Totolink N300RT
The firmware listed on this page is not “official” OpenWrt and is of unknown origin.
These images cannot be recommended for use.
There are no clear indications of the source of these images and they may contain unlicensed content and/or security vulnerabilities of various sorts.
2.4 GHz router. 300Mbps, 802.11 B/G/N 2x4dBi antennas. Also sold as “ELRO CM961S” in DIY stores. Comes with 4 LAN ports, 1 WAN port. 2 detachable antennas. No USB port. One button at the bottom for both RST/WPS. There is no on/off button. It runs on 5V at 1A, so it could be powered over USB, but only with a USB to DC-jack converter plug as it has a DC power jack.
Default firmware is set to dhcp, can be reached on http://192.168.1.1 with login/password admin/admin
Default firmware might have a known backdoor
Full dump memory. Installed N300RT-V2.2.0-B20161028.1843.web
https://mega.nz/#!PlxgVQaB!EnzduKn7Iq6mjSMwA4K1TqnmIrxZET32k7gpevJ3M4M
For the only other current Totolink device, on this wiki also check the Russian description of the Totolink N610RT
The N300RT Board layout resembles other RTL8196C devices like SMARTLAN APRIO150, see that discussion on the OpenWrt forum for more info.
Firmware
How-to recover router, use TFTP
0. Everything that you do so at your own risk!!! The author is not responsible!!!
1. Download http://www.anphat.vn/download/FirmwareUpgradeTool.zip
2. Use LAN1 or LAN2 port, change IP address PC to 192.168.1.100 netmask 255.255.255.0
3. Run FrmUpg.exe
4. Turn off router
5. Hold the reset button of the router (WPS / RST) and do not let go!
6. Turn the router power, wait about 10 seconds (must change the nature of the router blinking LED), and release the reset button.
7. Click “Send” button in the application FrmUpg.exe.
8. Wait few minutes.
9. Return IP settings PC to default.
How-to install OpenWrt
0. WAN and LAN1 port are reversed
1. Use TFTP method
2. Unpack and select in FrmUpg.exe this file and Send. This new Bootloader
https://mega.nz/#!q0xFEIQa!gw8fvmfbM5M9ekDuB_ffk7A890aVAXZi6ZY-pKeFGYY
3. Unpack and select in FrmUpg.exe this file and Send. This OpenWrt
https://mega.nz/#!21hhxbRA!eBjRqDB4Hhemur5EiKBxdFm9vI8ezqVgVYo_0Jm2-WU
4. After starting the visit to http://192.168.1.1 set a password on the root and connect through SSH (eg via Putty)
And follow the 3 commands
firstboot Y reboot -f
How-to return factory firmware
1. Use TFTP method
2. Unpack and choice in FrmUpg.exe this file and Send. This factory Bootloader
https://mega.nz/#!DgRlHJbZ!e2kAk8Vb2KRTVYOxpuZJcKgMgSxGSYE5yOVNBMnS0qc
3. Choice any N300RT file firmware *.web in FrmUpg.exe this file and Send
Other Firmware
Recompile source firmware DIR-605L - https://mega.nz/#!i8IlELyS!VkM1XG7DNnOobIB7XT_FHHdpgQoPAobxLIThjzE8DQQ
Install: Use TFTP and installed bootloader to boot96E_32M. WAN and LAN1 port are reversed
Hardware info
| Architecture: | ? |
| Vendor: | Realtek |
| Bootloader: | ? |
| System-On-Chip: | Realtek RTL8196E |
| CPU Speed: | 400MHz |
| Flash Chip: | MX25L3206E |
| Flash size: | 4MB |
| RAM chip: | Winbond W9825G6KH |
| RAM size: | 32MB |
| Wireless IEEE 802.11a/b/g/n: | RTL8192ER |
| Wireless IEEE 802.11ac: | ? |
| Ethernet: | ? |
| USB: | no |
| Serial: | UART |
| JTAG: | ? |
| Power supply: | 5VDC 1A via a DC power jack |
It's opened up easily by 4 screws under rubber feet. VCC TX RX GND pins are accessible. Use 3.3V serial, connect CTS to VCC on router. Serial 38400 baud, 8 data bits, no parity, no flow control.
Serial bootlog using default firmware
Jump to image start=0x80500000... decompressing kernel: Uncompressing Linux... done, booting the kernel. done decompressing kernel. early printk enabled Determined physical RAM map: memory: 01000000 @ 00000000 (usable) On node 0 totalpages: 4096 zone(0): 4096 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: root=/dev/mtdblock1 console=0 single Calibrating delay loop... 389.12 BogoMIPS Memory: 10816k/16384k available (1918k kernel code, 5568k reserved, 200k data, 60k init, 0k highmem) Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes) Inode-cache hash table entries: 1024 (order: 1, 8192 bytes) Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) check_wait... unavailable. POSIX conformance testing by UNIFIX Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd Serial driver version 6.02 (2003-03-12) with no serial options enabled ttyS00 at 0x2000 (irq = 5) is a rtl_uart1 state->flags=00000000 Realtek GPIO Driver for Flash Reload Default Init IPTIME GPIO: block: 64 slots per queue, batch=16 PPP generic driver version 2.4.1 MPPE/MPPC encryption/compression module registered SPI INIT flash device: 0x200000 at 0xbd000000 probe realtek SFCR ==> 3b800000 SFCR2 ==> 0b908000 get SPI CS0 maker:ef type:40 sector_cnt:32 get SPI CS1 maker:0 type:0 sector_cnt:0 can not get SPI chip driver! can not get SPI chip driver! can not get SPI chip driver! can not get SPI chip driver! can not get SPI chip driver! can not get SPI chip driver! can not get SPI chip driver! get SPI chip driver! Physically mapped flash: Found an alies 0x200000 for the chip at 0x0, winbond device detect. probe ends probe realtek2 Creating 2 MTD partitions on "Physically mapped flash": 0x00000000-0x00200000 : "boot+cfg+linux+rootfs" 0x000c0000-0x00200000 : "root fs" RealTek E-Flash System Driver. (C) 2002 RealTek Corp. Cannot find driver for DiskOnChip Millennium at 0x6000 RTL8192C/RTL8188C driver version 1.4 (2011-02-09) =====>>INSIDE rtl8192cd_init_one <<===== vendor_deivce_id=819110ec =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== Realtek 865x Ethernet driver v0.6 (Mar 26, 2008) eth0: RTL865x-NIC at 0xbb804000, 00:00:00:00:00:11, IRQ 2 eth1: RTL865x-NIC at 0xbb804000, 00:00:00:00:00:22, IRQ 2 eth2: RTL865x-NIC at 0xbb804000, 00:e0:4c:f0:00:02, IRQ 2 eth3: RTL865x-NIC at 0xbb804000, 00:e0:4c:f0:00:03, IRQ 2 eth4: RTL865x-NIC at 0xbb804000, 00:e0:4c:f0:00:04, IRQ 2 => rtl865x_ioctl init NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP, IGMP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 1024 bind 2048) Linux IP multicast router 0.06 plus PIM-SM ==> create_proc_ipclone() form DEV.c ip_conntrack version 2.1 (512 buckets, 1024 max) - 384 bytes per conntrack NETDETECT target register ip_nat_bnet: Trying to register for port 6112 FTP proc OK.... ip_ct_ftp: registering helper for port 21 ip_ct_ftp: # of port 1 ip_tables: (C) 2000-2002 Netfilter core team NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. NET4: Ethernet Bridge 008 for NET4.0 VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 60k freed mount /proc file system ok! mount /tmp file system ok! ---> /sbin/init doing alias:zn300rt version:8.18 Default Configuration Set WAN PORT ================================================================= press magic key to change default setting ... LAN MAC : 78:44:76:D6:DA:0C WAN MAC : 78:44:76:D6:DA:0D Bridge Init device wlan0-wds0 is not a slave of br0 device wlan0-wds1 is not a slave of br0 device wlan0-wds2 is not a slave of br0 device wlan0-wds3 is not a slave of br0 device wlan0-vxd is not a slave of br0 iptables: No chain/target/match by that name Jan 1 00:00:07 miniupnpd[177]: Reloading rules from lease file Jan 1 00:00:07 miniupnpd[177]: could not open lease file: /var/run/upnp_pmlist Jan 1 00:00:07 miniupnpd[177]: HTTP listening on port 2048 PPTP Server Start!! insmod: not found killall: iapp: no process killed killall: wscd: no process killed killall: iwcontrol: no process killed Reaped 211 Reaped 205 Reaped 194 Reaped 176 Reaped 175 WiFi Simple Config v1.12 (2009.07.31-11:35+0000). Invalid Save : DEFAULT SIGNAL -> Config Update signal progress Reaped 215 Check DHCP PID Elapsed Time: 1 killall: pppoe-relay: no process killed SIGNAL -> WAN ip changed
UART bootlog using factory firmware N300RT-V2.2.0-B20161028.1843.web
Booting... chipName: MX25L3205D ---RealTek(RTL8196E)at 2013.12.31-11:18+0800 v1.2 [16bit](400MHz) Jump to image start=0x80500000... decompressing kernel: Uncompressing Linux... done, booting the kernel. done decompressing kernel. start address: 0x80003440 Realtek WLAN driver - version 1.6 (2013-02-21)(SVN:目录 未版本控制) Adaptivity function - version 7.1 ####################################################### SKB_BUF_SIZE=2408 MAX_SKB_NUM=400 ####################################################### Probing RTL8186 10/100 NIC-kenel stack size order[3]... chip name: 8196C, chip revid: 0 NOT YET eth0 added. vid=9 Member port 0x10... eth1 added. vid=8 Member port 0x1... eth2 added. vid=9 Member port 0x8... eth3 added. vid=9 Member port 0x4... eth4 added. vid=9 Member port 0x2... [peth0] added, mapping to [eth1]... Realtek FastPath:v1.03 init started: BusyBox v1.13.4 (2015-07-24 17:41:30 CST) Init Start... Init bridge interface... ####################################################### NUM_RX_PKTHDR_DESC= 428, eth_skb_free_num= 694 ####################################################### ************* Initialize MAC/PHY parameter ************* Init Wlan application... WiFi Simple Config v2.16-wps2.0 (2014.09.30-03:47+0000). Register to wlan0 route: SIOCDELRT: No such process iwcontrol RegisterPID to (wlan0) IEEE 802.11f (IAPP) using interface br0 (v1.8) Init WAN Interface... MiniIGD v1.09.1 (2015.07.24-09:44+0000). Start setting IPv6[IPv6] boa: server version Boa/0.94.14rc21 boa: server built Jul 24 2015 at 17:42:39. boa: starting server pid=311, port 80 ----------------------------------------------- Date: 08.02.2017 - 23:44:03