OpenWrt Forum Archive

Topic: HooToo TripMate HT-TM01 Wireless N150 8M flash/32M RAM

The content of this topic has been archived between 18 Apr 2018 and 19 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

This seems to be a clever device with a silly name.  It's a 5200mAh LiIon battery with a grafted Ralink RT5350 SoC, a USB port on one end and Ethernet on the other.  Factory firmware includes normal SOHO router & bridge functions, as well as NAS and a WiFi bridge to e.g. provide guest access without revealing WPA codes.

I'd like to use one as a portable music streamer, self-powering is a huge draw for me.  What are my chances getting an OpenWrt nightly up on this thing?  I found some discussion about the RT5350 but it appears to be on the OpenWrt bleeding edge at the moment.

More info here:

http://blog.testfreaks.com/review/revie … -in-one/2/

(Last edited by Braklet on 10 Mar 2014, 13:57)

I am also interested in getting openwrt on this device.

I dug around through the hardware support section of the Wiki, and people have gotten OpenWrt running on other RT5350-based devices, e.g. the D-Link DIR-320:

http://wiki.openwrt.org/toh/d-link/dir-320_revb1

Before diving into OpenWrt on this device, I'd like an option to restore the factory HooToo firmware.  Unfortunately the manufacturer does not have an image available for download.  I contacted support and their answer is "all devices are shipped with latest firmware" so I suspect they won't embrace users trying OpenWrt.

There are more details about the hardware here:

http://www.hootoo.com/hootoo-tripmate-h … 00mah.html

Any update on this; have you tried it out?

The  Tripmate apppeares to have a reset button that says it will restore "factory settings". Will that work or does flashing openwrt render it useless?

Never got one.  You'll be a trailblazer! wink

I will sacrifice mine in the name of science if anyone wants to guide me on what to do.

Open it up and provide photos.  If there are 3 or 4 pads together somewhere, perhaps below the Ethernet connection if it is on the right, they are probably (3V3) Tx Rx 0V.  Tx and Rx may be reversed.  Connect tx & rx & 0V to a usb-to-serial dongle (make sure it is 3V3).  You can solder on small wires or use spring test clips. 

Connect at 57600 and look at the output.  You may have an option to flash using tftp.  Set up your tftp server with the proper settins and you may be able to flash a trunk download.

It will probably be 4mb flash and 16mb ram (yawn), but if it's 8mb flash and 32mb ram you will have found a device others would want to look at.

(Last edited by lizby on 8 Mar 2014, 14:41)

Here are the inside pictures. Taking it apart was fairly easy, screwdriver through the side with the  usb then popping it up.
HooToo Inside 

if you want me to take more specific pictures just direct me where.

On step 2:
Connect tx & rx & 0V to a usb-to-serial dongle (make sure it is 3V3). 
You can solder on small wires or use spring test clips.

Can you draw me a diagram, and a link to a usb-to-serial dongle I can buy that will work?


After that the step will be:
-Connect at 57600 and look at the output.  You may have an option to flash using tftp.

Found a cable, and a friend helped me set it up.
We got this from the dump. 

Also the parts are:
8MB NOR Flash http://www.zlgmcu.com/mxic/pdf/NOR_Flas … _DS_EN.pdf
32MB RAM http://www.esmt.com.tw/DB/manager/uploa … 6A(2A).pdf

Ralink RT5350F
TPSG321409
1341 STA1
RT5350 CPU http://dlnmh9ip6v2uc.cloudfront.net/dat … RT5350.pdf

HOLTEK HT66F30

Welcome to minicom 2.5

OPTIONS: I18n                                                               
Compiled on May  2 2011, 10:05:24.                                           
Port /dev/ttyUSB0                                                           
                                                                             
Press CTRL-A Z for help on special keys                                                                               
                                                                                                                     
                                                                                                                     
                                                                                                                           
U-Boot 1.1.3 (Apr 25 2013 - 09:25:18)                                                                                       
                                                                                                                           
DRAM:  32 MB                                                                                                               
Initialize usb ehci ohci                                   
find flash: MX25L6405D                                     
.*** Warning - bad CRC, using default environment           
                                                           
============================================               
UBoot Version: 3.6.0.0                                     
--------------------------------------------
ASIC 5350_MP (Port5<->None)
DRAM_CONF_FROM: Boot-Strapping
DRAM_TYPE: SDRAM
DRAM_SIZE: 256 Mbits
DRAM_WIDTH: 16 bits
DRAM_TOTAL_WIDTH: 16 bits
TOTAL_MEMORY_SIZE: 32 MBytes
Flash component: SPI Flash
Date:Apr 25 2013  Time:09:25:18
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384

##### The CPU freq = 360 MHZ ####
estimate memory size =32 Mbytes
.
Initialize vs configure module
.Initialize GPIO
Input i key to enter menu 0
........................## Booting image at 80500000 ...
   Image Name:   Linux Kernel Image
   Created:      2013-09-27   6:01:32 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1442377 Bytes =  1.4 MB
   Load Address: 80000000
   Entry Point:  80441000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80441000) ...
## Giving linux memsize in MB, 32

Starting kernel ...


LINUX started...

THIS IS ASIC
PROC INIT OK!
enter init
Start rootfs
mounted
echo 6 > /proc/sys/kernel/printk
tntfs: module license 'Commercial. For support email ntfs-support@tuxera.com.' taints kernel.
init dev files
mounted end
Sun Jan  1 00:00:00 UTC 2012
Get time information first
tz_minuteswest=0
Set time information
offset=0  tz.tz_minuteswest=0
Get time information again
tz_minuteswest=0
GMT-00:00
arch/mips/rt2880/nvram.c 472: len=0x3ffc, crc_value=0x962c8a5e, fb[0].env.crc=0x962c8a5e
arch/mips/rt2880/nvram.c 502: Same CRC
Finish the check crc
SSID_PREFIX:TripMate
wireless port last two bytes:-afe4!
tmp1 = TripMate-AFE4!
Default SSID:TripMate-AFE4!
arch/mips/rt2880/nvram.c 423: --> nvram_clear 0
arch/mips/rt2880/nvram.c 445: clear flash from 0x2004 for 0x3ffc bytes
arch/mips/rt2880/nvram.c 527: --> nvram_commit 0
init net

phy_tx_ring = 0x01255000, tx_ring = 0xa1255000

phy_rx_ring0 = 0x01320000, rx_ring0 = 0xa1320000
MAC_ADRH -- : 0x0000001c
MAC_ADRL -- : 0xc20bafe5
RT305x_ESW: Link Status Changed
vs_port_link_status=0
RX DESC a07dc000  size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
RTMP_TimerListAdd: add timer obj c0083b68!
RTMP_TimerListAdd: add timer obj c0020fe4!
RTMP_TimerListAdd: add timer obj c0020bb4!
RTMP_TimerListAdd: add timer obj c0020f90!
RTMP_TimerListAdd: add timer obj c0020fb8!
RTMP_TimerListAdd: add timer obj c0021210!
RTMP_TimerListAdd: add timer obj c0024104!
RTMP_TimerListAdd: add timer obj c0023cd4!
RTMP_TimerListAdd: add timer obj c00240b0!
RTMP_TimerListAdd: add timer obj c00240d8!
RTMP_TimerListAdd: add timer obj c0024330!
RTMP_TimerListAdd: add timer obj c0027224!
RTMP_TimerListAdd: add timer obj c0026df4!
RTMP_TimerListAdd: add timer obj c00271d0!
RTMP_TimerListAdd: add timer obj c00271f8!
RTMP_TimerListAdd: add timer obj c0027450!
RTMP_TimerListAdd: add timer obj c002a344!
RTMP_TimerListAdd: add timer obj c0029f14!
RTMP_TimerListAdd: add timer obj c002a2f0!
RTMP_TimerListAdd: add timer obj c002a318!
RTMP_TimerListAdd: add timer obj c002a570!
RTMP_TimerListAdd: add timer obj c002d464!
RTMP_TimerListAdd: add timer obj c002d034!
RTMP_TimerListAdd: add timer obj c002d410!
RTMP_TimerListAdd: add timer obj c002d438!
RTMP_TimerListAdd: add timer obj c002d690!
RTMP_TimerListAdd: add timer obj c0030584!
RTMP_TimerListAdd: add timer obj c0030154!
RTMP_TimerListAdd: add timer obj c0030530!
RTMP_TimerListAdd: add timer obj c0030558!
RTMP_TimerListAdd: add timer obj c00307b0!
RTMP_TimerListAdd: add timer obj c00336a4!
RTMP_TimerListAdd: add timer obj c0033274!
RTMP_TimerListAdd: add timer obj c0033650!
RTMP_TimerListAdd: add timer obj c0033678!
RTMP_TimerListAdd: add timer obj c00338d0!
RTMP_TimerListAdd: add timer obj c00367c4!
RTMP_TimerListAdd: add timer obj c0036394!
RTMP_TimerListAdd: add timer obj c0036770!
RTMP_TimerListAdd: add timer obj c0036798!
RTMP_TimerListAdd: add timer obj c00369f0!
RTMP_TimerListAdd: add timer obj c005170c!
RTMP_TimerListAdd: add timer obj c00512dc!
RTMP_TimerListAdd: add timer obj c00516b8!
RTMP_TimerListAdd: add timer obj c00516e0!
RTMP_TimerListAdd: add timer obj c0051738!
RTMP_TimerListAdd: add timer obj c0051764!
RTMP_TimerListAdd: add timer obj c0051790!
RTMP_TimerListAdd: add timer obj c0084088!
RTMP_TimerListAdd: add timer obj c0084060!
RTMP_TimerListAdd: add timer obj c0084038!
RTMP_TimerListAdd: add timer obj c005a924!
RTMP_TimerListAdd: add timer obj c005aa28!
RTMP_TimerListAdd: add timer obj c005a94c!
RTMP_TimerListAdd: add timer obj c0051c74!
RTMP_TimerListAdd: add timer obj c001e468!
RTMP_TimerListAdd: add timer obj c0021588!
RTMP_TimerListAdd: add timer obj c00246a8!
RTMP_TimerListAdd: add timer obj c00277c8!
RTMP_TimerListAdd: add timer obj c002a8e8!
RTMP_TimerListAdd: add timer obj c002da08!
RTMP_TimerListAdd: add timer obj c0030b28!
RTMP_TimerListAdd: add timer obj c0033c48!
RTMP_TimerListAdd: add timer obj c0051990!
Key1Str is Invalid key length(0) or Type(1)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
2b:39:24:2f:fa:ec:b9:89:8a:13:f5:bf:4f:f5:ad:e5:
3c:c5:ec:f7:dd:a4:66:7e:16:08:be:a5:e1:23:d7:96:

1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
RTMPSetPhyMode: channel is out of range, use first channel=0
MCS Set = ff 00 00 00 01
SYNC - BBP R4 to 20MHz.l
RTMP_TimerListAdd: add timer obj c0052244!
Main bssid = 00:1c:c2:0b:af:e4
<==== rt28xx_init, Status=0
0x1300 = 00064380
vconfig: ioctl error for rem: Invalid argument
eth2.2: Setting MAC address to  00 1c c2 0b af e5.
VLAN (eth2.2):  Underlying device (eth2) has same MAC, not checking promiscious mode.
ifconfig: ioctl 0x8913 failed: No such device
brctl: bridge br0: No such device or address
switch reg write offset=14, value=405555
switch reg write offset=50, value=2001
switch reg write offset=98, value=7f3f
switch reg write offset=e4, value=3f
switch reg write offset=40, value=1001
switch reg write offset=44, value=1001
switch reg write offset=48, value=1002
switch reg write offset=70, value=ffff506f
Set: phy[0].reg[0] = 3900
Set: phy[1].reg[0] = 3900
Set: phy[2].reg[0] = 3900
Set: phy[3].reg[0] = 3900
### adapter index 9
### adapter hardware address 00:1c:c2:0b:af:e5
udhcpc (v1.12.1) started
### vfork'ing and execle'ing /sbin/udhcpc.sh
### entering raw listen mode
### opening raw socket on ifindex 9
### got raw socket fd 5
### attached filter to raw socket fd 5
### bound to raw socket fd 5
### adding option 0x35
### adding option 0x3d
### adding option 0x3c
### adding option 0x39
### Waiting on select...
aaaaa
do_cmd:mkdir /tmp/led_tmp
BEGIN:=======================================2456 to wait child 2459
END:=======================================2456 to wait child 2459
/etc/rc.d/rc1.d/S73ddns start
/etc/rc.d/rc1.d/S75fileserv start
/etc/rc.d/rc1.d/S80webd start
/etc/rc.d/rc1.d/S82upnpd start
/etc/rc.d/rc1.d/S99local start

TM01 login:

Good work, and nice device.

Did you try this: "Input i key to enter menu 0"

Maybe you'll be lucky and that will give you an option to flash or even to reflash uboot.

Are you able to log in at the prompt?

Things are nicely labeled on that board.  I wonder what the 6 through-holes are connected to.

(Last edited by lizby on 9 Mar 2014, 01:35)

here is what happens when you press (i)

|-------------------------------|
|         IOVST MAIN MENU       |
|-------------------------------|
| 6 Test USB                    |
| 8 Test ethernet               |
| B Boot the Kernel             |
| E Test PIO                    |
| I Test system params          |
| U SPIFlash Upgrade            |
| T SMT test program            |
| X Update the license          |
| R Reboot                      |
| Z Enter Command Line Interface|
|-------------------------------|

you can do some sweet stuff in here like blink some LEDs I was going crazy.

Please input test item:U


|-------------------------------|
|    Flush UPGRADE TEST MENU    |
|-------------------------------|
|  0 Upgrade Bootloader         |
|  1 Upgrade Config             |
|  2 Upgrade Factory            |
|  3 Upgrade Kernel             |
|  4 Upgrade Rootfs             |
|  5 Resume Upgrade             |
|  a Upgrade All Flash          |
|  e Erase Config partition     |
|  f Erase Factory partition    |
|  g Erase User partition       |
|  q Quit                       |
|-------------------------------|
Please input test item:

So it looks like you can, among other things, upgrade the kernel and upgrade the rootfs.  I'm afraid I don't know how to do these things separately with openWrt, but I suspect that others do know how. 

You might find that the bootloader uses special checksums or magic numbers to prevent alien (e.g., openWrt) firmware from being flashed, but if not there would be no apparent reason to upgrade this bootloader, which is much more full-featured than most in devices like this.

If you enter "Z" to get to the command line interface, what does "help" show you?  And "printenv"?

If you are able to modify the subject of this thread, how about adding "8Mb/32Mb"?

(Last edited by lizby on 9 Mar 2014, 15:26)

Of course, there's the easy way--is there an option to flash from the browser interface?

If so, it may tell you if it objects to an openWrt image.  Maybe there's a way from the web interface to save the existing flash so that you can recover if need be.  The uboot options look pretty good if you have the original firmware.  Or perhaps you can find it on the web.

(Last edited by lizby on 9 Mar 2014, 16:15)

I did not make this thread so I can't. 

I will check in a few the options and post here.

Last night we added a serial jack to the HooToo case so now it is easy for me to login with it all together.

No options in the web interface.

Still trying to get to menu in serial....thing is annoying it says to press (i) but it seems like it only works sometimes.

There is an option in the web interface to backup and restore.
also to do a firmware upgrade and a reset to factory

guessing when we made the serial port we either did nto connect the Tx correctly or maybe the sodering is bad on the jack.

Because I cannot send message to log back into uboot.

Will take it apart later today and see if I can get in.

As I recall, some of the ralink devices required a pullup on RX for them to receive reliably, maybe 10K.  I don't remember the details, but perhaps someone who does will chime in.  Or you could search.

Try a backup from the web interface.  If you're feeling lucky, then you might try a trunk upgrade; but you may want to wait until you're confident of being able to interact with the console.

(Last edited by lizby on 9 Mar 2014, 17:53)

So I would download the trunk from openwrt.org then just choose it as the "backup restore"?

Remember, you're bleeding edge, so things could go wrong.  I would think you would want to choose "firmware upgrade".

I'm not sure which file--perhaps this one: http://downloads.openwrt.org/snapshots/ … actory.bin

You want to use a "factory" file to flash first.  If you subsequently do a "sysupgrade" from openwrt, you use a "sysupgrade" file.

Says Wrong file format if you try to import that in firmware upgrade.
same if you try to import it as a backup.

Modified thread title on request.  BTW that information was available on the HooToo hardware page I originally linked.

Thanks for the excellent information on the HT-TM01, by the way.  Once again I'm interested in messing around with one of these.

Lately I've shifted my focus away from OpenWrt and onto Android, but maybe it's time to come on back.