Hame MPR-A1

Small device with a 1800mAh Li-polymer rechargeable_battery. Product page: http://www.hametech.com/html/product/view1-31-45.html Size: 95 x 35 x 15 mm, Net Weight: 57g The device is marketed to have these functions:

  • RJ45 Port: 1 WAN (Support DHCP, ADSL, Static IP) or LAN

There are many clones of this device in similar package, but not marked as HAME and likely produced by other vendors.

Installation

Hardware

Info

  • SoC: RA-5350f (360MHz)
  • Flash: 4MB (some clones may have more)
  • RAM: 16MB (some clones may have more)
  • Wifi: Integrated 1T1R 802.11b/g/n
  • USB: Integrated USB 2.0 Host
  • USB: MicroUSB for powering/charging MPR-A1
  • 4 LED indicator + button: show the current power
  • 2 LED Red:System status Blue:Wifi Activity (with Openwrt)

Photos

Hame MPR-A1 Hame MPR-A1 Hame MPR-A1

Serial port

The serial port pads are located under the internal battery and are clearly labeled.

Teardown

To open the case, use a guitar pic, finger nail or similar device and snap open carefully the underside. You can then lift up the battery and (possibly after scratching off the coating on the pads) solder on the serial port. Serial port settings are: 57600n8

Detailed information can be found here from Stian Eikeland

Original firmware

  • Boot loader: Ralink UBoot Version: 3.6.0.0
  • Kernel: 2.6.21
  • BusyBox v1.12.1

Boot log

U-Boot 1.1.7 (Dec 13 2011 - 13:49:42) Board: Ralink APSoC DRAM: 16 MB relocate_code Pointer at: 80fb4000 spi_wait_nsec: 42 spi device id: 7f 9d 46 7f 9d (9d467f9d) Warning: un-recognized chip ID, please update bootloader! raspi_read: from:30000 len:1000 .*** Warning - bad CRC, using default environment ============================================ Ralink UBoot Version: 3.6.0.0 -------------------------------------------- ASIC 5350_MP (Port5<->None) DRAM_CONF_FROM: Boot-Strapping DRAM_TYPE: SDRAM DRAM_SIZE: 128 Mbits DRAM_WIDTH: 16 bits DRAM_TOTAL_WIDTH: 16 bits TOTAL_MEMORY_SIZE: 16 MBytes Flash component: SPI Flash Date:Dec 13 2011 Time:13:49:42 ============================================ icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:128, ways:4, linesz:32 ,total:16384 ##### The CPU freq = 360 MHZ #### estimate memory size =16 Mbytes raspi_read: from:40028 len:6 . raspi_read: from:0 len:30004 ....*************Is_update = 0 plat = 1************** Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 7: Load Boot Loader code then write to Flash via Serial. 9: Load Boot Loader code then write to Flash via TFTP. 0 3: System Boot system code via Flash. ## Booting image at bc050000 ... raspi_read: from:50000 len:40 . Image Name: Linux Kernel Image Created: 2012-09-07 2:27:34 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 3770346 Bytes = 3.6 MB Load Address: 80000000 Entry Point: 80244000 raspi_read: from:50040 len:3987ea .......................................................... Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 80244000) ... ## Giving linux memsize in MB, 16 Starting kernel ... LINUX started... THIS IS ASIC Linux version 2.6.21 (root@localhost.localdomain) (gcc version 3.4.2) #128 Thu Aug 2 10:37:55 CST 2012 The CPU frequency set to 360 MHz CPU revision is: 0001964c Determined physical RAM map: memory: 01000000 @ 00000000 (usable) Built 1 zonelists. Total pages: 4064 Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock5 Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes. Primary data cache 16kB, 4-way, linesize 32 bytes. Synthesized TLB refill handler (20 instructions). Synthesized TLB load handler fastpath (32 instructions). Synthesized TLB store handler fastpath (32 instructions). Synthesized TLB modify handler fastpath (31 instructions). Cache parity protection disabled cause = f0808030, status = 11000000 PID hash table entries: 64 (order: 6, 256 bytes) calculating r4koff... 0015f900(1440000) CPU frequency 360.00 MHz Using 180.000 MHz high precision timer. Dentry cache hash table entries: 2048 (order: 1, 8192 bytes) Inode-cache hash table entries: 1024 (order: 0, 4096 bytes) Memory: 13720k/16384k available (2021k kernel code, 2664k reserved, 295k data, 112k init, 0k highmem) Mount-cache hash table entries: 512 NET: Registered protocol family 16 usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb Time: MIPS clocksource has been installed. NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 512 (order: 0, 4096 bytes) TCP bind hash table entries: 512 (order: -1, 2048 bytes) TCP: Hash tables configured (established 512 bind 512) TCP reno registered deice id : 7f 9d 46 7f 9d (9d467f9d) Warning: un-recognized chip ID, please update SPI driver! AT25DF321(1f 47000000) (4096 Kbytes) mtd .name = raspi, .size = 0x00400000 (4M) .erasesize = 0x00010000 (64K) .numeraseregions = 0 Creating 7 MTD partitions on "raspi": 0x00000000-0x00400000 : "ALL" 0x00000000-0x00030000 : "Bootloader" 0x00030000-0x00040000 : "Config" 0x00040000-0x00050000 : "Factory" 0x00050000-0x0011282a : "Kernel" mtd: partition "Kernel" doesn't end on an erase block -- force read-only 0x0011282a-0x01000000 : "RootFS" mtd: partition "RootFS" extends beyond the end of device "raspi" -- size truncated to 0x2ed7d6 mtd: partition "RootFS" doesn't start on an erase block boundary -- force read-only 0x00050000-0x01000000 : "Kernel_RootFS" mtd: partition "Kernel_RootFS" extends beyond the end of device "raspi" -- size truncated to 0x3b0000 RT3xxx EHCI/OHCI init. squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher squashfs: LZMA suppport for slax.org by jro fuse init (API version 7.8) io scheduler noop registered (default) Hame plat 1 Ralink gpio driver initialized [003c4001] HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096 N_HDLC line discipline registered. Serial: 8250/16550 driver $Revision: 1.8 $ 2 ports, IRQ sharing disabled serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A loop: loaded (max 8 devices) rdm_major = 253 Ralink APSoC Ethernet Driver Initilization. v2.1 256 rx/tx descriptors allocated, mtu = 1500! MAC_ADRH -- : 0x00009c41 MAC_ADRL -- : 0x7ca6aac0 PROC INIT OK! IMQ starting with 2 devices... IMQ driver loaded successfully. PPP generic driver version 2.4.2 PPP BSD Compression module registered NET: Registered protocol family 24 PPPoL2TP kernel driver, V0.17 PPTP driver version 0.8.1 tun: Universal TUN/TAP device driver, 1.6 tun: (C) 1999-2004 Max Krasnyansky block2mtd: version $Revision: 1.1.1.1 $ usbcore: registered new interface driver cdc_acm drivers/usb/class/cdc-acm.c: v0.25:USB Abstract Control Model driver for USB modems and ISDN adapters usbcore: registered new interface driver usbhid drivers/usb/input/hid-core.c: v2.6:USB HID core driver nf_conntrack version 0.5.0 (128 buckets, 1024 max) ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone TCP cubic registered NET: Registered protocol family 1 NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 112k freed init started: BusyBox v1.12.1 (2011-10-22 23:04:50 CST) starting pid 14, tty '': '/etc_ro/rcS' Algorithmics/MIPS FPU Emulator v1.5 devpts: called with bogus options ------------------------------------------- Welcome to | | | | | | | | | | | | | |___ |_| |_| |_| |_| |_| |_| |_____| ------------------------------------------- killall: goahead: no process killed usbcore: registered new interface driver ipheth Start gpio 0 monitor g_iplat = 1 starting pid 46, tty '/dev/ttyS1': '/bin/sh' BusyBox v1.12.1 (2011-10-22 23:04:50 CST) built-in shell (ash) Enter 'help' for a list of built-in commands. # killall: udhcpc: no process killed killall: udhcpc: no process killed apcli0 no private ioctls. ifconfig: ioctl 0x8913 failed: No such device internet.sh Password for 'hame' changed /sbin/internet.sh: line 278: can't create /proc/sys/kernel/hotplug: nonexistent directory /sbin/internet.sh: line 289: can't create /proc/sys/net/ipv6/conf/default/accept_dad: nonexistent directory rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1 rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000 rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004 choose_configuration 0000 0000 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2 rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000 choose_configuration 0000 0000 usb usb2: configuration #1 chosen from 1 choice hub 2-0:1.0: USB hub found hub 2-0:1.0: 1 port detected rmmod: ralink_wdt: No such file or directory rmmod: cls: No such file or directory rmmod: hw_nat: No such file or directory rmmod: raeth: No such file or directory insmod: bridge.ko: module not found insmod: mii.ko: module not found insmod: raeth.ko: module not found /sbin/internet.sh: line 325: can't create /proc/ phy_tx_ring = 0x00951000, tx_ring = 0xa0951000 phy_rx_ring0 = 0x00952000, rx_ring0 = 0xa0952000 MAC_ADRH -- : 0x00009c41 MAC_ADRL -- : 0x7ca6aac0 sys/net/ipv6/conRT305x_ESW: Link Status Changed f/eth2/accept_dad: nonexistent directory ##### disable 1st wireless interface ##### rmmod: rt2860v2_ap_net: No such file or directory rmmod: rt2860v2_ap: No such file or directory rmmod: rt2860v2_ap_util: No such file or directory rmmod: rt2860v2_sta_net: No such file or directory rmmod: rt2860v2_sta: No such file or directory rmmod: rt2860v2_sta_util: No such file or directory insmod: rt2860v2_ap_util.ko: module not found rt2860v2_ap: module license 'unspecified' taints kernel. === pAd = c0069000, size = 629120 === <-- RTMPAllocAdapterBlock, Status=0 insmod: rt2860v2_ap_net.ko: module not found rmmod: nf_nat_pptp: No such file or directory rmmod: nf_conntrack_pptp: No such file or directory rmmod: nf_nat_proto_gre: No such file or directory rmmod: nf_conntrack_proto_gre: No such file or directory RX DESC a0437000 size = 2048 <-- RTMPAllocTxRxRingMemory, Status=0 RTMP_TimerListAdd: add timer obj c00d3b88! RTMP_TimerListAdd: add timer obj c007101c! RTMP_TimerListAdd: add timer obj c0070bec! RTMP_TimerListAdd: add timer obj c0070fc8! RTMP_TimerListAdd: add timer obj c0070ff0! RTMP_TimerListAdd: add timer obj c00710d4! RTMP_TimerListAdd: add timer obj c0071100! RTMP_TimerListAdd: add timer obj c00712ac! RTMP_TimerListAdd: add timer obj c00a19c4! RTMP_TimerListAdd: add timer obj c00a1594! RTMP_TimerListAdd: add timer obj c00a1970! RTMP_TimerListAdd: add timer obj c00a1998! RTMP_TimerListAdd: add timer obj c00a1a7c! RTMP_TimerListAdd: add timer obj c00a1aa8! RTMP_TimerListAdd: add timer obj c00a19f0! RTMP_TimerListAdd: add timer obj c00a1a1c! RTMP_TimerListAdd: add timer obj c00a1a48! RTMP_TimerListAdd: add timer obj c00d40a8! RTMP_TimerListAdd: add timer obj c00d4080! RTMP_TimerListAdd: add timer obj c00d4058! RTMP_TimerListAdd: add timer obj c00aa944! RTMP_TimerListAdd: add timer obj c00aaa48! RTMP_TimerListAdd: add timer obj c00aa96c! RTMP_TimerListAdd: add timer obj c00a1f8c! RTMP_TimerListAdd: add timer obj c006e4e0! RTMP_TimerListAdd: add timer obj c00a1cac! Key1Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) 1. Phy Mode = 9 2. Phy Mode = 9 TXALC> bInternalTxALC = 0 3. Phy Mode = 9 RTMP_TimerListAdd: add timer obj c006e0e4! NICInitAsicFromEEPROM: pAd->TxPowerCtrl.bInternalTxALC = 0 RTMPSetPhyMode: channel is out of range, use first channel=0 MCS Set = ff 00 00 00 01 SYNC - BBP R4 to 20MHz.l RTMP_TimerListAdd: add timer obj c00a228c! Main bssid = 9c:41:7c:a6:aa:c8 <==== rt28xx_init, Status=0 0x1300 = 00064380 vconfig: ioctl error for rem: Invalid argument vconfig: ioctl error for rem: Invalid argument rmmod: 8021q: No such file or directory insmod: 8021q.ko: module not found eth2.2: Setting MAC address to 9c 41 7c a6 aa c7. device eth2 entered promiscuous mode VLAN (eth2.2): Setting underlying device (eth2) to promiscious mode. /sbin/internet.sh: line 476: can't create /proc/sys/net/ipv6/conf/eth2.2/accept_dad: nonexistent directory /sbin/internet.sh: line 476: can't create /proc/sys/net/ipv6/conf/eth2.2/dad_transmits: nonexistent directory ifconfig: ioctl 0x8913 failed: No such device brctl: bridge br0: No such device or address ##### config Ralink ESW vlan partition (WLLLL) ##### switch reg write offset=14, value=405555 switch reg write offset=50, value=2001 switch reg write offset=98, value=7f3f switch reg write offset=e4, value=3f switch reg write offset=40, value=1002 switch reg write offset=44, value=1001 switch reg write offset=48, value=1001 switch reg write offset=70, value=ffff417e done. device ra0 entered promiscuous mode /sbin/internet.sh: line 763: can't create /proc/sys/net/ipv6/conf/br0/accept_dad: nonexistent dieth2.1: dev_set_promiscuity(master, 1) rectory /sbin/idevice eth2.1 entered promiscuous mode nternet.sh: line 763: can't create /proc/sys/net/ipv6/conf/br0/dad_transmits: nonexistent directory ##### start wan ##### wan.sh: unknown wan connection type: SMART ##### start lan ##### br0: port 2(eth2.1) entering learning state br0: port 1(ra0) entering learning state ifconfig: ioctl 0x8914 failed: Cannot assign requested address ifconfig: ioctl 0x8914 failed: Cannot assign requested address br0: topology change detected, propagating br0: port 2(eth2.1) entering forwarding state br0: topology change detected, propagating br0: port 1(ra0) entering forwarding state killall: udhcpd: no process killed Set: phy[0].reg[0] = 3900 Set: phy[1].reg[0] = 3900 Set: phy[2].reg[0] = 3900 Set: phy[3].reg[0] = 3900 Set: phy[4].reg[0] = 3900 Set: phy[0].reg[0] = 3100 ifconfig: ioctl 0x8913 failed: No such device /sbin/lan.sh: line 154: can't create /proc/sys/net/ipv6/conf/all/forwarding: nonexistent directory ##### start nat ##### ##### finish nat ##### killall rt2860apd 1>/dev/null 2>&1 iptables -F -t filter 1>/dev/null 2>&1 iptables -D FORWARD -j macipport_filter 1>/dev/null 2>&1 iptables -F macipport_filter 1>/dev/null 2>&1 iptables -D FORWARD -j web_filter 1>/dev/null 2>&1 iptables -F web_filter 1>/dev/null 2>&1 iptables -D FORWARD -j malicious_filter 1>/dev/null 2>&1 iptables -F malicious_filter 1>/dev/null 2>&1 iptables -D INPUT -j malicious_input_filter 1>/dev/null 2>&1 iptables -F malicious_input_filter 1>/dev/null 2>&1 iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT iptables -t filter -N web_filter 1>/dev/null 2>&1 iptables -t filter -N macipport_filter 1>/dev/null 2>&1 iptables -t filter -N malicious_filter 1>/dev/null 2>&1 iptables -t filter -N synflood_filter 1>/dev/null 2>&1 iptables -t filter -N malicious_input_filter 1>/dev/null 2>&1 iptables -t filter -N synflood_input_filter 1>/dev/null 2>&1 iptables -t filter -A FORWARD -j web_filter 1>/dev/null 2>&1 iptables -t filter -A FORWARD -j macipport_filter 1>/dev/null 2>&1 iptables -t filter -A FORWARD -j malicious_filter 1>/dev/null 2>&1 iptables -t filter -A malicious_filter -p tcp --syn -j synflood_filter 1>/dev/null 2>&1 iptables -t filter -A INPUT -j malicious_input_filter 1>/dev/null 2>&1 iptables -t filter -A malicious_input_filter -p tcp --syn -j synflood_input_filter 1>/dev/null 2>&1 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 1>/dev/null 2>&1 iptables -A malicious_input_filter -i -m state --state RELATED,ESTABLISHED -j ACCEPT Bad argument `state' Try `iptables -h' or 'iptables --help' for more information. iptables -A malicious_input_filter -i -m state -p tcp --dport 80 --state NEW,INVALID -j DROP Bad argument `state' Try `iptables -h' or 'iptables --help' for more information. /bin/super_dmz -f sh: /bin/super_dmz: not found iptables -t nat -D PREROUTING -j port_forward 1>/dev/null 2>&1 iptables -t nat -F port_forward 1>/dev/null 2>&1; iptables -t nat -X port_forward 1>/dev/null 2>&1 iptables -t nat -D PREROUTING -j DMZ 1>/dev/null 2>&1 iptables -t nat -F DMZ 1>/dev/null 2>&1; iptables -t nat -X DMZ 1>/dev/null 2>&1 iptables -t nat -F POSTROUTING 1>/dev/null 2>&1 iptables -t nat -N port_forward 1>/dev/null 2>&1; iptables -t nat -I PREROUTING 1 -j port_forward 1>/dev/null 2>&1 iptables -t nat -N DMZ 1>/dev/null 2>&1; iptables -t nat -I PREROUTING 2 -j DMZ 1>/dev/null 2>&1 iptables -t nat -A POSTROUTING -o -s 192.168.169.1/255.255.255.0 -j MASQUERADE 1>/dev/null 2>&1 ntp.sh ddns.sh kill -9 `cat /var/run/wscd.pid.ra0` pool.ntp.org: Unknown host cat: can't open '/var/run/wscd.pid.ra0': No such file or directory kill: you need to specify whom to kill iwpriv ra0 set WscConfMode=0 1>/dev/null 2>&1 route delete 239.255.255.250 1>/dev/null 2>&1 killall -q klogd killall -q syslogd syslogd -C8 1>/dev/null 2>&1 klogd 1>/dev/null 2>&1 killall -q zebra killall -q ripd webs: Listening for HTTP requests at address 192.168.169.1 tmk 7 set askdial=1 # RTMP_TimerListAdd: add timer obj c00e96f0! RTMP_TimerListAdd: add timer obj c00e98a4! AP SETKEYS DONE - WPA2, AuthMode(7)=WPA2PSK, WepStatus(4)=TKIP, GroupWepStatus(4)=TKIP

Services

  • Telnet (username: hame password: hame, on some clones: admin/admin, user changeable)
  • dnsmasq
  • goahead
  • lighttpd (on some clones)
  • proftpd (on some clones)

Links

Tags

Back to top

toh/hame/mpr-a1.txt · Last modified: 2014/03/19 00:45 (external edit)