EnGenius EPG5000
Supported Versions
Hardware Highlights
Installation
OEM Flash Layout
# cat /proc/mtd dev: size erasesize name mtd0: 01000000 00010000 "ALL" mtd1: 00030000 00010000 "Bootloader" mtd2: 00010000 00010000 "Config" mtd3: 00e50000 00010000 "Kernel" mtd4: 00c80000 00010000 "apps" mtd5: 00100000 00010000 "manufacture" mtd6: 00010000 00010000 "backup" mtd7: 00050000 00010000 "storage" mtd8: 00010000 00010000 "caldata"
Flash Layout
EPG5000 Flash Layout | |||||||||
---|---|---|---|---|---|---|---|---|---|
Layer0 | spi0.0: m25p80 16384KiB | ||||||||
Layer1 | mtd0 u-boot 192KiB | mtd1 u-boot-env 64KiB | mtd9 firmware 14656KiB | mtd5 manufacture 1024KiB | mtd6 backup 64KiB | mtd7 storage 320KiB | mtd8 caldata 64KiB | ||
Layer2 | mtd2 kernel 1408KiB | mtd3 rootfs 13248KiB | |||||||
mountpoint | / | ||||||||
filesystem | mini_fo/overlayfs | ||||||||
Layer3 | mtd4 rootfs_data 10688KiB | ||||||||
Size in KiB | 192KiB | 64KiB | 1408KiB | 2560KiB | 10688KiB | 1024KiB | 64KiB | 320KiB | 64KiB |
Name | u-boot | u-boot-env | kernel | rootfs | rootfs_data | manufacture | backup | storage | caldata |
mountpoint | none | none | none | /rom | /overlay | none | none | none | none |
filesystem | none | none | none | SquashFS | JFFS2 | none | none | none | none |
OEM installation using the TFTP method
Boot Serial Console and Press Key 2 Use TFTP server with Image openwrt-ar71xx-generic-epg5000-squashfs-sysupgrade.bin At this time ath10 is missing.
Upgrading OpenWrt
If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.
LuCI Web Upgrade Process
- Browse to
http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/
LuCI Upgrade URL - Upload image file for sysupgrade to LuCI
- Wait for reboot
Terminal Upgrade Process
After adding the device to the repository, correct the missing values in the commands.
- Login as root via SSH on 192.168.1.1
- Use the following commands to upgrade.
cd /tmp/ wget http://http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc sysupgrade /tmp/xxx.abc
- If sysupgrade does not support this router, use the following commands.
cd /tmp/ wget http://http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc mtd write /tmp/xxx.abc linux && reboot
Reverting to OEM firmware
- Download OEM .dlf firmware file to /tmp on your PC (for instance from http://www.engenius-europe.com/index.php/product-zoo/home-soho/item/epg5000#downloads)
- Decode .dlf via mkseanofw found in staging_dir/host/bin of OpenWRT buildroot
./mksenaofw -d /tmp/<oem-firmware.dlf> -r 0x101 -p 0x71 -t 2 -o /srv/tftp/oem.img
- Boot Serial Console and Press Key 2
- Use TFTP server with Image oem.img
Basic configuration
→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.
Interfaces
The default network configuration is:
Interface Name | Description | Default configuration |
---|---|---|
br-lan | LAN & WiFi | 192.168.0.1/24 |
vlan0 (eth0.0) | LAN ports (1 to 4) | None |
vlan1 (eth0.1) | WAN port | DHCP |
wl0 | WiFi | Disabled |
wl1 | WiFi | Disabled |
This might be wrong.
Switch Ports (for VLANs)
Port | Switch port |
---|---|
CPU ETH0 | 0 |
LAN 4 | 1 |
LAN 3 | 2 |
LAN 2 | 3 |
LAN 1 | 4 |
WAN | 5 |
CPU ETH1 | ? |
? | 6 |
Failsafe mode
Buttons
→ hardware.button on howto use and configure the hardware button(s).
The EnGenius EPG5000 has two buttons. They are Reset and WPS. Here, we merely name the buttons, so we can use them in the above Howto:
BUTTON | Event |
---|---|
Reset | reset |
WPS | wps |
I just guessed the names, I haven't actually gotten the real ones yet.
Info
Instruction set | MIPS |
---|---|
Vendor | Qualcomm Atheros |
bootloader | U-Boot |
System-On-Chip | QCA9558-AT4A Rev 2 |
CPU @Frq | MIPS 74Kc V5.0 @720MHz |
Flash size | 16 MiB |
Flash Chip | |
RAM size | 128 MiB |
RAM Chip | |
Wireless No1 | SoC-integrated: QCA9558-AT4A w/ 3×3 MIMO for 2.4GHz 802.11b/g/n |
Wireless No2 | Mini PCI-e: QCA9880-BR4A w/ 3×3 MIMO for 5GHz 802.11a/n/ac |
switch | Qualcomm Atheros QCA8337-AL3C (Gigabit, VLAN) |
Modem | none |
USB | Yes 1 x 2.0 |
Serial | Yes |
JTAG | ? |
Photos
Opening the case
Note: This will void your warranty!
- To remove the case, first flip the router upside-down, so that you can see the four screws holding it together.
- Then, use a screwdriver to remove the screws.
- Flip the router right-side up (EnGenius logo on top) and gently lift the top off.
- Unscrew the two screws holding the circuit board.
- Flip the router over again and pull the bottom casing away from the router (it might get stuck on the ethernet ports).
- Be sure not to lose the WPS button that will almost certainly fall out after removing the back case.
- You should now have access to all the important bits of the router. If you need to access the rest of it, just flip over the circuit board.
Serial
→ port.serial general information about the serial port, serial port cable, etc.
The pins, starting from the white triangle on the PCB marking pin 1:
1 | 2 | 3 | 4 |
---|---|---|---|
VCC (3.3V) | GND | TX | RX |
The serial port on the EPG5000 has a 4-pin 0.1“ header pre-soldered to the board, making connecting to it trivial. It uses 3.3V logic levels, so make sure your serial cable either only outputs 3.3V or has a 3.3V mode.
It is sufficient to connect only GND, RX and TX!
baud: 115200, parity: none, flow control: none.
password: aigo3d0a0tdagr
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc.
I don't think this router has any JTAG test points.
Debricking
Bootlogs
OEM bootlog
U-Boot 1.0.2 (Sep 3 2014 - 15:17:15) Product Name: ESR1200_1750 ap136 - Scorpion 1.0 DRAM:256 MB Now running in RAM - U-Boot at: 8ffc8000 Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18 flash_manuf_id =c22018 ,Flash size 16MB, sector count = 256 In: serial Out: serial Err: serial reset_switch: reset_usb: Multi Net: ath_gmac_enet_initialize... athrs_sgmii_res_cal: cal value = 0x1 No valid address in Flash. Using fixed address ath_gmac_enet_initialize: reset mask:c02200 Scorpion ----> S17 PHY * : cfg1 0x80000000 cfg2 0x7114 eth0: 00:03:7f:09:0b:ad athrs17_reg_init: SUPPORT_QCA8337 athrs17_reg_init: QCA8337 ID=1302 athrs17_reg_init: complete eth0 up eth0 Setting 0x18116290 to 0x60c0214f Please choose the operation: 1: Load system code to SDRAM via TFTP. 3: Boot system code via Flash (default). 0 3: System Boot system code via Flash. ## Booting image at 9f040000 ... Image Name: Linux Kernel Image Created: 2014-09-15 11:14:03 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 1876810 Bytes = 1.8 MB Load Address: 80002000 Entry Point: 802ae590 Verifying Checksum at 0x9f040040 ...OK Uncompressing Kernel Image ... OK Starting kernel ... Booting QCA955x init started: BusyBox v1.7.5 (2014-09-15 19:01:42 CST) starting pid 803, tty '/dev/console': '/sbin/config_init' mknod: /dev/ttyS0: File exists mknod: /dev/ttyS1: File exists Config Init version: 1.0.1.11 date: 2014/09/15 Wed Jan 1 00:00:00 UTC 2014 ln: /lib/./modules: File exists starting pid 863, tty '/dev/ttyS0': '/sbin/config_term' [sysUtil] Hardware ID - 01010071 [sysUtil] Load vendor[0] information ************************************************************************ * EPG5000 * ************************************************************************ KernelApp/Ramdisk Ver:1.0.1.11 Date:2014/09/15 password: