Table of Contents

ASUS WL-330N & WL-330N3G

This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram.
DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date and secure OpenWrt version onto it! See 4/32 warning for details.

1) This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation.
This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices what you can do now.

2) OpenWrt support for this device has ended in 2022.
19.07.10 was the last official build for 4/32 devices.

Ralink RT3050F

The device is a mobile 150Mbit wireless N router with

Supported Versions

Hardware

Model Version CPU Ram Flash Network USB Serial JTag
WL-330N A Ralink RT3050F@320MHz 16MiB 4MiB 1 x 10/100 No Yes Yes
WL-330N3G A Ralink RT3050F@320MHz 32MiB 4MiB 1 x 10/100 1 x 2.0 Yes Yes
WL-330N3G Rev 1.20 Ralink RT3050F@320MHz 16MiB 4MiB 1 x 10/100 1 x 2.0 Yes Yes

WL-330N3G Rev 1.20 is also sold as WL-330N. On WL-330N USB port is available but not soldered. Also, there's a few WL-330N3G with H/W version Rev 1.20 which have 32MiB RAM onboard. Installation image is same with WL-330N3G.

Info

Architecture: MIPS
Vendor: Asus
Bootloader: U-Boot
System-On-Chip: RT3050F
CPU Speed: 320 Mhz
Flash-Chip: MX25L3205E (Rev A) / Winbond W25Q32 (Rev 1.20)
Flash size: 4 MiB
RAM: 32 MiB
Wireless: RT28xx
Ethernet: 1 x 10/100
USB: 1 x 2.0
Serial: Yes
JTAG: Yes (untested)

Photos

PCB front PCB back

External and internal pictures

Opening the case

Note: This will void your warranty!

  1. There is one screw underneath the serial and mac sticker on bottom of the device.
  2. Sides of plastic case are held together with small clips. Three on both long sides, two on end with no connectors.

The case can be very difficult to open, but be careful not to destroy the plastic in the process as the case makes up half the body of the Ethernet socket.

Serial

The serial port on bottom side of PCB, left from USB port. There's two solder pads marked with TX and RX. Be careful when soldering and add drop of glue to prevent pulling fragile pads from pcb.

Settings: 57600N8, 3v3 TTL

Note: The pads may be covered in solder mask, in which case you will have to carefully scrape them clean with a sharp blade or tweezers before soldering.

RX/TX before removing solder mask RX/TX with removed solder mask RX/TX with cables attached

JTAG

JTAG pins can be seen after removing metal RF shield. Location and number of pins match with Ralink datasheet JTAG info. Functionality of JTAG has not been tested.

Installation

Note: OpenWrt supports this device since Attitude Adjustment 12.09.

Note: Be carefully while installing version 15.05.1 cause there's broken wireless security and it discover yourself after a hour since you connected to AP.

Note: Correct work with HUAWEI HiLink devices avaliable since LEDE 17.01.4.

Installation using console port

  1. download a stable image
  2. or build your image from SVN trunk(Target: Ralink RT288x/RT3xxx, Subtarget: RT305x based boards, Target Profile: Default Profile)
  3. Prepare a TFTP-Server and place the openwrt-ramips-rt305x-wl-330n3g-squashfs-sysupgrade.bin (or bin/ramips/openwrt-ramips-rt305x-wl-330n-squashfs-sysupgrade.bin) in its directory
  4. Rename the binary to test.bin (longer filename failed once, test.bin is the default)
  5. Connect to serial port (57600N8)
  6. Power-ON your WL-330N3G (or WL-330N)
  7. When asking “Please choose the operation” enter “2” (Load system code then write to Flash via TFTP.)
  8. fill out (WL-330N3g-)device and (TFTP-)server IP-Adresses
  9. enter the filename: test.bin

Press enter and wait until flashing is complete and the device reboots. The OpenWrt should be accessible on it's default IP (192.168.1.1).

Recovering should be possible as the bootmanager is not overwritten.

Installation using recovery mode

Note: Tested on WL-330N3G.

It is possible to load an OpenWrt or LEDE image this way, e.g. bin/ramips/lede-17.01.4-ramips-rt305x-wl-330n3g-squashfs-sysupgrade.bin. The example uses a firmware image downloaded from ASUS, it has a .trx extension, but the format is the same as the OpenWrt/LEDE image. The ASUS WEB-interface firmware update page does not accept an OpenWrt/LEDE image, it probably checks the image header. In the ASUS header the router model is specified, the OpenWrt/LEDE header does not include the router model.

  1. Connect the router to the Ethernet port of your computer.
  2. Power on your Router and press the restore or WPS button
  3. Keep holding the restore or WPS button approx 7 seconds more until the power LED blinks slowly (about 0.2 Hz). If you are running tcpdump on the Ethernet interface you should see ARP requests from 192.168.1.1 for 192.168.1.20.
  4. Configure your Ethernet IPv4 address as static: 192.168.1.20 netmask 255.255.255.0. Note the IP of .20 is critical - the bootloader accepts tftp only from this IP.
  5. Use tftp to upload a firmware file in binary mode to the device:
    Under Windows this can be done with “tftp -i 192.168.1.1 put WL-330N3G_1.0.2.0.trx”.
    Under Linux you can use the “tftp 192.168.1.1” command, on OpenWrt devices you can use tftp-hpa and send the following commands: 
    # tftp 192.168.1.1
tftp> binary
tftp> trace
Packet tracing on.
tftp> rexmt 1
tftp> put lede-17.01.4-ramips-rt305x-wl-330n3g-squashfs-sysupgrade.bin
sent WRQ <file=lede-17.01.4-ramips-rt305x-wl-330n3g-squashfs-sysupgrade.bin, mode=octet>
received ACK <block=0>
sent DATA <block=1, 512 bytes>
[...]
sent DATA <block=5377, 4 bytes>
received ACK <block=5377>

    Instead of the openwrt or lede image (lede-17.01.4-ramips-rt305x-wl-330n3g-squashfs-sysupgrade.bin) you can upload other images (eg. the original ASUS-Firmware: WL-330NG_1.0.2.0.trx).

  6. Wait, flashing may take a couple of minutes. Do not power off!
  7. The device will reboot when flashing is done. If you flashed OpenWrt/LEDE, telnet into 192.168.1.1 and set root password according to Log into your Router Running OpenWrt.

Bootlogs

OEM bootlog

U-Boot 1.1.3 (Jul 6 2010 - 14:04:15) Board: Ralink APSoC DRAM: 32 MB relocate_code Pointer at: 81b80000 spi_wait_nsec: 3e spi deice id: c2 20 16 c2 20 (2016c220) find flash: mx25l3205d raspi_read: from:30000 len:1000 *** Warning - bad CRC, using default environment ============================================ Ralink UBoot Version: 3.3 -------------------------------------------- ASIC 3052_MP2 (Port5<->None) DRAM component: 256 Mbits SDR DRAM bus: 16 bit Total memory: 32 MBytes Flash component: SPI Flash Date:Jul 6 2010 Time:14:04:15 ============================================ icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:128, ways:4, linesz:32 ,total:16384 ##### The CPU freq = 320 MHZ #### SDRAM bus set to 16 bit SDRAM size =32 Mbytes Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 9: Load Boot Loader code then write to Flash via TFTP. 3: System Boot system code via Flash. before LEDON: data:3787 Do bootm ## Booting image at bf050000 ... raspi_read: from:50000 len:40 Image Name: Created: 2011-04-25 3:41:28 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 3781695 Bytes = 3.6 MB Load Address: 80000000 Entry Point: 80345000 raspi_read: from:50040 len:39b43f Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 80345000) ... ## Giving linux memsize in MB, 32 Starting kernel ... LINUX started... THIS IS ASIC Linux version 2.6.21 (root@localhost.localdomain) (gcc version 3.4.2) #1014 Mon Apr 25 11:41:04 CST 2011 The CPU feqenuce set to 320 MHz CPU revision is: 0001964c Determined physical RAM map: memory: 02000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Built 1 zonelists. Total pages: 8128 Kernel command line: console=ttyS1,57600n8 root=/dev/ram0 Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes. Primary data cache 16kB, 4-way, linesize 32 bytes. Synthesized TLB refill handler (20 instructions). Synthesized TLB load handler fastpath (32 instructions). Synthesized TLB store handler fastpath (32 instructions). Synthesized TLB modify handler fastpath (31 instructions). Cache parity protection disabled cause = 80800058, status = 1100ff00 PID hash table entries: 128 (order: 7, 512 bytes) calculating r4koff... 00138800(1280000) CPU frequency 320.00 MHz Using 160.000 MHz high precision timer. Console: colour dummy device 80x25 Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Memory: 26244k/32768k available (2806k kernel code, 6524k reserved, 538k data, 2700k in it, 0k highmem) Mount-cache hash table entries: 512 NET: Registered protocol family 16 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb Time: MIPS clocksource has been installed. NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered detected lzma initramfs detected lzma initramfs initramfs: LZMA lc=3,lp=0,pb=2,dictSize=1048576,origSize=10226176 LZMA initramfs by Ming-Ching Tiew <mctiew@yahoo.com>................................... ....................................................................................... ...................................<6>squashfs: version 3.2-r2 (2007/01/15) Phillip Lou gher squashfs: LZMA suppport for slax.org by jro fuse init (API version 7.8) io scheduler noop registered (default) Ralink gpio driver initialized spidrv_major = 217 HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096 N_HDLC line discipline registered. Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A RAMDISK driver initialized: 16 RAM disks of 14784K size 1024 blocksize loop: loaded (max 8 devices) rdm_major = 254 PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered PPP MPPE Compression module registered NET: Registered protocol family 24 PPPoL2TP kernel driver, V0.17 PPTP driver version 0.8.4 block2mtd: version $Revision: 1.1.1.1 $ spi_wait_nsec: 72 deice id : c2 20 16 c2 20 (2016c220) mx25l3205d(c2 20160000) (4096 Kbytes) mtd .name = raspi, .size = 0x00400000 (4M) .erasesize = 0x00010000 (64K) .numeraseregio ns = 0 Creating 5 MTD partitions on "raspi": 0x00000000-0x00400000 : "ALL" 0x00000000-0x00030000 : "Bootloader" 0x00030000-0x00040000 : "Config" 0x00040000-0x00050000 : "Factory" 0x00050000-0x01000000 : "Kernel" mtd: partition "Kernel" extends beyond the end of device "raspi" -- size truncated to 0 x3b0000 Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. nf_conntrack version 0.5.0 (16384 buckets, 8192 max) ipt_time loading ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone arp_tables: (C) 2002 David S. Miller TCP cubic registered NET: Registered protocol family 1 NET: Registered protocol family 10 NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> GDMA1_MAC_ADRH -- : 0x00000000 GDMA1_MAC_ADRL -- : 0x00000000 Ralink APSoC Ethernet Driver Initilization. v2.00 256 rx/tx descriptors allocated, mtu = 1500! GDMA1_MAC_ADRH -- : 0x0000000c GDMA1_MAC_ADRL -- : 0x43305077 PROC INIT OK! Freeing unused kernel memory: 2700k freed Set: phy[0].reg[0] = 3900 Set: phy[1].reg[0] = 3900 Set: phy[2].reg[0] = 3900 Set: phy[3].reg[0] = 3900 Set: phy[4].reg[0] = 3900 Algorithmics/MIPS FPU Emulator v1.5 switch register base addr to 0xb0000000 write offset 0x60, value 0x2dd [ra setdir]: 47b80 devpts: called with bogus options spi deice id: c2 20 16 c2 20 (2016c220) find flash: mx25l3205d ## Restoring defaults... ## done set 3g chk pr[k] track_flag=0, clean_flag=0, mm_flag=0, ipaddr=0 echeck wan_proto of sw_mode()(6) [rc] router-mode set 3g flag track set 201 track ok:201 *** value_str [rswitch register base addr to 0xb0000000 c Chk sw_mode/ex] [6][] --- init_switch_mode --- write offset 0x60, value 0x2dd [ra setdir]: 47b80 *** value_str --- 3g mode --- --- start to gen ralink config. --- rt2860v2_ap: module license 'unspecified' taints kernel. [rc] main_loop: state= 2 vconfig... GDMA1_MAC_ADRH -- : 0x0000f46d GDMA1_MAC_ADRL -- : 0x04db409c phy_tx_ring = 0x0037c000, tx_ring = 0xa037c000 phy_rx_ring = 0x00000000, rx_ring = 0x00000000 RT305x_ESW: Link Status Changed CDMA_CSG_CFG = 81000007 GDMA1_FWD_CFG = 710000 [K] rtmp nv init: read from:40000 [RtmpFlashRead] from:(40000) [ra flash conf 3] 0x1300 = 00064380 ra0 up!!! waitpid: No child processes waitpid: No child processes device eth2 entered promiscuous mode waitpid: No child processes device ra0 entered promiscuous mode waitpid: No child processes [rc] not repeater mode [192.168.1.1][] ##br0: port 2(ra0) entering learning state [rc] set lan_ifbr0: port 1(eth2) entering learning state as 192.168.1.1/255.255.255.0 waitpid: No child processes update lan status set default filter settings Set: phy[0].reg[0] = 3100 Set: phy[1].reg[0] = 3100 waitpid: No child processes Set: phy[2].reg[0] = 3100 waitpid: No child processes Set: phy[3].reg[0] = 3100 waitpid: No child processes Set: phy[4].reg[0] = 3100 waitpid: No child processes start_wan start dns:rt_disable: 0 ready to exec dproxy start services... [rc] start services [rc] start dhcpd starting... [dhcpd] force setbr0: topology change detected, propagating extra option dnbr0: port 2(ra0) entering forwarding state s br0: topology change detected, propagating br0: port 1(eth2) entering forwarding state info, udhcp server (v0.9.8) started sh: lpd: not found ***** g_wl_interface = ra0 ****** libupnp: using UDP SSDP_PORT = 1900 upnpd[308]: UPnP SDK Successfully Initialized. upnpd[308]: Succesfully set the Web Server Root Directory. --- START: Wait to start wanduck --- Delay run wanduck 3 seconds upnpd[308]: IGD root device successfully registered. upnpd[308]: Advertisements Sent. Listening for requests ... cannot get proto entry: No such file or directory cannot get proto entry: No such file or directory [wanduck]: under sw_mode:6(f_bruse:0) resume stp forwarding delay and hello time waitpid: No child processes waitpid: No child processes killall: telnetd: no process killed Password for 'admin' changed switch register base addr to 0xb0000000 dwc_otg: version 2.72a 24-JUN-2008 DWC_otg: Core Release: 2.66a DWC_otg: Periodic Transfer Interrupt Enhancement - disabled DWC_otg: Multiprocessor Interrupt Enhancement - disabled DWC_otg: Using DMA mode DWC_otg: Device using Buffer DMA mode dwc_otg lm0: DWC OTG Controller dwc_otg lm0: new USB bus registered, assigned bus number 1 dwc_otg lm0: irq 18, io mem 0x00000000 DWC_otg: Init: Port Power? op_state=1 DWC_otg: Init: Power Port (0) [K] generic probe:1, 0, 0 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected write offset 0x60, value 0x2dd [ra setdir]: 47b80 pool.ntp.org: Unknown host upnp will be delayed 10 secs # Enable direct rule [k] track_flag=0, clean_flag=1, mm_flag=0, ipaddr=0 track set ok [k] track_flag=0, clean_flag=0, mm_flag=0, ipaddr=0 track set ok BusyBox v1.12.1 (2010-08-05 12:00:35 CST) built-in shell (ash) Enter 'help' for a list of built-in commands. # [wd] chk usb plugin [rc] main_loop: [k] track_flag=0, clean_flag=0, mm_flag=0, ipaddr=0 state= 6 ## rc recv HOTPLUG:none track set 202 track ok:0 SIGTTIN: do nothing [rc] main_loop: state= 4 #


Tags

, , , , , ,