I'd like to port OpenWRT to this access point. I have not gained serial console access yet, but it seems that the hardware is well supported (same CPU as EdgeRouter lite and ath9k radios). The other similarity with the EdgeRouter is that it has a 256 USB DOM, but I couldn't find a kernel in it, so it might be on the builtin flash memory. I have a DOM dump, but i cannot share it now because it contains credentials that I cannot share, but here's
Disk /dev/sdb: 245 MiB, 256901120 bytes, 501760 sectors
Disk model: ZyWALL_USG
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000
Dispositivo Avvio Start Fine Settori Size Id Tipo
/dev/sdb1 62 9919 9858 4,8M 83 Linux
/dev/sdb2 9920 150783 140864 68,8M 83 Linux
/dev/sdb3 150784 486079 335296 163,7M 83 Linux
and here is a tree of the last two file systems:
│ ├── compress.img
│ ├── etc_writable
│ │ ├── ksyms
│ │ ├── ksyms_last
│ │ └── zyxel
│ │ └── conf
│ │ ├── __eps_checking_default.xml
│ │ ├── startup-config.conf.xml
│ │ ├── startup-config-device-ha.xml
│ │ ├── __system_default_device_ha.xml
│ │ └── __system_default.xml
│ ├── filechecksum
│ ├── filechecksum.tmp
│ ├── filelist
│ ├── fwversion
│ ├── fwversion.old
│ └── fwversion.tmp
│ ├── custmiz_page.css
│ └── logo
│ ├── default
│ ├── default.prv
│ └── version
│ ├── lastgood.conf
│ ├── startup-config.conf
│ └── system-default.conf
│ ├── bbhangs_cnt1
│ └── bbhangs_cnt2
14 directories, 31 files
What can I do next?
Here are some board photos:
The disk on module:
My layman's suggestion would be to build a ramdisk image with the existing DTS (the kernel has a Cavium DTS that is used by the EdgeRouter Lite also), and see where that gets you for initial testing and research.
In your opinion, how can I boot the ramdisk? What do you think of the procedures in this PDF? https://mega.nz/file/TsxwSZwK#dq2f48TrtmNO9bqrIFE7lsLt7cY1L2zzxpwkA6gltCg (It is the upgrade guide)
Connect serial, see what the bootloader says, interrupt it if possible, load the initramfs image.
Thanks! I'll do it as soon as I can
Is there a way to proceed through JTAG? I don’t know the serial console pinout and I don’t know wether it’s ttl or rs232
Sorry I have no idea about that...
Hehe now everything is downhill (at least I hope so) because there’s an RS232 transceiver near the serial (mini DIN 6) port whose data sheet is this: https://mega.nz/file/CtoURKaC#ge_Y1MlemGqOnFn4FYEpo3pkbuIKbNOiKme9y_hlc8I
and that’s what I’ve found out
So this is what I get from the console:
======= Debug Command Listing =======
AT just answer OK
ATHE print help
ATSR system reboot
ATRTw,x,y(,z) RAM test level w, from address x to y (z iterations)
ATUK upload kernel image to disk
ATUR Use ATUK to upload kernel
ATBAx change baudrate 1:38.4k 2:19.2k 3:9.6k 4:57.6k 5:115.2k
ATGO boot router
ATKZ(x) show init switch or set to x
ATSH dump manufacturer related data in ROM
ATAC(x) Apply startup configuration
ATGT(x) Go hardware test module
BootModule Version :V1.16 | 08/31/2011 14:20:00
Vendor Name :ZyXEL Communications Corp.
Product Model :NWA3560-N
System Type :10
MAC Address :mymac
Default Country Code :e1
Boot Module Debug Flag :0
Hardware Version :ZyXEL NWA3560-N CN50xx
Serial Number :mysn
SNMP MIB level & OID :060102030405060708091011121314151617181920
Main Feature Bit :0
Other Feature Bits :
03 93 00 00 00 00 00 00-00 00 00 00 00 00 00 00
03 00 00 00 00 00 00 00-00 00 00 00 00 00
@Borromini as you can see above, the ATUK command should load the ramdisk, but the ATUR command (that should boot it) doesn't work.
There's a JTAG header onboard, can I use it to replace the bootloader with a more standard one?
@eutampieri: It will be interesting if it will be possible!
Have you progressed?
Note: The NWA3160-N is same but with only one WiFi card:
Good point for Console part!
Have you looked the JP4?
Where is on it?
Well, I haven’t made any progress, but I’m still interested!
Speaking of JP4, I’m not JTAG expert and I’m not even sure it’s JTAG, however I think we’d need a bootloader and I don’t know where to get one
Is there anyone here who has worked with ZyXEL bootloaders?