I think because it's Econet, probably hopeless am I right? It's a router given by ISP, which has wifi 6 AX1800. I was thinking maybe newer Econet's would have some open source, now or maybe years later. Then this data would be useful, maybe. Here are the teardown photos. Well maybe not adding photos since it's not supported anyway?
CPU: Econet 7561HU(possibly 900MHz Dual core)
Mediatek MT7975DN wifi
Mediatek MT7905DEN wifi 2
RAM 512MB
Storage 256MB( I think)
econrt is related to ramips or filogic, but comes with extra component like 5g or ont or dsl (neither supported). Likely only sold/given away as subscription cpe.
If you have fcc id printed one maylocate pictures at fcc
Best approach would be to try to break boot sequence via serial. Very likely device is heavily locked down to prevent secondary market.
It's econet 7561HU, probably not supported eh? So what good would come from fcc id? I see it has some serial too. But can I do anything, probably not. Again the soc is not supported no?
SoC is not supported, these socs have no public sources by mediatek. It is just my speculation that whatever-900mhz resembles 7621, caveat emptor if anything non-oem boots up.
Last picture above upper corner of removed shielding looks lice ttl port?
Yes uart there probably. I dont have ttl cable right now i ll buy again. Will share the results. So you're saying, maybe if i flash a 7621 based firmware file, it might maybe work?
If you boot mt7621 kernel from tftp the closed platform might turn out mt7621, but dont put too much hope on it, probably ttl will turn up with input cut off etc.
Ok here are some bootlogs and help. I've tried TFTP inside it too, it expects something like tplinux.bin, or tprootfs.bin and vice versa. I've dealt with this before on their Archer C5v router. Never got into anything. And please look at the bootloader, tf is bldr> I don't even know.
Valid filename: Bootloader : tcboot.bin
Linux Kernel&Rootfs: tclinux.bin
TP Linux Kernel: tpkernel.bin
TP Rootfs: tprootfs.bin
TP Linux: tplinux.bin
TP radio: tpradio.bin
Here are some of the bootlogs, not all it's too long:
QFP IC
Xtal:1
DDR3 init.
DRAMC init done.
Calculate size.
DRAM size=512MB
Set new TRFC.
ddr-900
7528DRAMC V1.7 (0)
Press 'x' or 'b' key in 1 secs to enter or skip bootloader upgrade.
EN7528 at Tue Sep 20 06:34:33 UTC 2022 version 1.1 free bootbase
Set SPI Clock to 40 Mhz
spi_nand_probe: mfr_id=0x2c, dev_id=0x34
Using Flash ECC.
Detected SPI NAND Flash : _SPI_NAND_DEVICE_ID_F50L4G41XB, Flash Size=0x20000000
bmt pool size: 163
BMT & BBT Init Success
GE Rext AnaCal Done! (2)(0x1e)
Press any key in 3 secs to enter boot command mode.
bldr> tttttttttt�
bldr> help
? Print out help messages.
help Print out help messages.
reset board reset
go Booting the linux kernel.
decomp Decompress kernel image to ram.
memrl <addr> Read a word from addr.
memwl <addr> <value> Write a word to addr.
dump <addr> <len> Dump memory content.
jump <addr> Jump to addr.
flash <dst> <src> <len> <oob> Write to flash from src to dst(oob: write nand oob if 1).
imginfo Show images info.
spinand_rwtest Flash Test
bdstore <flash dst> <bin src> Do backdoor config store
bdshow Show backdoor config
bdswitch[1|0] Enable or disable backdoor function
ddrcalswitch[1|0] Enable or disable ddr calibration funciton
drambistswitch[0|1|2] disable or enable, and quick or normal test
xmdm <addr> <len> Xmodem receive to addr.
miir <phyaddr> <reg> Read ethernet phy reg.
miiw <phyaddr> <reg> <value> Write ethernet phy reg.
cpufreq <freq num> / <m> <n> Set CPU Freq <156~450>(freq has to be multiple of 6)
ipaddr <ip addr> Change modem's IP.
httpd Start Web Server
bldr> httpd
PBUF_POOL_BUFSIZE = 256
tcp_bind()
Local Port = 0
tcp_bind: bind to port 80
bldr> ipaddr
Usage: ipaddr <ip addr>
bldr> ipaddr 19.2 2.168.1.1
Change IP address to 192.168.1.1
bldr> httpd
PBUF_POOL_BUFSIZE = 256
tcp_bind()
Local Port = 0
tcp_bind: bind to port 80
bldr> https d start
bldr> httpd --help
PBUF_POOL_BUFSIZE = 256
tcp_bind()
Local Port = 0
tcp_bind: bind to port 80
bldr> httpd help
PBUF_POOL_BUFSIZE = 256
tcp_bind()
Local Port = 0
tcp_bind: bind to port 80
bldr> help httpd
? Print out help messages.
help Print out help messages.
reset board reset
go Booting the linux kernel.
decomp Decompress kernel image to ram.
memrl <addr> Read a word from addr.
memwl <addr> <value> Write a word to addr.
dump <addr> <len> Dump memory content.
jump <addr> Jump to addr.
flash <dst> <src> <len> <oob> Write to flash from src to dst(oob: write nand oob if 1).
imginfo Show images info.
spinand_rwtest Flash Test
bdstore <flash dst> <bin src> Do backdoor config store
bdshow Show backdoor config
bdswitch[1|0] Enable or disable backdoor function
ddrcalswitch[1|0] Enable or disable ddr calibration funciton
drambistswitch[0|1|2] disable or enable, and quick or normal test
xmdm <addr> <len> Xmodem receive to addr.
miir <phyaddr> <reg> Read ethernet phy reg.
miiw <phyaddr> <reg> <value> Write ethernet phy reg.
cpufreq <freq num> / <m> <n> Set CPU Freq <156~450>(freq has to be multiple of 6)
ipaddr <ip addr> Change modem's IP.
httpd Start Web Server
bldr> httpd
PBUF_POOL_BUFSIZE = 256
tcp_bind()
Local Port = 0
tcp_bind: bind to port 80
bldr> http
PBUF_POOL_BUFSIZE = 256
tcp_bind()
Local Port = 0
tcp_bind: bind to port 80
bldr> imgfo info
os1:����Hn� RЙ6�t��-U7�os2:����Hn� RЙ6�t��-U7�bldr> Minicom2.8Minicom2.8
bldr> imginfo
os1:����Hn� RЙ6�t��-U7�os2:����Hn� RЙ6�t��-U7�bldr> Minicom2.8Minicom2.8
bldr> bdshow
back door config is not support NAND Flash
bldr> tftp
bldr> tftpd
bldr>
Starting the TFTP download...
.
Total 209 (0xD1) bytes received
Received file: d�.txt
rcvdata_size = 209
start = 0x80020000
Invalid filename, upload failed
Valid filename: Bootloader : tcboot.bin
Linux Kernel&Rootfs: tclinux.bin
TP Linux Kernel: tpkernel.bin
TP Rootfs: tprootfs.bin
TP Linux: tplinux.bin
TP radio: tpradio.bin
...
bldr>
bldr> QFP IC
Xtal:1
DDR3 init.
DRAMC init done.
Calculate size.
DRAM size=512MB
Set new TRFC.
ddr-900
7528DRAMC V1.7 (0)
Press 'x' or 'b' key in 1 secs to enter or skip bootloader upgrade.
EN7528 at Tue Sep 20 06:34:33 UTC 2022 version 1.1 free bootbase
Set SPI Clock to 40 Mhz
spi_nand_probe: mfr_id=0x2c, dev_id=0x34
Using Flash ECC.
Detected SPI NAND Flash : _SPI_NAND_DEVICE_ID_F50L4G41XB, Flash Size=0x20000000
bmt pool size: 163
BMT & BBT Init Success
GE Rext AnaCal Done! (2)(0x1e)
Press any key in 3 secs to enter boot command mode.
bldr> tttttttttt
bldr> httpd
PBUF_POOL_BUFSIZE = 256
tcp_bind()
Local Port = 0
tcp_bind: bind to port 80
bldr> QFP IC
Xtal:1
DDR3 init.
DRAMC init done.
Calculate size.
DRAM size=512MB
Set new TRFC.
ddr-900
7528DRAMC V1.7 (0)
Press 'x' or 'b' key in 1 secs to enter or skip bootloader upgrade.
EN7528 at Tue Sep 20 06:34:33 UTC 2022 version 1.1 free bootbase
Set SPI Clock to 40 Mhz
spi_nand_probe: mfr_id=0x2c, dev_id=0x34
Using Flash ECC.
Detected SPI NAND Flash : _SPI_NAND_DEVICE_ID_F50L4G41XB, Flash Size=0x20000000
bmt pool size: 163
BMT & BBT Init Success
GE Rext AnaCal Done! (2)(0x1e)
Press any key in 3 secs to enter boot command mode.
bldr> tttttttttttttttt
bldr> ipaddr 192.168.1.1
Change IP address to 192.168.1.1
bldr> httpd
PBUF_POOL_BUFSIZE = 256
tcp_bind()
Local Port = 0
tcp_bind: bind to port 80
bldr> help
? Print out help messages.
help Print out help messages.
reset board reset
go Booting the linux kernel.
decomp Decompress kernel image to ram.
memrl <addr> Read a word from addr.
memwl <addr> <value> Write a word to addr.
dump <addr> <len> Dump memory content.
jump <addr> Jump to addr.
flash <dst> <src> <len> <oob> Write to flash from src to dst(oob: write nand oob if 1).
imginfo Show images info.
spinand_rwtest Flash Test
bdstore <flash dst> <bin src> Do backdoor config store
bdshow Show backdoor config
bdswitch[1|0] Enable or disable backdoor function
ddrcalswitch[1|0] Enable or disable ddr calibration funciton
drambistswitch[0|1|2] disable or enable, and quick or normal test
xmdm <addr> <len> Xmodem receive to addr.
miir <phyaddr> <reg> Read ethernet phy reg.
miiw <phyaddr> <reg> <value> Write ethernet phy reg.
cpufreq <freq num> / <m> <n> Set CPU Freq <156~450>(freq has to be multiple of 6)
ipaddr <ip addr> Change modem's IP.
httpd Start Web Server
bldr> go
flash_base=0,flash_tclinux_start=20000,TCLINUX_SLAVE_FLASH_START=500000
==> boot flag = 1g_kernel_tag_start = 2980000
the tag fsLen is 0xf49000, fsAddr is 0x600000, kernelLen is 0x42cce9, kernelAddr is 0x200
==> startAddr = 0x80002000
Decompress to 80002000 free_mem_ptr=81C2EBE9 free_mem_ptr_end=807B0000
75xx: 0x0
Uncompressing [LZMA] ... done.
jumpAddr 1forbid all forward start
before regVal = 3735928559
after regVal = 3735920367
before regVal = 353024
after regVal = 328448
before regVal = 353024
after regVal = 328448
before regVal = 353024
after regVal = 328448
before regVal = 353024
after regVal = 328448
before regVal = 3735928559
after regVal = 3735920367
before regVal = 385803
after regVal = 361227
forbid all forward end
Initializing cgroup subsys cpuset
Initializing cgroup subsys cpu
Initializing cgroup subsys cpuacct
Linux version 3.18.21 (root@9854e57720c8) (gcc version 4.6.3 (Buildroot 2015.08.1) ) #2 SMP Wed Mar 8 11:32:08 UTC 2023
__l2cmem:0x808b1480, _l2cmem_end:0x808b1480, l2cmem_size:0 Bytes
memsize:432MB
EcoNet EN7528 SOC prom init
bootconsole [early0] enabled
CPU0 revision is: 0001992f (MIPS 1004Kc)
Determined physical RAM map:
memory: 1affe000 @ 00002000 (usable)
Wasting 64 bytes for tracking 2 unused pages
MIPS: machine is econet,en751221
Zone ranges:
Normal [mem 0x00002000-0x1affffff]
Movable zone start for each node
Early memory node ranges
node 0: [mem 0x00002000-0x1affffff]
Initmem setup node 0 [mem 0x00002000-0x1affffff]
Detected 3 available secondary CPU(s)
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
PERCPU: Embedded 9 pages/cpu @81365000 s6016 r8192 d22656 u36864
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 109726
Kernel command line:
log_buf_len individual max cpu contribution: 4096 bytes
log_buf_len total cpu_extra contributions: 12288 bytes
log_buf_len min size: 16384 bytes
log_buf_len: 32768 bytes
early log buf free: 13496(82%)
PID hash table entries: 2048 (order: 1, 8192 bytes)
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Writing ErrCtl register=00011b1d
Readback ErrCtl register=00011b1d
nmi base is 813fc200
allocated 884720 bytes of page_cgroup
please try 'cgroup_disable=memory' option if you don't want memory cgroups
Memory: 421308K/442360K available (8893K kernel code, 4048K rwdata, 1920K rodata, 224K init, 891K bss, 21052K reserved)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:64
tc3162_time_init: Init bus timeout and watchdog
set rbus timeout as NMI then enable it
CPU frequency 900.00 MHz
plat_time_init: Entered, mips_timer_ack ptr is [80008ac4]
Using 200.000 MHz high precision timer.
r4k_clockevent_init: setup_irq OK, irq is [52]
console [ttyS0] enabled
console [ttyS0] enabled
bootconsole [early0] disabled
bootconsole [early0] disabled
Calibrating delay loop... 591.87 BogoMIPS (lpj=2959360)
pid_max: default: 32768 minimum: 301
Security Framework initialized
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
Initializing cgroup subsys memory
Initializing cgroup subsys devices
Initializing cgroup subsys freezer
Initializing cgroup subsys blkio
Initializing cgroup subsys debug
34K sync es set to 0.
Config7: 0x80090500
launch: starting cpu1
launch: cpu1 gone!
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
CPU1 revision is: 0001992f (MIPS 1004Kc)
Synchronize counters for CPU 1: done.
launch: starting cpu2
launch: cpu2 gone!
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
CPU2 revision is: 0001992f (MIPS 1004Kc)
Synchronize counters for CPU 2: done.
launch: starting cpu3
launch: cpu3 gone!
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
CPU3 revision is: 0001992f (MIPS 1004Kc)
Synchronize counters for CPU 3: done.
Brought up 4 CPUs
devtmpfs: initialized
NET: Registered protocol family 16
PCIe 7528 PHY init
PCIe driver version: 7528.2.20190226
EN7528 pcie_init
check pcie link up status:
isRC0_LINKUP=1
isRC1_LINKUP=1
registering PCI controller with io_map_base unset
Initializing Ecnt Event Netlink Socket
Initializing Econet Event Netlink Socket nl_sk = 9aef4800
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
pci_bus 0000:00: root bus resource [io 0x1f600000-0x1f61ffff]
pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
pci 0000:00:01.0: BAR 8: assigned [mem 0x20200000-0x203fffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
pci 0000:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
pci 0000:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
pci 0000:00:00.0: PCI bridge to [bus 01]
pci 0000:00:00.0: bridge window [mem 0x20000000-0x201fffff]
pci 0000:02:00.0: BAR 0: assigned [mem 0x20200000-0x202fffff 64bit pref]
pci 0000:02:00.0: BAR 2: assigned [mem 0x20300000-0x20303fff 64bit pref]
pci 0000:02:00.0: BAR 4: assigned [mem 0x20304000-0x20304fff 64bit pref]
pci 0000:00:01.0: PCI bridge to [bus 02]
pci 0000:00:01.0: bridge window [mem 0x20200000-0x203fffff]
NET: Registered protocol family 8
NET: Registered protocol family 20
Switched to clocksource MIPS
NET: Registered protocol family 2
TCP established hash table entries: 4096 (order: 2, 16384 bytes)
TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
NET: Registered protocol family 1
mt7512_pcie_fixup: 0x1438 = 20000015
mt7512_pcie_fixup: 0x3438 = 20200015
mt7512_pcie_rc1_retrain: 80 = 0145dc12 80 = 01608c12
RC1 Link Traing Result: 10120008
l2c_op_range: 0x9fa41000 ~ 0x9fa4105f, op: 0x1f
l2c_lock_range for 7528 boot2: OK
TC3162 hardware watchdog module loaded.
futex hash table entries: 1024 (order: 4, 65536 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) � 2001-2006 Red Hat, Inc.
fuse init (API version 7.23)
msgmni has been set to 822
io scheduler noop registered (default)
ttyS0 at I/O 0xbfbf0003 (irq = 5, base_baud = 7200) is a TC3162
ECNT ring buffer init success
brd: module loaded
SPI Flash Init Start
Found no SPI flash device
Register flash device:flash0
IS_SPIFLASH=0x0, IS_NANDFLASH=0x1, (0xBFA10114)=0x6)
Set SPI Clock to 40 Mhz
spi_nand_probe: mfr_id=0x2c, dev_id=0x34
Using Flash ECC.
Detected SPI NAND Flash : _SPI_NAND_DEVICE_ID_F50L4G41XB, Flash Size=0x20000000
spi nand flash
tc3162: flash device 0x01000000 at 0x1c000000
EN7512 mtd init: spi nand probe enter
[spi_nand_setup] : Enter
nand: device found, Manufacturer ID: 0x2c, Chip ID: 0x34
nand: Micron _SPI_NAND_DEVICE_ID_F50L4G41XB
nand: 512MiB, SLC, page size: 4096, OOB size: 128
nand_scan_ident ok
[spi_nand_setup]: chip size = 0x20000000, erase_shift=0x12
bmt pool size: 163
BMT & BBT Init Success
Creating 12 MTD partitions on "EN7512-SPI_NAND":
0x000000000000-0x000000040000 : "boot"
0x000000040000-0x000000140000 : "romfile"
0x000000140000-0x000000340000 : "config"
0x000000340000-0x000000380000 : "radio"
0x000000380000-0x000000980000 : "kernel"
0x000000980000-0x000002980000 : "rootfs"
0x000000380000-0x000002980000 : "ker_rofs"
0x000002980000-0x000002f80000 : "kernel_2"
0x000002f80000-0x000004f80000 : "rootfs_2"
0x000002980000-0x000004f80000 : "ker_rofs_2"
0x000004f80000-0x00001c000000 : "reserve_area"
0x000008000000-0x000018000000 : "container"
mtd[config]: map address 00240000 to offset 00100000
tc3162_put_rootfs@728: use rootfs_2 as root
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
register rtpci
PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
<--mt7916_hif_init()
Rx[0] Ring: total 12288 bytes allocated
Rx[1] Ring: total 8192 bytes allocated
<-- pci_alloc_tx_rx_ring_mem, Status=0
PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
PCI: Enabling device 0000:02:00.0 (0000 -> 0002)
1 Like
Try that webserver setting nearby IP?
Also no. It also doesnt work properly. I think this is it 
it wont work.
1 Like
Probably dead end then.
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.