Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
totolink_n300rt [2016/11/20 12:27] – inserted images mipmipinbox:toh:totolink_n300rt [2019/08/14 07:07] (current) – [Tags] lexra + unsupported added tmomas
Line 1: Line 1:
 +======  Totolink N300RT ======
  
 +
 +{{section>meta:infobox:432_warning#infobox_for_dataentries&noheader&nofooter&noeditbutton}}
 +
 +<WRAP center round alert 60%>
 +The firmware listed on this page is **not** "official" OpenWrt and is of unknown origin.
 +
 +These images cannot be recommended for use.
 +
 +There are no clear indications of the source of these images and they may contain unlicensed content and/or security vulnerabilities of various sorts.
 +
 +</WRAP>
 +
 +
 +2.4 GHz router. 300Mbps, 802.11 B/G/N 2x4dBi antennas. Also sold as "ELRO CM961S" in DIY stores.
 +Comes with 4 LAN ports, 1 WAN port. 2 detachable antennas.
 +No USB port. One button at the bottom for both RST/WPS. There is no on/off button.
 +It runs on 5V at 1A, so it could be powered over USB, but only with a USB to DC-jack converter plug as it has a DC power jack. 
 +
 +Default firmware is set to dhcp, can be reached on %%http://192.168.1.1%% with login/password admin/admin
 +
 +Default firmware might have a [[https://pierrekim.github.io/blog/2015-07-16-backdoor-and-RCE-found-in-8-TOTOLINK-products.html|known backdoor]]
 +
 +Full dump memory. Installed N300RT-V2.2.0-B20161028.1843.web
 +
 +[[https://mega.nz/#!PlxgVQaB!EnzduKn7Iq6mjSMwA4K1TqnmIrxZET32k7gpevJ3M4M]]
 +
 +{{media:totolink:n300rt_case_rear.jpg?400|}}
 +{{media:totolink:n300rt_pcb.jpg?400|}}
 +
 +For the only other current Totolink device, on this wiki also check the Russian description of the  [[ru:toh:totolink:toton610rt|Totolink N610RT]]
 +
 +
 +The N300RT Board layout resembles other RTL8196C devices like [[https://forum.openwrt.org/viewtopic.php?id=31551&p=2|SMARTLAN APRIO150]], see that discussion on the OpenWrt forum for more info.
 +
 +
 +=====  Firmware =====
 +
 +How-to recover router, use TFTP
 +
 +0. **Everything that you do so at your own risk!!! The author is not responsible!!!**
 +
 +1. Download [[http://www.anphat.vn/download/FirmwareUpgradeTool.zip]]
 +
 +2. Use LAN1 or LAN2 port, change IP address PC to 192.168.1.100 netmask 255.255.255.0
 +
 +3. Run FrmUpg.exe
 +
 +{{media:firmware_upgrade_utility.png?nolink|}}
 +
 +4. Turn off router
 +
 +5. Hold the reset button of the router (WPS / RST) and do not let go!
 +
 +6. Turn the router power, wait about 10 seconds (must change the nature of the router blinking LED), and release the reset button.
 +
 +7. Click "Send" button in the application FrmUpg.exe.
 +
 +8. Wait few minutes.
 +
 +9. Return IP settings PC to default.
 +
 +
 +=====  How-to install OpenWrt =====
 +
 +0. WAN and LAN1 port are reversed
 +
 +1. Use TFTP method
 +
 +2. Unpack and select in FrmUpg.exe this file and Send. This new Bootloader
 +
 +[[https://mega.nz/#!q0xFEIQa!gw8fvmfbM5M9ekDuB_ffk7A890aVAXZi6ZY-pKeFGYY]]
 +
 +3. Unpack and select in FrmUpg.exe this file and Send. This OpenWrt
 +
 +[[https://mega.nz/#!21hhxbRA!eBjRqDB4Hhemur5EiKBxdFm9vI8ezqVgVYo_0Jm2-WU]]
 +
 +4. After starting the visit to %%http://192.168.1.1%% set a password on the root and connect through SSH (eg via Putty)
 +
 +And follow the 3 commands
 +
 +<code>
 +firstboot
 +
 +Y
 +
 +reboot -f
 +</code>
 +
 +
 +=====  How-to return factory firmware =====
 +1. Use TFTP method
 +
 +2. Unpack and choice in FrmUpg.exe this file and Send. This factory Bootloader
 +
 +[[https://mega.nz/#!DgRlHJbZ!e2kAk8Vb2KRTVYOxpuZJcKgMgSxGSYE5yOVNBMnS0qc]]
 +
 +3. Choice any N300RT file firmware *.web in FrmUpg.exe this file and Send
 +
 +
 +=====  Other Firmware =====
 +
 +Recompile source firmware DIR-605L - [[https://mega.nz/#!i8IlELyS!VkM1XG7DNnOobIB7XT_FHHdpgQoPAobxLIThjzE8DQQ]]
 +
 +Install: Use TFTP and installed bootloader to boot96E_32M. WAN and LAN1 port are reversed
 +
 +
 +==== Hardware info ====
 +| **Architecture:**                  | ?                             |
 +| **Vendor:**                        | Realtek                       |
 +| **Bootloader:**                    | ?                             |
 +| **System-On-Chip:**                | Realtek RTL8196E              |
 +| **CPU Speed:**                     | 400MHz                        |
 +| **Flash Chip:**                    | MX25L3206E                    |
 +| **Flash size:**                    | 4MB                           |
 +| **RAM chip:**                      | Winbond W9825G6KH             |
 +| **RAM size:**                      | 32MB                          |
 +| **Wireless IEEE 802.11a/b/g/n:**   | RTL8192ER                     |
 +| **Wireless IEEE 802.11ac:**        | ?                             |
 +| **Ethernet:**                      | ?                             |
 +| **USB:**                           | no                            |
 +| **Serial:**                        | UART                          |
 +| **JTAG:**                          | ?                             |
 +| **Power supply:**                  | 5VDC 1A via a DC power jack   |
 +
 +It's opened up easily by 4 screws under rubber feet. VCC TX RX GND pins are accessible. Use 3.3V serial, connect CTS to VCC on router.
 +Serial 38400 baud, 8 data bits, no parity, no flow control.
 +
 +
 +==== Serial bootlog using default firmware ====
 +
 +<WRAP bootlog>
 +<nowiki>Jump to image start=0x80500000...
 +decompressing kernel:
 +Uncompressing Linux... done, booting the kernel.
 +done decompressing kernel.
 +early printk enabled
 +Determined physical RAM map:
 + memory: 01000000 @ 00000000 (usable)
 +On node 0 totalpages: 4096
 +zone(0): 4096 pages.
 +zone(1): 0 pages.
 +zone(2): 0 pages.
 +Kernel command line: root=/dev/mtdblock1 console=0 single
 +Calibrating delay loop... 389.12 BogoMIPS
 +Memory: 10816k/16384k available (1918k kernel code, 5568k reserved, 200k data, 60k init, 0k highmem)
 +Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes)
 +Inode-cache hash table entries: 1024 (order: 1, 8192 bytes)
 +Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
 +Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
 +Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
 +check_wait... unavailable.
 +POSIX conformance testing by UNIFIX
 +Linux NET4.0 for Linux 2.4
 +Based upon Swansea University Computer Society NET3.039
 +Initializing RT netlink socket
 +Starting kswapd
 +Serial driver version 6.02 (2003-03-12) with no serial options enabled
 +ttyS00 at 0x2000 (irq = 5) is a rtl_uart1
 +state->flags=00000000
 +Realtek GPIO Driver for Flash Reload Default
 +Init IPTIME GPIO:
 +block: 64 slots per queue, batch=16
 +PPP generic driver version 2.4.1
 +MPPE/MPPC encryption/compression module registered
 +SPI INIT
 +flash device: 0x200000 at 0xbd000000
 +probe realtek
 +SFCR ==> 3b800000
 +SFCR2 ==> 0b908000
 +get SPI CS0
 +maker:ef  type:40  sector_cnt:32
 +get SPI CS1
 +maker: type: sector_cnt:0
 +can not get SPI chip driver!
 +can not get SPI chip driver!
 +can not get SPI chip driver!
 +can not get SPI chip driver!
 +can not get SPI chip driver!
 +can not get SPI chip driver!
 +can not get SPI chip driver!
 +get SPI chip driver!
 +Physically mapped flash: Found an alies 0x200000 for the chip at 0x0, winbond device detect.
 +probe ends
 +probe realtek2
 +Creating 2 MTD partitions on "Physically mapped flash":
 +0x00000000-0x00200000 : "boot+cfg+linux+rootfs"
 +0x000c0000-0x00200000 : "root fs"
 +RealTek E-Flash System Driver. (C) 2002 RealTek Corp.
 +Cannot find driver for DiskOnChip Millennium at 0x6000
 +RTL8192C/RTL8188C driver version 1.4 (2011-02-09)
 +=====>>INSIDE rtl8192cd_init_one <<=====
 +vendor_deivce_id=819110ec
 +=====>>EXIT rtl8192cd_init_one <<=====
 +=====>>INSIDE rtl8192cd_init_one <<=====
 +=====>>EXIT rtl8192cd_init_one <<=====
 +=====>>INSIDE rtl8192cd_init_one <<=====
 +=====>>EXIT rtl8192cd_init_one <<=====
 +=====>>INSIDE rtl8192cd_init_one <<=====
 +=====>>EXIT rtl8192cd_init_one <<=====
 +=====>>INSIDE rtl8192cd_init_one <<=====
 +=====>>EXIT rtl8192cd_init_one <<=====
 +=====>>INSIDE rtl8192cd_init_one <<=====
 +=====>>EXIT rtl8192cd_init_one <<=====
 +Realtek 865x Ethernet driver v0.6 (Mar 26, 2008)
 +eth0: RTL865x-NIC at 0xbb804000, 00:00:00:00:00:11, IRQ 2
 +eth1: RTL865x-NIC at 0xbb804000, 00:00:00:00:00:22, IRQ 2
 +eth2: RTL865x-NIC at 0xbb804000, 00:e0:4c:f0:00:02, IRQ 2
 +eth3: RTL865x-NIC at 0xbb804000, 00:e0:4c:f0:00:03, IRQ 2
 +eth4: RTL865x-NIC at 0xbb804000, 00:e0:4c:f0:00:04, IRQ 2
 +=> rtl865x_ioctl init
 +NET4: Linux TCP/IP 1.0 for NET4.0
 +IP Protocols: ICMP, UDP, TCP, IGMP
 +IP: routing cache hash table of 512 buckets, 4Kbytes
 +TCP: Hash tables configured (established 1024 bind 2048)
 +Linux IP multicast router 0.06 plus PIM-SM
 +==> create_proc_ipclone() form DEV.c
 +ip_conntrack version 2.1 (512 buckets, 1024 max) - 384 bytes per conntrack
 +NETDETECT target register
 +ip_nat_bnet: Trying to register for port 6112
 +FTP proc OK....
 +ip_ct_ftp: registering helper for port 21
 +ip_ct_ftp: # of port 1
 +ip_tables: (C) 2000-2002 Netfilter core team
 +NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
 +NET4: Ethernet Bridge 008 for NET4.0
 +VFS: Mounted root (squashfs filesystem) readonly.
 +Freeing unused kernel memory: 60k freed
 +mount /proc file system ok!
 +mount /tmp  file system ok!
 +---> /sbin/init doing
 +alias:zn300rt version:8.18
 +Default Configuration
 +Set WAN PORT
 +
 +
 +
 +=================================================================
 +press magic key to change default setting ...
 +  LAN MAC : 78:44:76:D6:DA:0C
 +  WAN MAC : 78:44:76:D6:DA:0D
 +Bridge Init
 +device wlan0-wds0 is not a slave of br0
 +device wlan0-wds1 is not a slave of br0
 +device wlan0-wds2 is not a slave of br0
 +device wlan0-wds3 is not a slave of br0
 +device wlan0-vxd is not a slave of br0
 +iptables: No chain/target/match by that name
 +Jan  1 00:00:07 miniupnpd[177]: Reloading rules from lease file
 +Jan  1 00:00:07 miniupnpd[177]: could not open lease file: /var/run/upnp_pmlist
 +Jan  1 00:00:07 miniupnpd[177]: HTTP listening on port 2048
 +PPTP Server Start!!
 +insmod: not found
 +killall: iapp: no process killed
 +killall: wscd: no process killed
 +killall: iwcontrol: no process killed
 +Reaped 211
 +Reaped 205
 +Reaped 194
 +Reaped 176
 +Reaped 175
 +
 +WiFi Simple Config v1.12 (2009.07.31-11:35+0000).
 +
 +Invalid Save : DEFAULT
 +SIGNAL -> Config Update signal progress
 +Reaped 215
 +Check DHCP PID Elapsed Time: 1
 +killall: pppoe-relay: no process killed
 +SIGNAL -> WAN ip changed</nowiki>
 +</WRAP>\\
 +
 +**UART bootlog using factory firmware N300RT-V2.2.0-B20161028.1843.web**
 +
 +<WRAP bootlog>
 +<nowiki>Booting...
 +chipName: MX25L3205D
 +
 + 
 +
 +---RealTek(RTL8196E)at 2013.12.31-11:18+0800 v1.2 [16bit](400MHz)
 +
 +
 +Jump to image start=0x80500000...
 +
 +
 +decompressing kernel:
 +Uncompressing Linux... done, booting the kernel.
 +done decompressing kernel.
 +start address: 0x80003440
 +Realtek WLAN driver - version 1.6 (2013-02-21)(SVN:目录 未版本控制)
 +Adaptivity function - version 7.1
 +
 +
 +#######################################################
 +SKB_BUF_SIZE=2408 MAX_SKB_NUM=400
 +#######################################################
 +
 +
 +
 +
 +Probing RTL8186 10/100 NIC-kenel stack size order[3]...
 +chip name: 8196C, chip revid: 0
 +NOT YET
 +eth0 added. vid=9 Member port 0x10...
 +eth1 added. vid=8 Member port 0x1...
 +eth2 added. vid=9 Member port 0x8...
 +eth3 added. vid=9 Member port 0x4...
 +eth4 added. vid=9 Member port 0x2...
 +[peth0] added, mapping to [eth1]...
 +Realtek FastPath:v1.03
 +
 +init started: BusyBox v1.13.4 (2015-07-24 17:41:30 CST)
 +Init Start...
 +Init bridge interface...
 +
 +#######################################################
 +  NUM_RX_PKTHDR_DESC= 428, eth_skb_free_num= 694
 +#######################################################
 +
 +
 +************* Initialize MAC/PHY parameter *************
 +Init Wlan application...
 +
 +WiFi Simple Config v2.16-wps2.0 (2014.09.30-03:47+0000).
 +
 +Register to wlan0
 +route: SIOCDELRT: No such process
 +iwcontrol RegisterPID to (wlan0)
 +IEEE 802.11f (IAPP) using interface br0 (v1.8)
 +Init WAN Interface...
 +
 +MiniIGD v1.09.1 (2015.07.24-09:44+0000).
 +
 +Start setting IPv6[IPv6]
 +boa: server version Boa/0.94.14rc21
 +boa: server built Jul 24 2015 at 17:42:39.
 +boa: starting server pid=311, port 80
 +
 +-----------------------------------------------
 +Date: 08.02.2017 - 23:44:03</nowiki>
 +</WRAP>\\
 +
 +===== Tags =====
 +[[meta:tags|How to add tags]]
 +{{tag>lexra unsupported 4flash 32ram}}
  • Last modified: 2019/08/14 07:07
  • by tmomas