Netgear WNCE4004

This is not a router but an "adapter". Basically, a regular Wifi router that can only operate in client mode.

The device runs a patched version of OpenWRT, based on Kamikaze r18571.

Supported Versions

Version/Model Launch Date S/N OpenWrt Version Supported Model Specific Notes
? 2012-08 - - -

OEM source code available at: http://kb.netgear.com/app/answers/detail/a_id/2649

Hardware Highlights

SoC Ram Flash Network USB Serial JTag
AR7240 32MiB 8MiB 4 x 1 No Yes ?

Opening the case

Note: This will void your warranty!

  • To remove the cover, there are four screw under the rubber pads under the case. Everything just comes out easily once they are unscrewed.

Serial

port.serial general information about the serial port, serial port cable, etc.

There is one populated serial port:

 ___________________________________
|
|___       _________________
    |     |                 |
 ETH|  o VCC (3.3V)      S  |
    |  o Tx              h  |
 ETH|  o Rx              i  |
    |  o GND             e  |
 ETH|     |              l  |
    |     |              d  |
  . |     |                 |
  . |     |_________________|
  . |

power
on/off switch

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

The device has no obvious JTAG pad, but it might be under one of the large shields or tape.

Bootlogs

OEM bootlog

U-Boot 1.1.4-gd050e40d-dirty (Jul 27 2012 - 11:30:11) AP99 (ar7241 - Virian) U-boot DRAM: sri ar7240_ddr_initial_config(133): virian ddr1 init #### TAP VALUE 1 = 0x2, 2 = 0x2 [0xc5365fe3: 0x3bbfa9dc] 32 MB Top of RAM usable for U-Boot at: 82000000 Reserving 247k for U-Boot at: 81fc0000 Reserving 192k for malloc() at: 81f90000 Reserving 44 Bytes for Board Info at: 81f8ffd4 Reserving 36 Bytes for Global Data at: 81f8ffb0 Reserving 128k for boot params() at: 81f6ffb0 Stack Pointer at: 81f6ff98 Now running in RAM - U-Boot at: 81fc0000 id read 0x100000ff sector count = 128 Flash: 8 MB BOARD IS NOT CALIBRATED!!! In: serial Out: serial Err: serial Net: ag7240_enet_initialize... No valid address in Flash. Using fixed address Fetching MAC Address from 0x81fea8e8 Virian MDC CFG Value ==> 4 : cfg1 0xf cfg2 0x7114 eth0: 00:03:7f:09:0b:ad eth0 up Virian MDC CFG Value ==> 4 : cfg1 0xf cfg2 0x7214 eth1: 20:e5:2a:68:87:42 athrs26_reg_init_lan ATHRS26: resetting s26 ATHRS26: s26 reset done eth1 up eth0, eth1 eth0 link down FAIL eth1 link down FAIL Client starts...[Listening] for ADVERTISE...TTTTTT Retry count exceeded; boot the image as usual nmrp server is stopped or failed ! Hit any key to stop autoboot: 0 ## Booting image at 9f050000 ... Image Name: MIPS OpenWrt Linux-2.6.31 Created: 2013-07-16 15:12:42 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 826941 Bytes = 807.6 kB Load Address: 80002000 Entry Point: 801cbfb0 Verifying Checksum at 0x9f050040 ...OK Verifying rootfs Checksum at 0x9f130000 ...OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 801cbfb0) ... ## Giving linux memsize in bytes, 33554432 Starting kernel ... Booting AR7240(Python)... Linux version 2.6.31 (root@dni-l-sw02) (gcc version 4.1.2) #1 Tue Jul 16 11:12:34 EDT 2013 flash_size passed from bootloader = 8 CPU revision is: 00019374 (MIPS 24Kc) Determined physical RAM map: memory: 04000000 @ 00000000 (usable) User-defined physical RAM map: memory: 02000000 @ 00000000 (usable) Zone PFN ranges: Normal 0x00000000 -> 0x00002000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00002000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 Kernel command line: console=ttyS0,115200 root=31:03 rootfstype=squashfs mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),896k(uImage),5760k(rootfs),64k(POT),64k(NVRAM),1024k(Language_Table),64k(ART) mem=32M PID hash table entries: 128 (order: 7, 512 bytes) Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes Writing ErrCtl register=00000000 Readback ErrCtl register=00000000 Memory: 29956k/32768k available (1861k kernel code, 2812k reserved, 452k data, 116k init, 0k highmem) NR_IRQS:128 plat_time_init: plat time init done Calibrating delay loop... 266.24 BogoMIPS (lpj=532480) Mount-cache hash table entries: 512 NET: Registered protocol family 16 ===== ar7240_platform_init: 0 PCI init:ar7240_pcibios_init ar7240_pcibios_init(305): PCI CMD write: 0x356 registering PCI controller with io_map_base unset bio: create slab at 0 pci 0000:00:00.0: PME# supported from D0 D1 D3hot pci 0000:00:00.0: PME# disabled Returning IRQ 48 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered NET: Registered protocol family 1 AR7240 GPIOC major 0 squashfs: version 4.0 (2009/01/31) Phillip Lougher msgmni has been set to 58 io scheduler noop registered io scheduler deadline registered (default) Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A console [ttyS0] enabled 8 cmdlinepart partitions found on MTD device ar7240-nor0 Creating 8 MTD partitions on "ar7240-nor0": 0x000000000000-0x000000040000 : "u-boot" 0x000000040000-0x000000050000 : "u-boot-env" 0x000000050000-0x000000130000 : "uImage" 0x000000130000-0x0000006d0000 : "rootfs" mtd: partition "rootfs" set to be root filesystem mtd: partition "rootfs_data" created automatically, ofs=410000, len=2C0000 0x000000410000-0x0000006d0000 : "rootfs_data" 0x0000006d0000-0x0000006e0000 : "POT" 0x0000006e0000-0x0000006f0000 : "NVRAM" 0x0000006f0000-0x0000007f0000 : "Language_Table" 0x0000007f0000-0x000000800000 : "ART" u32 classifier Performance counters on TCP cubic registered NET: Registered protocol family 10 IPv6 over IPv4 tunneling driver NET: Registered protocol family 17 Ebtables v2.0 registered 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller arch/mips/ar7240/gpio.c (ar7240_simple_config_init) JUMPSTART_GPIO: 12 ar7240wdt_init: Registering WDT success VFS: Mounted root (squashfs filesystem) readonly on device 31:3. Freeing unused kernel memory: 116k freed Please be patient, while OpenWrt loads ... - preinit - Press CTRL-C for failsafe Can't lock /tmp/.failsafe switching to jffs2 mount: mounting /dev/mtdblock4 on /jffs failed: No such device jffs2 not ready yet; using ramdisk mount: mounting /proc on /mnt/proc failed: No such file or directory Unlocking rootfs ... - init - init started: BusyBox v1.14.4 (2013-07-16 11:03:53 EDT) data 2:6 real_sum :4ca2 already back before! Loading data from /dev/mtd6 ... The data configuration is Valid The data center is Running ... ATHR_GMAC: Length per segment 1536 ATHR_GMAC: fifo cfg 3 01f00140 ATHR_GMAC: Mac address for unit 1:bfff0006 ATHR_GMAC: 20:e5:2a:68:87:42 ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 252 ATHR_GMAC: Mac capability flags : 24D91 SN: 37612A5J0090D WAN MAC: FF:FF:FF:FF:FF:FF clbr: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint client bridge loaded cp: cannot stat '/etc/wpa2.orig/*': No such file or directory device eth0 entered promiscuous mode athr_gmac_ring_alloc Allocated 640 at 0x81d69000 athr_gmac_ring_alloc Allocated 4032 at 0x81dbd000 Virian MDC CFG Value ==> 4 Setting Drop CRC Errors, Pause Frames and Length Error frames ATHRS26: resetting s26 ATHRS26: s26 reset done Setting PHY... ADDRCONF(NETDEV_UP): eth0: link is not ready udhcp client (v0.9.8) started Sending discover... Sending discover... Sending discover... ###### udhcpc leasefail udhcp server (v0.9.8) started No lease, forking to background. The attached devices demo is Running ... mkdir: cannot create directory '/dev/pts': File exists mknod: /dev/ptmx: File exists mknod: /dev/pts/0: Operation not permitted mknod: /dev/pts/1: Operation not permitted killall: utelnetd: no process killed killall: telnetenable: no process killed The telnetenable is running ... /sbin/uci: I/O error /sbin/uci: Entry not found The abbreviation of English is Eng! Passed the checksum verification! tar: short read gui_region = English region = English, download_region = English current version: 1000000022, new version: 1000000017 Update string table successfully, memory usage: 192KB. The httpd server is running ... telnetd: starting port: 23; interface: any; login program: /bin/login bind: Address already in use POT is Running... POT is Finished!!! The POT-(Get/Set) Demo is Running ... Modules already unloaded Args: 1 Args: 1 ath_hal: 0.9.17.1 (AR5416, AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D) ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved ath_dfs: Version 2.0.0 Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved ath_pci: 9.2.0_U10.1020 (Atheros/multi-bss) __ath_attach: Set global_scn[0] ACBKMinfree = 48 ACBEMinfree = 32 ACVIMinfree = 16 ACVOMinfree = 0 CABMinfree = 48 UAPSDMinfree = 0 ar9300RadioAttach: Need analog access recipe!! Restoring Cal data from Flash dfs_attach: use DFS enhancements DFS min filter rssiThresh = 18 DFS max pulse dur = 151 ticks ath_get_caps[5128] rx chainmask mismatch actual 7 sc_chainmak 0 ath_get_caps[5103] tx chainmask mismatch actual 3 sc_chainmak 0 SC Callback Registration for wifi0 wifi0: Atheros 9580: mem=0x10000000, irq=48 hw_base=0xb0000000 DFS min filter rssiThresh = 15 DFS max pulse dur = 151 ticks wifi1 no private ioctls. Creating sta for Arctica on wlan_vap_create : enter. devhandle=0x80cbc2c0, opmode=IEEE80211_M_STA, flags=0x3 wlan_vap_create : exit. devhandle=0x80cbc2c0, opmode=IEEE80211_M_STA, flags=0x3. VAP device ath0 created Added ath0 mode managed Invalid command : bgscan DES SSID SET=Arctica ieee80211_ioctl_siwmode: imr.ifm_active=131200, new mode=2, valid=1 /etc/ath/makeVAP: line 443: can't create /proc/sys/dev/ath/htdupieenable: nonexistent directory Invalid command : setVowExt Invalid command : setKeySrchAlways Invalid command : set_vsp_enable Interface doesn't accept private ioctl... setPhyRestartWar (8BE0): Operation not permitted Invalid command : setVowExtStats Created ath0 mode sta for Arctica *** WARNING: AP_SSID - WPS is enabled in TKIP only mode!! *** *** WARNING: WPS has been disabled *** lo no wireless extensions. sit0 no wireless extensions. Warning: Driver for device eth0 has been compiled with an ancient version of Wireless Extension, while this program support version 11 and later. Some things may be broken... br0 no wireless extensions. wifi0 no wireless extensions. device ath0 entered promiscuous mode br0: port 2(ath0) entering forwarding state arping: bind: Cannot assign requested address >>>>> WPS MODE, 0 CHH: System Configuration AP_IPADDR:=192.168.1.2 AP_NETMASK:=255.255.255.0 WAN_MODE:=bridged WAN_IPADDR:=192.168.2.1 WAN_NETMASK:=255.255.255.0 WAN_IF:=eth1 LAN_IF:=eth0 WLAN_ON_BOOT:=n AP_STARTMODE:=cb AP_RADIO_ID:=0 AP_RADIO_ID_2:=1 AP_PRIMARY_CH:=0 AP_CHMODE:=11A AP_PRIMARY_CH_2:=40 AP_CHMODE_2:=11NAHT40MINUS PUREG:=0 PUREN:=0 TXQUEUELEN:=1000 SHORTGI:=1 SHORTGI_2:=1 AMPDUENABLE:=1 AMPDUENABLE_2:=1 AMPDUFRAMES:=32 AMPDUFRAMES_2:=32 AMPDULIMIT:=50000 AMPDULIMIT_2:=50000 AMPDUMIN:=32768 AMPDUMIN_2:=32768 CWMMODE:=1 CWMMODE_2:=1 RATECTL:=auto MANRATE:=0x8c8c8c8c MANRETRIES:=0x04040404 RX_CHAINMASK:=0 RX_CHAINMASK_2:=3 TX_CHAINMASK:=0 TX_CHAINMASK_2:=3 AP_SSID:=Arctica AP_SSID_2:=Atheros_XSpan_5G AP_PRIMARY_KEY_0:=1 AP_PRIMARY_KEY_1:=1 AP_WEP_MODE_0:=1 AP_WEP_MODE_1:=1 AP_MODE:=ap AP_SECMODE:=WPA AP_SECFILE:=PSK WPS_ENABLE:=1 AP_MODE_2:=ap AP_SECMODE_2:=None AP_SECFILE_2:=PSK WPS_ENABLE_2:=0 AP_MODE_3:=ap AP_SECMODE_3:=None AP_SECFILE_3:=PSK WPS_ENABLE_3:=0 AP_MODE_4:=ap AP_SECMODE_4:=None AP_SECFILE_4:=PSK WPS_ENABLE_4:=0 AP_MODE_5:=ap AP_SECMODE_5:=None AP_SECFILE_5:=PSK WPS_ENABLE_5:=0 AP_MODE_6:=ap AP_SECMODE_6:=None AP_SECFILE_6:=PSK WPS_ENABLE_6:=0 AP_MODE_7:=ap AP_SECMODE_7:=None AP_SECFILE_7:=PSK WPS_ENABLE_7:=0 AP_MODE_8:=ap AP_SECMODE_8:=None AP_SECFILE_8:=PSK WPS_ENABLE_8:=0 AP_MODE_9:=ap AP_SECMODE_9:=None AP_SECFILE_9:=PSK WPS_ENABLE_9:=0 AP_MODE_10:=ap AP_SECMODE_10:=None AP_SECFILE_10:=PSK WPS_ENABLE_10:=0 AP_MODE_11:=ap AP_SECMODE_11:=None AP_SECFILE_11:=PSK WPS_ENABLE_11:=0 AP_MODE_12:=ap AP_SECMODE_12:=None AP_SECFILE_12:=PSK WPS_ENABLE_12:=0 AP_MODE_13:=ap AP_SECMODE_13:=None AP_SECFILE_13:=PSK WPS_ENABLE_13:=0 AP_MODE_14:=ap AP_SECMODE_14:=None AP_SECFILE_14:=PSK WPS_ENABLE_14:=0 AP_MODE_15:=ap AP_SECMODE_15:=None AP_SECFILE_15:=PSK WPS_ENABLE_15:=0 AP_MODE_16:=ap AP_SECMODE_16:=None AP_SECFILE_16:=PSK WPS_ENABLE_16:=0 AP_RFPARAM_HACK:=1 ATH_countrycode:=276 WSC_MANUFACTURER:=NTGR WSC_MODEL_NAME:=WNCE4004 WSC_MODEL_NUMBER:=n WSC_SERIAL_NUMBER:=none WSC_UPNP_AD_PERIOD:=1800 WSC_UPNP_AD_TTL:=4 WSC_CONF_RELOAD_TIME:=3 WSC_AP_PIN_ATTACK_CHECK:=1 WSC_AP_PIN_ATTACK_NUM:=3 WSC_AP_PIN_HISTORY_FAILURES:=0 WSC_CONFIGURED:=1 WSC_AP_SETUP_LOCKED:=0 WSC_AP_AUTO_LOCKED:=0 WSC_NAME:=WNCE4004(Wireless AP) AP_ANYSSID_HACK:=1 AP_WPA:=1 AP_CYPHER:=TKIP PSK_KEY:=*************** WPA_IS_HEX:=0 AP_WPA_GROUP_REKEY:=86400 AP_HIDE_SSID:=0 AP_RTS:=2347 AP_FRAG:=2346 AP_WMM:=1 AP_SHPREAMBLE:=1 AP_COUNTRY_IE:=0 BINTVAL:=100 DTIM:=2 WSC_PIN:=20075460 AP_DOTH:=0 AP_DISABLECOEXT:=0 WPS_LED_BEHAVIOR:=2 WIRED_STRING_HACK:=1 LED_CUSTOM:=8 CUR_APNAME:=ath0 br0: port 2(ath0) entering disabled state Can't lock /tmp/.switch2jffs MTD partition not found. WDT : enabling watchdog timer watchdog: WDIOC_SETTIMEOUT: Invalid argument Please press Enter to activate this console. ieee80211_ioctl_getparam : parameter 0x284 not supported kill led-extender... killall: led-extender: no process killed driver_atheros_event_wireless: scan result event DES SSID SET=Arctica - SIOCGIWSCAN DES SSID SET=Arctica ath0: Trying to ieee80211_ioctl_setmlme: os_opmode=1 associate with 1[ieee80211_ioctl_setmlme] set desired bssid 14:0c:76:78:86:ce 4:0c:76:78:86:ce (SSID='Arctica' freq=2462 MHz) ath0: Associatedbr0: port 2(ath0) entering forwarding state with 14:0c:76:78:86:ce WPA: EAPOL-Key (1/4) Received in GOOD state current state 7 expected state is 7WPA: EAPOL-Key (3/4) Received in GOOD state current state 8 expected state is 7ath0: WPA: Key negotiation completed with 14:0c:76:78:86:ce [PTK=TKIP GTK=TKIP] ath0: CTRL-EVENT-CONNECTED - Connection to 14:0c:76:78:86:ce completed (auth) [id=0 id_str=] run led-extender... The extender led demo is Running ... Performing a DHCP renew Sending discover... Sending select for 192.168.1.240... Sending select for 192.168.1.240... Lease of 192.168.1.240 obtained, lease time 43200 deleting routers adding router 192.168.1.254 adding dns 192.168.1.254 BusyBox v1.14.4 (2013-07-16 11:03:53 EDT) built-in shell (ash) Enter 'help' for a list of built-in commands. _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M KAMIKAZE (bleeding edge, r18571) ------------------ * 10 oz Vodka Shake well with ice and strain * 10 oz Triple sec mixture into 10 shot glasses. * 10 oz lime juice Salute! --------------------------------------------------- root@WNCE4004:/#

Tags

Back to top

toh/netgear/wnce4004.txt · Last modified: 2014/01/27 13:50 by m3m3nt0