The NB5PLUS4W is a router that loosely resembles the LinkSys ADSL2MUE. It has an integrated TI AR7WRD SoC with a TNET1350A wireless chipset.

NOTE: Anything not included in model specific notes, or where a short comment couldn't be included on the notes.

First, log into your router, go to Advanced, click Tools, and click Reset to Defaults. Then download a Kamikaze image for the AR7 platform from http://kamikaze.openwrt.org/.

Open the image in a hex editor (hexer for Linux/Unix which is like vi/less, and WHD for Windows at http://www.smalleranimals.com/index_free.htm), and search the location of the string hsqs (the squashfs magic number). This is where your kernel ends and the root filesystem begins. Note the hex number of this location - for the sake of an example we'll assume the location is d0000.

Secondly, power down your router, and set your IP to 192.168.1.2, netmask 255.255.255.0. Plug your modem in and quickly FTP to 192.168.1.1 - you have a 3 second window in which to do this, you may need to take a few goes at it. Login as user adam2, password adam2.

Let's get the current location of the MTD values:

ftp> quote GETENV mtd0
mtd0    0x9009f000,0x90400000

ftp> quote GETENV mtd1
mtd1    0x90020090,0x9009f000

ftp> quote GETENV mtd4
mtd4    0x90020000,0x90400000

Take special note of the value for mtd1 and mtd0 - these are for the kernel and filesystem respectively.

We'll need to change these because they are completely unsuitable for the OpenWrt. Remember the location of the squashfs? We'll need this now.

First, the mtd1 block. We subtract 0x90 from it so that it goes back to the first value of the mtd4 block, then add the squashfs offset (in this case d0000) to get the end block, to give 0x90020000,0x900f0000.

The mtd0 block contains our squashfs, and will need to point to the beginning of the filesystem in the system image. Take the end of the mtd1 block (0x900f0000) and use it as the beginning of the mtd0 block to give 0x900f0000,90400000.

Set the new values:

ftp> quote SETENV mtd0,0x900f0000,0x90400000
ftp> quote SETENV mtd1,0x90020000,0x900f0000

Now we're ready to upload our new image:

ftp> binary
ftp> quote MEDIA FLSH
ftp> put "openwrt-ar7-squashfs.bin" "c mtd4"

Wait patiently for this to complete, then type quote REBOOT to restart the router.

That's it - now we can telnet in and set our root password.

One should be able to upgrade using LuCi.

However one can also upgrade by clearing the configuration in LuCi and repeating the process above (sans setting the MTD values).

Photos to come.

WIP - will add pictures

Will see if a serial port is available and try to connect

Must first see if JTAG port is available.

The default network configuration is:

The 4 Ethernet ports seem to be joined together as eth0.

Will investigate this.

There is a reset button on the back, between the power connector and the WAN port.

Link to Generic basic config secion

• CategoryModel 100MB Network with 4x1 ports USB Devices Devices based on AR7