2

This is a very obscure Chinese router from a brand called Wavlink. It's the Model: WN529R2/WN529R2P. It's web interface was pretty limited and wouldn't allow firmware modifications.

I found GND/Tx/Rx/Vcc pins, so I soldered to them, and got a serial console (without any password at all). I have root access and it runs OpenWrt 14.07 BARRIER BREAKER, but it is incredibly trimmed and limited. To name something, it doesn't even have opkg available, so I can't install any kind of package, being unable to customize my router.

enter image description here

I decided to go and flash a clean OpenWrt binary. I found it used a Mediatek MT7628NN processor. Using commands I also found the arch is ramips. So I went to the OpenWrt download page. For some reason, there was no available version of OpenWrt 14.X for the 7628 (there was for other 762X processors). I went then to the OpenWrt 17.X and 15.X download pages and found binaries for the 7628.

The web interface doesn't recognize the update binaries. So I investigated and found I could also flash the firmware using a TFTP server, by booting the router with the reset button pushed. And so I did, this is the log of the flash process:

RST has be pushed!RST has be pushed!Auto Update: tftp 192.168.9.2 update.bin!
netboot_common, argc= 3
NetTxPacket = 0x81FE6380
KSEG1ADDR(NetTxPacket) = 0xA1FE6380
NetLoop,call eth_halt !
NetLoop,call eth_init !
Trying Eth0 (10/100-M)
Waiting for RX_DMA_BUSY status Start... done

ETH_STATE_ACTIVE!!
TFTP from server 192.168.9.2; our IP address is 192.168.9.233
Filename 'update.bin'.

TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: Got ARP REPLY, set server/gtwy eth addr (78:e3:b5:b7:1f:1d)
Got it
####################checksum bad
checksum bad
#############################################
###############checksum bad
##################################################
#################################################################
#################################################################
#################################################################
#################checksum bad
###########checksum bad
#####################################
#####################checksum bad
############################################
#################################################################
#################################################################
##############################
done
Bytes transferred = 3145732 (300004 hex)
NetBootFileXferSize= 00300004

Unfortunately, it seems like it is doing nothing. After that, the router boots normally again in 14.07 as if nothing had changed. I've tried different TFTP servers and binary files just in case, like 15.X and 17.X and none of them have worked so far. I'm using, for example, the file: mt7628-squashfs-sysupgrade.bin downloaded from: https://archive.openwrt.org/chaos_calmer/15.05.1/ramips/mt7628/ which is then renamed to update.bin in my server.

EXTRA: I'm not completely sure that the flashing has done nothing, because now on boot, two versions of Uboot are loaded, but the first one seems to fail or something, I don't know:

enter image description here

Uboot Ralink 4.3 was the default one, but I'm not sure if Uboot 1.1.3 was there before flashing.

From there it just loads the Linux kernel and proceeds to boot.

Why isn't the firmware getting flashed? Is there any sort of protection?

Improve this question
8
  • 1
    what is your question? this site is not for blog posts
    – Igor Skochinsky ♦
    Commented Jul 25, 2018 at 17:38
  • @IgorSkochinsky why the firmware isn't getting flashed.
    – 78dtat78da
    Commented Jul 25, 2018 at 17:45
  • 1
    It probably uses a custom firmware file format. You could find the updater binary and try to reverse how it works.
    – Avery3R
    Commented Jul 25, 2018 at 19:14
  • @PedroJavierFernández as far as I remember from my own tinkering that error you see regarding U-Boot is merely about the resident environment variables. So simply telling that U-Boot instance to edit and save the variables should make that message go away. Are you certain that this didn't happen before? Depending on the hardware I've seen all kinds of data in the environment block, including information such as addresses to load stuff from or to and other information required during CPU bootstrapping.
    – 0xC0000022L ♦
    Commented Jul 26, 2018 at 11:03
  • @0xC0000022L yes I am pretty sure. How can I edit and save the U-boot variables? Thanks
    – 78dtat78da
    Commented Jul 26, 2018 at 11:16

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.