User Tools

Site Tools


toh:sitecom:wl-351

Sitecom WL-351

Hardware info

Architecture: MIPS32
Target: ramips
Vendor: Sitecom
Bootloader: u-boot
System-On-Chip: RT3052
CPU Speed: ? (256 Bogomips)
Flash chip: MX 29LV320 Macronix MX29LV320ETTI-70G
Flash size: 4MB 4MB
RAM chip: 2 x EtronTech EM639165TSS-60 2 x Zentel A3V28S40FTP-G6
RAM size: 2 x 16MB 2 x 16MB
WAN: 1x RJ45
Ethernet: RTL8366RB
Wireless: RT3052 (RT28xx)
Serial: yes (see picture below)
JTAG: cn102?
Buttons: power switch, WPS button
Power: external 12V 1A external DVE DSA-12G-12 (12V 1A)

Software

Serial port settings:

Speed: 57600 Data Bits: 8 Stop Bits: 1 Parity: None Flow Control: None

Serial port output during the boot:

OEM bootlog

U-boot Ver:1.0.1.157 2010/05/17 Board: Ralink APSoC DRAM: 32 MB 2*16 MB ============================================ ASIC 3052_MP2 (Port5<->GigaSW) Product Name: ESR9850 SDRAM CAS = 3(d1835272) ============================================ Please choose the operation: 1: Load system code to SDRAM via TFTP. LINUX started... init started: BusyBox v1.7.5 (2010-08-03 17:54:38 CST) starting pid 131, tty '/dev/console': '/sbin/config_init' Config Init version: 1.5.0.7 date: 2010/08/03 starting pid 178, tty '/dev/ttyS1': '/sbin/config_term' ************************************************************************ * WL-351 * ************************************************************************ KernelApp/Ramdisk Ver:1.5.0.7 Date:2010/08/03 console> cat: can't open '/apps/lib/modules/2.6.21/modulesApp.dep': No such file or directory ln: /sbin/./apps_init: File exists


Installing OpenWRT

Currently installing OpenWRT requires you to access the bootloader using the serial port (3.3V level converter required). Set up your server to serve the firmware image (openwrt-ramips-rt305x-wl-351-squashfs-sysupgrade.bin) using tftp.

NOTE: Rename it to a shorter name (or use a symlink), the bootloader truncates the filename to 50 characters!

Hit '2' after it shows "Board: Ralink APSoC DRAM: 32 MB 2*16 MB", followed by 'y', IP for the device, IP for the server, tftp filename. The file will be transferred, flashed and booted automatically. Congratulations, you are now running OpenWRT! (Using '4' instead of '2' you can enter the uboot prompt)

2: System Load Linux Kernel then write to Flash via TFTP. Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N) Operation terminated U-boot Ver:1.0.1.157 2010/05/17 Board: Ralink APSoC DRAM: 32 MB 2*16 MB ============================================ ASIC 3052_MP2 (Port5<->GigaSW) Product Name: ESR9850 SDRAM CAS = 3(d1835272) ============================================ Please choose the operation: 1: Load system code to SDRAM via TFTP. UbootDate[2010/05/17]UbootDate UbootVer[1.0.1]UbootVer 2: System Load Linux Kernel then write to Flash via TFTP. Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N) Please Input new ones /or Ctrl-C to discard Input device IP (192.168.0.2) ==: Input server IP (192.168.0.1) ==: Input Linux Kernel filename (sysupgrade.bin) ==: Using Eth0 device TFTP from server 192.168.0.1; our IP address is 192.168.0.2 Filename 'sysupgrade.bin'. Loading: * ArpTimeoutCheck Got ARP REPLY, set server/gtwy eth addr (f0:de:f1:xx:xx:xx) Got it TftpTimeoutCount=0,max_retry:10 T !!!TFTP error: 'File not found' (1) Starting again Got ARP REQUEST, return our IP Using Eth0 device TFTP from server 192.168.0.1; our IP address is 192.168.0.2 Filename 'sysupgrade.bin'. Loading: Got ARP REPLY, set server/gtwy eth addr (f0:de:f1:90:26:6d) Got it TftpTimeoutCount=0,max_retry:10 T # first block received ################################################################ ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################ done Bytes transferred = 3407876 (340004 hex) Erase linux kernel block !! From 0xBF050000 To 0xBF39FFFF erase sector = 5 erase sector = 6 [...] *Erased 53 sectors Copy to Flash... Copy 3407876 byte to Flash... addr = 0xBF0A3458 ,cnt=3066796 addr = 0xBF0F68BE ,cnt=2725702 addr = 0xBF149D1C ,cnt=2384616 addr = 0xBF19D180 ,cnt=2043524 addr = 0xBF1F05E2 ,cnt=1702434 addr = 0xBF243A48 ,cnt=1361340 addr = 0xBF296EC4 ,cnt=1020224 addr = 0xBF2EA328 ,cnt=679132 addr = 0xBF33D78E ,cnt=338038 done [ 0.000000] Linux version 3.18.20 (buildbot@builder1) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r46450) ) #1 Fri Sep 4 19:34:21 CEST 2015


Inside

Notes

The original firmware image WL-351_fw1.5.zip contains two files: WL-351-APPS-V1-5-0-7.dlf
WL-351-KNL-V1-5-0-7.dlf

These are prefixed by 0x60 bytes header and the remainder is xor-obfuscated using the following key:

0x78,0x3c,0x9e,0xcf,0x67,0xb3,0x59,0xac,0x78,0x3c,0x9e,0xcf,0x67,0xb3,0x59,0xac

External sources

Tags

toh/sitecom/wl-351.txt · Last modified: 2016/02/27 04:20 by pkirkovsky