Hello everyone! I decided to start this thread on the seldom
discussed STARBRIDGE LYNX-110/220 ROUTER/MODEMS.
I can't find anywhere else that people are talking about them
and I've made some discoveries so hey, why not?

I'd love to see OPENWRT on this device.
I assume it can be done. It's been done on similar devices.

My girlfriend lives in a small town with fairly crappy DSL.
One day I decided to see if I could access her router/modem
as her speeds were terrible. She has a STARBRIDGE LYNX-220.
I was able to telnet into the device easilly with the usual
methods. I have a client in that same town who upgraded to
CABLE internet and had no use for her DSL router/modem so
she gave it to me, it's a STARBRIDGE LYNX-210. I have taken
the 210 home and put it onto my LAN as another embedded
busybox device that can be accessed via http or telnet.
I have also taken it apart and logged what I found.
I have not taken the 220 apart but I assume it's very similar.
So... Without further ado... Here is the start!!!

STARBRIDGE LYNX 210 ROUTER/MODEM
--------------------------------
This device is an Texas Instruments AR7 based DSL router/modem.

It can be accessed via telnet or http by going to 192.168.1.1
after setting your LAN to 192.168.1.X of course.
(X being anything other than 1.)

Strangely, the default logins from web and telnet are different.

TELNET
------
Login: root
Password: admin

HTTP
----
Login: admin
Password: admin

I'm pretty sure I found a backup of the firmware, it's located
at /usr/lib/modules and named "ar0700xx.bin".

You can enable web access to the entire filesystem and download
anything you want, including the firmware, with this from shell:

# thttpd -d / -p 81 -D

After that, go to 192.168.1.1:81 and you're in!
Hit CTRL+C to break the process or just put an & after it to
throw it into the background when you first type it.

It's easy to get the router into a state that needs resetting.
If you crash it by simply causing a core dump or something
from shell it often enters into a strange state where you can
telnet to it and get to the login, but nothing works.
In this state, you can't use http at all and the only thing I
have found to do is use a paperclip or similar object to hit
the reset button on the back.

TECHNICAL SPECS:

The device uses a TNETD7300AGDW CPU which is a version of
Texas Instrument's AR7. The WIKI listed below gives some very
usefull information and links about the AR7 plus links to
various devices that use it. Many of these devices have OPENWRT
on them so I assume the 210/220 should be easy to do!!!

http://www.linux-mips.org/wiki/AR7

You can get a datasheet on the cpu from here:

http://focus.ti.com.cn/pdfs/bcg/ar7wi_fact_sheet.pdf

It's a very cool CPU! I am wondering if it is possible, after
hacked, to turn the device into a VOIP box where it can grab
the net through it's ethernet port and put the voip out it's
analog DSL port to a phone. This *should* be possible in my
opinion, anyone in the know please give your thoughts!

Under the hood you will find:

TNETD7300AGDW CPU with alpha numeric 5C2CJ49 on it.

Linkcom LAN 1102 0550

Sticker on the board reading T488 11 P31A42

Small chip (controller chip?)

UTC SKA1 MC34063AL ND

Chip with sticker on it that lettering/numbering was rubbed
off of. 2 red dots on chip also. Here is all I could get:

INTEL C       F1 60
      A5
      (M) (C) '02

The sticker says: 62.48.3 P31 C 21

Another chip:

ISSI
FOUND INFO ON THIS! THIS IS THE RAM!
---> IS42S16400B-7T <---- THIS IS IT!
G2583500N 0521

Here's a link to the datesheet:
http://www.alldatasheet.com/datasheet-p … 0B-7T.html

It's 64 Megabits Synchronous DRAM

Sticker on back of board:
MAC: (My MAC ID)
DSL 600EU

Logo on back of board:
B(Looks like Devil's tail)RB M103D
94V-0 2405

Another thing on the board:
050-533000-401 G

I know I'm being overly descriptive but any information may
help so I'm doing this in hopes that someone in the know may
understand if firmware from another device may work in this.

STARBRIDGE LYNX 220 ROUTER/MODEM
--------------------------------
I am not positive but I assume all that applies to the 210 is
true with the 220 as well. Verification of this coming soon!

I hope that something can/will come of this thread and that
at the very least it will become the one place people who have
these devices can talk at. Thanks!!!

- Dieter

WWW.MENTALDOMINANCE.COM

(Last edited by MENTALDOMINANCE on 2 Apr 2009, 07:59)

AMMENDMENT:
I have done extensive research on the LYNX-210/220 and have discovered that they're the AZTECH DSL-600 series!

LYNX-210 = AZTECH DSL600EU
LYNX-220 = AZTECH DSL600E

There's a ton of other stuff I've recently discovered. Don't worry about playing either! If you brick the
router, the awesome TNET D7300AGDW CPU has an ADAM2 bootloader built into it!
Essentially this means that via FTP, you can access what you'd normally need a JTAG or TTL device to do!
I've already done it many times. Below is a very cool app to use. It lets you do all sorts of stuff such as
rebuild/edit/delete/resize the MTD partitions on the ADAM2 and more! This app is designed to interface
with AR7 processors via ADAM2 so anything else you have that fits that description will work with it also.

http://ciclamab.altervista.org/index_en.php

CAUTION: The MTD2 partition IS THE ADAM2 BOOTLOADER so whatever you do do not fuck with it!!!

You can get firmware for all of this stuff here:

ftp.aztech.com/SUPPORT
ftp.aztech.com/SHIRO

If you go into just ftp.aztech.com it appears as if nothing is there because all directories are hidden.
So far I have only found SUPPORT and SHIRO. SHIRO is some Singapore company that makes
devices like MP3 players and the lot. There are a ton of cool firmwares and shit in there, this is
a nice place to find a bunch of shit so go check it out!

I will post more on my work if anyone seems at all interested. I am currently working on interchanging
firmwares from 600E, EU, ER, EW, etc. for different functionality. They are all basically the same thing
except EW = Wireless, ER = Router, etc. but you should be able to put the software from any on the other.
This will give examples of how to access devices you may want to add to the hardware it's self or if you're
like me and you want to turn a LYNX-210/220 into a router with a hub/switch. My ultimate goal would be to
turn the device into a VOIP box or get OPENWRT onto it. We'll see. I haven't checked fully on OPENWRT yet,
been too busy with the other exciting progress I've been making but I have come across a forum on here
dealing with OPENWRT on the 600E. http://forum.openwrt.org/viewtopic.php?id=2820
Remember, your LYNX-210 is just a renamed AZTECH DSL-600EU and the LYNX-220 is a renamed
AZTECH DSL-600E. With this information in hand, you should be able to accomplish a lot as there is
documentation and hacking going on with the DSL-600 series.

Happy hacking!!!

- Dieter

(Last edited by MENTALDOMINANCE on 2 Apr 2009, 22:25)

CHANGING THE STARBRIDGE LYNX-220 INTO AN AZTECH DSL-600E/EU
-----------------------------------------------------------------------------------
I've managed to flash the AZTECH DSL-600E/EU's firmware onto my LYNX-220, essentially changing
it into a DSL-600E/EU for all intensive purposes. It's really pretty cool!
The complete kernel, flash, and filesystem were replaced.
Just letting everyone know that it can be done. Anyone interested let me know and I'll post details.

- Dieter

(Last edited by MENTALDOMINANCE on 5 Apr 2009, 23:27)

I have a lynx 220 but I can't access to it, and my LAN is 201.xxx.xxx.xx
DO you suggest anything?

(Last edited by xbonsx on 12 Apr 2009, 20:48)

Set your PC's ip to 192.168.1.4 and then go to 192.168.1.1 on the web.
It will work! 8)

An excellent hack and I enjoyed reading your posts.

What chipset is used on the FXO port for DSL? Can you find its driver source code?

Is it worth taking the risk in upgrading the firmware?  How old was your original one?  Anything notably different?  My 210 has version 38.2.10, which based on the BusyBox (Telnet) date anyway, is 5 years old. The only one I see seems even older:
ftp://ftp.aztech.com/SUPPORT/DOWNLOAD/Adsl/DSL600EU

38.2.6.

(Last edited by rseiler on 24 Apr 2009, 06:50)

Further question: How on earth do you set the system clock on this thing?

mazilo: Thanks for the compliment! I don't really know the answer to your question though, it's been a while
since I've played with the LYNX.

rseiler: Is it worth taking the risk? I don't really consider it a risk, as I said, it would be near impossible
to brick the device due to it's ADAM2. Nevertheless, "if it ain't broken don't fix it" is a rule to follow unless you're
like me and you have to hack everything you own. 8) I have moved on to other things since conquering the
LYNX so it isn't really fresh in my mind anymore. I don't know about the system clock, I assume you've tried
using the TIME and DATE commands, right? I don't recall if the version I "upgraded" to was higher or lower.
At the time I was more concerned with just proving the concept that the modem can be converted into a
DSL600XX from the LYNX. 8) Remember, this isn't a firmware upgrade per se - it's a device switch.
After doing this, you no longer have a LYNX-210 - you have a DSL600EU. The LYNX seems to be a noname
company that has no support for it's devices - the DSL on the other hand has many firmwares and seems not
only to be supported but to be the hardware the LYNX is based on. I had a free LYNX to play with that a client
had given me. If you are going to try the hack all I can say is make sure you know all the settings to get
your modem online once converted and make sure you dump the LYNX firmware so you can go back if needed.
(I don't remember how exactly, again this isn't fresh in my mind anymore. Sorry.)

- Dieter

(Last edited by MENTALDOMINANCE on 28 Apr 2009, 20:53)

AFAIK, most Texas Instruments AR7 based ATA devices use a telephony Legerity Le88221 voice chipset (download GPLed driver source code) on their VoIP Module (VM) to drive the FXS ports. Since you mentioned LYNX-210/220 devices are based on a TI AR7 chipset, perhaps its Modem Module (MM) is also based on a Legerity Le88221 voice chipset.

Hello,

I know it's been a while since this post was first opened; however I can not find a way to enter my LYNX-210 web interface, nor can I telnet into it. Suggestions? TIA.

Hello there,

I hope this topic is still viewed by anyone. I have a starbridge lynx-220 but I live in a country were the ISP refuses to give PPPoe username/password.

Now this router is givving me so much trouble and everytime it stops working I have to pay one of their mechanics to come reset the settings (for which I pay a rough 50$ a visit)

Now most of you will say why dont you switch ISP, well there is only 2ISP's around here and the one im with is the best of the 2 Can you imagine?? Hahahahaha

Now I would very much like to update a router with the Aztech firmware or maybe even an openwrt CFW if this is possible, but before I will be able to do that I would be needing my PPPoE user/passwd, so naturally my question is Do any of you have any idea if there's a way for me to retrieve it??

Dear users,

very interesting post, I would like to know if you have made some progress using Lynx-220.

Is there any progress on using it as VoIp router, i.e. porting openWrt to this box or any other progress I can take over and start with.

I would like to contribute as I have one of this devices.

Please let me know.

Best

LYNX-210 = AZTECH DSL600EU -> no info at wikidevi
LYNX-220 = AZTECH DSL600E -> 8MB RAM acc. wikidevi -> unsupportable