Port OpenWrt to ZyXEL NWA3560-N

eutampieri · February 11, 2021, 7:41am

Hello,
I'd like to port OpenWRT to this access point. I have not gained serial console access yet, but it seems that the hardware is well supported (same CPU as EdgeRouter lite and ath9k radios). The other similarity with the EdgeRouter is that it has a 256 USB DOM, but I couldn't find a kernel in it, so it might be on the builtin flash memory. I have a DOM dump, but i cannot share it now because it contains credentials that I cannot share, but here's fdisk output:

Disk /dev/sdb: 245 MiB, 256901120 bytes, 501760 sectors
Disk model: ZyWALL_USG      
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000

Dispositivo Avvio  Start   Fine Settori   Size Id Tipo
/dev/sdb1             62   9919    9858   4,8M 83 Linux
/dev/sdb2           9920 150783  140864  68,8M 83 Linux
/dev/sdb3         150784 486079  335296 163,7M 83 Linux

and here is a tree of the last two file systems:

.
├── 49A0000.ext
├── 4D8000.ext
├── ext-root
│   ├── compress.img
│   ├── etc_writable
│   │   ├── ksyms
│   │   ├── ksyms_last
│   │   └── zyxel
│   │       └── conf
│   │           ├── __eps_checking_default.xml
│   │           ├── startup-config.conf.xml
│   │           ├── startup-config-device-ha.xml
│   │           ├── __system_default_device_ha.xml
│   │           └── __system_default.xml
│   ├── filechecksum
│   ├── filechecksum.tmp
│   ├── filelist
│   ├── fwversion
│   ├── fwversion.old
│   └── fwversion.tmp
└── ext-root-0
    └── etc
        ├── custmiz_image
        │   ├── custmiz_page.css
        │   └── logo
        └── zyxel
            └── ftp
                ├── cert
                │   ├── default
                │   ├── default.prv
                │   └── version
                ├── conf
                │   ├── lastgood.conf
                │   ├── startup-config.conf
                │   └── system-default.conf
                ├── Firmware
                ├── tmp
                │   ├── bbhangs_cnt1
                │   └── bbhangs_cnt2
                └── wtp_image
                    ├── cwinfo
                    ├── cw_ver
                    ├── self.img
                    └── _self.img.extracted
                        └── 0.zip

14 directories, 31 files

What can I do next?

eutampieri · February 11, 2021, 7:46am

Here are some board photos:
The disk on module:

The board:

Borromini · February 11, 2021, 12:05pm

My layman's suggestion would be to build a ramdisk image with the existing DTS (the kernel has a Cavium DTS that is used by the EdgeRouter Lite also), and see where that gets you for initial testing and research.

eutampieri · February 11, 2021, 2:31pm

In your opinion, how can I boot the ramdisk? What do you think of the procedures in this PDF? https://mega.nz/file/TsxwSZwK#dq2f48TrtmNO9bqrIFE7lsLt7cY1L2zzxpwkA6gltCg (It is the upgrade guide)

Borromini · February 11, 2021, 5:43pm

Connect serial, see what the bootloader says, interrupt it if possible, load the initramfs image.

eutampieri · February 11, 2021, 5:58pm

Thanks! I'll do it as soon as I can

eutampieri · February 12, 2021, 8:36pm

Is there a way to proceed through JTAG? I don’t know the serial console pinout and I don’t know wether it’s ttl or rs232

Borromini · February 13, 2021, 12:00am

Sorry I have no idea about that...

eutampieri · February 13, 2021, 9:43am

Hehe now everything is downhill (at least I hope so) because there’s an RS232 transceiver near the serial (mini DIN 6) port whose data sheet is this: https://mega.nz/file/CtoURKaC#ge_Y1MlemGqOnFn4FYEpo3pkbuIKbNOiKme9y_hlc8I

eutampieri · February 13, 2021, 10:00am

and that’s what I’ve found out

eutampieri · February 15, 2021, 2:19pm

So this is what I get from the console:

NWA3560-N> athe                                                                 
======= Debug Command Listing =======                                           
AT            just answer OK                                                    
ATHE          print help                                                        
ATSR          system reboot                                                     
ATRTw,x,y(,z) RAM test level w, from address x to y (z iterations)              
ATUK          upload kernel image to disk                                       
ATUR          Use ATUK to upload kernel                                         
ATBAx         change baudrate 1:38.4k 2:19.2k 3:9.6k 4:57.6k 5:115.2k           
ATGO          boot router                                                       
ATKZ(x)       show init switch or set to x                                      
ATSH          dump manufacturer related data in ROM                             
ATAC(x)       Apply startup configuration                                       
ATGT(x)       Go hardware test module                                           
                                                                                
OK                                                                              
                                                                                
NWA3560-N> atsh                                                                 
BootModule Version      :V1.16 | 08/31/2011 14:20:00                            
Vendor  Name            :ZyXEL Communications Corp.                             
Product Model           :NWA3560-N                                              
System  Type            :10                                                     
MAC Address             :mymac                                           
Default Country Code    :e1                                                     
Boot Module Debug Flag  :0                                                      
Hardware Version        :ZyXEL NWA3560-N CN50xx                                 
Serial  Number          :mysn                                          
SNMP MIB level  & OID   :060102030405060708091011121314151617181920             
Main Feature Bit        :0                                                      
Other Feature Bits      :                                                       
03 93 00 00 00 00 00 00-00 00 00 00 00 00 00 00                                 
03 00 00 00 00 00 00 00-00 00 00 00 00 00

eutampieri · February 15, 2021, 3:11pm

@Borromini as you can see above, the ATUK command should load the ramdisk, but the ATUR command (that should boot it) doesn't work.

eutampieri · March 9, 2021, 3:10pm

There's a JTAG header onboard, can I use it to replace the bootloader with a more standard one?

Neustradamus · July 9, 2021, 9:34pm

@eutampieri: It will be interesting if it will be possible!

Have you progressed?

Note: The NWA3160-N is same but with only one WiFi card:

Good point for Console part!
Have you looked the JP4?
Where is on it?

eutampieri · July 9, 2021, 10:20pm

Well, I haven’t made any progress, but I’m still interested!

Speaking of JP4, I’m not JTAG expert and I’m not even sure it’s JTAG, however I think we’d need a bootloader and I don’t know where to get one

eutampieri · November 30, 2021, 9:07pm

Is there anyone here who has worked with ZyXEL bootloaders?

s_2 · October 19, 2022, 1:18pm

I have recently acquired an NWA3160-N, which seems to be quite similar, I had also dumped the USB DOM but could not get any further without finding the UART.
So, if I understand correctly, the 6-pin mini-DIN connector is using RS-232 signal levels, not TTL (3.3V), so I need a regular DB9 USB to serial adapter and build a cable, or can I just connect a CP2102 etc.?

I had not verified the CPU since it is located under a heatsink, but if this is really ath79, we might support this. I only bought this device since I added support for the NWA1100-H / NWA1121-NI / NWA1123-NI / NWA1123-AC recently, but then found this one is a totally different hardware platform.

Regarding the factory image, it seems to use a custom per-model zip password, which can be generated using a binary found in the file system. Someone did a bit of reverse engineering here:

eutampieri · October 19, 2022, 1:22pm

Wow, that’s fantastic! Yes, the serial port is RS232 because it’s behind a TTL<->RS232 converter. Here you can find more infos (sorry for the awful theme) https://blog.eutampieri.eu/openwrt-zyxel-1/

s_2 · October 20, 2022, 6:19pm

RS232 bootlog was successful, thanks for the pinout!

It still doesn't look promising though, maybe they removed most of the output since the log would be visible on the external port, in any case it does not quite look like uboot or anything familiar, also the "debug mode" seems to do not so much after pressing any key (maybe it restores factory default settings?)

FLASH: AMD 16M

BootModule Version: V1.16 | 08/31/2011 14:20:00
DRAM: Size = 256 Mbytes

Kernel Version: V2.6.25.4 | 2014-12-09 15:11:38
ZLD Version: V2.23(UJA.8) | 2014-12-09 16:13:57

Press any key to enter debug mode within 1 seconds.
.....................


BM cmd line: console=ttyS0,115200 root=/dev/ram init=zyinit "-r /dev/sda", address: 0x100000

Uncompressing Linux...done.
Start to remount db partition
Start to check file system...
/dev/sda2: 33/17352 files (0.0% non-contiguous), 54997/69296 blocks
/dev/sda3: 68/41120 files (1.5% non-contiguous), 54670/163841 blocks
Done

INIT: version 2.86 booting
Initializing Debug Account Authentication Seed (DAAS)... done.

INIT: Entering runlevel: 3
Starting zylog daemon: zylogd zylog starts.
Starting syslog-ng.
Starting uam daemon.
Starting periodic command scheduler: cron.
Start EnterpriseWLAN system daemon....
................................................
Got LINK_CHANGE
Port [0] Copper is up --> Group [0] is up
Got WIRELESS_CARD_CHANGE
Applying system configuration file, please wait...
no startup-config.conf file, Applying system-default.conf
Use system default configuration file (system-default.conf)

Got LINK_CHANGE
Port [0] Copper is down --> Group [0] is down

Got LINK_CHANGE
Port [0] Copper is up --> Group [0] is up
EnterpriseWLAN system is configured successfully with system-default.conf

Welcome to NWA3160-N

Username: admin
Password:
Router>
<cr>
apply
atse
clear
configure
copy
daily-report
debug
delete
diag           Diagnostic
diag-info
dir
disable
enable
exit
htm
interface
no
nslookup
packet-trace
ping
psm
reboot
release
rename
renew
run
setenv
show
shutdown
telnet
test
tracepath
traceroute
wlan-report
write
Router>

Login works with the default settings (admin / 1234), pressing ? will print a list of commands.

I tried to remove the heatsink from the CPU, but liquifiying the two solder points on the back of the PCB while pushing did not help much.
Considering the FCC ID only refers to the ath9k miniPCIe card, there are no pictures of the main SoC, so is most probably not AR934x, but could be some other network processor, so the chances of supporting this might be even lower.
But first we'd need to figure out what the CPU is

eutampieri · October 20, 2022, 9:14pm

Our best bet is to load an image like it’s done with the recovery image (the .ri file). See the link you posted and my notes (there’s a part one too)