OpenWrt on Nokia WI2B-AC200i

I have a wifi Nokia WI2B-AC200i. I want to access LuCI and set up Network interface for AP .
Currently, I connected device via console (Uart) but cannot input command or access root mode.
pls show me up how to access and config!
Here is image when I access console.


There's no support for Nokia in openwrt, what you're running, is a derivative created by Nokia.

1 Like

If you can't get uboot to react to input, then your options are: buy a programmer and directly access the flash and modify either uboot or the OS (or both) to accept input from UART, or come up with a vulnerability that you can use to access a shell on the running OS.

Besides the above, you'd still then have to port OpenWrt for the device.

Hi WereCatf,
I can't hit any key when boot when connect device via console.
Although the screen display notify as below inmage.
image

1 Like
Hi WereCatf,
I'm newbin so Could you guide me how to buy programmer? what kind of this programmer?
I will find to buy in my country.
Thank for your support.

this might be worth reading Help me, OpenWrt on Nokia WI2B-AC200i

Hi Frollic,
As I mention on below. I able to connect device via console but cannot hit any key to login.
Maybe the block access the device via console.
Moreover, I can access SSH to device but can't enable to access privilege mode to config because not password correct.
Any somebody know default passwords?
image

yeah, but you're supposed to interrupt the boot loader, not the OS.

have you verified your USB TTL actually works ?

Hi frollic,
Could you show me how to supposed to interrupt the boot loader?
I think I complete verify my USB TTL (TX, RX, GND, not connect VCC) and it work normal because I see booting information display on screen console.

it only verifies the TX pin, short the TX and RX, see if you can see yourself typing in the terminal app.

in the bottom of your first screen shot, uboot says "Hit any key to stop autoboot".

When the bootloader says "Hit any key to stop autoboot", you'd normally do exactly that to interrupt it. You could also try e.g. CTRL+C or similar combinations. If none of them work, though, you would have to modify the bootloader or OpenWrt directly with a programmer.

To even begin with a programmer, though, you'd have to first find the SPI NOR flash on the PCB. It's an 8-pin SOIC-8 package, most likely close to the CPU.

https://fccid.io/2AD8UFZCWI2A1/Internal-Photos/Internal-Photo-2797965

That's a WI2A, but OP is talking about WI2B -- I am not familiar with either device, but they may not have the same specs or components. Also, those FCC-photos are fricking terrible and I can't make out the markings on any of the SOIC-8 packages -- there's a TSOP-48 NAND there, but that's not that helpful, unless OP is willing to invest in the equipment to desolder it and a NAND-programmer (which is a lot more expensive)

true, didn't catch the differance.

I'll instruct on only accessing the command line as this device has very heavily modified OpenWrt fork (QSDK), for the rest You are on Your own.
It looks as the interruption on bootloader is disabled. If Your USB-UART adapter is properly attached:

  1. Interrupt boot through entering "failsafe" mode when prompted by quickly typing 'f' a 'Enter'.
  2. If the device entered "failsafe" mode, there invoke these commands:
mount_root
sed -e 's/root:x:/root::/' -i /etc/passwd
fw_setenv bootdelay 3 #this is unnecessary, but could enable access to U-Boot
reboot

I don't know if this will work, since OEM firmware could forbid that or reset password to default value, but doesn't hurt to try. Good luck.

Dear tmn505,
I tried interrupt booth through entering failsafe mode when prompted by quickly typing "f" & 'Enter'.
But bootloader still continus running.
Maybe, Nokia setup disable interruption on bootloader on their device.
I am finding ssh account because I check it open port SSH

Then either, as proposed earlier, use external flash programmer, find exploit or try pin2pwn trick (search web for explanation).