The ARV752DPW is a combined ADSL/VOIP/SIP/UMTS/3G-enabled WLAN router and home PBX device, primarily sold as "Easybox 802" by Vodafone Germany. It was also sold in the past by German fixed-line phone company Arcor, prior to the aquisition of Arcor by Vodafone.
In the so called "open" or user-defined configuration mode whith the firmware by Vodafone, the device can suit as a standalone UMTS/3G network router in combination with a compatible UMTS/3G USB modem, with any 3G network, the APN can be configured without any restrictions.
BAUSTELLE The Device is not thorougly tested with OpenWrt. Do not follow the Informations here if you don't have a backup router inplace, you may end up with a bricked device… you've been warned.
This site here is Work in Progress. Please help if you have some usefull Informations, any help is welcome!
|Target:||ifxmips / lantiq|
|System-On-Chip:||Infineon/Lantiq Xway Danube|
|CPU Speed:||333 Mhz|
|Flash chip:||Macronix MX 29LV640EBTI-70G|
|Flash size:||8 MiB|
|RAM chip:||PSC A3S12D40ETP|
|RAM size:||64 MiB (DDR400 SDRAM)|
|USB:||3x USB2.0 (one of these ports is connected with a grey cable)|
|MODEM:||ADSL (G.992.1 & T1.413, V2), ADSL2 (G.992.3), ADSL2+ (G.992.5)|
|Ethernet:||Realtek RTL8306G, 4x LAN 100MBit/s|
|Wireless:||Ralink RT2860T, 802.11n 300MBit/s 2.4 GHz 2 antennas|
|Phone:||3x FXS ( 2x TAE ports which provide POTS via a SIP gateway), ISDN S0|
|Serial:||yes (see picture below)|
|Buttons:||power switch, WPS button, reset button|
|Power:||external PSU, 15V DC, 1,6A (25W max, 16W typical) polarity: -(+)|
6 7 8 9 10 [ ][ ][ ][ ][ ] [ ]Rx Tx [ ]Gnd 1 2 3 4 5
Pin 1 is marked with an small arrow on the motherboard, speed is 115200 8N1
After connect and power on the device you should see something like this:
[root@localhost]# screen /dev/ttyUSB0 115200
ROM VER: 1.0.3 CFG 01 Read EEPROMX X ======================================================================== Wireless ADSL Gateway DANUBE Loader V1.00.01 build Sep 24 2008 10:11:06 Arcadyan Technology Corporation ======================================================================== MXIC MX29LV640BB bottom boot 16-bit mode found Copying boot params.....DONE Press Space Bar 3 times to enter command mode ...123 Yes, Enter command mode ... [DANUBE Boot]:
If you select "
[E] Erase Flash" in the bootloader you can see the original flash layout:
Area Address Length
 Boot 0xB0000000 128K
 Configuration 0xB0020000 256K
 None 0xB0060000 64K
 Special Area 0xB0070000 64K
 Primary Setting 0xB0080000 64K
 Code Image 0 0xB0090000 3776K
 Code Image 1 0xB0440000 3776K
 Boot Params 0xB07F0000 64K
 Flash Image 0xB0000000 8192K
Enter area to ERASE: ESC pressed
ERROR: Not a valid area.
There are three ways to get U-Boot running on the device. Each approach requires different uboot images. At the moment trunk snapshot does not contain those images. See Downloads for copies.
In case your u-boot supports loady, you can upload everything you need via YModem Transfer. If loady is not supported, the user pgid69 has written a nice python script to easily write data to your router:
Temporarily load U-Boot as second stage bootloader from within the vendor Bootloader (brnboot) Requires: uboot-lantiq-arv752DPW_brnboot
(taken and tested from ARV752DPW22 Wiki Article
[M] Upload to Memory
sx u-boot.bin </dev/ttyUSB0 >/dev/ttyUSB0
[Y] Go to Memory
u-boot starts like this:
[DANUBE Boot]:Y Go to Memory Address: (default:0x80002000) : 0x Jump to address 0x80002000 ... U-Boot 2010.03 (Sep 29 2012 - 18:24:13) Board: ARV752DPW SoC: Danube/Twinpass/Vinax-VE V1.5, DDR Speed 166 MHz, CPU Speed 333 MHz DRAM: 64 MB Flash: 8 MB *** Warning - bad CRC, using default environment
You can hit [Ctrl] + [C] to get to the command line or hitting a key at the requested time.
Use this image when you want to put the u-boot permanently on the flash. Requires: uboot-lantiq-arv752DPW_flash
From a running u-boot (see instructions above)
2. unprotect the sector where the U-BOOT config is being stored.
protect off 0xb0010000 0xb001FFFF
2. erase the flash
erase 0xb0000000 0xb001FFFF
3. write the uploaded u-boot.bin to flash (here; 0x80500000 is the RAM adress, where i've uploaded my file)
cp.b 0x80500000 0xb0000000 10000
4. protect the config sector
protect on 0xb0010000 0xb001FFFF
5. reboot device and hope for the best :)
* If kernel ignores parameters from u-boot, remove the preceding - in linux's hardcoded cmdline
PANIC! i flashed U-Boot, now TFTP/HTTP in U-BOOT is not working anymore
calm down, you can upload everything you need via your serial connection.
Hand over the u-boot directly to the cpu with UART, this requires soldering and is intended for rescue purposes. Requires: uboot-lantiq-arv752DPW_ramboot
If you power on the device you will see this on serial console:
ROM VER: 1.0.3 CFG 04 Read EEPROMX X UART
Jumpstart your Device by getting a suitable u-boot.asc File ( uboot-lantiq-arv752DPW_ramboot ). see Downloads
send this file via your serial connection to the router.
cat u-boot.asc > /dev/ttyUSB0
or by using cutecom, send file - plain
after the file is transmitted, uboot should load. Beware, u-boot is being currently loaded only in the ram. powering off your router will kill your u-boot, you will need to start again with this procedure.
To restore u-boot completely, upload u-boot via your serial connection and write it back to flash using the u-boot functions (see 2. FLASH)
There are some parts for telephony on the PCB. This parts are currently not supported.
Sip client for infineon danube based routers running openwrt: http://code.google.com/p/danube-voip/
Some research on university of freiburg germany (german): http://lab.ks.uni-freiburg.de/issues/515
A "map" of the PCB: http://lab.ks.uni-freiburg.de/attachments/download/431/baugruppen.jpg
Please Backup your original firmware!
I will use brntool to explain the backup here. As an alternative you could use brndumper to save the original firmware. (if you prefer a grafical interface brndumper may be better for you)
You have to download the small Python tool. You also need the packages python and phyton-Serial(Debian and clones) or pyserial(Redhat and clones) to run brntool.
Acording to the readme of brntool:
"A successful flash block read will output '.' while a botched one (a byte or
more gets lost in the serial port) will output '!' and retry. Even so, unless
in a hurry, I'd recommend to at least dump twice and compare the dumps, just
to be on the safe side."
A dump of the firmware is done in ~~1 hour. to dump twice as recomended by the autor of brntool you have to plan 2 hours to backup your device. First you have to enter the "Administrator Mode" in DANUBE Boot. Just fire up your serial terminal (
screen /dev/ttyUSB0 115200), power on the device, hurry press 3x space bar. You will see the bootloader prompt:
[DANUBE Boot]:. Then type a exclamation mark (!) to enter the administration mode in the DANUBE bootloader. You will see this output:
Press Space Bar 3 times to enter command mode …123
Yes, Enter command mode …
Enter Administrator Mode !
[#] Set Serial Number
 Use Normal Firmware
 Use ART-Testing Firmware
 Taggle ART Firmware Enable/Disable
[A] Set MAC Address
[E] Erase Flash
[G] Run Runtime Code
[H] Set Options
[M] Upload to Memory
[P] Print Boot Params
[R] Read from Memory
[T] Memory Test
[U] Upload to Flash
[V] Set Board Version
[W] Write to Memory
[Y] Go to Memory
[Z] Dump DDR Ram Register
 Primary = Image 0
 Primary = Image 1
Kill your serial terminal (screen: "ctrl+a, k" and confirm exit with "y"). Now you are able to dump the original firmware as shown below.
[root@localhost]# time ./brntool.py –read=ARV752DPW_whole.dump –addr=0xB0000000 –verbose –size=0x800000
Waiting for a prompt… Ok.
………………..!…!…………!…. [abbreviated version, you will see many more dots and exclamation marks]
Powercycle the router, enter the "Admin Mode" of the bootloader and dump the firmware again:
[root@localhost]# ./brntool.py –read=ARV752DPW_whole2.dump –addr=0xB0000000 –verbose –size=0x800000
Compare the files. If everything is ok you will end with 2 identical files:
[root@localhost]# ls -l ARV752DPW_whole*.dump
-rw-r–r–. 1 root root 8388608 12. Feb 23:32 ARV752DPW_whole2.dump
-rw-r–r–. 1 root root 8388608 13. Feb 00:58 ARV752DPW_whole.dump
[root@localhost]# diff ARV752DPW_whole.dump ARV752DPW_whole2.dump
[root@localhost]# cmp ARV752DPW_whole.dump ARV752DPW_whole2.dump
[root@localhost]# md5sum ARV752DPW_whole*
As you see, the two files are the same. If you compare your own output with this example you probably note the md5sums differ, thats ok: You have to end with md5sums different like shown here in this example, because my MAC Adress/Serial No./configuration its also saved in this dump.
This information is really old. Can someone please comment on this? Is this still possible to do?
WIP: DO NOT FOLLOW THIS INFORMATIONS AT THE MOMENT: SIGNED FIRMWARE IS NOT WORKING (uboot can't find the ethernet devices, a bugreport is opened, stay tuned, we are working on this issue)
DO NOT POWER OFF THE DEVICE! Drink some coffee, tea… simply do nothing, just wait. The first reboot will take some time, because the device will be flashed with new firmware. AGAIN: DO NOT POWER OFF THE DEVICE! The LED in front of the device will show you the status and success of the process:
Drink more tea now… wait, and do not power off the device. The second reboot will take a bit longer, compared with the first one. The LED in front of the device will show you the current state of the process again:
Power off the device now, its bricked :)
just kidding… powercycle your device now.
Successfully flashed and tested Attitude Adjustment image (bootloader is still missing here!) :
U-Boot snapshots are broken at the moment (August 2013), here is a backup for some working images:
Also, 12.09-rc1 still contains some automatically built images:
The lantiq snapshot repo may contain some useful images:
Alternatively, try this repo to build u-boot yourself:
Python script to transfer over serial:
(original source: https://forum.openwrt.org/viewtopic.php?pid=183315#p183315 )