Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revisionBoth sides next revision | ||
| inbox:toh:zyxel:nbg7815_armor_g5 [2024/10/06 09:15] – wip pwned | inbox:toh:zyxel:nbg7815_armor_g5 [2024/10/31 16:08] – case pwned | ||
|---|---|---|---|
| Line 57: | Line 57: | ||
| ===== Limitations ===== | ===== Limitations ===== | ||
| - | Currently (state of 2024) OpenWrt officially **__does not support__** the integrated FAN, the integrated LED and Bluetooth. | + | Currently (state of 2024) OpenWrt officially **__does not support__** the integrated FAN, the integrated LED. |
| * LED: [[https:// | * LED: [[https:// | ||
| * FAN: [[https:// | * FAN: [[https:// | ||
| Line 114: | Line 114: | ||
| ==== Backup ==== | ==== Backup ==== | ||
| - | Before you modify | + | Before you modify |
| - | The generic process is described [[: | + | |
| We have one 8MB SPI NOR flash chip and one 4GB emmc flash chip. For both you can use dd. The partition layout of both chips is described [[# | We have one 8MB SPI NOR flash chip and one 4GB emmc flash chip. For both you can use dd. The partition layout of both chips is described [[# | ||
| - | You can spare out the last 2 partitions on the emmc chip. They are not important. Transfer the files either via USB or ssh/scp.\\ | + | You can spare out the last two big partitions on the emmc chip if you want. They are not important. Transfer the files either via USB or ssh/scp.\\ |
| \\ | \\ | ||
| ==== Installing OpenWrt ==== | ==== Installing OpenWrt ==== | ||
| - | Basically | + | :!: **Do not power off the device during |
| - Login as root via SSH. | - Login as root via SSH. | ||
| Line 129: | Line 128: | ||
| - Extract the firmware file. | - Extract the firmware file. | ||
| - Determine the bootconfig of the device and flash OpenWrt to the currently not active kernel and rootfs partitions. | - Determine the bootconfig of the device and flash OpenWrt to the currently not active kernel and rootfs partitions. | ||
| - | - Mark the partitions to boot OpenWrt. | + | - Mark the partitions to boot OpenWrt. |
| - Reboot the device. | - Reboot the device. | ||
| - | < | + | < |
| cd / | cd / | ||
| wget -O openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin https:// | wget -O openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin https:// | ||
| Line 187: | Line 186: | ||
| echo 0 > / | echo 0 > / | ||
| sync | sync | ||
| - | </ | + | </ |
| :!: For reference: [[https:// | :!: For reference: [[https:// | ||
| Line 194: | Line 193: | ||
| ===== Back to OEM firmware ===== | ===== Back to OEM firmware ===== | ||
| - | OpenWrt is currently not using the dual partition layout writing the opposite/ | + | OpenWrt is currently not using the dual partition layout writing the opposite/ |
| \\ | \\ | ||
| ==== Back to OEM firmware (1) ==== | ==== Back to OEM firmware (1) ==== | ||
| + | |||
| + | Be carefull with this process. :!: **Do not power off the device during the process!** | ||
| - Login via SSH to the router. | - Login via SSH to the router. | ||
| - | - :!: To use this method it is required to install kmod-mtd-rw first: '' | + | - To use this method it is required to install kmod-mtd-rw first: '' |
| - Change directory to /tmp. | - Change directory to /tmp. | ||
| - | - Get script | + | - Copy & paste the code from script '' |
| - | - Execute the script with '' | + | - Execute the script with '' |
| - Reboot the device. | - Reboot the device. | ||
| - After reboot force a reflash of OEM firmware via WebGui using one of the provided [[#OEM firmware| OEM firmware files]] to purge OpenWrt entirely. | - After reboot force a reflash of OEM firmware via WebGui using one of the provided [[#OEM firmware| OEM firmware files]] to purge OpenWrt entirely. | ||
| - | < | + | < |
| - | < | + | cat <<' |
| # Script to changing active boot partitions | # Script to changing active boot partitions | ||
| # Author: Karol Przybylski < | # Author: Karol Przybylski < | ||
| + | # Orginal script: https:// | ||
| openwrt_type=$(cat / | openwrt_type=$(cat / | ||
| Line 226: | Line 228: | ||
| fi | fi | ||
| + | insmod mtd-rw i_want_a_brick=1 | ||
| mtd write boot.bin /dev/mtd2 | mtd write boot.bin /dev/mtd2 | ||
| mtd write boot.bin /dev/mtd3 | mtd write boot.bin /dev/mtd3 | ||
| Line 248: | Line 250: | ||
| sync | sync | ||
| fi | fi | ||
| + | EOF | ||
| </ | </ | ||
| - | </ | ||
| \\ | \\ | ||
| ==== Back to OEM firmware (2) ==== | ==== Back to OEM firmware (2) ==== | ||
| - | To use this method it is required to install kmod-mtd-rw first. | + | :!: Be carefull with this process. Make sure you write the correct images to the correct partitions! **Do not power off the device during the process!** |
| - | :!: WIP! | ||
| - Download OEM firmware: [[#OEM firmware|see below]] | - Download OEM firmware: [[#OEM firmware|see below]] | ||
| - Extract rootfs and kernel. Already extracted v8: [[https:// | - Extract rootfs and kernel. Already extracted v8: [[https:// | ||
| - Login via SSH to the router. | - Login via SSH to the router. | ||
| - | - :!: To use this method it is required to install kmod-mtd-rw first: '' | + | - To use this method it is required to install kmod-mtd-rw first: '' |
| - | - Copy the files to the router to /tmp (e. g. using scp or an usb drive). | + | - Copy the files to the router to /tmp (e. g. using scp or an usb drive). Rename them to '' |
| - | - Flash the kernel and rootfs to the currently not active partitions. | + | - Flash the kernel and rootfs to the currently not active partitions. |
| - | - Get script with '' | + | - Copy & paste the code from [[#Back to OEM firmware (1)|script Step 4]] from [[#Back to OEM firmware (1)|Back to OEM firmware (1)]] and execute |
| - | - Execute | + | |
| - Reboot the device. | - Reboot the device. | ||
| - After reboot force a reflash of OEM firmware via WebGui using one of the provided [[#OEM firmware| OEM firmware files]] to purge OpenWrt entirely. | - After reboot force a reflash of OEM firmware via WebGui using one of the provided [[#OEM firmware| OEM firmware files]] to purge OpenWrt entirely. | ||
| - | < | + | < |
| + | cat <<' | ||
| + | # check files | ||
| - | </code>< | + | if [ ! -f "/tmp/rootfs" |
| + | echo " | ||
| + | exit 1 | ||
| + | fi | ||
| + | if [ ! -f "/ | ||
| + | echo " | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | # get bootconfig | ||
| + | |||
| + | mtd_part=$(grep -i " | ||
| + | bootconfig=$(hexdump -v -e '1/1 " | ||
| + | |||
| + | # write rootfs and kernel; mmcblk0p3=0/ | ||
| + | |||
| + | if [ " | ||
| + | dd if=/ | ||
| + | dd if=/ | ||
| + | dd if=/ | ||
| + | dd if=/ | ||
| + | sync | ||
| + | fi | ||
| + | if [ " | ||
| + | dd if=/ | ||
| + | dd if=/ | ||
| + | dd if=/ | ||
| + | dd if=/ | ||
| + | sync | ||
| + | fi | ||
| + | EOF | ||
| + | </ | ||
| ==== OEM firmware ==== | ==== OEM firmware ==== | ||
| Line 299: | Line 332: | ||
| - [[#Opening the case|Open the device case.]] | - [[#Opening the case|Open the device case.]] | ||
| - Connect to the device via [[# | - Connect to the device via [[# | ||
| - | - [[#U-Boot access|Access the device via bootloader.]] | + | - [[#Bootloader/U-Boot access|Access the device via bootloader.]] |
| - [[#TFTP boot OpenWrt|TFTP boot OpenWrt]] to either reinstall or fix a broken installation | [[#TFTP flash OEM firmware|TFTP flash OEM firmware]] to purge OpenWrt. | - [[#TFTP boot OpenWrt|TFTP boot OpenWrt]] to either reinstall or fix a broken installation | [[#TFTP flash OEM firmware|TFTP flash OEM firmware]] to purge OpenWrt. | ||
| \\ | \\ | ||
| Line 305: | Line 338: | ||
| ==== Opening the case ==== | ==== Opening the case ==== | ||
| - | <WRAP BOX> | + | 1. Remove the two rubber crosses from the device' |
| - | FIXME //Describe what needs to be done to open the device, e.g. remove | + | 2. Unscrew the two screws appearing after step 1. |
| - | </ | + | 3. Remove the socket. |
| + | 4. After step 3. another four screws appear. Remove them as well. | ||
| + | 5. Around | ||
| + | 6. Keep the device with bottom side up and pry it up carefully around the case to remove | ||
| + | |||
| + | *) You will likely break some of them. Especially those on the left or right side. The clips at the front' | ||
| + | \\ | ||
| ==== Serial ==== | ==== Serial ==== | ||
| Line 352: | Line 391: | ||
| - Generate the password:\\ \\ :!: **Do not enter the code below it into the current shell!** We have to open a new terminal application. We have distinguish here between Windows and Linux users!\\ \\ **__Linux__**: | - Generate the password:\\ \\ :!: **Do not enter the code below it into the current shell!** We have to open a new terminal application. We have distinguish here between Windows and Linux users!\\ \\ **__Linux__**: | ||
| < | < | ||
| - | cat << | + | cat <<'EOF' |
| ror32() { | ror32() { | ||
| echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) )) | echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) )) | ||
| Line 366: | Line 405: | ||
| <tabbox password> | <tabbox password> | ||
| < | < | ||
| - | sh tool.sh | + | sh tool.sh 013D72FF0710 |
| </ | </ | ||
| - Put the output from paragraph 4. in the terminal and press enter:\\ \\ < | - Put the output from paragraph 4. in the terminal and press enter:\\ \\ < | ||
| Line 397: | Line 436: | ||
| - Connect your PC/ | - Connect your PC/ | ||
| - Power up your router and get access to [[# | - Power up your router and get access to [[# | ||
| - | - Enter '' | + | - Enter '' |
| ===== Photos ===== | ===== Photos ===== | ||