0 0 2c 2 0 10 0 0 0 0 2a 2 0 10 0 0 0 0 28 2 0 10 0 0 0 0 26 2 0 10 0 0 0 0 24 2 0 10 0 0 0 0 22 2 0 10 0 0 0 0 20 2 0 10 0 0 0 0 1e 2 0 10 0 0 0 0 1c 2 0 10 0 0 0 0 1a 2 0 10 0 0 0 0 18 2 0 10 0 0 0 0 25 8 0 0 25 10 0 0 25 18 0 0 25 20 0 0 25 28 0 0 25 30 0 0 25 38 0 0 25 40 0 0 25 48 0 0 25 50 0 0 25 58 0 0 25 60 0 0 25 68 0 0 25 70 0 0 25 78 0 0 25 80 0 0 25 88 0 0 25 90 0 0 25 98 0 0 25 a0 0 0 25 a8 0 0 25 b0 0 0 25 b8 0 0 25 c0 0 0 25 c8 0 0 25 d0 0 0 25 d8 0 0 25 e0 0 0 25 e8 0 0 25 f0 0 0 25 f8 0 0 0 b0 8 3c 34 0 8 35 0 0 9 8d 0 4 29 35 0 0 9 ad 0 60 a 40 4 0 b 24 0 60 8b 40 0 90 80 40 3 0 b 24 0 98 8b 40 0 68 80 40 0 80 a 40 7 0 b 24 27 58 60 1 24 50 4b 1 3 0 4a 35 0 80 8a 40 0 48 80 40 ff ff a 24 0 58 8a 40 1 80 a 40 80 5a a 0 42 5f b 0 13 0 60 11 0 0 0 0 2 0 e 24 4 58 6e 1 c0 61 a 0 42 67 c 0 40 0 e 24 4 60 8e 1 40 6b a 0 
MT7628 #

now the question is, how to grab hex code from serial line to file ...

mk24 · December 11, 2019, 7:11pm

On a Linux PC, there should be xxd, with the -r option xxd can create a binary file out of hex text.

JRD_McLAREN · December 11, 2019, 9:15pm

problem is single char value ..

hex 00 is "reported" as 0
hex 03 as 3 ..
etc.

it need to be reformated

(I must improve my skill)

EDITED: ...
..NO .. don't need

JRD_McLAREN · December 14, 2019, 3:15pm

.. IT MUST BE REFORMATED ... !!

and grabbed as 64k blocks

JRD_McLAREN · December 14, 2019, 4:39pm

..if anybody can play with this ..
http://195.28.90.62/dohc/ostatne/YTXC-985K/dumpcc.bin
http://195.28.90.62/dohc/ostatne/YTXC-985K/dumpcc.hex

JRD_McLAREN · December 15, 2019, 12:28pm

OH,
I have some mistakes in image files ..
New versions are uploaded.

JRD_McLAREN · December 15, 2019, 2:26pm

Separate files uploaded also

http://195.28.90.62/dohc/ostatne/YTXC-985K/Bootloader.bin
http://195.28.90.62/dohc/ostatne/YTXC-985K/Bootloader.hex
http://195.28.90.62/dohc/ostatne/YTXC-985K/Config.bin
http://195.28.90.62/dohc/ostatne/YTXC-985K/Config.hex
http://195.28.90.62/dohc/ostatne/YTXC-985K/Factory.bin
http://195.28.90.62/dohc/ostatne/YTXC-985K/Factory.hex
http://195.28.90.62/dohc/ostatne/YTXC-985K/firmware.bin
http://195.28.90.62/dohc/ostatne/YTXC-985K/firmware.hex

JRD_McLAREN · December 15, 2019, 2:49pm

Yes, I got it ..
and the real root for this router is "e-ruike"
just try any password, now...

(or try john)

JRD_McLAREN · December 15, 2019, 4:32pm

Where is stored dts / dtb information in OpenWrt system..??
(..at the end of the kernel .. ?? )

..I can't find it ..

JRD_McLAREN · December 15, 2019, 5:47pm

Here is modified bin file .. "root with shell" ..

http://195.28.90.62/dohc/ostatne/YTXC-985K/original_firmware_kernel_hsqs_root_with_shell_no_jffs.bin

E-RUIKE login: root
Password: 


BusyBox v1.22.1 (2019-01-13 22:23:20 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 BARRIER BREAKER (2.4, unknown)
 -----------------------------------------------------
  * 1/2 oz Galliano         Pour all ingredients into
  * 4 oz cold Coffee        an irish coffee mug filled
  * 1 1/2 oz Dark Rum       with crushed ice. Stir.
  * 2 tsp. Creme de Cacao
 -----------------------------------------------------
e-ruike@E-RUIKE:~#

JRD_McLAREN · December 17, 2019, 5:13pm

Now I have new image based on OpenWrt 19.07 for generic mt7628

make image PROFILE=mt7628 PACKAGES="luci mc luci-app-p910nd luci-app-ddns"

http://195.28.90.62/dohc/ostatne/YTXC-985K/openwrt-19.07.0-rc2-ramips-mt76x8-mt7628-squashfs-sysupgrade.bin

DTS and kernel for 64MB device and 8MB flash ...
http://195.28.90.62/dohc/ostatne/YTXC-985K/YTXC-958_mt7628an-eval-board.dtb
http://195.28.90.62/dohc/ostatne/YTXC-985K/YTXC-958_mt7628an-eval-board.dts
http://195.28.90.62/dohc/ostatne/YTXC-985K/mt7628-kernel.bin

I have not tested buttons (Reset, WPS, Wifi)
and some settings in device tree may be corrected.