Ubootmod layout for Cudy TR3000

In theory, you could apply the ubootmod from within the Cudy intermediate image, if it ships with kmod-mtd-rw.

Sure, where's the location of the data?

It's not impossible, you just have to locate it. My point was your request is unique and indvidual to your needs, given OpenWrt's WiFi is different by default.

You could use a hex editor to look at a copy of the data in the relevant partition for the key and note its location.

I understood you.

Unfortunately, Cudy support confirmed they encrypt the password in the bdata partition, it’s mtd3, MAC address is in plain text there, other things - not.

the reproduce Cudy wifi password have been asked before, and the answer was it was calculated based on .... something (their signing key ?), I don't remember, but you can probably find the thread/post if you use the search function.

What’s the value in encrypting the password at all in this location? Just trying to work out why the engineers might have done this.

they're not, they're calculating it, based on ... MAC, I'm guessing, since it's pretty much the only unique value on each device.

Ah makes sense.

Would GPL code help?

if they somehow add the key they're signing their images with, it's not going to be in there.

Where do I get:

openwrt-mediatek-filogic-cudy_tr3000-v1-ubootmod-preloader.bin

openwrt-mediatek-filogic-cudy_tr3000-v1-ubootmod-bl31-uboot.fip

and when applying the sysupgrade after the modifications do I need to apply from ‘SNAPSHOT’ in firmware selector?

Does this mean that if you don’t apply the Ubootmod layout but install SNAPSHOT there will be a problem because the SNAPSHOT images expect the modded layout?

ubootmod for TR3000 only exists in snapshots, again, as pointed out earlier.

Will SNAPSHOT still work without having applied the mod?

Vanilla exists in stable, no need to go snapshot if you're not doing ubootmod.

Got it, but for anyone who wants to go to SNAPSHOT they must first apply the mod or is it optional? I’m also trying to work out future compatibility. Say if 24.10.3 issues will users need to apply the mod to actually use 24.10.3?

I gather one must use SNAPSHOT to use the mod?

So following the mtd write one must sysupgrade to SNAPSHOT?

Source version doesn't matter when migrating to ubootmod.

ubootmod in itself is optional too, currently only available in snapshots.

mtd is only required for ubootmod, not vanilla stable.

Wait, so can one apply the ubootmod from 24.10.2 and keep using 24.10.2? The installation instructions include the step of sysupgrade over TFTP. Is that always necessary and if so why? I guess I just don’t know enough about how this works and I imagine it’s not documented anywhere readily accessible.

Is TR3000 ubootmod available in 24.10.2 ?

Installation of what ? Ubootmod, yes.

I didn't write the instruction, but I would guess so.

These rather clearer instructions for applying the ubootmod to the UniFi 6 LR involve: first applying the mtd operations; and then flashing the ubootmod recovery and ubootmod sysupgrade itb images:

Would this approach work for the TR3000?

Serial on the TR3000 is a PITA, that's probably why it's not applied the same way.

Hey guys, I’ve just found out that there is an OpenWrt package cudy-bdinfo available in official repos. It’s made by cool blocktrron https://github.com/blocktrron/cudy-bdinfo-decrypt. After I’ve built a firmware with this and put this into uci-defaults I finally got the same wifi networks with a proper password and router IP from the label!

#!/bin/sh
for iface in $(uci show wireless | grep "=wifi-iface" | grep "radio1" | cut -d. -f2 | cut -d= -f1); do
    uci set wireless.$iface.disabled='1'
done

uci -q delete wireless.@wifi-iface[0]
uci -q delete wireless.@wifi-iface[1]

uci set wireless.radio0=wifi-device
uci set wireless.radio0.band='2g'
uci set wireless.radio0.channel='6'
uci set wireless.radio0.htmode='HE40'
uci set wireless.radio0.country='PA'
uci set wireless.radio0.disabled='0'

uci set wireless.radio1=wifi-device
uci set wireless.radio1.band='5g'
uci set wireless.radio1.channel='36'
uci set wireless.radio1.htmode='HE80'
uci set wireless.radio1.country='PA'
uci set wireless.radio1.disabled='0'

MAC_HEX=$(dd if=/dev/mtd3 bs=1 skip=56832 count=6 2>/dev/null | hexdump -v -e '6/1 "%02X"')
MAC_SUFFIX=${MAC_HEX:8:4}

SSID_2G="Cudy-${MAC_SUFFIX}"
SSID_5G="Cudy-${MAC_SUFFIX}-5G"

PIN=$(cudy-bdinfo -i /dev/mtd3 | awk -F' = ' '/^pin = / {print $2}')

uci set wireless.@wifi-iface[0].ssid="${SSID_2G}"
uci set wireless.@wifi-iface[0].encryption='psk2'
uci set wireless.@wifi-iface[0].key="${PIN}"

uci set wireless.@wifi-iface[1].ssid="${SSID_5G}"
uci set wireless.@wifi-iface[1].encryption='psk2'
uci set wireless.@wifi-iface[1].key="${PIN}"

uci commit wireless

uci set network.lan.ipaddr='192.168.10.1'
uci commit network

24.10.3 is being built, including the TR3000 ubootmod - https://downloads.openwrt.org/releases/24.10.3/targets/mediatek/filogic/, wait until the official announcement, just in case.