Need help starting development for UTStarcom WA3002G4

For Developers
1

I am a newbie to OpenWRT. This is my first post so forgive me for my mistakes or missing information (if any) :upside_down_face:
Alos, I don't know if I have posted this query in the right forum category or not ー The reason for me posting this here is because after my research, I concluded that the only way to achieve my main aim (mentioned below in bold) is by building OpenWRT for my router and flashing it.
But, if anyone knows of any other way (even if that does not include building OpenWRT) to achieve my main aim, your words are more than welcome! :slight_smile:

So, here's the story -
I have a ADSL modem+router which is nearly a decade old.
It was provided by my ISP. Here are its details ー
Manufacturer: UTStarcom
Model: WA3002G4

This was simply lying around for the past few years and so I thought I could find some other use for it ー
(Main Aim) ー I would like to use it as a wireless client to connect to another router (that does not have Ethernet support by hardware) and extend its network via the ethernet ports on this router.
(Similar to this - openwrt:org/docs/guide-user/network/wifi/relay_configuration) - please replace :
with . to get to the actual link. Because I am limited to only 2 links/post, I have to do this :slightly_frowning_face:
So, I telnet-ed into the router and did some basic findings ー

cat /proc/cpuinfo

system type : 96338W2
processor : 0
cpu model : BCM6338 V1.0
BogoMIPS : 239.20
wait instruction : no
microsecond timers : yes
tlb_entries : 32
extra interrupt vector : yes
hardware watchpoint : no
unaligned access : 24
VCED exceptions : not available
VCEI exceptions : not available

cat /proc/meminfo

MemTotal: 13924 kB
MemFree: 860 kB
Buffers: 1580 kB
Cached: 6604 kB
SwapCached: 0 kB
Active: 3748 kB
Inactive: 5720 kB
HighTotal: 0 kB
HighFree: 0 kB
LowTotal: 13924 kB
LowFree: 860 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 0 kB
Writeback: 0 kB
Mapped: 3128 kB
Slab: 1012 kB
Committed_AS: 5136 kB
PageTables: 232 kB
VmallocTotal: 1048560 kB
VmallocUsed: 912 kB
VmallocChunk: 1046624 kB

df

Filesystem 1k-blocks Used Available Use% Mounted on
/dev/mtdblock0 2944 2944 0 100% /
tmpfs 320 144 176 45% /var
tmpfs 16 0 16 0% /mnt

cat /proc/kmsg

Output is here.



What brought me to OpenWRT in the first place?
After looking at all these, I searched online with the CPU name and landed on this page - wiki:openwrt.org/doc/hardware/soc/soc.broadcom.bcm63xx (please replace :
with . to get to the actual link).
Then, I also read somewhere that it is possible to flash the firmware of another router if they have the same hardware. So, I searched WikiDevi for routers with similar hardware and only 3 results showed up. On checking the OpenWRT supported devices list (TOH), I couldn't find any of the 3 routers that appeared in the above results.
So, I concluded that the only way to achieve my aim is to build OpenWRT on my own. Correct me if I'm wrong.

But when I saw the recommended hardware configuration, I was sad to see that my router does not meet those requirements, so what can I do now?
Truly speaking, I am fine with a router that has minimal or no GUI and am also fine with giving up certain features of OpenWRT which I don't need (as long as my main aim above is satisfied).
Also, if there is some other build that is already built by someone and will work on this router, please suggest me about it. Thank you.

1 Like
3

But how is this related to my original query?
I do not want to buy a new router. I just need help creating a customised build of OpenWRT that will work on my router.
Is this not possible?

1 Like
4

WA3002G4 modem not supported:
DD-WRT
TOMATO
OpenWRT

5

It is not (very) hard to create a new image - but the cost/benefit for your router is not good. It is a very low RAM router (16MB), so it will probably not work with newer distributions. And the work to do that for a single unit seems a waste of time. But if you really want to do it, there are pages and pages that you can read that will help you - basically, you start with a similar router (same architecture) and change the things specific to your router (amount of ram, flash map, and so on), then compile the image.

You have a flash map

<4>Blk# BlkOff Blks MemLen Partition Name

<4> 0 1408 1 1024 NVRAM

<4> 69 40960 1 24576 Config 2

<4> 70 32768 1 8192 Scratch PAD

<4> 70 40960 1 24576 Config 1

From the file you annexed.

But I think it may be easier to get a supported router.

S.

1 Like
6

Ok. Thank you for replying. I found some similar routers on this website when I searched using tags.
However, I found that almost none of them have a build that has everything working satisfactorily.
And, I also agree with your point.
So, I have decided to postpone this work. I will do it surely. But later.
Thanks again. :slightly_smiling_face:

1 Like
7

So I was messing with this exact device, and I want to report what does not work - I ended up bricking it.

I interfaced with it using the UART serial (TTL) port header after opening it up. There were three different modes that I was able to use on this device:

CFE

This is a bootloader interface that you can access by interrupting a certain countdown. It is a severely hobbled interface - there are only commands to download or run images, and to change boot parameters before booting. The images can be obtained from TFTP. However, the checks on running an image seemed to be more stringent than those on flashing an image, which is really backwards. So I could not run random firmware images of other routers that are supposedly based on the same hardware platform, but I could flash them which I eventually took the risk of doing. This functionality is also available over the web interface over ethernet once the CFE is entered (which you can trigger using some reset button trickery that I didn't bother since I had serial port UART access). The flashing of images itself I did over the web interface.

I tried flashing three images, excluding the ones which the router absolutely refused to flash. One didn't work (one of the images in https://archive.openwrt.org/backfire/10.03.1/brcm63xx/), one worked (I think it was of some DSL 2600 router, deleted all the files out of frustration a little while ago) but gave me a similarly useless rooted experience (see next section), and one (from https://shankerbalan.net/blog/airtel-beetel-220bx-firmware/) destroyed the little functionality that existed and bricked the device.

Root

The root shell of the device I accessed by Ctrl-C ing at a particular point (a narrow window within the booting process that even allows it. Other stages simply ignore the Ctrl-C.). It was a little fun working on the root shell of the device, but wholly unsatisfying. The shell does not have even ls. Further, most of the useful functionality is wrapped up in a single cfm executable, whose autorunning is what you can stop by the above Ctrl-C. Without this cfm, network interfaces are not up, and I did not have the patience to figure out how to do that from scratch.

Thus there is no way I could see to get arbitrary data in or out of the device, to say copy a new binary for ls :

  • There is no dd to dump data.
  • There is a dumpmem, but most of the memory locations I tried were refused with access denied.
  • There is only cat which can output data, but no switches that popped up on --help which could be used to dump binary data. As text, loads of characters were question marks and the like.
  • There are ftpget and bftpd, which simply did not work because network interfaces were down.
  • There is tftp and tftpd but which only are meant to work with images (download to device only) or configuration data (both ways). In any case they would not have worked for the same reason as the previous bullet.

admin

This is the mode I get after allowing the full bootup. The user accounts here are the same 3 that one can see in the web GUI : admin, user, support. No root user as far as I can tell. The functionality also is not a full shell, but a restricted CLI that offers 1-14 guided inputs. It's wholly useless for rooting purposes.

As far as I can see, the only real way to mess with this device is to desolder the flash and access it via SPI externally. That is way too much trouble for me, so I am giving up and throwing the device.

1 Like
8

I too own this modem and was figuring out if in any I can make use of its working condition. But turns out, sadly it would become junk. Also I still found lot of people selling Modems in used markets. I wonder how many people would think of utilizing their possible potential