Hello everyone!
I have TP-Link Touch P5
I found some information on wikidevi: Touch P5
Also there is similar model to it: RE590T
But unfortunately there is no custom firmware available for this good routers
As I can see, it's pretty fast, contains two ARM cores plenty of ram and a touchscreen.
How to connect to ssh
I was playing with router and default firmware for a couple of days and there is ssh root shell available on router.
Here is the way how to get it:
- You should reset router settings to default and not changing default password, so main login account supposed to be
admin:admin
.
I don't know why, but they broke authentication in dropbear binary, so it works only with this credentials. - After that, you're able to use ssh by default port and router ip address.
Important note: if you'll reset router, rsa keys will be different, so you can just delete them from your local.ssh/known_hosts
file - It seems this router works on QS DK fork, which is fork from OpenWRT probably
Firmware changes
Unfortunately I wasn't able to find out how to change anything in firmware, because it's mounted in read-only.
If someone will help me with that, I'll be very thankful!
root@Akronite:~# mount
/dev/mtdblock2 on / type squashfs (ro,noatime)
devtmpfs on /dev type devtmpfs (rw,relatime,size=127496k,nr_inodes=31874,mode=755)
proc on /proc type proc (rw,noatime)
sysfs on /sys type sysfs (rw,noatime)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noatime)
devpts on /dev/pts type devpts (rw,noatime,mode=600)
root on /overlay type tmpfs (rw,noatime,mode=755)
/dev/mtdblock2 on /mnt type squashfs (ro,noatime)
root on /mnt type tmpfs (rw,noatime,mode=755)
none on /etc type ramfs (rw,relatime)
none on /lib/wifi type ramfs (rw,relatime)
none on /usr/lib/lua type ramfs (rw,relatime)
none on /proc/bus/usb type usbfs (rw,relatime)
Also I found that there is big amount of data stored in nvram.
root@Akronite:~# nvrammanager -s
partition 01: name = fs-uboot , base = 0x00000000, size = 0x00040000 Bytes, usedFlag = 1
partition 02: name = os-image1 , base = 0x00040000, size = 0x00200000 Bytes, usedFlag = 1
partition 03: name = file-system1 , base = 0x00240000, size = 0x00c00000 Bytes, usedFlag = 1
partition 04: name = default-mac , base = 0x00e40000, size = 0x00000200 Bytes, usedFlag = 1
partition 05: name = pin , base = 0x00e40200, size = 0x00000200 Bytes, usedFlag = 1
partition 06: name = product-info , base = 0x00e40400, size = 0x0000fc00 Bytes, usedFlag = 1
partition 07: name = partition-table , base = 0x00e50000, size = 0x00010000 Bytes, usedFlag = 1
partition 08: name = soft-version , base = 0x00e60000, size = 0x00010000 Bytes, usedFlag = 1
partition 09: name = support-list , base = 0x00e70000, size = 0x00010000 Bytes, usedFlag = 1
partition 10: name = profile1 , base = 0x00e80000, size = 0x00010000 Bytes, usedFlag = 1
partition 11: name = default-config1 , base = 0x00e90000, size = 0x00010000 Bytes, usedFlag = 1
partition 12: name = user-config1 , base = 0x00ea0000, size = 0x00040000 Bytes, usedFlag = 1
partition 13: name = qos-db , base = 0x00ee0000, size = 0x00040000 Bytes, usedFlag = 1
partition 14: name = log , base = 0x00fc0000, size = 0x00020000 Bytes, usedFlag = 1
partition 15: name = radio_bk , base = 0x00fe0000, size = 0x00010000 Bytes, usedFlag = 1
partition 16: name = os-image2 , base = 0x01040000, size = 0x00200000 Bytes, usedFlag = 1
partition 17: name = file-system2 , base = 0x01240000, size = 0x00500000 Bytes, usedFlag = 1
partition 18: name = user-config2 , base = 0x01770000, size = 0x00010000 Bytes, usedFlag = 1
partition 19: name = default-config2 , base = 0x01780000, size = 0x00010000 Bytes, usedFlag = 1
partition 20: name = profile2 , base = 0x01790000, size = 0x00000400 Bytes, usedFlag = 1
partition 21: name = mcu , base = 0x01800000, size = 0x007f0000 Bytes, usedFlag = 1
partition 22: name = radio , base = 0x01ff0000, size = 0x00010000 Bytes, usedFlag = 1
partition 23: name = , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 24: name = , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 25: name = , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 26: name = , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 27: name = , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 28: name = , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 29: name = , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 30: name = , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 31: name = , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 32: name = , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
Please help me to figure out how I can make any changes to firmware. I would appreciate any help.
Feel free to ask questions or requests for additional information. I just don't know what might be needed...