SSHD for Official Linksys EA7500v2 Firmware
I have flashed six EA7500v2 units to OpenWrt, but there was a 7th no way boot to OpenWrt. I have tried EVERYTHING I can find from the Internet.
Ref: all methods mentioned in these two threads failed.
(https://forum.openwrt.org/t/linksys-ea7500-v2-installation-failing)
(https://forum.openwrt.org/t/problem-installing-on-linksys-ea7500v2)
For revenge, I decided to inject sshd to the official FW and have fun.
Facts about Linksys EA7500V2 FW
Assuming factory settings,
-
http://192.168.1.1/sysinfo.cgi
gives a whole lot of info. If asked for auth, use admin:admin.
We can see boot_part=1 or 2, make sure boot_part=2 before flashing OpenWrt, thus avoid flashing 3-times(openwrt-official-openwrt).
If you see boot_part=2 and flashed OpenWrt, but the unit reboots 3 times fail, and 1 more time to go back to Linksys FW (part 2), then you got a (not so) rare unit. Before we find the cause, I suggest planting sshd for fun. -
To switch boot partition, access http://192.168.1.1, then Troubleshooting -> Diagnostics -> Restore previous firmware
This does not re-flash anything, it only switch boot partition and reboot.
Inject sshd summary
- Dissect FW_EA7500v2_2.0.8.194281_prod.img 3 parts.
0x0 - 0x25FFFF, save as head.bin
0x260000 - 0x20FFFFF, save as body.jffs2
0x2100000 - 0x21000FF(end), save as tail.bin - Mount body.jffs2.
- Use openwrt toolchain to build static dropbear.
- Install dropbear to mount, and write a startup script.
- use mkfs.jffs2 against the mount dir to make mod.jffs2.
- Combine head.bin, mod.jffs2, tail.bin, and correct CRC.
- Flash and have ssh.
Step by Step
Because OpenWrt toolchain requires 64-bit Linux, all the following commands run on such OS.
1. Dissect FW image
Assuming FW_EA7500v2_2.0.8.194281_prod.img in home dir.
dd if=FW_EA7500v2_2.0.8.194281_prod.img bs=128k of=head.bin count=19
dd if=FW_EA7500v2_2.0.8.194281_prod.img bs=128k of=body.jffs2 count=245 skip=19
dd if=FW_EA7500v2_2.0.8.194281_prod.img bs=128k of=tail.bin count=1 skip=264
2. mount body.jff2
These commands must be run as root. we use sudo here.
/mnt must be empty, or use another empty dir for mount
sudo modprobe mtdram total_size=36864 erase_size=128
sudo modprobe mtdblock
sudo dd if=body.jffs2 of=/dev/mtdblock0
sudo mount -t jffs2 -o rw,noatime /dev/mtdblock0 /mnt
3. Build dropbear
Download two files to home folder
dropbear source
openwrt toolchain
Run commands.
tar -xf dropbear-2022.83.tar.bz2
tar -xf openwrt-toolchain-22.03.5-ramips-mt7621_gcc-11.2.0_musl.Linux-x86_64.tar.xz
export PATH=$PATH:~/openwrt-toolchain-22.03.5-ramips-mt7621_gcc-11.2.0_musl.Linux-x86_64/toolchain-mipsel_24kc_gcc-11.2.0_musl/bin
export STAGING_DIR=~/openwrt-toolchain-22.03.5-ramips-mt7621_gcc-11.2.0_musl.Linux-x86_64/toolchain-mipsel_24kc_gcc-11.2.0_musl
cd ~/dropbear-2022.83
./configure --build=x86_64-pc-linux-gnu --host=mipsel-openwrt-linux-musl --disable-zlib --disable-syslog --disable-lastlog --enable-static
make strip PROGRAMS="dropbear scp" STATIC=1 MULTI=1
upx --best --ultra-brute -o dropbear dropbearmulti
4. Install dropbear
sudo cp dropbear /mnt/usr/sbin/
sudo ln -s /usr/sbin/dropbear /mnt/usr/bin/scp
sudo tee /mnt/etc/registration.d/31_dropbear << EOD >> /dev/null
#!/bin/sh
dropbear -B -r /etc/dropbear_rsa_host_key
EOD
sudo chmod 755 /mnt/etc/registration.d/31_dropbear
Optionally, set uncanny version string
echo 2.0.9.194281 | sudo tee /mnt/etc/version > /dev/null
5. make JFFS2 file
cd ~
sudo mkfs.jffs2 --little-endian --squash-uids --pad --eraseblock=128 --root=/mnt --output=mod.jffs2
Cleanup
sudo umount /mnt
sudo modprobe -r mtdblock
sudo modprobe -r mtdram
6. Combine mod.img
CRC Ref: OpenWrt imagebuilder/scripts/linksys-image.sh
cat head.bin mod.jffs2 tail.bin > mod.img
printf "%08X" $(dd status=none if=mod.img bs=$((`stat -c%s head.bin` + `stat -c%s mod.jffs2`)) count=1|cksum| cut -d ' ' -f1) > /tmp/crc
dd conv=notrunc if=/tmp/crc of=mod.img bs=1 count=8 seek=$((`stat -c%s head.bin` + `stat -c%s mod.jffs2` + 32))
7. Flash and ssh
Switch to boot_part 1, then flash, so that this FW goes to boot_part 2. If we want to try OpenWrt again some time, OpenWrt will go to boot_part 1.
ssh root@192.168.1.1
passwd: admin
Now we can dump mtd, etc to see why OpenWrt can't boot
