This is a stub page. I own a D-Link DAP-2553 and will start testing this. Here is a picture. It looks like it has: AR9132 (Which could be a 400Mhz MIPS CPU, I didn't test the thing yet), an AR9106 wifi chip. Looking from the picture, it has 64MB memory and the flash memory W29GL128CH looks like a 128Mbit = 16Mbyte flash chip. The Ethernet chip is an AR8021.

JP2 is the serial port. -[DIODE]- . . . . 1 2 3 5 1=TX, 2=GND, 3=VCC 3.3V, 5=RX

Baud rate is 115200. You are root, once connected to the serial port.

The machine runs "U-Boot 1.1.4 (May 20 2011 - 16:44:33)", with the following memory layout:

64 MB Top of RAM usable for U-Boot at: 84000000 Reserving 227k for U-Boot at: 83fc4000 Reserving 256k for malloc() at: 83f84000 Reserving 44 Bytes for Board Info at: 83f83fd4 Reserving 36 Bytes for Global Data at: 83f83fb0 Reserving 128k for boot params() at: 83f63fb0 Stack Pointer at: 83f63f98

After booting, (and pressing q) it says: press 'q' to stop autoboot: 0 Emergency web server start… Trying eth0 eth0 link down FAIL Press 'q' to quit

You can now access the "emergency web server" at Uploading the default D-link firmware works. Download and unpack, and send the ".bin" file to your dap-2553 to unbrick it. It tells us:

TCP:Can't alloc pktbuf TCP:Can't alloc pktbuf TCP:Can't alloc pktbuf [… many, many times], then: Control flag in image header: 0x00000001 Control flag in boot config: 0x00000001 Upload file OK! (ENV) begin addr=0xbf0a0000,end=0xbf53ffff Erase Flash from 0xbf0a0000 to 0xbf53ffff in Bank # 1 First 0x5 last 0x29 100% Erased 37 sectors 100% write image into flash…OK,dest addr=0xbf0a0000

Pressing q again will give you a u-boot menu, that has the following functions: autoscr - run script from memory ? - alias for 'help' base - print or set address offset bdinfo - print Board Info structure boot - boot default, i.e., run 'bootcmd' bootd - boot default, i.e., run 'bootcmd' bootelf - Boot from an ELF image in memory bootm - boot application image from memory bootp - boot image via network using BootP/TFTP protocol bootvx - Boot vxWorks from an ELF image cmp - memory compare coninfo - print console devices and information cp - memory copy crc32 - checksum calculation echo - echo args to console erase - erase FLASH memory flinfo - print FLASH memory information go - start application at address 'addr' help - print online help iminfo - print header information for application image imls - list all images found in flash itest - return true/false on integer compare loadb - load binary file over serial line (kermit mode) loads - load S-Record file over serial line loady - load binary file over serial line (ymodem mode) loop - infinite loop on address range md - memory display mii - MII utility commands mm - memory modify (auto-incrementing) mtest - simple RAM test mw - memory write (fill) nfs - boot image via network using NFS protocol nm - memory modify (constant address) ping - send ICMP ECHO_REQUEST to network host printenv- print environment variables protect - enable or disable FLASH write protection rarpboot- boot image via network using RARP/TFTP protocol reset - Perform RESET of the CPU run - run commands in an environment variable saveenv - save environment variables to persistent storage setenv - set environment variables sleep - delay execution for some time tftpboot- boot image via network using TFTP protocol version - print monitor version

Command bdinfo tells: boot_params = 0x83F63FB0 memstart = 0x80000000 memsize = 0x04000000 flashstart = 0xBF000000 flashsize = 0x01000000 flashoffset = 0x000279AC ethaddr = 00:05:0D:06:01:03 ip_addr = baudrate = 115200 bps

More to come.

Back to top

toh/d-link/dap-2553.txt · Last modified: 2014/07/06 16:39 by valentijn