I've had a couple of these newer Verizon FIOS mi424wr routers lying around and figured it would be nice to get OpenWRT working on them. They currently run some variant of openrg firmware but the source provided by Actiontec appears to be incomplete/broken.
The Rev. I has a native telnet interface but it appears to be more locked down that previous revisions. I tried using the previous script from the older revisions to create a backup of the installed firmware but it did not work since the "cat" command has been removed unlike the Rev. D and older routers. I was also trying to update that script to work with python3. I was able to use the script on a Rev. D mi424wr I had lying around without a problem but was unable to extract the produced image. I tried binwalk and a number of extraction tools but could not get anything working, I've uploaded that here as well if anyone wants to try and extract it.
These are all the options available over telnet:
Wireless Broadband Router> help all
Command Category conf - Read and write Wireless Broadband Router configuration data
factory Factory related commands
print Print Wireless Broadband Router configuration
set Set Wireless Broadband Router configuration path to value
set_obscure Set Wireless Broadband Router configuration path to an
obscured value
del Delete subtree from Wireless Broadband Router configuration
ram_set Set Wireless Broadband Router dynamic configuration
ram_print Print Wireless Broadband Router dynamic configuration
reconf Reconfigure the system according to the current Wireless
Broadband Router configuration
firmware_restore Restore to saved firmware and reboot.
exit Exit sub menu
help Show help for commands within this menu
Command Category upnp - UPnP commands
igd IGD commands
status Display UPnP status
exit Exit sub menu
help Show help for commands within this menu
Command Category qos - Control and display QoS data
utilization Connection utilization information
exit Exit sub menu
help Show help for commands within this menu
Command Category wmm - wmm configuration and control
get get the specified entry
set set the specified entry
del del the specified entry
get_dev get the entries of the specified device
exit Exit sub menu
help Show help for commands within this menu
Command Category cwmp - CWMP related commands
status Print CWMP status
session_start Start CWMP session to ACS
session_stop Stop CWMP session
indexes Print CWMP devices indexes
exit Exit sub menu
help Show help for commands within this menu
Command Category bridge - API for managing ethernet bridge
connection connect separate network interfaces to form one seamless LAN
config Configure bridge
info Print bridge information
exit Exit sub menu
help Show help for commands within this menu
Command Category firewall - Control and display Firewall and NAT data
restart Stop and start Firewall & NAT
start Start Firewall & NAT
stop Stop Firewall & NAT
filter Turn Firewall packet inspection on/off
mac_cache_dump Dump MAC cache data
dump Display Firewall data
variable Display variables of the firewall rules
trace Trace packet traversal via the Firewall ruleset
fastpath Turns firewall fastpath feature on/off (default is on)
exit Exit sub menu
help Show help for commands within this menu
Command Category connection - API for managing connections
pppoe Configure pppoe interface
vlan Configure vlan interface
exit Exit sub menu
help Show help for commands within this menu
Command Category inet_connection - API for managing internet connections
pppoe Configure pppoe internet connection
ether Configure ethernet internet connection
exit Exit sub menu
help Show help for commands within this menu
Command Category misc - API for Wireless Broadband Router miscellaneous tasks
print_ram print ram consumption for each process
vlan_add Add VLAN interface
top Profiling over event loop and estream
wbm_debug_set Stop and start WBM debug mode
wbm_border_set Stop and start WBM border mode
knet_hooks_dump Dump to console which knet_hooks run on each device
malloc_info Print memory information of malloc module
malloc_trim Free unused allocated memory in malloc module
exit Exit sub menu
help Show help for commands within this menu
Command Category firmware_update - Firmware update commands
start Remotely upgrade Wireless Broadband Router
cancel Kill running remote upgrade
exit Exit sub menu
help Show help for commands within this menu
Command Category log - Controls Wireless Broadband Router logging behavior
filter Controls the CLI session logging behavior
print Print the contents of a given syslog buffer to the console
clear Clear the contents of a given syslog buffer
exit Exit sub menu
help Show help for commands within this menu
Command Category dev - Device related commands
mv88e60xx Marvell MV88e60xx Ethernet Switch commands
moca MOCA commands
mii_reg_get Get Ethernet MII register value
mii_reg_set Set Ethernet MII register value
mii_phy_reg_get Get Ethernet MII register value
mii_phy_reg_set Set Ethernet MII register value
exit Exit sub menu
help Show help for commands within this menu
Command Category kernel - Kernel related commands
sys_ioctl issue openrg ioctl
meminfo Print memory information
top Print Wireless Broadband Router's processes memory usage
cpu_load_on Periodically shows cpu usage.
cpu_load_off Stop showing cpu usage (triggered by cpu_load_on).
cpu_load_avg Shows average cpu usage of last 1, 5 and 15 minutes.
exit Exit sub menu
help Show help for commands within this menu
Command Category system - Commands to control Wireless Broadband Router execution
http_intercept_status Display HTTP intercept status
diag_test run diagtest 0=all or select 1-9 for TBHR
..TLANIPSTB
diag_correction run corrections -- may reboot or reset BHR
die Exit from Wireless Broadband Router and return ret
ps Print Wireless Broadband Router's tasks
entity_close Close an entity
etask_list_dump Dump back trace of all etasks
restore_factory_settings Restore factory configuration
reboot Reboot the system
ver Display version information
print_config Print compilation configuration. Search for option
if specified
exec Execute program
cat Print file contents to console
shell Spawn busybox shell in foreground
date Print the current UTC and local time
print_page Print page id and name
exit Exit sub menu
help Show help for commands within this menu
Command Category flash - Flash and loader related commands
commit Save Wireless Broadband Router configuration to flash
erase Erase a given section in the flash
load Load and burn image
boot Boot the system
bset Configure bootloader
layout Print the flash layout and content
dump Dump the flash content
lock Lock mtd region
unlock Unlock mtd region
exit Exit sub menu
help Show help for commands within this menu
Command Category net - Network related commands
dns_route Dyncamic Routing according to DNS replies
igmp IGMP Proxy related commands
host Resolve host by name
wsc wps related commands
ifconfig Configure network interface
ping Test network connectivity
rg_ifconfig List Wireless Broadband Router Network Devices
route Print route table
main_wan Print the name of the current main wan device
intercept_state Print interception state
exit Exit sub menu
help Show help for commands within this menu
Command Category cmd - Commands related to the Command module
exit Exit from the current CLI session
help Show help for commands within this menu
Returned 0
Flash layout gives:
Wireless Broadband Router> flash
flash> layout
Flash layout:
Section 00 Type FACTORY Range 0x00000000-0x00020000 MaxSize 0x0001FF6C
Flash file: /mnt/jffs2/rg_factory
Size 0x0000040A Name 'Downloaded at: Fri Dec 14 19:15:13 2007'
Checksum 0x0000EAFF Counter 0x0000000D Start Offset 0x00000000
Section 01 Type CONF Range 0x00000000-0x00020000 MaxSize 0x0001FF6C
Flash file: /mnt/jffs2/rg_conf1
Size 0x000066C8 Name 'rg_conf'
Checksum 0x0032DC91 Counter 0x0000005F Start Offset 0x00000000
Section 02 Type CONF Range 0x00000000-0x00020000 MaxSize 0x0001FF6C
Flash file: /mnt/jffs2/rg_conf2
Size 0x000066CA Name 'rg_conf'
Checksum 0x0032C0E8 Counter 0x0000005D Start Offset 0x00000000
Section 03 Type BACKUP_CONF Range 0x00000000-0x00020000 MaxSize 0x0001FF6C
Flash file: /mnt/jffs2/backup_rg_conf
Uninitialized.
Section 04 Type IMAGE Range 0x00000000-0x00F00000 MaxSize 0x00EFFF6C
Flash file: /mnt/jffs2/openrg1.img
Size 0x0043F9F0 Name 'FEROCEON Version 4.7.5.3.31.2.14.40.19.22 Downloaded at: Fri Dec 14 19:14:20 2007'
Checksum 0x225EF815 Counter 0x0000000A Start Offset 0x00000000
Section 05 Type IMAGE Range 0x00000000-0x00F00000 MaxSize 0x00EFFF6C
Flash file: /mnt/jffs2/openrg2.img
Size 0x0043F9F0 Name 'FEROCEON Version 4.7.5.3.31.2.14.40.19.22 Downloaded at: Fri Dec 14 19:15:02 2007'
Checksum 0x225EF817 Counter 0x0000000B Start Offset 0x00000000
Section 06 Type LOG Range 0x00000000-0x00040000 MaxSize 0x0003FF6C
Flash file: /mnt/jffs2/persistent_log
Size 0x000000B3 Name 'Persistent_log'
Checksum 0x0000626E Counter 0x0000002D Start Offset 0x00000000
Total 7 sections found.
Returned 0
Flash dump has the following usage, I'm not sure exactly what I need to put there though in order to get a dump on the Rev I:
flash> help dump
dump Dump the flash content
Usage:
dump [-s section | -r address -p flash_file] [-l length] [-1|2|4]
Returned 0
Anyone know what I should be putting into that command or any other steps I should be doing? I don't mind bricking these since I have 2 Rev I's and 1 Rev D and don't use any right now. The hardware is quite nice and it would be great if we could get the MOCA interface working since you can't buy routers with that capability that are not from verizon. It would also be nice to get MOCA working on the Rev D which is why I wanted to extract the firmware so I could take a look at the MOCA binary driver.