CPU: Ralink RT2880F
RAM: 32MB
Flash: 8MB
Wi-Fi: Ralink RT2860 (maybe RT2820 - hard to see) 802.11N, 3 antennas look to be non-removable
Switch: IC+ IP175C 4LAN+1WAN 10/100

Serial console is available at 57600 8n1 on J1 (I had to desolder / solder a 0.1" pin header), pinout:

1: VCC (closest to edge of board) (?)
2: RXD (data from PC to router)
3: GND
4: TXD (Data from router to PC)

U-Boot 1.1.3 (Nov 15 2007 - 14:37:24)

Board: RT2880 DRAM:  32 MB

 twe0 set to <NULL>

 toe0 set to <NULL>
flash_protect ON: from 0xBC400000 to 0xBC42B097
protect on 0
protect on 1-------------------------------------------------------------------
protect on 2                     <ESC> Exit                     <Enter> Enter
flash_protect ON: from 0xBC430000 to 0xBC43FFFF
protect on 3
*** Warning - bad CRC, using default environment



============================================
ASIC -VerB/C (MAC to Phy Mode)
DRAM COMPONENT=128Mbits
DRAM BUS=32BIT
Total memory = 32Mbytes
Date:Nov 15 2007  Time:14:37:24
============================================
 D-CACHE set to 4 way
 I-CACHE set to 4 way

 ##### The CPU freq = 266 MHZ ####

 SDRAM bus set to 32 bit
 SDRAM size =32 Mbytes

Please choose the operation:
   0: Load ucos code to SDRAM via TFTP Client.
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   5: Load ucos code to SDRAM via TFTP.                                       0

3: System Boot system code via Flash.
## Booting image at bc450014 ...
   Image Name:   Linux Kernel Image
   Created:      2008-01-30   8:40:50 UTC
System Control Status = 0x02110084
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2531244 Bytes =  2.4 MB
   Load Address: 8a000000
   Entry Point:  881b0040
   Verifying Checksum ... OK
   Uncompressing Kernel Image ...
No initrd
## Transferring control to Linux (at address 881b0040) ...
## Giving linux memsize in MB, 32

Starting kernel ...


THIS IS ASIC
ramsize = 32 MBytes
rambase not set, set to default (0x08000000)
MEMORY DESCRIPTOR dump:
[0,88239940]: base<08000000> size<02000000> type<Free RAM memory>

 The CPU feqenuce set to 266 MHz
CPU revision is: 0001906c
icache: sets:256, ways:4, linesz:16 ,total:16384, waybit:12, flags:0x0
dcache: sets:256, ways:4, linesz:16 ,total:16384, waybit:12, flags:0x0
i waysize = 4096, d waysize = 4096, i sets= 256, d sets=256
Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 16kB, 4-way, linesize 16 bytes.
[setup_scache]:1032
Linux version 2.4.30 (root@localhost.localdomain) (gcc version 3.3.6) #636 ä¸ 1æ 30 16:40:47 CST 2008
Determined physical RAM map:
 memory: 02000000 @ 08000000 (usable)
On node 0 totalpages: 40960
zone(0): 40960 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock4
cause = c0c08268, status = 1000e700
calculating r4koff... 00144b50(1330000)
CPU frequency 133.00 MHz
Using 133.000 MHz high precision timer.
Calibrating delay loop... 265.42 BogoMIPS
Memory: 28712k/32768k available (1713k kernel code, 4056k reserved, 112k data, 96k init, 0k highmem)
Dentry cache hash table entries: 32768 (order: 6, 262144 bytes)
Inode cache hash table entries: 16384 (order: 5, 131072 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 8192 (order: 3, 32768 bytes)
Page-cache hash table entries: 65536 (order: 6, 262144 bytes)
Checking for 'wait' instruction...  unavailable.
POSIX conformance testing by UNIFIX
pci.c pcibios_init():840
BAR0 at slot 0 = 8
pci.c pcibios_fixup_resources():640
bus = 0, dev = 0, fun = 0
dev= 0x883fcc00
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
pty: 256 Unix98 ptys configured
LED & GPIO & LAN Status Driver LED_VERSION
spidrv_major = 217
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0x300500 (irq = 9) is a 16550A
ttyS01 at 0x300c00 (irq = 8) is a 16550A
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
RA2880 Ethernet Driver Initilization. v1.01  256 rx/tx descriptors allocated!
Netlink init ok!
PROC INIT OK!
ICPLUS 175C config LAN_WAN finished (evaluation board)
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
FLASH_API: MAN_ID=C2 DEV_ID=22A8 SIZE=4MB
physmap flash device: 800000 at 1c400000
 Amd/Fujitsu Extended Query Table v1.1 at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
Using physmap partition definition
Creating 7 MTD partitions on "RT2880 SOC Physically mapped flash":
0x00000000-0x00030000 : "Bootloader"
mtd: Giving out device 0 to Bootloader
0x00030000-0x00040000 : "Config "
mtd: Giving out device 1 to Config
0x00040000-0x00050000 : "Factory"
mtd: Giving out device 2 to Factory
0x00050000-0x00110000 : "Kernel"
mtd: Giving out device 3 to Kernel
0x00110000-0x003e0000 : "RootFS"
mtd: Giving out device 4 to RootFS
0x003e0000-0x00400000 : "Cimage"
mtd: Giving out device 5 to Cimage
0x00050000-0x003e0000 : "Uimage"
mtd: Giving out device 6 to Uimage
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 1024 buckets, 8Kbytes
TCP: Hash tables configured (established 16384 bind 32768)
Linux IP multicast router 0.06 plus PIM-SM
ip_conntrack version 2.1 (1280 buckets, 10240 max) - 316 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team, Type=Restricted Cone
ipt_random match loaded
netfilter PSD loaded - (c) astaro AG
ipt_recent v0.3.1: Stephen Frost <sfrost@snowman.net>.  http://snowman.net/projects/ipt_recent/
ipt_IPV4OPTSSTRIP loaded
arp_tables: (C) 2002 David S. Miller
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Load RT2880 Timer Module(Wdg/Soft)
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing prom memory: 0kb freed
Freeing unused kernel memory: 96k freed
console started
trying to start /sbin/init
Algorithmics/MIPS FPU Emulator v1.5
insmod: /lib/modules/2.4.30: No such file or
Please press Enter to activate this console. Sat Jan  1 00:00:00 UTC 2000
mount: Mounting /proc on /proc failed: Device or resource busy
IC-Plus PHY Init...ok
GDMA1_FWD_CFG = 10000
DSP_EN OFF version driver

phy_tx_ring = 09afe000, tx_ring = a9afe000, size: 16 bytes

phy_rx_ring = 09afd000, rx_ring = a9afd000, size: 16 bytes
ra2880stop()...Done
Free TX/RX Ring Memory!
IC-Plus PHY Init...ok
GDMA1_FWD_CFG = 10000
DSP_EN OFF version driver

phy_tx_ring = 09afc000, tx_ring = a9afc000, size: 16 bytes

phy_rx_ring = 09afb000, rx_ring = a9afb000, size: 16 bytes
eth2.1: Setting MAC address to  00 90 cc f7 6d 04.
VLAN (eth2.1):  Underlying device (eth2) has same MAC, not checking promiscious mode.
eth2.2: Setting MAC address to  00 90 cc f7 6d 05.
device eth2 entered promiscuous mode
VLAN (eth2.2):  Setting underlying device (eth2) to promiscious mode.
killall: pptp.sh: no process killed
killall: pppoe.sh: no process killed
Initialize WLAN interface
Using /bin/rt2860ap.o
2860 version : v1.6.0.0 (2007/10/12)


=== pAd = c00ff000, size = 465104 ===

<-- RTMPAllocAdapterBlock, Status=0
RX DESC a9876000  size = 2048
<-- RTMPAllocDMAMemory, Status=0
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
MCS Set = ff ff 00 00 00
Main bssid = 00:90:cc:f7:6d:04
The UUID Hex string is:2880288028801880a8800090ccf76d04
The UUID ASCII string is:28802880-2880-1880-a880-0090ccf76d04!
<==== RTMPInitialize, Status=0
0x1300 = 00064300
Setup BRIDGE interface
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
bridge br0 doesn't exist; can't delete it
Setup bridge...
device eth2.1 entered promiscuous mode
eth2.1: dev_set_promiscuity(master, 1)
SIOCDELRT: No such process
device ra0 entered promiscuous mode
ra0: attempt to add interface with same source address.
SIOCDELRT: No such process
br0: port 2(ra0) entering learning state
br0: port 1(eth2.1) entering learning state
br0: port 2(ra0) entering forwarding state
br0: topology change detected, propagating
br0: port 1(eth2.1) entering forwarding state
br0: topology change detected, propagating
SIOCDELRT: No such process
SIOCDELRT: No such process
------> 802.1x--------->Enter
------> 802.1x------>Exit
Static DHCP Leases disable!
SIOCDELRT: No such process
udhcpd (v0.9.9-pre) started
Setup WAN interface
device eth2 is not a slave of br0
device eth2.1 is already a member of a bridge; can't enslave it to bridge br0.
Set: phy[29].reg[23] = 07c2
Set: phy[29].reg[22] = 8420
Set: phy[29].reg[24] = 0001
Set: phy[29].reg[25] = 0001
Set: phy[29].reg[26] = 0001
Set: phy[29].reg[27] = 0001
Set: phy[29].reg[28] = 0002
Set: phy[30].reg[9] = 1089
Set: phy[30].reg[1] = 2f00
Set: phy[30].reg[2] = 0030
don't create flash.inc
********** run Diagd **********
********** run GaTest **********
=================Enable WSC_UPNP===================
=================Enable WSC_UPNP===================
udhcp client (v0.9.9-pre) started
don't create flash.inc
=================Enable LLTD===================
into eth2.2.deconfig
killall: lld2d: no process killed
killall: snmpd: no process killed
=================END LLTD===================
=================Enable GPIO Interrupt================
gPassiveMsgQ Init success! gPassiveMsgID=0x386d4390!
gActiveMsgQ Init success!
ralink_gpio:ioctl GPIO REG
ralink_gpio:ioctl GPIO REG
=================END GPIO Interrupt===================
rm: cannot remove `/tmp/agentenabledflag': No such file or directory
/bin/init.sh: 484: /bin/agent: not found
sock=5!(0x0x7fff7d00)
Create netlink socket thread success!
Create ioctl socket(6) success!
Pthread(wscDevNLHandle)Now waiting for the netlink socket incoming message!
ip_table: set wan_name=eth2.2
Using /lib/modules/2.4.18-MIPS/RT2880/sw_nat.o
insmod: unresolved symbol ra_sw_nat_hook_tx
insmod: unresolved symbol ra_sw_nat_hook_rx
@@@@@@ SSDP_PORT = 1900
UPnP Initialized
         IP-Addr: 192.168.1.1 Port: 49152
         HW-Addr: 00:90:cc:f7:6d:04!
Specifying the webserver root directory -- /etc/xml
UUID Str=uuid:28802880-2880-1880-a880-0090ccf76d04!
alloc memory size=1050!
<?xml version="1.0" encoding="utf-8"?>
<root xmlns="urn:schemas-upnp-org:device-1-0">
  <specVersion>
    <major>1</major>
    <minor>0</minor>
  </specVersion>
  <device>
    <deviceType>urn:schemas-wifialliance-org:device:WFADevice:1</deviceType>
    <friendlyName>11N_Router</friendlyName>
    <manufacturer>.</manufacturer>
    <manufacturerURL>.</manufacturerURL>
    <modelDescription>AP WSC device</modelDescription>
    <modelName>Wireless Router</modelName>
    <modelNumber>BR6524N</modelNumber>
    <modelURL>.</modelURL>
    <serialNumber>12345678</serialNumber>
<UDN>uuid:28802880-2880-1880-a880-0090ccf76d04</UDN>
    <serviceList>
      <service>
        <serviceType>urn:schemas-wifialliance-org:service:WFAWLANConfig:1</serviceType>
        <serviceId>urn:wifialliance-org:serviceId:WFAWLANConfig1</serviceId>
        <SCPDURL>WFAWLANConfigSCPD.xml</SCPDURL>
        <controlURL>control</controlURL>
        <eventSubURL>event</eventSubURL>
      </service>
    </serviceList>
  </device>
</root>

Registering the RootDevice
         with descDocUrl: http://192.168.1.1:49152/description.xml
RootDevice Registered
WscLocalDevice:
        Device:
                FriendlyName=11N_Router!
                DescDocURL=http://192.168.1.1:49152/description.xml!
                UDN=uuid:28802880-2880-1880-a880-0090ccf76d04!
                PresURL=!
        Service:
                servIdStr=urn:wifialliance-org:serviceId:WFAWLANConfig1!
                servTypeStr=urn:schemas-wifialliance-org:service:WFAWLANConfig:1!
                scpdURL=http://192.168.1.1:49152/WFAWLANConfigSCPD.xml!
                eventURL=http://192.168.1.1:49152/event!
                controlURL=http://192.168.1.1:49152/control!
WscLocalDeviceInit Initialized
killall: radiusd: no process killed
RADIUS server disable !!

And then boots to some lame GUI-ish login program…

So I ordered a MZK-W04N instead of the USB equipped MZK-W04NU … The MZK-W04N is a totally different beast. Oops.

I haven't been able to find GPL source for this thing, but it def is running U-Boot and Linux. Seems similar to the Asus RT-N15, Belkin F5D8235-4, Linksys WRT-160N, etc.

===== UPDATE 10/jun/2010 ======

Planex (PCi) W04n-XX is IDENTICAL to Edimax 6524N router. The only difference is ROM & RAM sizes.

I've just flashed a custom firmware (dd-wrt) specific for Edimax 6524N on my MZK-W04N-XX and it's working perfectly.

How to flash without serial cable: Configure your PC with static IP address between 192.168.1.2 and 192.168.1.5 (ex. 192.168.1.2). Connect your pc to mzk-w04n-xx port 1. Remove the power cable from the router. Press and hold reset button, while inserting the power cable, hold pressing the reset for 10 seconds. Now w04n-xx is accepting tftp flashing on fixed IP 192.168.1.6.

Enjoy. By RyLoS (you can reach me on rylos78@gmail.com) Press and keep pressed th