OpenWrt Forum Archive

Topic: New success story: ViewSonic WR100!

The content of this topic has been archived on 14 Mar 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hey, fellow OpenWRT aficionados!  Long time no post. wink  Been pretty dang busy recently.

Here's a fun story for you all, though:

I was visiting my parents over Thanksgiving, and ended up shopping around the day after (Black Friday) to see what deals I could find.

One thing I was looking for was a cheap wireless AP or router for my parents' home (broadband, but no wireless...a shame).  Didn't need to be anything fancy...just something that would allow my dad (and myself, whenever I come to visit smile ) to use his laptop without having to string a wire across the living room.  Didn't even need to be a router, really...just a dumb AP would have been fine.  CompUSA was opening at Midnight in our area, and advertised a CompUSA-branded 11g AP+router for US$2.99 after rebates ($60 before).

Well, I got there too late for that deal (all sold out 45 minutes after opening), but I found a whole stockpile of ViewSonic WR100s for $24.98, no rebates necessary.  It was listed as a "Manager's Special," so they were going to remain that price until they sold out.  Apparently, it had nothing to do with Black Friday sales (it wasn't even listed in their BF circular)...ViewSonic was simply getting out of the networking hardware business (I never knew they got in it!), so CompUSA was trying to clear out their stock.

After shopping around on-line some and determining that this was as good a deal as I was going to find for a wireless router (esp. since I wouldn't have to wait for mail order), I went ahead and purchased one, not really knowing anything about the router itself.

When I got it home, naturally the first thing I did was open it up.  And what do you think I found inside this unit?  That's right: a BCM4712KPB CPU.  Oh, and the usual ADMTek ethernet switch.  And a very GemTek-esque model number sikscreened onto the PCB.  Running the first 6 digits of the MAC address through the OUI database confirmed my suspicions: this was indeed OEM'd from GemTek.  (Interestingly, the FCC ID Grantee Code was assigned to ViewSonic directly, so they weren't just riding on GemTek's FCC certs.)  This coupled with the very familiar-looking hardware inside probably indicated that it would be able to run OpenWRT with little work.

Based on my previous experience with Trendnet routers and GPIOs being different from what OpenWRT is accustomed to them being (http://forum.openwrt.org/viewtopic.php?id=424, see last two posts), I custom-built a whiterussian RC4 image that excluded the diag kernel module and contained an /etc/preinit script edited to remove the loading of the module and the checking of the appropriate /proc devices for reset button presses (I didn't want to risk having my ethernet ports disabling themselves again...someday, I'll map out all the GPIO functions and figure out what GPIO the reset button on this unit is wired to so that fail-safe mode can work).  I tried loading using the web interface upgrader in the ViewSonic firmware (and this worked when I tried it on the Trendnet), but no go..."Error during upgrade" every time I tried.  The ViewSonic must have some specific custom header requirements like the Linksys ones, I'm guessing.  There is also no ping.asp bug to exploit on this model, nor is boot_wait enabled by default.  Hmm.

I didn't want (nor did I have enough time) to solder a pin header on the JTAG cutout on the board, and my "flash chip pin shorting" days are well behind me now (see http://forum.openwrt.org/viewtopic.php?id=1418, and last post of http://forum.openwrt.org/viewtopic.php?id=1522), so instead I took my JTAG cable that I made for my Trendnet, cut off the connector on the end, stripped the wires, put numbers 3, 5, 7, and 9 through the right holes on the JTAG interface on the board, bent the wires so that they were touching the exposed traces around the pin holes, and then stuck a bottle of Bacardi on top to keep the wires in place. wink  I plugged the parallel port connector into my laptop, fired up HairyDairyMaid's flasher, and managed to extract the current NVRAM contents.  Score!  Working JTAG in 10 minutes. wink  After I got NVRAM, I edited the "boot_wait=off" to read "on," padded the end with an extra ASCII 255 to keep the size of the file the same, and then flashed the new NVRAM contents back over the JTAG.  After rebooting the router, I confirmed it was accepting TFTP connections!

The last step was to send my OpenWRT image to it via TFTP.  The router accepted the image, wrote it to flash, and 5 minutes later I was staring at an ash shell. smile  After this, I installed nas and the new webif package and managed to configure it for WPA2 and have my dad's WinXP laptop associate to it.  Slick, slick, slick.

All for US$25 + tax. smile

Most web retailers still seem to be selling the ViewSonic at retail ($70-80), and CompUSA's own site claims that they are completely out-of-stock and that they won't ship you one (and even then, CompUSA's site shows that their price is currently $71.99).  But I imagine that we may be seeing the price come down on these things fairly soon, if our own local CompUSA store is any indication.

Have fun,

-- Nathan

Further adventures with the ViewSonic WR100.

I have it set up to allow me to remotely-administer it.  My dad was having trouble getting his card to work with WPA2 (installed the WinXP patch, and it sees it as a WPA2 access point, but when you try to connect or go in and add a network manually, there are no WPA2 options...I'm guessing that we need to find some newer drivers for his WiFi card), so I tried setting it back to plain WPA-PSK+AES.  This was when I ran into troubles:

root@OpenWrt:~# nvram set wl0_akm=psk
root@OpenWrt:~# nvram commit
/dev/nvram: Cannot allocate memory

Uhhh, okay...(quick search through OpenWRT forum archives, Wiki, and even Google...nothing).

Let's see, for every 'nvram commit' attempt, dmesg shows...:

__alloc_pages: 5-order allocation failed (gfp=0x1f0/0)
nvram_commit: out of memory

Odd.  But, whoa, what is this?!:

Memory: 6192k/8192k available (1395k kernel code, 2000k reserved, 100k data, 80k init, 0k highmem)

Only 8MB of RAM?!?  Seriously?  Well, that sucks!  It also surprises me that it would come with so little RAM since it has the full complement of flash (4MB).  Is it possible that there really is 16MB of RAM but it is being limited somehow by NVRAM values (kind of like on the "special" WRT54G v2 rev. XH w/ 32MB)?  Unfortunately, since the router is at my parents' home 300 miles away, I cannot easily peak inside to look at the RAM chip(s) from here. ;-)

Here are my sdram values, for the curious:

root@OpenWrt:~# nvram show | grep sdram
size: 7064 bytes (25704 left)
sdram_config=0x0032
sdram_refresh=0x0000
sdram_ncdl=0x21
sdram_init=0x0000

Also, here's an output showing total and free memory:

root@OpenWrt:~# free
              total         used         free       shared      buffers
  Mem:         6272         6020          252            0          388
 Swap:            0            0            0
Total:         6272         6020          252

-- Nathan

(Last edited by NathanA on 10 Dec 2005, 22:14)

I was about to hack my U.S. Robotics 5461 USB Printer Server/Router that only comes with 2/8MB flash/RAM. Being a non-experience firmware hacker, I got chickened out reading your post above, especially that involves with soldering... sad

Well...here are the internal pics filed with the FCC (FCC ID of unit is GSS-VS10276):

https://gullfoss2.fcc.gov/prod/oet/form … or_pdf=pdf

Sadly, although it is hard to read in that particular photo and to be completely sure, what I think I'm reading off of the *single* SDRAM chip on the bottom of the board is:

ISSI IS42S32200B-6T

...which would be a 2M x 32 (== 64 / 8) == 8MiB part. sad  Very limiting, and very disappointing.  Thus, I would not recommend this unit for some of the more "interesting" projects that OpenWRT could be put to use on.

However, at $25, I still do not regret my purchase...with OpenWRT on it, it is still a more capable router than I could otherwise have gotten at that price. smile  And if someone wanted to use this as a cheap 802.11b client/bridge/managed switch thingie instead of an AP/router, at $25 this is still a steal compared to something like the WET54GS5 @ around $150 or even the WET54G @ ~$80.

Another interesting factoid about this unit: NVRAM space also contains a *second* NVRAM section called "NVRAM2."  It seems to only contain a single variable...that of the ethernet MAC:

NVRAM2 et0macaddr=XX:XX:XX:XX:XX:XX

It's at the very, very beginning of the NVRAM partition, before the "FLSH" header that designates the beginning of all of the "official" NVRAM stuff.  I'm guessing this is probably used by the version of CFE on this unit.

If anyone is interesting in dissecting CFE or the original ViewSonic firmware from this board (no firmware updates/downloads available from ViewSonic's web site, apparently), I did back them up before throwing OpenWRT on here, so I can send anyone who is interested a copy.

Anyway, to wrap this up, here are the board* NVRAM vars from this unit:

root@OpenWrt:~# nvram show | grep board
size: 7064 bytes (25704 left)
boardrev=0x10
boardtype=0x0101
boardflags2=0
boardflags=0x0388
boardnum=44

Here is the complete dmesg output from my router running custom build of whiterussian RC4 (squashfs):

CPU revision is: 00029007
Primary instruction cache 8kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 4kB, 2-way, linesize 16 bytes.
Linux version 2.4.30 (root@descartes) (gcc version 3.4.4) #1 Wed Nov 30 02:07:28 PST 2005
Setting the PFC value as 0x15
Determined physical RAM map:
 memory: 00800000 @ 00000000 (usable)
On node 0 totalpages: 2048
zone(0): 2048 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/preinit noinitrd console=ttyS0,115200
CPU: BCM4712 rev 1 at 200 MHz
Using 100.000 MHz high precision timer.
Calibrating delay loop... 199.47 BogoMIPS
Memory: 6192k/8192k available (1395k kernel code, 2000k reserved, 100k data, 80k init, 0k highmem)
Dentry cache hash table entries: 1024 (order: 1, 8192 bytes)
Inode cache hash table entries: 512 (order: 0, 4096 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
Checking for 'wait' instruction...  unavailable.
POSIX conformance testing by UNIFIX
PCI: Fixing up bus 0
PCI: Fixing up bridge
PCI: Setting latency timer of device 01:00.0 to 64
PCI: Fixing up bus 1
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
Squashfs 2.1-r2 (released 2004/12/15) (C) 2002-2004 Phillip Lougher
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xb8000300 (irq = 3) is a 16550A
ttyS01 at 0xb8000400 (irq = 0) is a 16550A
Software Watchdog Timer: 0.05, timer margin: 60 sec
Physically mapped flash: Found an alias at 0x400000 for the chip at 0x0
Physically mapped flash: Found an alias at 0x800000 for the chip at 0x0
Physically mapped flash: Found an alias at 0xc00000 for the chip at 0x0
Physically mapped flash: Found an alias at 0x1000000 for the chip at 0x0
Physically mapped flash: Found an alias at 0x1400000 for the chip at 0x0
Physically mapped flash: Found an alias at 0x1800000 for the chip at 0x0
Physically mapped flash: Found an alias at 0x1c00000 for the chip at 0x0
cfi_cmdset_0001: Erase suspend on write enabled
0: offset=0x0,size=0x20000,blocks=32
Using buffer write method
Flash device: 0x400000 at 0x1c000000
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "pmon"
0x00040000-0x003e0000 : "linux"
0x000ba9ec-0x001d3000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x003e0000-0x00400000 : "nvram"
0x001e0000-0x003e0000 : "OpenWrt"
Initializing Cryptographic API
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
ip_conntrack version 2.1 (5953 buckets, 5953 max) - 320 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 80k freed
Algorithmics/MIPS FPU Emulator v1.5
jffs2.bbc: SIZE compression mode activated.
PCI: Setting latency timer of device 00:02.0 to 64
eth0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.90.23.0
PCI: Setting latency timer of device 00:01.0 to 64
eth1: Broadcom BCM4320 802.11 Wireless Controller 3.90.37.0
device eth0 entered promiscuous mode
vlan0: Setting MAC address to  xx xx xx xx xx xx.
VLAN (vlan0):  Underlying device (eth0) has same MAC, not checking promiscious mode.
vlan0: add 01:00:5e:00:00:01 mcast address to master interface
device eth1 entered promiscuous mode
eth1: attempt to add interface with same source address.
br0: port 2(eth1) entering listening state
br0: port 1(vlan0) entering listening state
br0: port 2(eth1) entering learning state
br0: port 1(vlan0) entering learning state
br0: port 2(eth1) entering forwarding state
br0: topology change detected, propagating
br0: port 1(vlan0) entering forwarding state
br0: topology change detected, propagating
vlan1: Setting MAC address to  xx xx xx xx xx xx.
vlan1: add 01:00:5e:00:00:01 mcast address to master interface

...and my complete NVRAM contents:

root@OpenWrt:~# nvram show
size: 7064 bytes (25704 left)
wl_wds2=
wl_radius_port=1812
wl_wds3=
os_ram_addr=80001000
filter_macA=1
wan0_primary=1
pptp_netmask=0.0.0.0
IncomingPortRange=
wl0_frameburst=on
wanif=vlan1
log_ipaddr=192.168.1.0
wan0_ipaddr=0.0.0.0
il0macaddr=XX:XX:XX:XX:XX:XX
boardrev=0x10
DDNSEnable=2
URL0=
filter_udp=
wan0_proto=dhcp
URL1=
URL2=
pptp_ipaddr=0.0.0.0
URL3=
URL4=
et0macaddr=XX:XX:XX:XX:XX:XX
URL5=
URL6=
WlEnable=1
real_ipaddr=0.0.0.0
URL7=
URL8=
d11g_mode=1
wl0_akm=psk
watchdog=0
boot_wait=on
URL9=
wan0_dns=0.0.0.0 0.0.0.0 0.0.0.0
pptp_idletime=300
wl0_infra=1
et0mdcport=0
SNMPCommunityOne=public
fw_disable=0
wl0_country_code=JP
pppoe_keepalive=1
WAN_ENABLE=1
wl_infra=1
pmon_ver=CFE 3.51.21.0
restore_defaults=0
filter_PPTPPassThru=1
wan0_ifname=vlan1
wan_lease=*******
d11g_dtim=1
http_wanport=80
wl_radius_ipaddr=0.0.0.0
wl0_ifname=eth1
pptp_redialtime=30
lan_domain=
timer_interval=0
gpio2=adm_eecs
kernel_mods=et wl kmemory
gpio3=adm_eesk
pptp_username=
gpio4=adm_eedi
pppoe_mtu=1400
vlan0ports=0 1 2 3 5*
gpio5=adm_rc
filter_MulticastPassThru=1
DevType=router
localip=192.168.1.1
filter_tcp=
wl0_mrate=54000000
wan_gateway=0.0.0.0
wl0_mode=ap
wlif=eth1
dhcp_start=100
wl0_ap_isolate=0
LogEnable=0
pppoe_redialtime=30
dhcp_end=149
wl_mrate=54000000
os_flash_addr=bfc40000
wins_1=
wl0_gmode=1
sromrev=2
dhcp_lease=wan
auth_mode=disabled
boardtype=0x0101
filter_portVar=0:0:0 0:0:0 0:0:0 0:0:0 0:0:0
pptp_passwd=
is_default=1
et1macaddr=XX:XX:XX:XX:XX:XX
wl_gmode=1
stats_server=
Country=PacificTime
static_route=
wl_mac_index=0
d11g_rate=0
wl0_macEnable=0
lan_netmask=255.255.255.0
ModelId=WRT55AG
SYSName=
wl0_dtim=1
http_username=
wl0_ssid=viewsonic
et1mdcport=1
os_date=Dec  8 2004
FirmwareVersion=v1.09 (ViewSonic), Aug 26, 2004
http_lanport=80
wl_plcphdr=long
wlogpio4=0
filter_blockWANRequest=1
wl_macmode=disabled
wan_hwname=et1
wan_domain=
wl0id=0x4320
lan_lease=86400
wan_netmask=0.0.0.0
wl_keytype=1
wl0_key1=
wl_phytype=g
wl_lazywds=1
wan0_hostname=
wl0_key2=
wl0_txant=0
wl0_key3=
wl0_key4=
move_to_defaults=0
filter_BlockJava=0
wl_auth_mode=open
wl_txant=0
PortServiceList=17:53:53:DNS 1:0:0:Ping 6:80:80:HTTP 6:443:443:HTTPS 6:21:21:FTP 6:110:110:POP3 6:143:143:IMAP 6:25:25:SMTP 6:119:119:NNTP 6:23:23:Telnet 17:161:161:SNMP 17:69:69:TFTP 17:500:500:IKE
PortFilter0=
PortFilter1=
PortFilter2=
d11g_rts=2346
PortFilter3=
ag0=255
PortFilter4=
http_passwd=admin
PortFilter5=
d11g_country=1
PortFilter6=
lan_stp=1
PortFilter7=
PortFilter8=
wl_mode=ap
pptp_dns=0.0.0.0 0.0.0.0 0.0.0.0
PortFilter9=
wl0_rate=0
wl0_plcphdr=long
wl0_closed=0
wl0gpio0=0
d11g_rateset=default
wl0_macmode=disabled
wl_wpa_gtk_rekey=300
wl0gpio1=0
dmz_ipaddr_4=0
wl0_radioids=BCM2050
wl0gpio2=0
wl0_phytype=g
wl0_keytype=1
wl0gpio3=0
wl0_lazywds=1
wl0gpio4=0
localsn=255.255.255.0
wl0gpio5=0
dns_1=
d11g_rts_cts=off
boardflags2=0
wan_real_proto=dhcp
dns_2=
dns_3=
wl0_afterburner=auto
wl0_antdiv=0
lan_hwaddr=XX:XX:XX:XX:XX:XX
wan_dns=0.0.0.0 0.0.0.0 0.0.0.0
real_gateway=0.0.0.0
DDNSEmail=
UrlBlockingList=
wl_ssid=viewsonic
wl_dtim=1
wl0_wpa_psk=
WorkingModel=0
d11g_bcn=100
DDNSHostname=
radius_port=1812
filter_ipA=1
dhcp_wins=wan
pptp_keepalive=1
os_server=
wan_proto=dhcp
wl_key1=
DMZEnableFlag=0
wl_key2=
pppoe_dnsaddr1=0.0.0.0
wl0_unit=0
wl_key3=
pppoe_ipaddr=0.0.0.0
pppoe_dnsaddr2=0.0.0.0
wl_key4=
wl_country_code=JP
wl_hwaddr=XX:XX:XX:XX:XX:XX
pa0itssit=62
SNMPEnable=0
MyFirmwareVersion=v1.09 (ViewSonic), Aug 26, 2004
pptp_demand=0
real_netmask=0.0.0.0
d11g_frag=2346
wl0_wds=
wl_rate=0
cctl=0
DDNSPassword=
log_level=0
dhcp_dns=wan
wan0_gateway=0.0.0.0
MACloneSys=0
ntp_server=
wan_hwaddr=XX:XX:XX:XX:XX:XX
SYSLocation=
lan_ifnames=vlan0 eth1 wlan wds0.2 wds0.3 wds0.4 wds0.5
lan_dns=
pppoe_ifname=eth1
filter_L2TPPassThru=1
MACFilter0=
ConnectionOption=0
wl0_auth=0
wl0_radius_port=1812
MACFilter1=
MACFilter2=
wl0_radius_ipaddr=0.0.0.0
MACFilter3=
TriggerPortRange=
pppoe_service=
filter_mtuSize=1400
MACFilter4=
wl_country=JP
pa0maxpwr=60
MACFilter5=
GemtekFirmwareVersion=1.24.34, Apr.3, 2003
MACFilter6=
MACFilter7=
MACFilter8=
wan_ifnames=vlan1
MACFilter9=
wan0_hwname=et1
wan0_domain=
wl_rateset=default
wl_crypto=tkip
wl_macEnable=0
pppoe_gateway=0.0.0.0
DDNSServicename=dyndns
lan_ipaddr=192.168.1.1
clkfreq=200
os_name=linux
lan_proto=static
aa0=3
vlan1hwname=et0
RWEnableTwo=1
wl_unit=0
TimeZone=-8
wl0_phytypes=g
wl0_frag=2346
UPnPEnable=0
router_disable=0
d11g_channel=6
wl0_wep=disabled
wan0_netmask=0.0.0.0
pppoe_passwd=
sdram_config=0x0032
wl0_country=JP
vlan1ports=4 5
MIBFileVersion=v1.02
dmz_ipaddr=192.168.1.0
wan0_wins=0.0.0.0
wl_wds=
scratch=a0180000
pptp_enable=0
DhcpReleaseTime=0
filter_ipNot=0 0 0 0 0 0 0 0 0 0
DDNSKey=
ccode=0
NeedReboot=0
filter_ip=
wl0_rateset=default
SYSContact=
FilterTypes=0 0 0 0 0 0 0 0 0 0
PortForwardVar=0:0:4:0:0 0:0:4:0:0 0:0:4:0:0 0:0:4:0:0 0:0:4:0:0 0:0:4:0:0 0:0:4:0:0 0:0:4:0:0 0:0:4:0:0 0:0:4:0:0
cpu_type=BCM3302
AutoDaylight=1
pppoe_idletime=300
lan_ifname=br0
filter_BlockProxy=0
pppoe_netmask=0.0.0.0
boardflags=0x0388
sdram_refresh=0x0000
wl0_mac=
dhcp_domain=wan
wl_auth=0
sdram_ncdl=0x21
MACloneAddress=00:00:00:00:00:00
filter_mac=
radius_key=
filter_macNot=0 0 0 0 0 0 0 0 0 0
filter_BlockActiveX=0
UrlBlockingNum=0
wl_frameburst=on
ezc_enable=1
CFEver=SparkLanv100
OS_VER=3_51_21_0
wan0_lease=86400
wan_ipaddr=0.0.0.0
radius_ipaddr=0.0.0.0
wl0_rts=2346
InternetAccessCtrlFlag=0
wan_wins=0.0.0.0
wl_wep=off
os_version=3.50.21.10
pppoe_username=
wl_gmode_protection=off
wl0_wpa_gtk_rekey=300
filter_SchedularWebFilter=0
Wl5GEnable=0
wan0_desc=Default Connection
wl_frag=2346
RWEnableOne=0
wl0_key=1
filter_macmode=disabled
wl_maclist=
et0phyaddr=30
ScheduleList=0 0 0 0 0 0 0 0 0 0
console_loglevel=1
filter_remotePort=8080
time_zone=PST8PDT
wan_ifname=vlan1
DRoutingModel=0
AuthType=2
DDNSok=0
wan_hostname=
wl_mac=
filter_BlockCookies=0
wl0_radio=1
wl_corerev=
wl0_wds0=
d11g_hwaddr=
wl0_wds1=
wl_channel=11
wl0_bcn=100
pptp_dnsaddr1=0.0.0.0
wl0_wds2=
pptp_dnsaddr2=0.0.0.0
wl0_wds3=
wl0_hwaddr=XX:XX:XX:XX:XX:XX
forward_udp=
wl_radio=1
wl_afterburner=auto
ezc_version=2
pa0b0=0x1716
Text0=
pppoe_authtype=3
wl0_gmode_protection=off
pa0b1=0xFA42
Text1=
wl0_maclist=
pa0b2=0xFE5C
Text2=
sdram_init=0x0000
Text3=
wl_rts=2346
Text4=
vlan0hwname=et0
filter_Remote=0
Text5=
lan_wins=
wl_ap_isolate=0
dl_ram_addr=a0001000
lanif=vlan0
lan_hwnames=et0 il0 wl0
Text6=
UrlBlockingFlag=0
wpa_psk=
wl0_mac_index=0
filter_index=0
filter_mtuEnable=0
Text7=
PortForwardName=
Text8=
pppoe_demand=0
SNMPCommunityTwo=private
IPFilter0=
Text9=
wan0_unit=0
IPFilter1=
DDNSUsername=
IPFilter2=
IPFilter3=
Key_Length_24G=0
wl0_corerev=7
IPFilter4=
pptp_gateway=0.0.0.0
wl_key=1
wl0_channel=9
IPFilter5=
pppoe_mru=1400
IPFilter6=
filter_IPSecPassThru=1
IPFilter7=
real_dns=0.0.0.0 0.0.0.0 0.0.0.0
IPFilter8=
ParentalDateTime=
upnp_enable=0
ScheduleName=---#---#---#---#---#---#---#---#---#---
IPFilter9=
flag_MAC=0
wl0_auth_mode=psk
wl_closed=0
wpa_gtk_rekey=300
et1phyaddr=0
boardnum=44
wl0_crypto=aes
StaticRouteNames=
wl_bcn=100
forward_tcp=
wl_wds0=
wl_antdiv=0
wl_wds1=

TTFN,

-- Nathan

pap2boy wrote:

I was about to hack my U.S. Robotics 5461 USB Printer Server/Router that only comes with 2/8MB flash/RAM. Being a non-experience firmware hacker, I got chickened out reading your post above, especially that involves with soldering... sad

pap2boy,

I didn't do any soldering at all to the actual router board (I did on my old Trendnet unit, but not on the ViewSonic).  I had to solder wires from a ribbon cable to a male DB-25 connector (for the parallel port/JTAG interface), but I just touched exposed wires from the other end of the ribbon cable to the JTAG contacts on the board, and then used something (a bottle of rum wink ) to hold the cable down in place while flashing with the JTAG interface.

If you don't want to potentially ruin your board with a soldering iron, there are ways to avoid having to touch an iron to the board altogether. smile  Making yourself a JTAG cable might be a good way to teach yourself how to solder, since if you ruin the cable, who cares?  You're only out however many cents the wire, resistors, and DB-25 connector cost you!  Oh, and perhaps a wounded pride. wink

-- Nathan

Hi Nathan,

Thank you for your surportive post. I think I will give it a try. Anyway, CompUSA has this ZyXel Prestige router for $9.99 (after $60 rebates). I think I will go and grab some.

I opened up my US Robotics 5461 and only saw a set of an isonlated 4-pin holes, called J5 (beneath an empty pad for additional RAM chip. I wished this forum allows me to attach an image to show you.

Anyway, without knowing where I can jump the JTAG cable, it really is pretty risky to go ahead to start flashing my U.S. Robotic 5461 G router with printer server that only comes with 2/8 MB RAM/Flash.

Can someone help me out? (I have never flashed anyrouter before)
For those of us who do not want to mess with a JTAG solution.
  a) Since this unit is also using the broadcom chipset. can I use the (hold reset until power button flashes, then tftp) method? I tried once with but it did not seem to work. I figured maybe the ip address is not 192.168.1.1 or you have to put it into a different directory like the asus
  b) Maybe there is a easy way to generate the header to append to the .trx file? that way we can just upload using the web interface. I looked at the motorola bin files and compared to the trx files there is only 8 bytes of header, unfortunately they change with different bin file. Viewsonic website does not have any firmware for download, maybe someone can supply one?
  c) lastly using the default braodcom squashfs firmware will work?

norm wrote:

Maybe there is a easy way to generate the header to append to the .trx file? that way we can just upload using the web interface. I looked at the motorola bin files and compared to the trx files there is only 8 bytes of header, unfortunately they change with different bin file. Viewsonic website does not have any firmware for download, maybe someone can supply one?

Welllll...it's not that easy.  See, the OpenWRT .BIN "for Linksys" firmware (and similarly with the "for Motorola" firmware) is exactly bit-for-bit the same as a TRX, save for a prepended "custom" header a few bytes long that the Linksys web firmware upload page uses.  If you try to load the firmware via the Linksys firmware's web-based upgrader or via Linksys's TFTP server, the Linksys code checks for the presence and validity of the header.  If it doesn't exist or doesn't match what it is expecting, then it rejects the file.  I can't remember off-hand (and the FAQ on openwrt.org should be able to confirm or deny this), but I think that Linksys's version of CFE (when upgrading using the boot_wait method) also checks for this header, so you can't just send a TRX to a Linksys router via TFTP to the bootloader, either.

This is ONLY used by Linksys (and Motorola) during the flash process to verify the file sent to it is, in fact, a valid firmware image.  The header part is NOT ACTUALLY WRITTEN TO FLASH!  It is stripped off by the Linksys firmware before being committed to flash ROM, so what ends up getting written is, in fact, just a normal TRX-formatted file.  Once OpenWRT is on your Linksys or Motorola and has replaced the "factory" firmware, nothing is preventing you from performing further OpenWRT upgrades by using the TRX version instead of the BIN.  In fact, there is really no way (except through Linksys CFE's TFTP) to use the BIN version after you have installed OpenWRT.  If you were to upload the BIN file to the OpenWRT router, before you could write it to flash, you would be required to strip off the excess data and thus, in essence, "convert" the BIN to a TRX before flashing.

Because of this, you can see that we are in a slight bind: I may have managed to copy off the original ViewSonic firmware from my router before replacing it with OpenWRT, but because that BIN header (if one is even required for ViewSonic's WR100) doesn't actually reside on flash and is only used to verify "image integrity" during the upgrade process, my copy of the ViewSonic firmware doesn't HAVE any header on it.  It's just a plain TRX file.  And, as you have discovered, ViewSonic never released either their original firmware image or an upgrade, so we may never know if there is something special that the ViewSonic firmware is looking for, or what it might be.  Unfortunately, you can't try to dissect the WR100's CFE looking for clues, either, because as I demonstrated by merely modifying my NVRAM (through JTAG) to enable boot_wait, the WR100's CFE accepted a plain TRX file through TFTP without any grumbling, so at the very least, the version of CFE used by ViewSonic does NOT require a special firmware binary.

Nonetheless, for anyone who is interested or has any use for them, I have posted copies of the original ViewSonic WR100 firmware image, the WR100 CFE image, and my own build of RC4 (squashfs format) that I used on my WR100 on my web page: http://www.anderson-net.com/~nathan/blog/  I merely ripped out diag.o from my version of RC4 in order to possibly avoid a problem on the WR100 like the one I encountered while trying to use OpenWRT on my Trendnet when diag.o's idea of "which GPIO maps to what" was in conflict with reality (see http://forum.openwrt.org/viewtopic.php?id=424).  It's a little risky this way, since if you screw up something, you won't have the benefit of holding down RESET to enter failsafe, but at least you don't risk bricking your router on the first try. :-P  (One of these days I'll get around to mapping out which GPIO on the ViewSonic is used for RESET and see if the stock diag.o works.)

If you'd rather not try it without diag.o despite the risks associated with that action, then the default OpenWRT squashfs TRX should work fine...I made no other modifications to my version other than diag.o removal and related /etc/preinit hacking.

-- Nathan

P.S. -- Yay, DNS for openwrt.org is working tonight. :-)

(Last edited by NathanA on 10 Feb 2006, 10:34)

Nathan:

I seem to be missing some pixie dust or something....

I have a WR100 (a couple oif them, actually) and I have been waging a mighty battle to get one of them to accept OpenWRT.... - the second one is still shrink-wrapped.

Fist, I soldered a JTAG header on, made a JTAG cable, and downloaded the NVRAM.  Changed boot_wait=off to boot_wait=on, padded the end of the nvram file with FF, and wrote it back to the WR100.

Then I set up tftp, and sent the rc5 image over.  Everything seemed to have gone OK; no error messages, and I left it long enough to boot up.   It didn't look like it was rebooting, but then again, I don't know anything about this router....

What happens is the box boots, requests and gets its IP address from DHCP, but then becomes unresponsive....

I've now tried your rc4 image, my own self-compiled rc5r with diag removed, and the stock rc5, and *all* exhibit the same behavior.....  I even reflashed the wr100 with the original nvram jus to make sure that's not screwing it up....

Just today I ordered a max233a chip so I can make serial cables to see what is going on...  It 'feels' as if the routing in the box is messed up; like perhaps the it's trying to send packets out some other interface than it received them...  Or it is changing its IP after it gets it assigned via DHCP...

In the meantime, I would appreciate any suggestions.

OK, I got it figured out.....

Basically, I suspect the interfaces are lableled differently in the WR100 from the various linksys models, so when the firewall comes up the AP 'bricks'.  I made the problem worse by trying to use a subnet different from the pervasive 192.168.1.x - that appears to be hardcoded in a bunch of places....

So now to look through the config files and figure out where to fix things...

But yes, the wr100 can run at least RC4.

I just picked up a WR100 for $2.73 ~ needed a power supply (ho-hum) ~ no previous knowledge of this unit, never even heard of it but some sort of little bell went off and I did the "at this price, how can I go wrong" bit. Saw NathanA's post and decided to give it a shot. No results yet - just got the puppy running.
It is somewhat power sensitive - which was a surprise. First 12v unit lit it up but all the leds STAYED on. Hmmm. Tried 6v unit with the same result. Then I pulled the power brick off an old Linksys and voila - lights, cameras, action.
Then I discovered the WR100 has bridge mode. That's exactly what I wanted. So - I think I'll flash my old (broken down) Motorola WE800 bridge first and after that success return to the viewsonic.
Stay tuned but don't hold your breath. :-)

The discussion might have continued from here.