Port OpenWrt to ZyXEL NWA3560-N

eutampieri · February 11, 2021, 7:41am

Hello,
I'd like to port OpenWRT to this access point. I have not gained serial console access yet, but it seems that the hardware is well supported (same CPU as EdgeRouter lite and ath9k radios). The other similarity with the EdgeRouter is that it has a 256 USB DOM, but I couldn't find a kernel in it, so it might be on the builtin flash memory. I have a DOM dump, but i cannot share it now because it contains credentials that I cannot share, but here's fdisk output:

Disk /dev/sdb: 245 MiB, 256901120 bytes, 501760 sectors
Disk model: ZyWALL_USG      
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000

Dispositivo Avvio  Start   Fine Settori   Size Id Tipo
/dev/sdb1             62   9919    9858   4,8M 83 Linux
/dev/sdb2           9920 150783  140864  68,8M 83 Linux
/dev/sdb3         150784 486079  335296 163,7M 83 Linux

and here is a tree of the last two file systems:

.
├── 49A0000.ext
├── 4D8000.ext
├── ext-root
│   ├── compress.img
│   ├── etc_writable
│   │   ├── ksyms
│   │   ├── ksyms_last
│   │   └── zyxel
│   │       └── conf
│   │           ├── __eps_checking_default.xml
│   │           ├── startup-config.conf.xml
│   │           ├── startup-config-device-ha.xml
│   │           ├── __system_default_device_ha.xml
│   │           └── __system_default.xml
│   ├── filechecksum
│   ├── filechecksum.tmp
│   ├── filelist
│   ├── fwversion
│   ├── fwversion.old
│   └── fwversion.tmp
└── ext-root-0
    └── etc
        ├── custmiz_image
        │   ├── custmiz_page.css
        │   └── logo
        └── zyxel
            └── ftp
                ├── cert
                │   ├── default
                │   ├── default.prv
                │   └── version
                ├── conf
                │   ├── lastgood.conf
                │   ├── startup-config.conf
                │   └── system-default.conf
                ├── Firmware
                ├── tmp
                │   ├── bbhangs_cnt1
                │   └── bbhangs_cnt2
                └── wtp_image
                    ├── cwinfo
                    ├── cw_ver
                    ├── self.img
                    └── _self.img.extracted
                        └── 0.zip

14 directories, 31 files

What can I do next?

eutampieri · February 11, 2021, 7:46am

Here are some board photos:
The disk on module:

The board:

Borromini · February 11, 2021, 12:05pm

My layman's suggestion would be to build a ramdisk image with the existing DTS (the kernel has a Cavium DTS that is used by the EdgeRouter Lite also), and see where that gets you for initial testing and research.

eutampieri · February 11, 2021, 2:31pm

In your opinion, how can I boot the ramdisk? What do you think of the procedures in this PDF? https://mega.nz/file/TsxwSZwK#dq2f48TrtmNO9bqrIFE7lsLt7cY1L2zzxpwkA6gltCg (It is the upgrade guide)

Borromini · February 11, 2021, 5:43pm

Connect serial, see what the bootloader says, interrupt it if possible, load the initramfs image.

eutampieri · February 11, 2021, 5:58pm

Thanks! I'll do it as soon as I can

eutampieri · February 12, 2021, 8:36pm

Is there a way to proceed through JTAG? I don’t know the serial console pinout and I don’t know wether it’s ttl or rs232

Borromini · February 13, 2021, 12:00am

Sorry I have no idea about that...

eutampieri · February 13, 2021, 9:43am

Hehe now everything is downhill (at least I hope so) because there’s an RS232 transceiver near the serial (mini DIN 6) port whose data sheet is this: https://mega.nz/file/CtoURKaC#ge_Y1MlemGqOnFn4FYEpo3pkbuIKbNOiKme9y_hlc8I

eutampieri · February 13, 2021, 10:00am

and that’s what I’ve found out

eutampieri · February 15, 2021, 2:19pm

So this is what I get from the console:

NWA3560-N> athe                                                                 
======= Debug Command Listing =======                                           
AT            just answer OK                                                    
ATHE          print help                                                        
ATSR          system reboot                                                     
ATRTw,x,y(,z) RAM test level w, from address x to y (z iterations)              
ATUK          upload kernel image to disk                                       
ATUR          Use ATUK to upload kernel                                         
ATBAx         change baudrate 1:38.4k 2:19.2k 3:9.6k 4:57.6k 5:115.2k           
ATGO          boot router                                                       
ATKZ(x)       show init switch or set to x                                      
ATSH          dump manufacturer related data in ROM                             
ATAC(x)       Apply startup configuration                                       
ATGT(x)       Go hardware test module                                           
                                                                                
OK                                                                              
                                                                                
NWA3560-N> atsh                                                                 
BootModule Version      :V1.16 | 08/31/2011 14:20:00                            
Vendor  Name            :ZyXEL Communications Corp.                             
Product Model           :NWA3560-N                                              
System  Type            :10                                                     
MAC Address             :mymac                                           
Default Country Code    :e1                                                     
Boot Module Debug Flag  :0                                                      
Hardware Version        :ZyXEL NWA3560-N CN50xx                                 
Serial  Number          :mysn                                          
SNMP MIB level  & OID   :060102030405060708091011121314151617181920             
Main Feature Bit        :0                                                      
Other Feature Bits      :                                                       
03 93 00 00 00 00 00 00-00 00 00 00 00 00 00 00                                 
03 00 00 00 00 00 00 00-00 00 00 00 00 00

eutampieri · February 15, 2021, 3:11pm

@Borromini as you can see above, the ATUK command should load the ramdisk, but the ATUR command (that should boot it) doesn't work.

eutampieri · March 9, 2021, 3:10pm

There's a JTAG header onboard, can I use it to replace the bootloader with a more standard one?

Neustradamus · July 9, 2021, 9:34pm

@eutampieri: It will be interesting if it will be possible!

Have you progressed?

Note: The NWA3160-N is same but with only one WiFi card:

Good point for Console part!
Have you looked the JP4?
Where is on it?

eutampieri · July 9, 2021, 10:20pm

Well, I haven’t made any progress, but I’m still interested!

Speaking of JP4, I’m not JTAG expert and I’m not even sure it’s JTAG, however I think we’d need a bootloader and I don’t know where to get one