Netgear WN604 information

starfry · September 8, 2017, 4:29pm

I have a Netgear WN604, an 802.11n 150 access point and 4-port 10/100 switch (it is not an ADSL router). I found the stock firmware to be pretty bad and unreliable so I decided to pull it apart this afternoon...

It has a UART header (no soldering, yay!) and I was able to get a root login. Now, from what I have seen it's pretty basic Atheros AR7240 MIPS 24K V7.4 RAM=32MB and Flash=4M. So probably a borderline candidate for wasting any more time on.

That said, I have collected various info including board scans and other images, UART boot logs and various info from U-Boot and the Linux kernel.

There is a page on OpenWRT (https://wiki.openwrt.org/toh/netgear/netgear_wn604) but it's more of a placeholder than of much use. But I would be happy to contribute what I have either here or there.

Is there any interest ?

robimarko · September 8, 2017, 6:42pm

Well,should be too hard to support it.
Image without Luci will fit.

Can you post all you have?

starfry · September 8, 2017, 7:29pm

Sure. I'll try to get some time to do it tomorroe. Should i just post it here in the forum or as a table of hardware page? I'm unsure of the process.

robimarko · September 8, 2017, 7:36pm

You can do both.
Also OpeWRT wiki is a good place too

starfry · September 9, 2017, 4:26pm

Just pasting here for now.

Brand: Netgear
Model: WN604
Version:
SoC: Atheros AR7240
CPU: MIPS 24K V7.4
RAM MB: 32MB
Flash MB: 4MB

Flash must be ≥4MB; RAM must be ≥32MB (min. required for current LEDE) - OK (just!)

WAN: NONE
WLAN:Atheros AR9285 (from OpenWRT page) Atheros AR7240 (from Wikidevi) 2.4 b/g/n
Switch: Atheros AR7240 (from Wikidevi) 4 ports 10/100

CPU Query:

# cat /proc/cpuinfo
system type             : Atheros AR7240 (Python)
processor               : 0
cpu model               : MIPS 24K V7.4
BogoMIPS                : 225.79
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 16
extra interrupt vector  : yes
hardware watchpoint     : yes
ASEs implemented        : mips16
VCED exceptions         : not available
VCEI exceptions         : not available

Memory Query:

# cat /proc/meminfo
MemTotal:        30608 kB
MemFree:          9516 kB
Buffers:          1648 kB
Cached:           7312 kB
SwapCached:          0 kB
Active:           3588 kB
Inactive:         6304 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:        30608 kB
LowFree:          9516 kB
SwapTotal:           0 kB
SwapFree:            0 kB
Dirty:               0 kB
Writeback:           0 kB
Mapped:           2540 kB
Slab:             7380 kB
CommitLimit:     15304 kB
Committed_AS:     2768 kB
PageTables:        244 kB
VmallocTotal:  1048560 kB
VmallocUsed:      3416 kB
VmallocChunk:  1044832 kB

Storage Query:

 # cat /proc/mtd
 dev:    size   erasesize  name

mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 000b0000 00010000 "kernel"
mtd3: 00290000 00010000 "rootfs"
mtd4: 00050000 00010000 "var"
mtd5: 00010000 00010000 "manufacturing-data"
mtd6: 00010000 00010000 "ART"

The Flash size is reported as 4MB on the serial console during boot.

WiFi Query

 # iwinfo
 wifi0     IEEE 802.11a  ESSID:off/any  Nickname:""
      Mode:Managed  Channel:0  Access Point: F6:F8:00:00:00:00
      Bit Rate:128.76 kb/s   Tx-Power:2144400328 dBm   Sensitivity=0/3
      Retry:on   RTS thr=0 B   Fragment thr=0 B
      Encryption key:off
      Power Managementmode:All packets received

System query

 # uname -a
 Linux 2.6.15--LSDK-7.3.0.387-WN604_V3.3.7 #199 Wed Jul 26 09:54:49 IST 2017 mips unknown

U-Boot reports as U-Boot 1.1.4-g12193fce-dirty (Dec 14 2009 - 13:39:19)

Embossed on INSIDE of case bottom:

NETGEAR
280-10002-01
REV 09>ABS<
M6/CAV1

board scans https://imgur.com/a/ztv2F
(sorry too big to post here, but I wanted to keep the resolution high)

Screen logs https://gist.github.com/2df531d89f90cc5632f53796f2349f62

Admin username : admin
Admin password : password

Opening case

prise up four rubber feet on underside. They are not glued but designed to be lifted and have a retaining lug so they stay attached and don't get lost. Remove four screws. I believe they are torx but I was able to remove them with a flat 2.0mm bit. Once the screws are removed, the top just lifts off.
Arrange the board with the ethernet ports towards you (the antenna will be on the right-hand side and the power socket on the left hand side).
Locate four-pin header labelled UART in the centre of the board. Counting from the left, connect pins 1, 2, and 3 to a serial device (e.g. a USB-TTL adaptor). Pin 1 is GND, Pin 2 is TX and Pin 3 is RX.
Start terminal (e.g. screen /dev/TTYUSB0 115200)
Connect power to device and power on.

robimarko · September 9, 2017, 5:55pm

Do you maybe have switch configuration from stock firmware?

starfry · September 9, 2017, 7:19pm

I don't, but I can take a look tomorrow perhaps. I presume you mean if/how it has any vlans setup etc. If not, let me know what you mean and how I can get that info. I'm happy to try whatever...

robimarko · September 9, 2017, 8:54pm

Not VLAN-s, it would be nice to know which port is tied to CPU and which ones to WAN and LAN.

starfry · September 11, 2017, 7:05pm

I'm not sure how to find that out. I have run a load of other commands to get more info, not sure if any of it's helpful but I've added it to the gist linked above. If you want me to run any specific commands, either in u-boot or in the booted linux shell, let me know.

robimarko · September 11, 2017, 7:28pm

To me this device pretty much looks like Netgear WPN824N which is already supported.
Just without WAN port.
I can give it a go today/tommorow and try to make a image(May or may not work)

starfry · September 12, 2017, 9:26am

I looked up that WPN824N following your comment and it led me to find an OpenWRT forum post about WNR1000v2 which also discusses the WN604 and that led me to this thread which discusses a successful flashing of the WN604. So it looks like it is possible.

Also this may be of interest.

I'll keep the board out on my bench so I can try anything if you'd like me to. But I haven't done anything beyond flashing updated factory firmware via the web interface on this particular hardware. I have done a complete installation including tftp booting and installation through a soldered uart on another device so I am willing to roll my sleves up but I might need a little guidance. In case it matters, my computer is running Arch Linux.

robimarko · September 12, 2017, 9:44am

Well from what I have seen WP842N nad WN604 are exactly the same,WP842N just has WAN port in adittion of 4 LAN ports and that is it.
I have tried to build the firmware yesterday but since WP842N is legacy device it looks like building for it is broken so WN604 does not also works since they share almost everything

starfry · September 12, 2017, 10:21am

Do you think the build for wn824n (lede-17.01.2-ar71xx-generic-wpn824n-squashfs-factory.img) would work as is?

I guess it probably isn't worth the effort though. Anyway, I have more capable devices here awaiting my attention and I know they are supported. I will keep the WN604 around for a few more days but I'll probably sell it on....

robimarko · September 12, 2017, 10:27am

It could easily work.
Give it a try

starfry · September 12, 2017, 11:57am

OK. Mixed success.

I have a successful boot but it's old BARRIER BREAKER (14.07, r44095). I followed the instructions in this post using an image downloaded from github, specifically openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-barrier-breaker-r44095-img. Before I tried that one, I tried these:

lede-17.01.2-ar71xx-generic-wpn824n-squashfs-factory.img which gave Bad Magic Number,it is forbidden to be written to flash!!
lede-17.01.2-ar71xx-generic-wnr1000v2-squashfs-factory.img which installed but would not boot: Wrong Image Type for bootm command

I tried modifying the bootargs as per the linked forum post and that allows boot to proceed but the boot did not complete (some complaint about using jffs with an old kernel). I then tried:

openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-chaos-calmer-r44154.img obtained from github but that entered a boot loop.

Finally the one that worked:

## Booting image at 80800000 ...
   Image Name:   MIPS OpenWrt Linux-3.10.49
   Created:      2015-01-24  22:37:24 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1118220 Bytes =  1.1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 33554432

Starting kernel ...

[    0.000000] Linux version 3.10.49 (build@downloadfast01) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r44065) ) #3 Sat Jan 24 17:35:02 EST 2015
...
Please press Enter to activate this console.

I guess that the bootargs might be modified so that the LEDE image works. I think there's some kind of magic number that need to be replaced to get the image to take. No idea how to do either.

At least I have some kind of openwrt firmware on the device now.

One thing is that I can't get back to the factory firmware because the format is wrong (i.e. a zip-tar rather than an img). I'm not that bothered but it would be nice to be able to complete the cycle.

robimarko · September 12, 2017, 12:20pm

Great that one version works.
Yeah, it looks like LEDE uses a magic number from other Netgear router which does not match stock one.
Unfortunately that is beyond my knowledge

starfry · September 12, 2017, 2:46pm

I'm going to stick with what I have now - it may be an older build but I have it configured as an access point bridge and it's working great. Far better than the stock firmware ever was. Thank you for helping me, I appreciate it.

jlpapple · January 13, 2018, 5:39pm

It appears the magic number is 0x31303031.

http://www.saltwaterc.eu/adding-openwrt-support-for-netgear-wnr1000v2.html

jlpapple · January 14, 2018, 5:09pm

I'm currently running LEDE 17.01.4 r3560 successfully on a WNR1000V2-VC. I built the image using Image Builder and removed packages so the final size is ~3.4MB. If an image is much larger than that the device will bootloop or not preserve settings upon reboot.

More information:

kamild1996 · April 22, 2018, 11:58am

Hello, my Netgear WN604 has also been acting up lately and I would like to try OpenWRT out before replacing it. Just to make sure I understood correctly - you're using the "openwrt-ar71xx-generic-wnr1000v2-squashfs-factory-barrier-breaker-r44095-img" image, right? Do I follow the instructions exactly, without any changes in commands?
No performance or stability issues? Actually remembers settings after reboot, unlike Netgear's FW?
Thank you