Hi everyone .
The Omada router is equipped with the Marvell 3720 CPU (DB-88F3720) with 1GB of DDR3 RAM.
I wanted to ask if it was possible to have an OpenWrt firmware compatible with the router. Or if someone was working on it.
Internally on the ER7212 PCB there are 4 pins for jtag.
Furthermore, the router currently only supports 1Gb of speed
but the two SFP ports are connected directly to the Marvell, perhaps you can use them at 2.5Gb (The other 10 ports will always go to 1Gb but it would become a very interesting router)
Have you got ssh access?
Yes but it is very limited
What's the results of dmesg and unname -a
dmseg
Error: Invalid command "dmseg"
unname -a
Error: Invalid command "unname"
Just making sure. Is it JTAG or a serial port?
Would be handy if there was a serial port?
We can also start to help if you want to try to upload more info to help and/or start work yourself on getting this in?
What's your development experience? It sounds like the shell you have isn't that featured and/or is locked down?
edit: your post above looks to be a locked down not a normal shell.
Can you break into a standard root shell from that?
Anyway here's quoting another thread where I posted steps to start adding a device:
Finally. Doing a binwalk and/or exploring the normal firmware image you download from the manufacturer's site. And/or find the GPL source dump from TP link for example if available?
edit:
There's code for er7206? I can't find er7212?
@evs
https://www.reddit.com/r/TPLink_Omada/s/zT7WU9CwJC
Teardown here
The Reddit post suggests the serial port is not connected
1 Like
I don't think I can get a different schell it's very limiting like ssh.I don't think I can get a different schell it's very limiting like ssh.
every now and then I enjoy writing codes and tinker a lot.
I don't know. On the PCB only the words TX RX are shown
2 Likes
My idea was to modify the original firmware to unlock ssh, or in any case to see the limitations imposed.
Can you downgrade to the earliest known firmware, there's known exploits across the omada range, TDDP is the most interesting:
What version of firmware are you running, if it's earlier than on the tplink website don't upgrade.
1 Like
I'm using the latest version😅
Need you to downgrade please, root for the er7206 was found here, the earliest firmware may still be vulnerable
1 Like
Thanks for the link!
Yeah U13 and associated circuitry aren't hooked up.
I'm guessing U13 is level converter? It says something about circuitry is same as OC200 so i'd have to look photos of that.
I guess "just add your own level converter" and "just have a steady hand and soldering skills" and now have serial port? =P
1 Like
ok I can try
do you mean to attack me on the rx and tx pins that I see?
Not an attack. I'm trying to be sarcastic. The quote was for effect. As In I don't expect you to do that. Obviously didn't translate well. Apologies.
We've confirmed that the RX/TX pins aren't going to work without soldering and/or a test jig and figuring out what the voltages are on that serial port out of the CPU?
I don't expect nor demand soldering skills. Just outlining that I guess that's a last resort.
Thanks for the photos!
no, don't worry. I meant if you wanted me to solder some wires to those outputs. It's not a problem for me to solder or see what signal comes out from there. but yes, I would also like it to be the last resort.
I also apologize for the translations
1 Like
All good. Just trying to de-escalate quickly.
And yeah would require a multimeter to check before doing something silly.
OC200 doesn't look similar at all. I'd need a better photo (of both) to mark it up and reverse engineer the circuit better. I'll try to mark up a photo of er7212 quickly before I have to go for today.
Here:
I guess to start with what is that big trace that is connected to R1347? What's the voltage?
And whether other end of that circuit connects to the TX/RX pins?
