OpenWrt Support for Armor G5 (NBG7815)

For Developers
11

Hi guys

I wonder what was hidden under the hood, so i connected cable TTL and:

  1. Interrupted autoboot:
Zyxel zloader v1.0.0 (2020-01-06 - 08:24)


Multiboot clinent version: 2.0
ipq807x_eth_halt: done
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
10M speed not supported
ipq807x_eth_halt: done
Ethernet interface failed to initialized!

Hit any key to stop autoboot:  3
NBG7815> ATHE
ATEN    x[,y]     set BootExtension Debug Flag (y=password)
ATSE    x         show the seed of password generator
ATSH              dump manufacturer related data in ROM
ATRT    [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
ATGO              boot up whole system
ATUR    x         upgrade RAS image (filename)
ATUS    x         upgrade image by fit script (filename)
**NBG7815>**

It seems that U-boot has been locked

  1. Enter failsafe mode:
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
f
- failsafe -
[    8.161839] random: dropbearkey: uninitialized urandom read (32 bytes read, 8 bits of entropy available)
[    8.163176] random: dropbearkey: uninitialized urandom read (32 bytes read, 8 bits of entropy available)
Generating key, this may take a while...
[    8.418384] random: dropbearkey: uninitialized urandom read (32 bytes read, 8 bits of entropy available)
Public key portion is:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQCAYHBFJs0Eqn8VjK2JFsp7Oh[    8.430835] random: dropbear: uninitialized urandom read (32 bytes read, 8 bits of entropy available)


BusyBox v1.25.1 (2021-09-29 08:20:53 UTC) built-in shell (ash)

ash: can't access tty; job control turned off
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 (eb4b1a4+r49254)

================= FAILSAFE MODE active ================
special commands:
* firstboot          reset settings to factory defaults
* mount_root     mount root-partition with config files

after mount_root:
* passwd                         change root's password
* /etc/config               directory with config files

for more help see:
http://wiki.openwrt.org/doc/howto/generic.failsafe
=======================================================

root@(none):/#
root@(none):/etc# cat openwrt_release
DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='Chaos Calmer'
DISTRIB_REVISION='eb4b1a4+r49254'
DISTRIB_CODENAME='chaos_calmer'
DISTRIB_TARGET='ipq/ipq807x_64'
DISTRIB_DESCRIPTION='OpenWrt Chaos Calmer 15.05.1'
DISTRIB_TAINTS='no-all busybox'

After mount_root i was looking for some informations in config and succesfully found root password, so

  1. Login as root
NBG7815 login: root
Password:


BusyBox v1.25.1 (2021-09-29 08:20:53 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 (eb4b1a4+r49254)

root@NBG7815:~# uname -a
Linux NBG7815 4.4.60 #1 SMP PREEMPT Wed Sep 29 08:31:14 UTC 2021 aarch64 GNU/Linux
  1. Conclusions:

a) Default software has been built on OpenWRT 15.05.1 "Chaos Calmer" software,
opkg packages -> http://downloads.openwrt.org/chaos_calmer/15.05.1/ipq/ipq807x_64/packages/
b) ssh deamon has been removed :frowning:
c) Fortunetly there's telnet deamon, you can connect to it right after reset to factory setting
d) you can login as root

4 Likes