OpenWrt Forum Archive

Topic: Arcadyan ARW7519 (VR9) Support?

The content of this topic has been archived between 30 Mar 2018 and 20 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hello,

I have an Arcadyan ARW7519RW router. It has nice stock firmware features such as USB, Wifi-N, GE Port, 2 FXS, 3g modem support, 5 port switch. I would like to know if there is support (total or partial booting would be just fine) with openwrt for such router. I know the chipset is VR9, because I can read in one of the chips that is the VRX268 model http://www.lantiq.com/uploads/tx_abzlan … 1_lres.pdf. However, the processor is still unknown for me as it has a big black cooler on the top of it.

Can somebody give me a hint of a firmware that could work? I am ready to flash it with openWRT to check if it works.

Here, few pictures of the board.

http://img26.imageshack.us/img26/20/20120902005324.th.jpg http://img854.imageshack.us/img854/9658/20120902201523.th.jpg http://img713.imageshack.us/img713/1667/20120902201512.th.jpg http://img339.imageshack.us/img339/7972/20120902201430.th.jpg http://img502.imageshack.us/img502/5646/20120902201425.th.jpg http://img39.imageshack.us/img39/2049/20120902201417.th.jpg http://img716.imageshack.us/img716/7903/20120902201357.th.jpg

Thank you in advance smile

Nobody? Fritz!box compatible firmware?

where did you get this unit from ?

i would need 1 sample to port owrt to this board

I got it from the Spanish ISP "orange". It is a ADSL2+. I don't know how you can get a sample of it, it may be used for another ISP as well.

cotarelo wrote:

I got it from the Spanish ISP "orange". It is a ADSL2+. I don't know how you can get a sample of it, it may be used for another ISP as well.

The VR9 is an ADSL/VDSL chipset.

The router is called Livebox 2.1 and manufactured by Astoria. Model: ARV7519RW22-A-LT.

When blogic asks for a sample means that if somebody can send him a router to begin the port of it to OpenWRT.

In the reviews i have readen the router is blocked only for Orange in Spain.

Hardware:
- CPU: PSB 80920 (VRX288).
- RAM: Etrontech EM68C16CWVB (64Mx16 DDRII) up to 400 MHz.
- Flash: MXIC MX29gl256elt2i. 32 MB.
- ADSL/VDSL: Lantiq PSB 80208V
- Wireless: Lantiq PSB 8231 + PSB 8304 (maybe XWAY 300).
- VOIP: Lantiq PEF 42068
- Gigabit switch: Lantiq PEF 7071V (four 10/100 ports integrated in SoC and one 10/100/1000 throught RGMII).

The firmware i guess is based in VxWorks and BRN-Boot as bootloader. Couldn't find a bootlog.

Review (in spanish):
http://www.redeszone.net/routers/nuevo- … a-300mbps/

I could send  you but then I'd like to have it back to play with OpenWRT. Would I receive it back once is ported?

I couldn't capture a bootlog. Couldn't find serial port pins...

(Last edited by cotarelo on 9 Sep 2012, 21:14)

According with the bootlog the bootloader is BRN-Boot and the firmware is Vxdon'tWorks based.

¿There are any way to enter in the bootloader or it calls directly the firmware?

(Last edited by Pteridium on 11 Sep 2012, 18:09)

Looking good Torpets. Thank you!

Pteridium. Is there a possibility then for openWRT to run on such hardware?

If blogic wants then will be ported, but he needs a unit for testing.
I'll ask my cousin; i think he has got one.

The big problem is the wifi, because i don't know if there are drivers for linux for the XWAY WAVE 300.

(Last edited by Pteridium on 11 Sep 2012, 21:30)

any news?

somebody knows something?

How can I do to port it myself? Some guidelines? Am an computer engineer thou never did it

I imagine that the serial port is at the row of solder pads below the cpu. Try to interface with the bootloader to make it boot an image via tftp. I think OpenWrt already supports some other router with VR9, so that would be an obvious starting point.

Nice, I found a post where they unlock the router even opening a ash shell (the following post is in Spanish, but gtranslator is your friend)

https://foro.elhacker.net/hacking_wirel … 330.0.html

Then I think it will be much easier to flash

I have the same router (though it is a dutch model from KPN (Experia Box v8)

I have added the model to the table of hardware, (http://wiki.openwrt.org/toh/arcadyan/vgv7519)
I have JTAG access, but I can't get access to the bootloader menu, as there seems to be a 16 character password in it.

Too bad the link in the previous post doens't work anymore (It might by my companies web access policy though)

(Last edited by TheLizard on 13 May 2013, 11:51)

TheLizard wrote:

I have the same router (though it is a dutch model from KPN (Experia Box v8)

I have added the model to the table of hardware, (http://wiki.openwrt.org/toh/arcadyan/vgv7519)
I have JTAG access, but I can't get access to the bootloader menu, as there seems to be a 16 character password in it.

Too bad the link in the previous post doens't work anymore (It might by my companies web access policy though)

That link works fine here. I would like to know the possibilities of this device. Does it have MAC-based VLAN support? (Interactive TV Motorola boxes). Extracting/decrypting the configuration would be nice (for VOIP details).
Opening up the device was a bit difficult, but I think it needs to be done only once? I would like a password-patched bootloader to flash. I have soldered in a JTAG header. I doubt they want this device back since it's from 2011 already. The stickers have yellowed already. Is there a JTAG programmer software for this that also does USB cables?
I have have serial output at least, showing v3.00.06c loader version and 16 asterisks for password...
I don't know if I'll use this device though, some say it's not so good and if OpenWrt doesn't do DSL, it's not as useful. In that case I'll be using a different router with the required VLAN settings.

(Last edited by darkfader on 9 Jul 2013, 15:45)

hello People,

any progress on the bootloader? I also have an arcadyan to spare, so would really like to see if we can get it working on openwrt. Anyone used john the ripper attempts on the hash from thelizard on the wiki?
grtz

sebastiaan wrote:

hello People,

any progress on the bootloader? I also have an arcadyan to spare, so would really like to see if we can get it working on openwrt. Anyone used john the ripper attempts on the hash from thelizard on the wiki?
grtz

Or Cryptohaze. Too bad I don't have fast GPUs. But I doubt we don't have much luck with that.
I don't see the problem with patching the bootloader via JTAG. Just need a supported tool. I use Windows 7 x64 and only can run "EJTAG Debrick Utility v3.0.1 X64 Tornado-MOD" or something that supports FTDI USB device e.g. UrJTAG but that needs correct BSDL files.

CPU Chip ID: 00100000000000000000000001000001 (20000041)
*** Unknown or NO CPU Chip ID Detected ***

I also tried one of those config file decrypters, but failed since it's for different firmware.

(Last edited by darkfader on 12 Jul 2013, 12:14)

darkfader wrote:
sebastiaan wrote:

hello People,

any progress on the bootloader? I also have an arcadyan to spare, so would really like to see if we can get it working on openwrt. Anyone used john the ripper attempts on the hash from thelizard on the wiki?
grtz

Or Cryptohaze. Too bad I don't have fast GPUs. But I doubt we don't have much luck with that.
I don't see the problem with patching the bootloader via JTAG. Just need a supported tool. I use Windows 7 x64 and only can run "EJTAG Debrick Utility v3.0.1 X64 Tornado-MOD" or something that supports FTDI USB device e.g. UrJTAG but that needs correct BSDL files.

CPU Chip ID: 00100000000000000000000001000001 (20000041)
*** Unknown or NO CPU Chip ID Detected ***

I also tried one of those config file decrypters, but failed since it's for different firmware.

and if you use and USB stick to boot MINT from, then install it to another USB stick? Thats how I run it.

and if you use and USB stick to boot MINT from, then install it to another USB stick? Thats how I run it.

That would be an option. Anyway, I had to take this modem in use today and I'll get complaints when I take it offline for tinkering probably.
I also had hoped I could use the old ZyXEL modem and use PPPoE, but I can't change the DSL settings since it's locked. And I don't know if my old provider wants it back. DMZ is my only option now it seems.

TheLizard wrote:

I have the same router (though it is a dutch model from KPN (Experia Box v8)

I have added the model to the table of hardware, (http://wiki.openwrt.org/toh/arcadyan/vgv7519)
I have JTAG access, but I can't get access to the bootloader menu, as there seems to be a 16 character password in it.

Too bad the link in the previous post doens't work anymore (It might by my companies web access policy though)

hello, can explain please how u get acces via jtag?
i conected , but receive strange data.

root@HOME-PC:~/Downloads/zjtag.source_1.7/src# ./zjtag -probeonly /cable:1 /skipdetect

        ==============================================
               zJTAG EJTAG Debrick Utility v1.7 R4
        ==============================================

cableid=1, cabletype=1

Detected IR chain length = 5

Probing bus ... Done

Detected IR chain Length is 5 bits

CPU assumed running under LITTLE endian

CPU Chip ID: 00000000000000000001000110000011 (00001183)
    CPU Manufacturer :Unknown(ID=0X182)
    CPU Device ID :0001
    CPU Revision  :1

*** CHIP DETECTION OVERRIDDEN ***

    - EJTAG IMPCODE ....... : 00000000000000000001000110000011 (00001183)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS64

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped

Probing Flash at Address: 0x1FC00000 ...
Detected Chip ID (VenID:DevID = 0083 : 0000)
*** Unknown or NO Flash Chip Detected ***
darkfader wrote:
TheLizard wrote:

I have the same router (though it is a dutch model from KPN (Experia Box v8)

I have added the model to the table of hardware, (http://wiki.openwrt.org/toh/arcadyan/vgv7519)
I have JTAG access, but I can't get access to the bootloader menu, as there seems to be a 16 character password in it.

Too bad the link in the previous post doens't work anymore (It might by my companies web access policy though)

That link works fine here. I would like to know the possibilities of this device. Does it have MAC-based VLAN support? (Interactive TV Motorola boxes). Extracting/decrypting the configuration would be nice (for VOIP details).
Opening up the device was a bit difficult, but I think it needs to be done only once? I would like a password-patched bootloader to flash. I have soldered in a JTAG header. I doubt they want this device back since it's from 2011 already. The stickers have yellowed already. Is there a JTAG programmer software for this that also does USB cables?
I have have serial output at least, showing v3.00.06c loader version and 16 asterisks for password...
I don't know if I'll use this device though, some say it's not so good and if OpenWrt doesn't do DSL, it's not as useful. In that case I'll be using a different router with the required VLAN settings.

Hello any luck with the decrypting configuration file? I would like to change some country related setting which is normally not accessible. Would that be possible via JTAG too? Could you post link for JTAG HW and SW you used? Thank you.

(Last edited by t23145 on 21 May 2015, 14:38)