Netcomm NB5PLUS4W

The NB5PLUS4W is a router that loosely resembles the LinkSys ADSL2MUE. It has an integrated TI AR7WRD SoC with a TNET1350A wireless chipset.

Supported Versions

Version/Model S/N OpenWrt Version Supported Model Specific Notes
v1 C Unknown Unknown
v2 A WIP Wireless doesn't work in Kamikaze

NOTE: Anything not included in model specific notes, or where a short comment couldn't be included on the notes.

Hardware Highlights

CPU Ram Flash Network USB Serial JTag
TI AR7WRD 16MB 4MB 4x1 Used as network Unknown Unknown


First, log into your router, go to Advanced, click Tools, and click Reset to Defaults. Then download a Kamikaze image for the AR7 platform from

Open the image in a hex editor (hexer for Linux/Unix which is like vi/less, and WHD for Windows at, and search the location of the string hsqs (the squashfs magic number). This is where your kernel ends and the root filesystem begins. Note the hex number of this location - for the sake of an example we'll assume the location is d0000.

Secondly, power down your router, and set your IP to, netmask Plug your modem in and quickly FTP to - you have a 3 second window in which to do this, you may need to take a few goes at it. Login as user adam2, password adam2.

Let's get the current location of the MTD values:

ftp> quote GETENV mtd0
mtd0    0x9009f000,0x90400000

ftp> quote GETENV mtd1
mtd1    0x90020090,0x9009f000

ftp> quote GETENV mtd4
mtd4    0x90020000,0x90400000

Take special note of the value for mtd1 and mtd0 - these are for the kernel and filesystem respectively.

We'll need to change these because they are completely unsuitable for the OpenWrt. Remember the location of the squashfs? We'll need this now.

First, the mtd1 block. We subtract 0x90 from it so that it goes back to the first value of the mtd4 block, then add the squashfs offset (in this case d0000) to get the end block, to give 0x90020000,0x900f0000.

The mtd0 block contains our squashfs, and will need to point to the beginning of the filesystem in the system image. Take the end of the mtd1 block (0x900f0000) and use it as the beginning of the mtd0 block to give 0x900f0000,90400000.

Set the new values:

ftp> quote SETENV mtd0,0x900f0000,0x90400000
ftp> quote SETENV mtd1,0x90020000,0x900f0000

Now we're ready to upload our new image:

ftp> binary
ftp> quote MEDIA FLSH
ftp> put "openwrt-ar7-squashfs.bin" "c mtd4"

Wait patiently for this to complete, then type quote REBOOT to restart the router.

That's it - now we can telnet in and set our root password.

Upgrading OpenWRT

One should be able to upgrade using LuCi.

However one can also upgrade by clearing the configuration in LuCi and repeating the process above (sans setting the MTD values).



Architecture: MIPS
Vendor: Texas Instruments
Bootloader: PSPBoot
System-On-Chip: AR7WRD
CPU Speed: 211 Mhz
Flash-Chip: Unknown
Flash size: 4 MiB
RAM: 16 MiB
Wireless: Texas Instruments TNET1350A
Ethernet: Switch in CPU
Serial: Unknown
JTAG: Unknown


Photos to come.

Opening the case

WIP - will add pictures


Will see if a serial port is available and try to connect


Must first see if JTAG port is available.

specific configuration


The default network configuration is:

Interface Name Description Default configuration
br-lan LAN, WiFi, WAN
eth0 LAN (all 4 ports) none

Switch Ports (for VLANs)

The 4 Ethernet ports seem to be joined together as eth0.

Failsafe mode

Will investigate this.


There is a reset button on the back, between the power connector and the WAN port.

Basic configuration


Back to top

inbox/netcomm-nb5plus4w.txt · Last modified: 2014/02/13 07:31 by hhm