Altai C1n

Under Construction!
This page is currently under construction. You can edit the article to help completing it.

This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram.
DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date and secure OpenWrt version onto it! See 4/32 warning for details.

1) This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation.
This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices what you can do now.

2) OpenWrt support for this device has ended in 2022.
19.07.10 was the last official build for 4/32 devices.

Write a short, relevant description of the device. Include a technical overview, but avoid marketing buzzwords/useless stuff. Two to four sentences is about right. A picture is good, too. Edit the page to see how to add pictures.

Generic Router

Not supported.

Describe if there are any ongoing activities that might lead to OpenWrt support.

CPU Ram Flash Network WLAN USB Serial JTag
AR9344 32 MiB 8 MiB 1x 10/100 bgn No ? ?

https://wikidevi.com/wiki/Altai_WA1011N-G_(C1n)

Architecture EXAMPLE MIPS
Vendor EXAMPLE Ralink
Bootloader EXAMPLE U-Boot
System-On-Chip EXAMPLE Ralink RT3052 - MIPS 24K V4.12
CPU/Speed EXAMPLE 451 MHz
Flash-Chip EXAMPLE unkown
Flash size EXAMPLE 8 MiB
RAM EXAMPLE 64 MiB
Wireless EXAMPLE RT2860v2 2.4GHz 802.11bgn
Ethernet EXAMPLE 10/100 Mbit/s w/ vlan support
USB EXAMPLE 1x 2.0
Serial EXAMPLE Yes
JTAG EXAMPLE Not populated

Insert photo of front of the casing

Insert photo of back of the casing

Insert photo of backside label

Insert photo of PCB

FIXME Describe what needs to be done to open the device, e.g. remove rubber feet, adhesive labels, screws, ...

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:
Insert photo of PCB with markings for serial port

FIXME Replace EXAMPLE by real values.

Serial connection parameters
for Altai C1n @@Version@@
EXAMPLE 115200, 8N1

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

U-Boot 1.1.4 (Oct 8 2012 - 17:01:18) U-boot DB120 DRAM: sri Wasp 1.2 wasp_ddr_initial_config(249): (16bit) ddr2 init wasp_ddr_initial_config(426): Wasp ddr init done Tap value selected = 0xf [0x0 - 0x1f] Setting 0xb8116290 to 0x20402d0f 32 MB Top of RAM usable for U-Boot at: 82000000 Reserving 204k for U-Boot at: 81fcc000 Reserving 192k for malloc() at: 81f9c000 Reserving 44 Bytes for Board Info at: 81f9bfd4 Reserving 36 Bytes for Global Data at: 81f9bfb0 Reserving 128k for boot params() at: 81f7bfb0 Stack Pointer at: 81f7bf98 Now running in RAM - U-Boot at: 81fcc000 Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x17 flash size 8MB, sector count = 128 Flash: 8 MB pci_init_board: PCIe PLL not set for 40MHz refclk *** Warning *** : PCIe WLAN Module not found !!! In: serial Out: serial Err: serial Net: ag934x_enet_initialize... No valid address in Flash. Using fixed address Fetching MAC Address from 0x81fee378 wasp reset mask:c03300 WASP ----> S27 PHY : cfg1 0x80000000 cfg2 0x7114 eth0: 00:03:7f:09:0b:ad s27 reg init athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000 athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :50 eth0 up WASP ----> S27 PHY : cfg1 0x7 cfg2 0x7214 eth1: 00:19:be:a0:ce:81 s27 reg init lan ATHRS27: resetting s27 ATHRS27: s27 reset done athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000 athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10 athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000 athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10 athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000 athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10 athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000 athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10 eth1 up eth0, eth1 Hit any key to stop autoboot: 0 ## Booting image at 9f050000 ... Image Name: MIPS OpenWrt Linux-2.6.32.25 Created: 2014-04-07 11:34:54 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 892269 Bytes = 871.4 kB Load Address: 80060000 Entry Point: 80060000 Verifying Checksum at 0x9f050040 ...OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 80060000) ... ## Giving linux memsize in bytes, 33554432 Starting kernel ... Linux version 2.6.32.25 (gerrit@andes) (collect2: ld returned 1 exit status) #1 Mon Apr 7 19:34:34 HKT 2014 bootconsole [early0] enabled CPU revision is: 0001974c (MIPS 74Kc) Atheros AR9344 rev 2, CPU:560.000 MHz, AHB:40.000 MHz, DDR:80.000 MHz Determined physical RAM map: memory: 02000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Zone PFN ranges: Normal 0x00000000 -> 0x00002000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00002000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 Kernel command line: root=31:03 rootfstype=squashfs,jffs2 console=ttyS0,115200 board=DB120 root=31:03 PID hash table entries: 128 (order: -3, 512 bytes) Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes Writing ErrCtl register=00000000 Readback ErrCtl register=00000000 Memory: 29380k/32768k available (1970k kernel code, 3388k reserved, 494k data, 136k init, 0k highmem) SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 Hierarchical RCU implementation. NR_IRQS:80 Calibrating delay loop... 279.55 BogoMIPS (lpj=559104) Mount-cache hash table entries: 512 NET: Registered protocol family 16 MIPS: machine is Atheros DB120 PCI: no PCIe module found bio: create slab <bio-0> at 0 Switching to clocksource MIPS NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered NET: Registered protocol family 1 squashfs: version 4.0 (2009/01/31) Phillip Lougher Registering mini_fo version $Id$ JFFS2 version 2.2. (NAND) (SUMMARY) �ᩩ 2001-2006 Red Hat, Inc. msgmni has been set to 57 io scheduler noop registered io scheduler deadline registered (default) Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled �Y�+��250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A console [ttyS0] enabled, bootconsole disabled console [ttyS0] enabled, bootconsole disabled Atheros AR71xx SPI Controller driver version 0.2.4 m25p80 spi0.0: mx25l6405d (8192 Kbytes) Searching for RedBoot partition table in spi0.0 at offset 0x7e0000 Searching for RedBoot partition table in spi0.0 at offset 0x7f0000 No RedBoot partition table detected in spi0.0 Creating 6 MTD partitions on "spi0.0": 0x000000000000-0x000000040000 : "u-boot" 0x000000040000-0x000000050000 : "u-boot-env" 0x000000050000-0x000000170000 : "vmlinux" 0x000000170000-0x0000007a0000 : "rootfs" mtd: partition "rootfs" set to be root filesystem mtd: partition "rootfs_data" created automatically, ofs=670000, len=130000 0x000000670000-0x0000007a0000 : "rootfs_data" 0x0000007a0000-0x0000007f0000 : "wlanconfig" 0x0000007f0000-0x000000800000 : "EEPROM" ATHR_GMAC: Length per segment 1536 ATHR_GMAC: fifo cfg 3 01f00140 ATHR_GMAC: RX TASKLET - Pkts per Intr:16 mac:0 Registering S27.... ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 128 ATHR_GMAC: Max rx descriptor count : 128 ATHR_GMAC: Mac capability flags : 2380 ATHR_GMAC: RX TASKLET - Pkts per Intr:16 mac:1 Registering S27.... ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 128 ATHR_GMAC: Max rx descriptor count : 128 ATHR_GMAC: Mac capability flags : 2D80 Atheros AR71xx hardware watchdog driver version 0.1.0 Registered led device: ethernet Registered led device: led1 Registered led device: led2 Registered led device: led3 Registered led device: led4 TCP westwood registered NET: Registered protocol family 17 Bridge firewalling registered 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> VFS: Mounted root (squashfs filesystem) readonly on device 31:3. Freeing unused kernel memory: 136k freed Please be patient, while OpenWrt loads ... input: gpio-buttons as /devices/platform/gpio-buttons/input/input0 Button Hotplug driver version 0.3.1 athr_gmac_ring_alloc Allocated 2048 at 0x818fc800 athr_gmac_ring_alloc Allocated 2048 at 0x818fd000 WASP ----> S27 PHY MDIO Setting Drop CRC Errors, Pause Frames and Length Error frames Setting PHY... ATH_MAC_TIMER: enet unit:0 is up... syslog@<6> Mii 100Mbps full duplex ATH_MAC_TIMER: done cfg2 0x7115 ifctl 0x10000 miictrl - preinit - Press the [f] key and hit [enter] to enter failsafe mode - regular preinit - jffs2_scan_eraseblock(): End of filesystem marker found at 0x10000 jffs2_build_filesystem(): unlocking the mtd device... done. jffs2_build_filesystem(): erasing all blocks after the end marker... done. switching to jffs2 mini_fo: using base directory: / mini_fo: using storage directory: /overlay >>>>>>>>>>>> pivot - init - athr_gmac_ring_free Freeing at 0x818fc800 athr_gmac_ring_free Freeing at 0x818fd000 Please press Enter to activate this console. athr_gmac_ring_alloc Allocated 2048 at 0x818fd000 athr_gmac_ring_alloc Allocated 2048 at 0x818fd800 WASP ----> S27 PHY MDIO Setting Drop CRC Errors, Pause Frames and Length Error frames Setting PHY... ATH_MAC_TIMER: enet unit:0 is up... syslog@<6> Mii 100Mbps full duplex ATH_MAC_TIMER: done cfg2 0x7115 ifctl 0x10000 miictrl device eth0 entered promiscuous mode br-lan: port 1(eth0) entering forwarding state APROCLOG@<6>awrt_procfs_modu[0154]: Module Init DAL@<6>dal_init[0303]: Module init awrt ctl module init!! Registerd character driver DAL@<6>dal_attach_awrt_[0264]: Attached DAL fpga hooks APROLOG@<6>awrt_proinfo_mod[1236]: Module Init Registerd character driver ARUNSTATELOG@<6>module_awrt_runs[1947]: Module Init ARUNSTATELOG@<6>awrt_runstate_in[1919]: awrt runstate init AUSERLOG@<6>module_awrt_usys[0111]: User Space Syslog Module Init ip_tables: (C) 2000-2006 Netfilter Core Team nf_conntrack version 0.5.0 (461 buckets, 1844 max) syslog@<6> ethernet up xt_time: kernel timezone is -0000 Enabling Auto Neg on port:4 Phy status:1000 IMQ driver loaded successfully. Hooking IMQ before NAT on PREROUTING. Hooking IMQ after NAT on POSTROUTING. Ebtables v2.0 registered enet0 port4 down syslog@<6> ATH_MAC_TIMER: unit 0: phy 4 not up carrier 1 br-lan: port 1(eth0) entering disabled state aaa: module license 'AAA' taints kernel. Disabling lock debugging due to kernel taint SUPERWLOG@superwifi_autoairtime: superwifi autoairtime module init. syslog@<6> ipchange 0.0.0.0 > 192.168.1.222 ath_hal: 0.9.17.1 (AR9380, DEBUG, REGOPS_FUNC, PRIVATE_DIAG, WRITE_EEPROM, 11D) ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved enet0 port4 up 100Mbps Full duplex ATH_MAC_TIMER: enet unit:0 is up... syslog@<6> Mii 100Mbps full duplex ATH_MAC_TIMER: done cfg2 0x7115 ifctl 0x10000 miictrl br-lan: port 1(eth0) entering forwarding state ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved ath_ahb: 9.2.0_U11.14 (Atheros/multi-bss) ar934x_wmac_probe[338]:entry ar934x_wmac_probe[384]:0x802b8750 __ath_attach: Set global_scn[0] ACBKMinfree = 48 ACBEMinfree = 32 ACVIMinfree = 16 ACVOMinfree = 0 CABMinfree = 48 UAPSDMinfree = 0 Bootstrap clock 40MHz ar9300Attach: This Mac Chip Rev 0x300.2 is ar9300Attach: Phy Rev 0x9999, 2G Rev 0x00, 5G Rev 0x00 Wasp Enterprise mode: 0x00000000 ar9300RadioAttach: Need analog access recipe!! Restoring Cal data from Flash Using Cal data from Flash 802b8750 ath_txq_setup: 80e30000: sc_txq[8] qtype 3 subtype 0 ath_txq_setup: 80e30000: sc_txq[0] qtype 1 subtype 0 ath_txq_setup: 80e30000: sc_txq[1] qtype 1 subtype 1 ath_txq_setup: 80e30000: sc_txq[2] qtype 1 subtype 2 ath_txq_setup: 80e30000: sc_txq[3] qtype 1 subtype 3 ath_get_caps[6424] rx chainmask mismatch actual 3 sc_chainmak 0 ath_get_caps[6399] tx chainmask mismatch actual 3 sc_chainmak 0 wifi0: Atheros 9340: mem=0xb8100000, irq=2 ATHDAL@<6>ath_dal_init[3449]: Attach Atheros DAL ATHDAL@<6>ath_dev_idx_look[0155]: wifi0: ifindex = 21, ath_dev = 80e30000 DAL@<6>dal_attach_wifi_[0141]: Attached DAL wifi_ops ATHDAL@<6>awrt_wifiinfo_in[1227]: Init countries info ATHDAL@<6>awrt_wdsinfo_ini[0111]: Init WDS info proc STT@<0>module_stt_init[5196]: STT Module Init AAIB_HISTO@<0>module_aaib_hist[0125]: AAIB Module Init DAL@<6>dal_attach_kalar[0197]: Attached DAL kalarm_hooks ### Startup Initialization (takes about 0 sec) ### u32 classifier Performance counters on input device check on Actions configured AWRT_ATH_RXBUFSIZE=2340 , it is less than 3840 ,so Force AMSDU to be Disabed wlan_vap_create : enter. devhandle=0x80e002c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit. devhandle=0x80e002c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. WARNING: Fragmentation with HT mode NOT ALLOWED!! Setting Max Stations:64 device ath000 entered promiscuous mode br-lan: port 2(ath000) entering forwarding state syslog@<6> radio0 up kalarm@<6>kalarm_update_al[0150]: alarm already cleared(35) syslog@<6> schedule a bg scan for radio0 syslog@<6> bg scan for radio0 finish scan. events@<5>awrt_events_rece[0346]: recv msg from[PID=2927] eventID=20 size=1(reg) syslog@<6> bridge name bridge id STP enabled interfaces syslog@<6> br-lan 8000.0019bea0ce81 no eth0 syslog@<6> ath000 syslog@<6> Bridge table: filter syslog@<6> Bridge chain: INPUT, entries: 0, policy: ACCEPT syslog@<6> Bridge chain: FORWARD, entries: 0, policy: ACCEPT syslog@<6> Bridge chain: OUTPUT, entries: 0, policy: ACCEPT syslog@<6> Bridge table: broute syslog@<6> Bridge chain: BROUTING, entries: 0, policy: ACCEPT syslog@<6> system start syslog@<6> ethernet up


COPY HERE THE BOOTLOG ONCE OPENWRT IS INSTALLED AND RUNNING


The stock firmware has a built in backdoor. Tested on serial, SSH and luci.

username: root

password: superwifi123

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2019/11/03 16:11
  • by yeawellwhatever