Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
Last revisionBoth sides next revision
totolink_n300rt [2016/11/20 12:27] – inserted images mipmipinbox:toh:totolink_n300rt [2018/12/11 22:07] – [Totolink N300RT] jeff
Line 1: Line 1:
 +======  Totolink N300RT ======
  
 +
 +{{section>meta:infobox:432_warning#infobox_for_dataentries&noheader&nofooter&noeditbutton}}
 +
 +<WRAP center round alert 60%>
 +The firmware listed on this page is **not** "official" OpenWrt and is of unknown origin.
 +
 +These images cannot be recommended for use.
 +
 +There are no clear indications of the source of these images and they may contain unlicensed content and/or security vulnerabilities of various sorts.
 +
 +</WRAP>
 +
 +
 +2.4 GHz router. 300Mbps, 802.11 B/G/N 2x4dBi antennas. Also sold as "ELRO CM961S" in DIY stores.
 +Comes with 4 LAN ports, 1 WAN port. 2 detachable antennas.
 +No USB port. One button at the bottom for both RST/WPS. There is no on/off button.
 +It runs on 5V at 1A, so it could be powered over USB, but only with a USB to DC-jack converter plug as it has a DC power jack. 
 +
 +Default firmware is set to dhcp, can be reached on %%http://192.168.1.1%% with login/password admin/admin
 +
 +Default firmware might have a [[https://pierrekim.github.io/blog/2015-07-16-backdoor-and-RCE-found-in-8-TOTOLINK-products.html|known backdoor]]
 +
 +Full dump memory. Installed N300RT-V2.2.0-B20161028.1843.web
 +
 +[[https://mega.nz/#!PlxgVQaB!EnzduKn7Iq6mjSMwA4K1TqnmIrxZET32k7gpevJ3M4M]]
 +
 +{{media:totolink:n300rt_case_rear.jpg?400|}}
 +{{media:totolink:n300rt_pcb.jpg?400|}}
 +
 +For the only other current Totolink device, on this wiki also check the Russian description of the  [[ru:toh:totolink:toton610rt|Totolink N610RT]]
 +
 +
 +The N300RT Board layout resembles other RTL8196C devices like [[https://forum.openwrt.org/viewtopic.php?id=31551&p=2|SMARTLAN APRIO150]], see that discussion on the OpenWrt forum for more info.
 +
 +
 +=====  Firmware =====
 +
 +How-to recover router, use TFTP
 +
 +0. **Everything that you do so at your own risk!!! The author is not responsible!!!**
 +
 +1. Download [[http://www.anphat.vn/download/FirmwareUpgradeTool.zip]]
 +
 +2. Use LAN1 or LAN2 port, change IP address PC to 192.168.1.100 netmask 255.255.255.0
 +
 +3. Run FrmUpg.exe
 +
 +{{media:firmware_upgrade_utility.png?nolink|}}
 +
 +4. Turn off router
 +
 +5. Hold the reset button of the router (WPS / RST) and do not let go!
 +
 +6. Turn the router power, wait about 10 seconds (must change the nature of the router blinking LED), and release the reset button.
 +
 +7. Click "Send" button in the application FrmUpg.exe.
 +
 +8. Wait few minutes.
 +
 +9. Return IP settings PC to default.
 +
 +
 +=====  How-to install OpenWrt =====
 +
 +0. WAN and LAN1 port are reversed
 +
 +1. Use TFTP method
 +
 +2. Unpack and select in FrmUpg.exe this file and Send. This new Bootloader
 +
 +[[https://mega.nz/#!q0xFEIQa!gw8fvmfbM5M9ekDuB_ffk7A890aVAXZi6ZY-pKeFGYY]]
 +
 +3. Unpack and select in FrmUpg.exe this file and Send. This OpenWrt
 +
 +[[https://mega.nz/#!21hhxbRA!eBjRqDB4Hhemur5EiKBxdFm9vI8ezqVgVYo_0Jm2-WU]]
 +
 +4. After starting the visit to %%http://192.168.1.1%% set a password on the root and connect through SSH (eg via Putty)
 +
 +And follow the 3 commands
 +
 +<code>
 +firstboot
 +
 +Y
 +
 +reboot -f
 +</code>
 +
 +
 +=====  How-to return factory firmware =====
 +1. Use TFTP method
 +
 +2. Unpack and choice in FrmUpg.exe this file and Send. This factory Bootloader
 +
 +[[https://mega.nz/#!DgRlHJbZ!e2kAk8Vb2KRTVYOxpuZJcKgMgSxGSYE5yOVNBMnS0qc]]
 +
 +3. Choice any N300RT file firmware *.web in FrmUpg.exe this file and Send
 +
 +
 +=====  Other Firmware =====
 +
 +Recompile source firmware DIR-605L - [[https://mega.nz/#!i8IlELyS!VkM1XG7DNnOobIB7XT_FHHdpgQoPAobxLIThjzE8DQQ]]
 +
 +Install: Use TFTP and installed bootloader to boot96E_32M. WAN and LAN1 port are reversed
 +
 +
 +==== Hardware info ====
 +| **Architecture:**                  | ?                             |
 +| **Vendor:**                        | Realtek                       |
 +| **Bootloader:**                    | ?                             |
 +| **System-On-Chip:**                | Realtek RTL8196E              |
 +| **CPU Speed:**                     | 400MHz                        |
 +| **Flash Chip:**                    | MX25L3206E                    |
 +| **Flash size:**                    | 4MB                           |
 +| **RAM chip:**                      | Winbond W9825G6KH             |
 +| **RAM size:**                      | 32MB                          |
 +| **Wireless IEEE 802.11a/b/g/n:**   | RTL8192ER                     |
 +| **Wireless IEEE 802.11ac:**        | ?                             |
 +| **Ethernet:**                      | ?                             |
 +| **USB:**                           | no                            |
 +| **Serial:**                        | UART                          |
 +| **JTAG:**                          | ?                             |
 +| **Power supply:**                  | 5VDC 1A via a DC power jack   |
 +
 +It's opened up easily by 4 screws under rubber feet. VCC TX RX GND pins are accessible. Use 3.3V serial, connect CTS to VCC on router.
 +Serial 38400 baud, 8 data bits, no parity, no flow control.
 +
 +
 +==== Serial bootlog using default firmware ====
 +
 +<WRAP bootlog>
 +<nowiki>Jump to image start=0x80500000...
 +decompressing kernel:
 +Uncompressing Linux... done, booting the kernel.
 +done decompressing kernel.
 +early printk enabled
 +Determined physical RAM map:
 + memory: 01000000 @ 00000000 (usable)
 +On node 0 totalpages: 4096
 +zone(0): 4096 pages.
 +zone(1): 0 pages.
 +zone(2): 0 pages.
 +Kernel command line: root=/dev/mtdblock1 console=0 single
 +Calibrating delay loop... 389.12 BogoMIPS
 +Memory: 10816k/16384k available (1918k kernel code, 5568k reserved, 200k data, 60k init, 0k highmem)
 +Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes)
 +Inode-cache hash table entries: 1024 (order: 1, 8192 bytes)
 +Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
 +Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
 +Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
 +check_wait... unavailable.
 +POSIX conformance testing by UNIFIX
 +Linux NET4.0 for Linux 2.4
 +Based upon Swansea University Computer Society NET3.039
 +Initializing RT netlink socket
 +Starting kswapd
 +Serial driver version 6.02 (2003-03-12) with no serial options enabled
 +ttyS00 at 0x2000 (irq = 5) is a rtl_uart1
 +state->flags=00000000
 +Realtek GPIO Driver for Flash Reload Default
 +Init IPTIME GPIO:
 +block: 64 slots per queue, batch=16
 +PPP generic driver version 2.4.1
 +MPPE/MPPC encryption/compression module registered
 +SPI INIT
 +flash device: 0x200000 at 0xbd000000
 +probe realtek
 +SFCR ==> 3b800000
 +SFCR2 ==> 0b908000
 +get SPI CS0
 +maker:ef  type:40  sector_cnt:32
 +get SPI CS1
 +maker: type: sector_cnt:0
 +can not get SPI chip driver!
 +can not get SPI chip driver!
 +can not get SPI chip driver!
 +can not get SPI chip driver!
 +can not get SPI chip driver!
 +can not get SPI chip driver!
 +can not get SPI chip driver!
 +get SPI chip driver!
 +Physically mapped flash: Found an alies 0x200000 for the chip at 0x0, winbond device detect.
 +probe ends
 +probe realtek2
 +Creating 2 MTD partitions on "Physically mapped flash":
 +0x00000000-0x00200000 : "boot+cfg+linux+rootfs"
 +0x000c0000-0x00200000 : "root fs"
 +RealTek E-Flash System Driver. (C) 2002 RealTek Corp.
 +Cannot find driver for DiskOnChip Millennium at 0x6000
 +RTL8192C/RTL8188C driver version 1.4 (2011-02-09)
 +=====>>INSIDE rtl8192cd_init_one <<=====
 +vendor_deivce_id=819110ec
 +=====>>EXIT rtl8192cd_init_one <<=====
 +=====>>INSIDE rtl8192cd_init_one <<=====
 +=====>>EXIT rtl8192cd_init_one <<=====
 +=====>>INSIDE rtl8192cd_init_one <<=====
 +=====>>EXIT rtl8192cd_init_one <<=====
 +=====>>INSIDE rtl8192cd_init_one <<=====
 +=====>>EXIT rtl8192cd_init_one <<=====
 +=====>>INSIDE rtl8192cd_init_one <<=====
 +=====>>EXIT rtl8192cd_init_one <<=====
 +=====>>INSIDE rtl8192cd_init_one <<=====
 +=====>>EXIT rtl8192cd_init_one <<=====
 +Realtek 865x Ethernet driver v0.6 (Mar 26, 2008)
 +eth0: RTL865x-NIC at 0xbb804000, 00:00:00:00:00:11, IRQ 2
 +eth1: RTL865x-NIC at 0xbb804000, 00:00:00:00:00:22, IRQ 2
 +eth2: RTL865x-NIC at 0xbb804000, 00:e0:4c:f0:00:02, IRQ 2
 +eth3: RTL865x-NIC at 0xbb804000, 00:e0:4c:f0:00:03, IRQ 2
 +eth4: RTL865x-NIC at 0xbb804000, 00:e0:4c:f0:00:04, IRQ 2
 +=> rtl865x_ioctl init
 +NET4: Linux TCP/IP 1.0 for NET4.0
 +IP Protocols: ICMP, UDP, TCP, IGMP
 +IP: routing cache hash table of 512 buckets, 4Kbytes
 +TCP: Hash tables configured (established 1024 bind 2048)
 +Linux IP multicast router 0.06 plus PIM-SM
 +==> create_proc_ipclone() form DEV.c
 +ip_conntrack version 2.1 (512 buckets, 1024 max) - 384 bytes per conntrack
 +NETDETECT target register
 +ip_nat_bnet: Trying to register for port 6112
 +FTP proc OK....
 +ip_ct_ftp: registering helper for port 21
 +ip_ct_ftp: # of port 1
 +ip_tables: (C) 2000-2002 Netfilter core team
 +NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
 +NET4: Ethernet Bridge 008 for NET4.0
 +VFS: Mounted root (squashfs filesystem) readonly.
 +Freeing unused kernel memory: 60k freed
 +mount /proc file system ok!
 +mount /tmp  file system ok!
 +---> /sbin/init doing
 +alias:zn300rt version:8.18
 +Default Configuration
 +Set WAN PORT
 +
 +
 +
 +=================================================================
 +press magic key to change default setting ...
 +  LAN MAC : 78:44:76:D6:DA:0C
 +  WAN MAC : 78:44:76:D6:DA:0D
 +Bridge Init
 +device wlan0-wds0 is not a slave of br0
 +device wlan0-wds1 is not a slave of br0
 +device wlan0-wds2 is not a slave of br0
 +device wlan0-wds3 is not a slave of br0
 +device wlan0-vxd is not a slave of br0
 +iptables: No chain/target/match by that name
 +Jan  1 00:00:07 miniupnpd[177]: Reloading rules from lease file
 +Jan  1 00:00:07 miniupnpd[177]: could not open lease file: /var/run/upnp_pmlist
 +Jan  1 00:00:07 miniupnpd[177]: HTTP listening on port 2048
 +PPTP Server Start!!
 +insmod: not found
 +killall: iapp: no process killed
 +killall: wscd: no process killed
 +killall: iwcontrol: no process killed
 +Reaped 211
 +Reaped 205
 +Reaped 194
 +Reaped 176
 +Reaped 175
 +
 +WiFi Simple Config v1.12 (2009.07.31-11:35+0000).
 +
 +Invalid Save : DEFAULT
 +SIGNAL -> Config Update signal progress
 +Reaped 215
 +Check DHCP PID Elapsed Time: 1
 +killall: pppoe-relay: no process killed
 +SIGNAL -> WAN ip changed</nowiki>
 +</WRAP>\\
 +
 +**UART bootlog using factory firmware N300RT-V2.2.0-B20161028.1843.web**
 +
 +<WRAP bootlog>
 +<nowiki>Booting...
 +chipName: MX25L3205D
 +
 + 
 +
 +---RealTek(RTL8196E)at 2013.12.31-11:18+0800 v1.2 [16bit](400MHz)
 +
 +
 +Jump to image start=0x80500000...
 +
 +
 +decompressing kernel:
 +Uncompressing Linux... done, booting the kernel.
 +done decompressing kernel.
 +start address: 0x80003440
 +Realtek WLAN driver - version 1.6 (2013-02-21)(SVN:目录 未版本控制)
 +Adaptivity function - version 7.1
 +
 +
 +#######################################################
 +SKB_BUF_SIZE=2408 MAX_SKB_NUM=400
 +#######################################################
 +
 +
 +
 +
 +Probing RTL8186 10/100 NIC-kenel stack size order[3]...
 +chip name: 8196C, chip revid: 0
 +NOT YET
 +eth0 added. vid=9 Member port 0x10...
 +eth1 added. vid=8 Member port 0x1...
 +eth2 added. vid=9 Member port 0x8...
 +eth3 added. vid=9 Member port 0x4...
 +eth4 added. vid=9 Member port 0x2...
 +[peth0] added, mapping to [eth1]...
 +Realtek FastPath:v1.03
 +
 +init started: BusyBox v1.13.4 (2015-07-24 17:41:30 CST)
 +Init Start...
 +Init bridge interface...
 +
 +#######################################################
 +  NUM_RX_PKTHDR_DESC= 428, eth_skb_free_num= 694
 +#######################################################
 +
 +
 +************* Initialize MAC/PHY parameter *************
 +Init Wlan application...
 +
 +WiFi Simple Config v2.16-wps2.0 (2014.09.30-03:47+0000).
 +
 +Register to wlan0
 +route: SIOCDELRT: No such process
 +iwcontrol RegisterPID to (wlan0)
 +IEEE 802.11f (IAPP) using interface br0 (v1.8)
 +Init WAN Interface...
 +
 +MiniIGD v1.09.1 (2015.07.24-09:44+0000).
 +
 +Start setting IPv6[IPv6]
 +boa: server version Boa/0.94.14rc21
 +boa: server built Jul 24 2015 at 17:42:39.
 +boa: starting server pid=311, port 80
 +
 +-----------------------------------------------
 +Date: 08.02.2017 - 23:44:03</nowiki>
 +</WRAP>\\
 +
 +===== Tags =====
 +[[meta:tags|How to add tags]]
 +{{tag>4flash 32ram}}
  • Last modified: 2019/08/14 07:07
  • by tmomas