Oh! Is there some connection to OpenWRT as some references claim?
And is it then possible, the bootloader is also not from Android?
yes. It’s fork of OpenWrt v18
I don't know where to get the bootloader image. You'll have to provide it.
The FIT-kernel image contains many dtb images:
- fdt@mp02.1 = IPQ5018/AP-MP02.1
- fdt@mp03.1-c2 = IPQ5018/AP-MP03.1-C2
- …
- fdt@mp03.3-c3 = IPQ5018/AP-MP03.3-C3
You need to find out what configuration is used on your device revision.
when I googled CB0401 yesterday, I also found references to a CB0401v2.
I know
1 Like
I suppose I don’t for the primary goal which is to make it boot properly. I hope it only takes flashing the original FW.
Making clean OpenWRT for it a bit different ballgame.
And it is the CB0401. Not V2.
Some people have managed to root these devices:
Some even dumped the images, but posted them only for a select few:
Can I somehow detect what kind of network traffic this device makes while booting?
I would like to know if it does try to reach a tftp server.
Someone has already been to the same issue as I am. UART seems to be where I expected it to be:
Unfortunately no information if it is 1,8V or 3,3V, but I think It’s expected to be 3,3V.
1 Like
I got 1,8V USB TTL -adapter now and tested it.
There is only the “SBL-like” output. When it is supposed to output U-boot printout, it’s blank.
Hi, I am also trying to open the same router, but I am having trouble separating the two plastic halves from the PCB. How did you manage to access it?
I removed the outer plastic shell, then removed all the screws along the cylindrical body I could find and removed the upper plastic part with the NFC. From there, I noticed two additional latches (one at the top and one at the bottom). But here it stops. The bottom part seem to be already free, but the upper part looks like is still hooked. Are there any other hidden latches on the sides or elsewhere that I might be missing?
Any tips will be very helpful.
Can you show a picture about where you are now.
Here is a picture from different sides. The two latches are circled with red. I also removed some of the coax cables but after taking the pictures.
You still have one of the “plates” attached. Did you take all screws off of it?
Then you have to detach antennas 7 and 8 from the black plastic because you can not detach the related wire from the mainboard. Antennas 9-12 will remain attach to the plastic because wire connector can be reached and detached from the mainboard.
The black plastic cylinder halve has 6 screws and 6 tiny notches (5 at one end and one at the other) to keep it in place.
1 Like
Awesome, thank you for the instructions. I managed to open it.
What’s your next intention about it?
My router is malfunctioning and I wanted to check what is happening. I ordered a used one on Ebay but received it defective, though it was tested before shipped and was working. First issue was that no light would turn on when powered, now that I opened it, it does randomly power on when I lift it from the second heatsink or when some antennas are disconnected, but I wasn't able to repeat the behaviour yet. When it does power on the system led glows orange (error state), but just once it booted and I was able to see the wifi signal but then it just turned off.
This is more like a hobby project to try to troubleshoot it, as I have only basic experience in electronic repairs. In the worst case I will throw it away.
So you bought on from Latvia.
Is it in bootloop shutting itself down some 1 minute after powering on?
Exactly. Do you have similar experience?
Probably yes, but from my short observation it behaves a bit random.
Yes, I have the same situation except that I got my money back.
If I only got the device up without bootloop, I’d try to establish SSH and/or uart connection to extract kernel and initramfs from it.
I also got it somehow up maybe once, but after reboot it was’n working any more.
If I only got it up once again …
Hah, I see. Luckily I also got a full refund. I will try to test it some more and can report back.