Serial port settings: 57600 8N1

Serial port output during the boot:

U-boot Ver:1.0.1.157 2010/05/17


Board: Ralink APSoC DRAM:  32 MB  2*16 MB
============================================ 
ASIC 3052_MP2 (Port5<->GigaSW)
Product Name: ESR9850
SDRAM CAS = 3(d1835272) 
============================================ 

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 

LINUX started...
init started: BusyBox v1.7.5 (2010-08-03 17:54:38 CST)
starting pid 131, tty '/dev/console': '/sbin/config_init'
Config Init version: 1.5.0.7 date: 2010/08/03
starting pid 178, tty '/dev/ttyS1': '/sbin/config_term'
************************************************************************
*                                   WL-351                             *
************************************************************************

KernelApp/Ramdisk Ver:1.5.0.7                    Date:2010/08/03
console> cat: can't open '/apps/lib/modules/2.6.21/modulesApp.dep': No such file or directory
ln: /sbin/./apps_init: File exists

Currently installing OpenWRT requires you to access the bootloader using the serial port (3.3V level converter required). Set up your server to serve the firmware image (openwrt-ramips-rt305x-wl-351-squashfs-sysupgrade.bin) using tftp.

NOTE: Rename it to a shorter name (or use a symlink), the bootloader truncates the filename to 50 characters!

Hit '2' after it shows "Board: Ralink APSoC DRAM: 32 MB 2*16 MB", followed by 'y', IP for the device, IP for the server, tftp filename. The file will be transferred, flashed and booted automatically. Congratulations, you are now running OpenWRT! (Using '4' instead of '2' you can enter the uboot prompt)

U-boot Ver:1.0.1.157 2010/05/17


Board: Ralink APSoC DRAM:  32 MB  2*16 MB
============================================ 
ASIC 3052_MP2 (Port5<->GigaSW)
Product Name: ESR9850
SDRAM CAS = 3(d1835272) 
============================================ 

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
UbootDate[2010/05/17]UbootDate
UbootVer[1.0.1]UbootVer
   
2: System Load Linux Kernel then write to Flash via TFTP. 
 Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
 Please Input new ones /or Ctrl-C to discard
        Input device IP (192.168.1.1) ==:192.168.42.42

        Input server IP (192.168.1.2) ==:192.168.42.1
        Input Linux Kernel filename (default.bin) ==:openwrt-ramips-rt305x-wl-351-squashfs-sysupgrade.bin
Using Eth0  device
TFTP from server 192.168.42.1; our IP address is 192.168.42.42
Filename 'openwrt-ramips-rt305x-wl-351-squashfs-sysupgrade.b'.
Loading: *
ArpTimeoutCheck 
Got ARP REPLY, set server/gtwy eth addr (00:04:21:33:a0:24)
Got it
TftpTimeoutCount=0,max_retry:10
T #
 first block received~~
################################################################
>------- #################################################################
>------- #################################################################
>------- #################################################################
>------- #################################################################
>------- #################################################################
>------- ##################################################Got ARP REQUEST, return our IP
###############
>------- ################################
done
Bytes transferred = 2490368 (260000 hex)
Erase linux kernel block !!
From 0xBF050000 To 0xBF2AFFFF
[...]
*Erased 38 sectors
Copy to Flash...
 Copy 3276804 byte to Flash...
 addr = 0xBF0A3FD6 ,cnt=2932782
 addr = 0xBF0F7FAC ,cnt=2588760
 addr = 0xBF14BF82 ,cnt=2244738
 addr = 0xBF19FF58 ,cnt=1900716
 addr = 0xBF1F3F2E ,cnt=1556694
 addr = 0xBF247F04 ,cnt=1212672
 addr = 0xBF29BEDA ,cnt=868650
 addr = 0xBF2EFEB0 ,cnt=524628
 addr = 0xBF343E86 ,cnt=180606 done
[    0.000000] Linux version 3.3.8 (ranma@nukunuku) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #4 Fri Aug 3 01:39:11 CEST 2012
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 0001964c (MIPS 24KEc)
[    0.000000] Ralink RT3052 id:1 rev:3 running at 384.00 MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[...]
[    0.680000] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    0.700000] Freeing unused kernel memory: 172k freed
[    2.570000] Button Hotplug driver version 0.4.1
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
[...]

The original firmware image WL-351_fw1.5.zip contains two files: WL-351-APPS-V1-5-0-7.dlf WL-351-KNL-V1-5-0-7.dlf

These are prefixed by 0x60 bytes header and the remainder is xor-obfuscated using the following key:

0x78,0x3c,0x9e,0xcf,0x67,0xb3,0x59,0xac,0x78,0x3c,0x9e,0xcf,0x67,0xb3,0x59,0xac

• http://www.sitecom.com/support-product/productid/756 (firmware updates and GPL source code)
• http://www.sitecom.com/en/do-you-need-help-with-your-sitecom-product-no-problem/97?product=233&t=1&version=V1-001 Support page (above link doesn't appear to work)