====== ZTE H188A ======
===== Status =====
^ Item ^ Status ^
| OpenWrt Support | No |
| Bootloader | Unknown (likely U-Boot, not confirmed) |
| Root Access | Yes (SSH) |
| Flash Dump | Not yet obtained |
| Serial Console | Not investigated |
| Device Tree | Unknown |
===== Hardware =====
^ Component ^ Information ^
| Model | ZTE H188A |
| SoC | EcoNet EN751627 |
| CPU | Quad-Core MIPS 1004Kc V2.15 |
| Architecture | MIPS32r2 |
| Logical CPUs | 4 |
| RAM | 128 MB |
| Flash | 112 MB NAND |
| Kernel | Linux 3.18.21 |
| Toolchain | GCC 4.6.3 (Buildroot 2015.08.1) |
CPU Features:
<code>
mips1
mips2
mips32r1
mips32r2
mips16
dsp
mt
</code>
===== Flash Layout =====
mtd0 Whole flash
mtd1 Bootloader
mtd2 wifi
mtd3 tag
mtd4 config
mtd5 rootfs1
mtd6 kernel1
mtd7 kernel2
mtd8 rootfs2
The flash layout indicates a dual-bank (A/B) firmware design.
===== Mounted Filesystems =====
/ squashfs
/usercfg jffs2
/tmp tmpfs
/var tmpfs
Supported filesystems:
squashfs
jffs2
overlay
tmpfs
ext2
ext3
vfat
ntfs
===== Memory =====
MemTotal: 105176 kB
===== Network Hardware =====
==== Ethernet ====
Loaded modules:
eth
fe_core
qdma_lan
qdma_wan
hw_nat
Hardware NAT appears to be implemented using the proprietary ''hw_nat'' driver.
==== DSL ====
Loaded modules:
tc3162_dmt
mt7510ptm
The device uses a proprietary DSL implementation.
===== Wireless =====
Loaded wireless drivers:
mt7603eap
mt7612_ap
Wireless hardware appears to consist of:
^ Band ^ Chip ^
| 2.4 GHz | MediaTek MT7603 |
| 5 GHz | MediaTek MT7612 |
These Wi-Fi chipsets already have Linux/OpenWrt driver support.
===== Voice Hardware =====
The firmware includes VoIP support.
Loaded modules include:
usrline
DSPCore
ovdsp
foip
fxs3_silicon
===== BusyBox =====
BusyBox Version:
BusyBox v1.17.2
The firmware uses a heavily stripped BusyBox.
Available utilities include:
ash
brctl
cat
cp
date
df
dmesg
free
hostname
ifconfig
insmod
kill
ls
lsmod
mkdir
mount
mv
ping
ps
pwd
reboot
rm
route
tftp
top
traceroute
umount
wget
Missing common utilities:
chmod
dd
grep
hexdump
strings
tar
vi
xxd
fw_printenv
===== Executable Behaviour =====
Execution from ''/tmp'' is permitted.
Example:
cp /bin/ping /tmp/ping
/tmp/ping
works correctly.
However, binaries downloaded using ''wget'' are created with permissions:
-rw-r--r--
Because ''chmod'' is unavailable, downloaded executables cannot easily be run.
===== Kernel =====
Kernel Version:
Linux 3.18.21
Compiler:
gcc 4.6.3
Buildroot 2015.08.1
===== PCIe =====
Kernel reports two PCIe buses:
PCI Bus 0000:01
PCI Bus 0000:02
===== Interrupts =====
Dedicated interrupts exist for:
* wlan5g0
* qdma_lan
* qdma_wan
* USB
* PCM
===== Current Findings =====
* Root SSH access is available.
* Firmware uses SquashFS + JFFS2.
* Device implements dual firmware (A/B) layout.
* 128 MB RAM.
* Approximately 112 MB NAND flash.
* MediaTek Wi-Fi hardware already supported by Linux/OpenWrt.
* Proprietary DSL implementation.
* Proprietary hardware NAT implementation.
* Bootloader has not yet been identified.
===== Information Still Needed =====
* UART pinout
* Boot log
* U-Boot console access
* Bootloader dump
* Complete flash dump
* Original firmware image
* Device Tree Blob (DTB)
* GPIO assignments
* Flash chip model
* RAM chip model
* Ethernet PHY identification
* Switch chip identification
* NAND geometry
* Recovery procedure
===== OpenWrt Port Status =====
The major blockers for an OpenWrt port currently appear to be:
* No existing EN751627 platform support.
* Missing Device Tree.
* Unknown bootloader/recovery procedure.
* Proprietary DSL implementation.
* Ethernet initialization not documented.
The hardware itself (RAM, flash, CPU, and Wi-Fi chipsets) appears capable of running OpenWrt if platform support is developed.
===== Comments =====
**SSH isnt supported on the base h188a but by installing a config (h288a) which supports SSH
this devices is used by more than 10 million people across egypt
its has great hardware paired with terrible software
[admin edit: removed email address and cleaned up the post formatting]