OpenWrt Forum Archive

Topic: OpenWRT Kamikaze on TP-link tl-wa501g?

The content of this topic has been archived between 31 Aug 2014 and 5 May 2018. Unfortunately there are posts – most likely complete pages – missing.

xssa wrote:

2010-05-03 23:13:03
Tommorow I'll try to put all configs and images together and put it there on the forum.

Could you please specify the meaning of tommorow? :-) Just kidding. It would be great if you could post your additional work.
Thanks

I second that :-)

Hi,

how can I install the WA500G Firmware to my WR340G? It always complains that it is the wrong version.

Also, both download links for vxkiller are unfortunately dead, so I don't know how to get Kamikaze on my router.

knuthelm wrote:

Hi,

how can I install the WA500G Firmware to my WR340G? It always complains that it is the wrong version.

Also, both download links for vxkiller are unfortunately dead, so I don't know how to get Kamikaze on my router.

I think you should use vxkiller and than vxrestore and µRedBoot to flash the other firmware.
Here is a link to vxkiller: http://rapidshare.com/files/402964957/T … e.rar.html
Here is an example of a WR340G firmware which should be flashable with µRedBoot. xssa has tested it but I am not responsible if it bricks your router:
http://rapidshare.com/files/402965603/vxworks.raw.html
Your firmware of the WA500G must be stripped similar. (see above for detailed instructions by xssa)

Ah great, thanks!
Didn't know that the other original FW could be installed only with µRedBoot.
Is there already an OpenWRT image for the WR340G or should I compile one myself? Just have to look which options/packages I need then...

knuthelm wrote:

Ah great, thanks!
Didn't know that the other original FW could be installed only with µRedBoot.
Is there already an OpenWRT image for the WR340G or should I compile one myself? Just have to look which options/packages I need then...

I am pretty sure that there are more possibilities to install the other firmware, like patching the string and recalculate the checksum or flashing it with spipgm but I think using µRedBoot is the easiest way. xssa has a working kernel and root filesystem but I am not sure if he wants that I post it here. You should ask him.

padrecito007 wrote:

how to access RedBoot.
Wa500g because no telnet service.
all you need is ftp and http.
please respond need to know that.
and if possible write you a mini manual

You have to install vxkiller/µRedBoot first but this works probably only on a WR340G/WR340GD. Maybe xssa can create an image for your WA500G. You should ask him. I don't have the sources.

diazeeeee wrote:

I think I did right but this is still not working:

[ diaz_j->192-168-0-106.wifi.diaznet.fr ~ ]                                                                                                                                                                                                                                              $ telnet 192.168.1.1 9000
Trying 192.168.1.1...
Connected to 192-168-1-1.pool-vpn.diaznet.fr.
Escape character is '^]'.
RedBoot> fis list
Name              FLASH addr  Mem addr    Length      Entry point
RedBoot           0xBFC00000  0xBFC00000  0x00010000  0x00000000
vmlinux.bin.l7    0xBFC10000  0x80041000  0x000C0000  0x80041000
rootfs            0xBFCD0000  0x80033800  0x00110000  0x80033800
FIS directory     0xBFDE0000  0xBFDE0000  0x0000F000  0x00000000
RedBoot config    0xBFDEF000  0xBFDEF000  0x00001000  0x00000000
RedBoot>

The AP does not reboot but I have no access to 192.168.1.1.

I think I will wait for your images :-)

I had a working openwrt with your vxkiller, I don't why I wanted to do it by myself...

Hello,

I'm still stuck with my problem.
I have access to redboot, but cannot load any working image.

Does anyone know how to proceed ? Or has working image ?

Thanks :-)

how to get into the RedBoot?
can you tell me how I'm one step behind you.
I can not even get to RedBoot.
but if I managed to kadmikaze image.

(Last edited by padrecito007 on 1 Jul 2010, 20:30)

Well, I just unplug the power wire from the tp-link.
Then I press reset, plug the power wire back. After the network LED goes up, I stop pressing reset button.

Then to access RedBoot, just telnet 192.168.1.1 on port 9000.

If you have a working OS you have around 10 seconds to telnet redboot, otherwise the OS will boot.

If you are like me (ie. no working OS) you can connect whenever you want wink

padrecito007 wrote:

how to get into the RedBoot?
can you tell me how I'm one step behind you.
I can not even get to RedBoot.
but if I managed to kadmikaze image.

I am pretty sure that diazeeeee uses a WR340G/WR340GD.  The only way without a flash programmer is to find out how the update works and install a patched vxkiller (for your WA500G) in the web dialog. Try to send an email to xssa. He nows how to do this (hopefully for your WA500F too).

diazeeeee wrote:
diazeeeee wrote:

I think I did right but this is still not working:

[ diaz_j->192-168-0-106.wifi.diaznet.fr ~ ]                                                                                                                                                                                                                                              $ telnet 192.168.1.1 9000
Trying 192.168.1.1...
Connected to 192-168-1-1.pool-vpn.diaznet.fr.
Escape character is '^]'.
RedBoot> fis list
Name              FLASH addr  Mem addr    Length      Entry point
RedBoot           0xBFC00000  0xBFC00000  0x00010000  0x00000000
vmlinux.bin.l7    0xBFC10000  0x80041000  0x000C0000  0x80041000
rootfs            0xBFCD0000  0x80033800  0x00110000  0x80033800
FIS directory     0xBFDE0000  0xBFDE0000  0x0000F000  0x00000000
RedBoot config    0xBFDEF000  0xBFDEF000  0x00001000  0x00000000
RedBoot>

The AP does not reboot but I have no access to 192.168.1.1.

I think I will wait for your images :-)

I had a working openwrt with your vxkiller, I don't why I wanted to do it by myself...

Hello,

I'm still stuck with my problem.
I have access to redboot, but cannot load any working image.

Does anyone know how to proceed ? Or has working image ?

Thanks :-)

xssa has a running image. Try to send him an email.

hello.
mvsroot and padrecito007 and other colleagues on the forum.
I have assembled a spipgm cable and my question is if I can flash the file wr340v5_linux.bin. I have a question about the RedBoot.
I must first and then flash the RedBoot image?

xssa wrote:

Guys.

Work on vxkiller is done.
Upgrade your TL-WR340G through TP-Link's web.
After second reboot you can telnet 192.168.1.1 onto (very striped) OpenWrt 10.03 and enjoy.
RedBoot interface is accesable on telnet 192.168.1.1:9000 when you poweron your device with pressed reset key.
For reverting back to VxWorks use vxrestore and read carefully what it says ;-)

http://78.109.17.98/files/klients/price … 7cee3e.rar
Ooops! Where can I post binary image on this forum?

PS. It seems to be compatible with TL-WA500G  but I can't check this due luck of such hardware to test.
Native WA500G firmware runs well on WR340G (client mode) ;-)

Edit: Added link to file

Unfortunately the link is dead. As are all the others I found on this thread. If someone can point me to the image I'll give it a place where it will be available for at least a year without limits.
TIA, Michiel

melkman wrote:

New location of the images (thanks mvsroot):

vxkiller made by xssa:
http://www.xs4all.nl/~mettema/TL-340G-L … 7cee3e.rar

Kernel for openwrt made by xssa:
http://www.xs4all.nl/~mettema/openwrt-a … linux.lzma

RootFS for openwrt made by xssa (IP Address is 192.168.1.55 logon with root/ar2317):
http://www.xs4all.nl/~mettema/rootsq.rom

Thanks

About 2 months ago, I write the wr340v5_linux.bin through the web interface and could telnet to redboot.

But i had no time to compile a kernel and rootfs then and i left the router aside.

Today i need to use a working router and i take it out again.

But i found that my flash can not be init.

RedBoot> version

RedBoot(tm) bootstrap and debug environment [RAM]
Non-certified release, version UNKNOWN - built 20:18:26, Mar 29 2010

Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.
Copyright (C) 2009 NewMedia-NET GmbH

Board: ap61
RAM: 0x80000000-0x80800000, [0x80033620-0x807fd000] available
FLASH: 0x00000000 - 0x00000001, 0 blocks of 0x00000000 bytes each.
RedBoot> fis list
Name              FLASH addr  Mem addr    Length      Entry point
RedBoot> fis init
About to initialize [format] FLASH image system - continue (y/n)? y


??????????(here i lost connection with the router)

FLASH: 0x00000000 - 0x00000001   ??? strange

My router MODEL is TL-WR340G+, Ver 3.2

The flash is ATMEL 0950 250F161

What should i do now? I can't write the flash through telnet.

Do i have to program the flash through LPT port?

hipboi wrote:

FLASH: 0x00000000 - 0x00000001   ??? strange

My router MODEL is TL-WR340G+, Ver 3.2

The flash is ATMEL 0950 250F161

What should i do now? I can't write the flash through telnet.

Do i have to program the flash through LPT port?

Seems flash chip is not detected at all. There is another interesting thing
My router MODEL is TL-WR340G+ <-interesting trailing Plus

First of all you need to open the box, post here good internal photo, solder serial console and catch booting log with Putty (serial port speed 115200 flow control off).

I will look to the redboot sources when i will go back from vacation.

padrecito007 wrote:

I have assembled a spipgm cable and my question is if I can flash the file wr340v5_linux.bin. I have a question about the RedBoot.
I must first and then flash the RedBoot image?

wa500 needs another version of vxkiller. To flash vxkiller directly by spipgm you'll need to remove header from the bin image.

Seems flash chip is not detected at all. There is another interesting thing
My router MODEL is TL-WR340G+ <-interesting trailing Plus

First of all you need to open the box, post here good internal photo, solder serial console and catch booting log with Putty (serial port speed 115200 flow control off).

I will look to the redboot sources when i will go back from vacation.

Thanks,xssa.

I don't have a serial cable yet sad .

I'll solder the serial console as soon as I move to the new city and get everything done.

BTW,did you modify a lot in the redboot sources?

Here are the pics,sorry,they are so big.

http://i26.tinypic.com/2s9ybrd.jpg

http://i29.tinypic.com/2q22xjr.jpg

http://i27.tinypic.com/1r99vk.jpg

xssa wrote:
hipboi wrote:

FLASH: 0x00000000 - 0x00000001   ??? strange

My router MODEL is TL-WR340G+, Ver 3.2

The flash is ATMEL 0950 250F161

What should i do now? I can't write the flash through telnet.

Do i have to program the flash through LPT port?

Seems flash chip is not detected at all. There is another interesting thing
My router MODEL is TL-WR340G+ <-interesting trailing Plus

First of all you need to open the box, post here good internal photo, solder serial console and catch booting log with Putty (serial port speed 115200 flow control off).

I will look to the redboot sources when i will go back from vacation.

padrecito007 wrote:

I have assembled a spipgm cable and my question is if I can flash the file wr340v5_linux.bin. I have a question about the RedBoot.
I must first and then flash the RedBoot image?

wa500 needs another version of vxkiller. To flash vxkiller directly by spipgm you'll need to remove header from the bin image.

If the WA500 requires another VXKiller, you make it? or is very hard.
In the case of flash spipgm Vxkiller directly, as I remove the head of the Bin image. or the head but you remove it because for me it is very difficult because I'm not experienced like you.

Hi i have tl-wr542 and my hardware is same with hipboi's hardware same atheros and marvel chips. is there anyway to VXKiller from my web interface because i dont have a serial cable?

Finally I install openwrt on WR340GD v1.1

power LED, SYS, and WLAN are on. and everything seems to work properly.

Now I have one last little problem, not the username and password to enter
I tried to root, admin, blank space, etc. but neither is correct.

in the update process appeared a message like this:
=== IMPORTANT ============================
  Use 'passwd' to your login password in September
  this will disable telnet and enable SSH
------------------------------------------

But I took no notice and now not the username and password.

There is a vxkiller for tl-wa500 and tl-wr542

http://rapidshare.com/files/410655418/wa500_linux.bin
http://rapidshare.com/files/410660355/wr542_linux.bin

It seems to be compatible but i can not check it without hardware. So better to have soldered serial console port. Before upload it make shure there is a supported flash chip on your board. Atmel a25df161 is unsupported in Redboot. Some unveryfied Intel's can by unsupported too.

(Last edited by xssa on 2 Aug 2010, 22:28)

padrecito007 wrote:

Now I have one last little problem, not the username and password to enter
I tried to root, admin, blank space, etc. but neither is correct.

What do you think about the following message from above? :-)

melkman wrote:

IP Address is 192.168.1.55 logon with root/ar2317

xssa wrote:

There is a vxkiller for tl-wa500 and tl-wr542

http://rapidshare.com/files/410655418/wa500_linux.bin
http://rapidshare.com/files/410660355/wr542_linux.bin

It seems to be compatible but i can not check it without hardware. So better to have soldered serial console port. Before upload it make shure there is a supported flash chip on your board. Atmel a25df161 is unsupported in Redboot. Some unveryfied Intel's can by unsupported too.

thanks for replay i will try to kill my vxwork smile and soon i will complite my jtag cable. if device die it's isn't big problem for me, my wr542 is just test device wink
ps After flash with image my device is brecked - no ping 192.168.1.1. When I finish my jag will post output from my device smile
ps2 sorry for my bad english

(Last edited by Neo2SHYAlien on 3 Aug 2010, 13:15)

I hope all of you who (did) try to install vxkiller can describe in details what board version do you have, what flash chip is soldered on it and your success in detailes (LED illumination also can be usefull). This information will be very helpfull for me and all who will read this topic to determine what configurations are usefull and what ones have problems and still need fixing. If you need some kind of specific support you can PM me. But i think it is better to be in public.
Don't forget, there is NO jtag pads on this board!!!  There is one woking serial console port with TTL levels that can be converted to RS232 levels by simple scheme with 74HC14 or MAX232 chip. Logs on this port is VERY USEFULL for debugging. Also there is SPI flash chip which, in case of bricked router, can be simply programmed by 4 wires with spipgm utility through LPT port. google it if you need it.

(Last edited by xssa on 18 Aug 2010, 12:42)