OpenWrt for Securifi Almond 3S

For Developers
1

Hey guys!

I’ve managed to port OpenWrt to this device, and was wondering if anyone else happens to own one too? It’s from 2018; the company went bankrupt — all their servers are offline now. It’s selling for about $17 here, and honestly, it has surprisingly nice specs for the price and build quality:

Specs:

  • MediaTek MT7621A (dual-core MIPS 1004Kc @ ~880 MHz)
  • 256 MB RAM, 64 MB SPI-NOR Flash
  • 2.8" color LCD/TFT (S028HQ29NN, 320×240, stylus)
  • I²C touch controller: SX8650 (from Mouser)
  • USB 2.0, 1× WAN, 2× LAN (1 Gbit)
  • Wi-Fi: 2.4 & 5 GHz (MT7662)
    • 2×2 802.11ac up to 867 Mbps
    • 2×2 802.11n up to 300 Mbps
  • Zigbee: EM357 from Silicon Labs (192 kB flash, 12 kB RAM)
  • 1× LED, built-in siren
  • About 5 hours of battery life
  • LTE Cat 1 modem (Quectel EC21EFAR06A03M4G, up to 10 Mbps)
  • Linux Almond3 (kernel 3.10.14)
  • PIC16LF1509 + BQ24133 charge controller

I built a stable OpenWrt 24.10.5 image for it — MACs, WAN, LAN, USB, LTE, and Wi-Fi all work fine. I also found a GPIO pin for the display, so it’s just acting as an LED for now (I can turn it off when needed).

I switched the bootloader to this one: https://github.com/DragonBluep/uboot-mt7621, since the stock firmware uses a weird dual-boot setup that wastes half the flash and slows down boot.

If anyone familiar with the MT7621 platform can check out my latest commit here — https://github.com/fildunsky/openwrt/tree/almond_24.10.5 — I’d really appreciate any feedback or pointers on what could be improved. I don’t have a ton of experience with this chip yet.

Also, the PIC16LF1509 seems to run the show here. The vendor firmware doesn’t have any DTS, and I’m not skilled enough to reverse-engineer how it handles the LCD, Zigbee, and the rest. Even rebooting is odd — the SSH reboot command doesn’t work properly, and sysupgrade hangs after successfull upgrade and stops all processes. So you manually have to power off the device after sysupgrade and then switch it on again.

Despite that, it’s a solid little OpenWrt router with LTE — really stable, around 4+ hours of battery life. I’m planning to swap the modem for a SIM7100E-PCIe, which should be about 10× faster.

I’ve already ended up with four of these things — don’t even know why, guess I got a bit obsessed, haha.

If anyone has ideas or tips for getting everything (LCD, Zigbee, etc.) working together, I’d love to hear them. Thanks for reading!

1 Like
2

This?

https://firmware.securifi.com/AL2/AL2-R087

(broken ssl cert though)

3

I also found these firmwares but non of them seem to match my exact model Almond 3S. You link point to Almond 2 I think. They also had some similar looking device Almond+ but with 750 MHz Dual-Core Cortina Systems CS7542 SoC.

4

But I can share stock firmware partitions dump if you want to check it out.

5

Extract DTS -

binwalk firmware.bin
# offset 12345 dec size 6789 dec
dd if=firmware.bin bs=1 skip=12345 count=6789 of=device.dtb
dtc -I dtb -O dts -o device.dts device.dtb

I trust you it is 7621 :wink:

Then in DTS look for unsupported hardware sections, try to backtrack to existing driver.
Some device have multiple dts overlays - like model pro has usb3 ipo usb2, or model M has GSM modem etc.

6

I’ve tried to binwalk factory backups but there seems to be no Flattened Device Tree blobs there.

7

read/dumpelf kernel for symbols characteristic to the drivers
look for signs of HID and framebuffer in binwalk -eM $$ filesystems....
sometimes there is literarily kernel .config in /usr/src/ (seen it couple of times)