OpenWrt Forum Archive

Topic: Asus WL600g

The content of this topic has been archived between 19 Sep 2015 and 3 May 2018. Unfortunately there are posts – most likely complete pages – missing.

I've found a new router with dsl modem from asus and i discovered that it is linux based since it's firmware upgrade is a linux filesystem with busybox etc.
i have also added it to the wiki hoping someone will complete the fields.
Unfortunately i'm unable to read the filesystem sunce it uses an unknown compression method, see the wiki (http://wiki.openwrt.org/OpenWrtDocs/Har … sus/WL600g) for details.
Asus doesn't provide a GPL tarball yet.

Cheers

I'm working on the 2.x unsquashfs addition to the firmware-mod-kit now, but how long it takes will determine how much trouble I run into. Since unsquashfs doesn't exist for that version (afaik), I have to create it.

Ok, I completed this wink. It wasn't that time consuming.

I tried both unsquashfs and unsquashfs-lzma with your image, and although neither work, I have a new idea about what type of compression is used.

I need to look closer, I believe it may be LZMA, but a different implementation than what is used by openwrt/dd-wrt/etc. Remember how I told you on irc that the LZMA compressor doesn't prepend any sort of header to the compressed data and so each implementation of LZMA defines its own header format? This may be the case here..

It may be that the LZMA implementation uses a different header on compressed blocks than the squashfs-lzma implementation OpenWrt uses. Perhaps it includes the encoding parametes, where-as the openwrt/dd-wrt squashfs-lzma assumes the encoding parameters on decompression.

Chances are its not an entirely custom squashfs-lzma though, so it'd be a good idea to check alternate squashfs-lzma patches (I believe there are a few laying around).

But.. this could be wrong, maybe it uses a really different compression algorithm or applies some obfuscation to the compressed blocks, we'll see.

I'm committing the unsquashfs and unsquashfs-lzma for 2.x images to the firmware-mod-kit repository now.

i suggest to ask asus for the GPL tarball...

You want me to ask ASUS for the GPL tarball? You're the one who needs this, you ask them wink.

If it is LZMA, I should be able to figure it out pretty easily. What I'll then do is modify the code so that it tries ones format, then falls back to other format.

I'll take a closer look later maybe. For now I'm going to watch a movie.

db90h wrote:

You want me to ask ASUS for the GPL tarball? You're the one who needs this, you ask them wink.

A stolen source is a shame for the whole FS, not only the people using it.

i'll ask ASUS tomorrow...

rootkit wrote:
db90h wrote:

You want me to ask ASUS for the GPL tarball? You're the one who needs this, you ask them wink.

A stolen source is a shame for the whole FS, not only the people using it.

i'll ask ASUS tomorrow...

Done, let's see...

Well, they replied to my mail but in the mail is written that i can't disclose its content, lol
in a few words it seems that they have forwarded my request to the right place

udate: ASUS hasn't released nothing yet

rootkit wrote:

udate: ASUS hasn't released nothing yet

You say, ASUS sells Linux-based router (WL-600G), without releasing the sources to the customers who bought that device?

(Last edited by mangoo on 7 Oct 2006, 23:13)

mangoo wrote:
rootkit wrote:

udate: ASUS hasn't released nothing yet

You say, ASUS sells Linux-based router (WL-600G), without releasing the sources to the customers who bought that device?

Apparently so. Are you in a position to do something about it?

No, I don't even has that device.

Is it 100% sure it runs Linux, and not, say, VxWorks?

mangoo wrote:

No, I don't even has that device.

Is it 100% sure it runs Linux, and not, say, VxWorks?

Well, yes... this from its syslog:

Jan 1 00:00:18    user    info    kernel: Linux video capture interface: v1.00
Jan 1 00:00:18  user  warn  kernel: Using noop io scheduler
..
Jan 1 00:00:18  user  warn  kernel: VFS: Mounted root (squashfs filesystem) readonly.
Jan 1 00:00:18  user  info  kernel: Mounted devfs on /dev
Jan 1 00:00:18  user  info  kernel: Freeing unused kernel memory: 76k freed
..
Jan 1 00:00:24  user  info  kernel: pwc Philips webcam module version 9.0.1 loaded.

See that last entry btw... it's loading an usb webcam module...wtf? smile

Btw, I haven't gotten mine online in router mode yet hmm It only works in bridged mode.. in router mode, it never gets assigned an IP address using DHCP hmm

Last line it produces in syslog is:

Jan 1 00:00:27  user  debug   syslog: dhcpc -i nas_8_35 &

And WAN status is 'waiting for dhcp client'..

I managed to compile a firmware 1.0.2.8b with the GPL source and toolchain mentioned in the previous post. I flashed it into the WL-600g and it
booted happily with it. Sadly, not with a working ADSL link.

To build the firmware, run in /opt/bcm963xx/ : make TARGET=96348GW

Might have to edit targets/96348GW/96348GW to change ANNEX_B into ANNEX_A, as ANNEX_B was the default.

So, this little box is a broadcom 96348GW .. does this mean openWRT can be run on it? At least it's possible to build a custom image with the supplied toolchain now, but how to proceed from here?

Could you tell us what CPU WL-600g has, and how much memory?

cat /proc/cpuinfo, cat /proc/meminfo, but also dmesg output would be interesting.

I haven't gotten a prompt on the box yet. I haven't tried ssh access with the 1.0.2.8b firmware yet though, only with 1.0.2.4. On that firmware though, I do get a connection but it's closed almost immediately.

I'll have a looksy tonight to try my luck with the self-built firmware, and report the specs.

No luck so far, can't login with the self-built version either. And the root filesystem is rather cryptic.. many precompiled binaries without source for one thing. Any clue on how I could enter the box, or figure out how to change the root filesystem such that I can actually ssh/telnet to the box and get a root prompt?

Do you have a serial console there?

No. There's no serial port on the box. Maybe there's a pinout on the board to solder one on, but I'd prefer the software way, if possible.

with stock firmware (1.0.2.4), I can log in as admin with telnet.  at the prompt, press ? to see a list of available commands.
using the menu system i was able to enable ssh login and disable telnet login (but you still just have the menu system and the same limited commands available)
the available commands are very limited (notably missing: ls):

-> ?

?
help
logout
reboot
adsl
atm
brctl
cat
df
dumpcfg
echo
ifconfig
kill
arp
defaultgateway
dhcpserver
dns
lan
passwd
ppp
remoteaccess
restoredefault
route
save
swversion
wan
ping
ps
pwd
siproxd
sntp
sysinfo
tftp
wlctl


-> cat /proc/cpuinfo
system type             : 96348GW-10
processor               : 0
cpu model               : BCM6348 V0.7
BogoMIPS                : 254.77
wait instruction        : no
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : no
VCED exceptions         : not available
VCEI exceptions         : not available

-> cat /proc/meminfo
MemTotal:        13436 kB
MemFree:           732 kB
Buffers:           528 kB
Cached:           4108 kB
SwapCached:          0 kB
Active:           4812 kB
Inactive:         2068 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:        13436 kB
LowFree:           732 kB
SwapTotal:           0 kB
SwapFree:            0 kB
Dirty:               0 kB
Writeback:           0 kB
Mapped:           4100 kB
Slab:             3316 kB
Committed_AS:     7144 kB
PageTables:        492 kB
VmallocTotal:  1048560 kB
VmallocUsed:      1608 kB
VmallocChunk:  1046740 kB

This looks really good.
What does df show (sysinfo would be interesting, too) ?
Well, apparently the box seems to have only 16MB ram. Hopefully it's comparable to the WL-500gP where you have to unlock the rest of the ram.
Anyone who did a autopsy yet?

-> df
Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/root                 2624      2624         0 100% /
tmpfs                      764       420       344  55% /var
/dev/discs/disc0/part1244076800   4999232 239077568   2% /var/harddisk  <-- my attached usb drive

-> sysinfo
Number of processes: 42
  2:13pm  up  3:14,
load average: 1 min:0.00, 5 min:0.00, 15 min:0.00
              total         used         free       shared      buffers
  Mem:        13436        12788          648            0          528
Swap:            0            0            0
Total:        13436        12788          648

-> cat /proc/version
Linux version 2.6.8.1 (root@Yau) (gcc version 3.4.2) #30 Tue May 16 10:40:23 CST 2006

Doh! I did get into the telnet menu before, but didn't realise that you could actually perform commands outside of the menu structure.

PS: you can have somewhat-of-an-ls using echo /path/*, but if you download the firmware 'source' from asus, you can also see what's on the fs.

(Last edited by brama on 22 Oct 2006, 16:02)

Running binaries is possible by using backticks in commands from the menu.

E.g.:

-> echo `/bin/dmesg > /var/dmesg.out`
-> cat /var/dmesg.out

(in this case, running dmesg directly doesn't work, it actually crashses the modem if attempted multiple times)

I've attached the dmesg output below. Seems like a rather standard install to me..how to start attempting openwrt on this thing?

Linux version 2.6.8.1 (root@Yau) (gcc version 3.4.2) #30 Tue May 16 10:40:23 CST 2006
Total Flash size: 4096K with 71 sectors
96348GW-10 prom init
CPU revision is: 00029107
mpi: No Card is in the PCMCIA slot
Determined physical RAM map:
memory: 00fa0000 @ 00000000 (usable)
On node 0 totalpages: 4000
  DMA zone: 4000 pages, LIFO batch:1
  Normal zone: 0 pages, LIFO batch:1
  HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=31:0 ro noinitrd
brcm mips: enabling icache and dcache...
Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 8kB 2-way, linesize 16 bytes.
PID hash table entries: 64 (order 6: 512 bytes)
Using 128.000 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 13340k/16000k available (1578k kernel code, 2640k reserved, 681k data, 76k init, 0k highmem
)
Calibrating delay loop... 254.77 BogoMIPS
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Checking for 'wait' instruction...  unavailable.
NET: Registered protocol family 16
Can't analyze prologue code at 801992fc
usbcore: registered new driver usbfs
usbcore: registered new driver hub
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
NTFS driver 2.1.15 [Flags: R/O DEBUG].
PPP generic driver version 2.4.2
NET: Registered protocol family 24
Linux video capture interface: v1.00
Using noop io scheduler
bcm963xx_mtd driver v1.0
brcmboard: brcm_board_init entry
bcm963xx_serial driver v2.0
u32 classifier
    OLD policer on
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
NET: Registered protocol family 1
NET: Registered protocol family 17
Ebtables v2.0 registered
NET: Registered protocol family 8
NET: Registered protocol family 20
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 76k freed
Algorithmics/MIPS FPU Emulator v1.5
atmapi: module license 'Proprietary' taints kernel.
blaadd: blaa_detect entry
adsl: adsl_init entry
Broadcom BCMPROCFS v1.0 initialized
Broadcom BCM6348A2 Ethernet Network Device v0.3 Mar 10 2006 11:30:45
Config Ethernet Switch Through MDIO
eth0: MAC Address: 00:18:F3:2D:BC:AB
Broadcom BCM6348A2 USB Network Device v0.4 Mar 10 2006 11:30:46
usb0: MAC Address: 00 18 F3 2D BC AB
usb0: Host MAC Address: 00 18 F3 2D BC AB
PCI: Setting latency timer of device 0000:00:01.0 to 64
PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
wl: srom not detected, using main memory mapped srom info (wombo board)
wl0: wlc_attach: using main board MAC address base in NVRAM (wombo board)
wl0 MAC Address: 00:18:F3:2D:BC:AB
dgasp: kerSysRegisterDyingGaspHandler: wl0 registered
wl0: Broadcom BCM4318 802.11 Wireless Controller 3.91.41.0
BcmAdsl_Initialize=0xC0054208, g_pFnNotifyCallback=0xC0067374
AdslCoreHwReset: AdslOemDataAddr = 0xA0FF8054
dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered
eth0 Link UP.
device usb0 entered promiscuous mode
br0: port 1(usb0) entering learning state
br0: topology change detected, propagating
br0: port 1(usb0) entering forwarding state
device eth0 entered promiscuous mode
br0: port 2(eth0) entering learning state
br0: topology change detected, propagating
br0: port 2(eth0) entering forwarding state
device wl0 entered promiscuous mode
br0: port 3(wl0) entering learning state
br0: topology change detected, propagating
br0: port 3(wl0) entering forwarding state
ADSL G.994 training
br0: port 3(wl0) entering disabled state
uhci_hcd: falsely claims to have parameter debug
USB Universal Host Controller Interface driver v2.2
PCI: Enabling device 0000:00:07.0 (0000 -> 0001)
uhci_hcd 0000:00:07.0: UHCI Host Controller
uhci_hcd 0000:00:07.0: irq 32, io base 0c000000
uhci_hcd 0000:00:07.0: new USB bus registered, assigned bus number 1
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
PCI: Enabling device 0000:00:07.1 (0000 -> 0001)
uhci_hcd 0000:00:07.1: UHCI Host Controller
br0: port 3(wl0) entering learning state
br0: topology change detected, propagating
br0: port 3(wl0) entering forwarding state
br0: port 3(wl0) entering disabled state
uhci_hcd 0000:00:07.1: irq 32, io base 0c000020
uhci_hcd 0000:00:07.1: new USB bus registered, assigned bus number 2
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
PCI: Enabling device 0000:00:07.2 (0000 -> 0002)
ehci_hcd 0000:00:07.2: EHCI Host Controller
capbase:::1000010
capbase:::1000010
ehci_hcd 0000:00:07.2: irq 32, pci mem a8010800
ehci_hcd 0000:00:07.2: new USB bus registered, assigned bus number 3
ehci_hcd 0000:00:07.2: USB 2.0 enabled, EHCI 1.00, driver 2004-May-10
hub 3-0:1.0: USB hub found
hub 3-0:1.0: 4 ports detected
usblp: falsely claims to have parameter proto_bias
usbcore: registered new driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
br0: port 3(wl0) entering learning state
br0: topology change detected, propagating
br0: port 3(wl0) entering forwarding state
br0: port 3(wl0) entering disabled state
br0: port 3(wl0) entering learning state
br0: topology change detected, propagating
br0: port 3(wl0) entering forwarding state
br0: port 3(wl0) entering disabled state
br0: port 3(wl0) entering learning state
br0: topology change detected, propagating
br0: port 3(wl0) entering forwarding state
ADSL G.992 started
ov511: falsely claims to have parameter ov518_color
usbcore: registered new driver ov511
drivers/usb/media/ov511.c: v1.64 for Linux 2.5 : ov511 USB Camera Driver
pwc: falsely claims to have parameter dev_hint
pwc Philips webcam module version 9.0.1 loaded.
pwc Supports Philips PCA645/646, PCVC675/680/690, PCVC720[40]/730/740/750 & PCVC830/840.
pwc Also supports the Askey VC010, various Logitech Quickcams, Samsung MPC-C10 and MPC-C30,
pwc the Creative WebCam 5 & Pro Ex, SOTEC Afina Eye and Visionite VCS-UC300 and VCS-UM100.
usbcore: registered new driver Philips webcam
SCSI subsystem initialized
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
br0: port 1(usb0) entering disabled state
ADSL G.992 channel analysis
ADSL link up, interleaved, us=988, ds=12058