There is a Mikrotik RB951Ui-2HnD router with OpenWrt 07/19/10 r11427-9ce6aa9d8d. The password is not known. Standard Mikrotik reset methods do not work. WinBox doesn't see it. Luci on 192.168.0.1 is available.
How can I reset the password?
https://openwrt.org/docs/guide-user/troubleshooting/failsafe_and_factory_reset
--
A lot of your question doesn't really compute, so we'll have to leave it at that generic advice.
1 Like
this instruction not working too.
without additional info, we can't help you.
Please, what info i need provide?
I can't enter filesafe mode, or make hard reset.
It looks as if the router does not respond to the reset button.
But if I press reset, then turn on the power and hold the button for a long time, the boot pattern changes.
So the button is not broken.
Did you follow the directions carefully, including setting a static IP on your computer?
Typically, you'll need to hit the reset button at just the right time to get into failsafe mode. For most devices, that means powering up and then immediately pressing and releasing the button quickly and many times until the LED goes from a medium speed blink to a very rapid one.
I tried many times in different ways. And always the same result:
- a fast 5-per-second blinking rhythm during two seconds, while router waits for a button press
- A slower, 2.5-per-second blink continuing to the end of normal boot, if the failsafe was not triggered
Do you have any information about the specific OpenWrt build that is on this device? Is it from the official project? Has it been customized (aside from the IP address and password)? It is possible to disable failsafe booting if you create a custom build, so that's always a possibility.
Are you able/willing to open the box and connect a serial UART cable?
Luci shows: Powered by LuCI openwrt-19.07 branch (git-22.099.58928-786ebc9) / OpenWrt 19.07.10 r11427-9ce6aa9d8d
Always on 192.168.0.1 That is all I know.
I can try.
I did a quick search on the device, and I didn't see anything specific about connecting serial (I may have just missed it, though). However, this may help in general, and we can assist in identifying candidate ports/pins.
I see rx, tx, gnd, 3.3v on the board. I can connect to it.
Great. As long as you have a 3.3V TTL UART adapter, you should be good... connect and see what happens.
Remember that you need to connect Tx on the board to Rx on your UART, and Rx to Tx. Connect ground, but do not connect the 3.3v.
I did it. COM5 CP210x is present
And do you get any output when you power up the device?
FWIW, the com port will show up regardless of the actual serial connection to the device... it's just the USB side that has been recognized by your computer's operating system.
OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80060000...
[ 0.000000] Linux version 4.14.275 (builder@buildhost) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r11427-9ce6aa9d8d)) #0 Sat Apr 16 13:13:32 2022
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
[ 0.000000] SoC: Atheros AR9344 rev 3
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 08000000 @ 00000000 (usable)
[ 0.000000] User-defined physical RAM map:
[ 0.000000] memory: 08000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] random: get_random_bytes called from 0x8052d740 with crng_init=0
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32512
[ 0.000000] Kernel command line: parts=1 boot_part_size=4194304 gpio=130603 HZ=300000000 mem=128M kmac=E4:8D:8C:5F:4B:44 board=951HnD board=951HnD ver=6.49.6 bver=3.24 hw_opt=00210005 boot=1 mlc=11 rootfstype=squashfs noinitrd
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 124164K/131072K available (4209K kernel code, 172K rwdata, 524K rodata, 204K init, 213K bss, 6908K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 51
[ 0.000000] Clocks: CPU:600.000MHz, DDR:400.000MHz, AHB:400.000MHz, Ref:25.000MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6370868154 ns
[ 0.000010] sched_clock: 32 bits at 300MHz, resolution 3ns, wraps every 7158278654ns
[ 0.008871] Calibrating delay loop... 299.82 BogoMIPS (lpj=1499136)
[ 0.086009] pid_max: default: 32768 minimum: 301
[ 0.091471] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.098984] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.109383] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.120594] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 0.128691] NET: Registered protocol family 16
[ 0.135348] MIPS: machine is MikroTik RouterBOARD 951Ui-2HnD
[ 0.645002] clocksource: Switched to clocksource MIPS
[ 0.651790] NET: Registered protocol family 2
[ 0.656975] IP idents hash table entries: 2048 (order: 2, 16384 bytes)
[ 0.665179] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.673095] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.680356] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.687709] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.694355] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.701711] NET: Registered protocol family 1
[ 0.709749] Crashlog allocated RAM at address 0x3f00000
[ 0.717028] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[ 0.729417] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.736085] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.757409] io scheduler noop registered
[ 0.761862] io scheduler deadline registered (default)
[ 0.768151] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.777542] console [ttyS0] disabled
[ 0.801770] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A
This doesn't look promising... it looks like you're not going to be able to do anything with serial on the OS. But maybe the bootloader???
IIRC, OpenWrt's serial console is not disabled by default. This suggests that this may be a customized build that may have also disabled failsafe mode. It would be worth trying to enter failsafe mode while observing the console output.
pressing reset not change any serial output.
Is there anything in terms of serial output on the bootloader? Can you interrupt the boot process and ideally flash new firmware?
Sorry, I don’t understand how this is?
How i can try to interrupt boot?
as the device boot up press any key on the pc keyboard