hope you are not a botnet zombie now 
No it was a USC university campus info drive dropped by a student near my wife's lab. Also reformatted. 
I think the risk was super low.
@mazza2590 my drive is only 1G I think. I don't know about a guide but if you know linux you just install the f2fs tools and gdisk and repartition to a single partition with f2fs and add the partition to /etc/fstab
1 Like
Okay, one more for the infiltration handbook, source USB media that look like they belong to the target area "naturally" and fill them with innocent local material
Eh, people have gotten malware installed directly into big name usb flash drives directly from the factory 
The real thing needed is to ensure that usb host hardware, firmware, and drivers are resistant to malicious usb devices. It's a risk to plug any usb device into your machine without those proper mitigations.
Hello again all.
Finally got rsyslog working and have a lot of events.
Dont really see anything that stands out other then the following:
ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/fwcfg-pci-0000:00:00.0.txt failed with error -2
firmware ath10k!fwcfg-pci-0000:00:00.0.txt: firmware_loading_store: map pages failed
ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/pre-cal-pci-0000:00:00.0.bin failed with error -2
firmware ath10k!pre-cal-pci-0000:00:00.0.bin: firmware_loading_store: map pages failed
ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/ct-firmware-5.bin failed with error -2
firmware ath10k!QCA988X!hw2.0!ct-firmware-5.bin: firmware_loading_store: map pages failed
ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/ct-firmware-2.bin failed with error -2
firmware ath10k!QCA988X!hw2.0!ct-firmware-2.bin: firmware_loading_store: map pages failed
ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/firmware-6.bin failed with error -2
firmware ath10k!QCA988X!hw2.0!firmware-6.bin: firmware_loading_store: map pages failed
ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/firmware-5.bin failed with error -2
firmware ath10k!QCA988X!hw2.0!firmware-5.bin: firmware_loading_store: map pages failed
ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/firmware-4.bin failed with error -2
firmware ath10k!QCA988X!hw2.0!firmware-4.bin: firmware_loading_store: map pages failed
ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/firmware-3.bin failed with error -2
firmware ath10k!QCA988X!hw2.0!firmware-3.bin: firmware_loading_store: map pages failed
ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/board-2.bin failed with error -2
firmware ath10k!QCA988X!hw2.0!board-2.bin: firmware_loading_store: map pages failed
(There were tons of repeating events, i just trimmed down and remove the duplicates as best i could)
Is it possible that these errors are what's causing my router to crash when wifi is enabled?
It's just weird that i have 3 of the same hardware, and i'm only getting 1 that crashes?
Sure the other two are doing nothing BUT wifi, with odhcpd/dnsmasq/firewalld disabled.. but still!
EDIT - Nope, i see these errors on my APs as well! This is strange
These errors seem to come from the driver looping over a list of potential firmwares to load and failing to find them, see https://forum.openwrt.org/t/showing-ath10k-firmware-load-successes/35550
Have you tried the crash debug output:
cat /sys/kernel/debug/crashlog > /tmp/last_crash_log ; cat /tmp/last_crash_log
use this immediately after a reboot following one of your crashes.
Thank you @moeller0 !
I disabled logd as part of my rsyslog & syslog-ng advendture yesterday. Will the crashlog still exist in this case? If so, i'll turn wifi back on to trigger the crash soon..
I do see some "Crashlog allocated RAM at address 0x3f00000" events, but there is no crashlog file that exists at the moment. (wifi's been off overnight, so things were stable)
I think this is independent of logd, but I have not tested that independence, I did use the crashlog feature in the past successfully though.
Appreciate it. Will report back soon!
1 Like
Just crashed, and no log exists 
root@Basement:~# cat /sys/kernel/debug/crashlog > /tmp/last_crash_log ; cat /tmp/last_crash_log
cat: can't open '/sys/kernel/debug/crashlog': No such file or directory
Last syslog events i got were me turning wlan0 and wlan1 back up, and immediately followed by the bootup events later.
Brutal..
I just wanted to have some fast AP roaming lol - this has taken one hell of a turn.
Here are the configs in case anyone can point out the issue?
- office - dumbAP - https://pastebin.com/mPWhGZgJ
- basement - Router - https://pastebin.com/bSjtVMms
Only things i obfuscated were the wifi ssid/password, pppoe account, some firewall rules that work - just dont want those details on the net. I also may have broken some of the syntax during my obfuscation efforts so disregard those.
And if i simply found a bug, what may the bug reporting processes be?
Try disable flow-offload on main router.
firewall.@defaults[0].flow_offloading='1'
most of crashes and nat issue are related to this option.
I noticed in my config that my basement router had explicitly selected some wifi channels. I've changed that to auto and turned 5Ghz back on and it hasn't rebooted all night!
I turned 2.4Ghz on this morning and the rebooting started again soon after...
I also noticed that with just 5Ghz on, my IPTV service started buffering, which was perfectly fine before.
Turned both radios off and it looks like IPTV is back to normal.
So to your point @leeandy - i Wonder if im just trying to do too much on this router. CPU and RAM seems ok, so its hard to point the finger.
But i turned that feature on because the Archer C7 has some hardware NATing capabilities that are not supported on OpenWRT, so it caps at ~300Mbps.
I think i should just invest in a dedicated router, and turn this C7 into just another dumb AP...
Sad, sorry to hear that. I guess I was lucky when I had crashing issues in the past...
I think you mixed two posts?
1 Like
aww i got excited that there were new posts here 
lol!
Yes, pilot error, I thought I had deleted the draft, but it seems I did just scroll it out of sight....
Flashed this back to stock and still caught it rebooting. Thing's a lemon. Returning to store.
Thanks everyone for your assistance
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.