Etisalat S3

OEM: Sercomm S3

Etisalat S3 is a wireless router based on the MT7621 platform with USB 3.0 port.

• Community builds

1. Login to the router web interface under admin account

2. Navigate to Settings → Configuration → Save to Computer

3. Decode the configuration. For example, using cfgtool.py tool (A tool for decoding and encoding Sercomm configs - https://github.com/r3d5ky/sercomm_cfg_unpacker):

cfgtool.py -u configurationBackup.cfg

"""
Copyright (c) 2022 r3d5ky
 
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
 
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
 
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
OR OTHER DEALINGS IN THE SOFTWARE.
"""
 
import zlib
import sys
import argparse
 
def unpack(cfg_file, raw):
    with open(cfg_file, 'rb') as f:
        infile = f.read()
 
    unpacked = zlib.decompress(infile[4:])
    config = unpacked[unpacked.find(b'\x3c\x44\x41\x54\x41'):-6]
    userdata = unpacked[:unpacked.find(b'\x3c\x44\x41\x54\x41')]
 
    if raw:
        with open(cfg_file[:-4] + '_raw.txt', 'wb') as f:
            f.write(unpacked)
 
    with open(cfg_file[:-4] + '.xml', 'wb') as f:
        f.write(config)
    with open(cfg_file[:-4] + '_userdata.bin', 'wb') as f:
        f.write(userdata)
 
 
def pack(xml_file, endianness):
    with open(xml_file, 'rb') as f:
        rawconfig = f.read() + b'\x0a\x00'
    with open(xml_file[:-4] + '_userdata.bin', 'rb') as f:
        userdata = f.read()
    endian = "little"
    if endianness:
        endian = "big"
    crc = zlib.crc32(rawconfig).to_bytes(4, endian)
    config = userdata + rawconfig + crc
 
    with open(sys.argv[2][:-4] + '_changed.cfg', 'wb') as f: 
        f.write(len(config).to_bytes(4, endian) + zlib.compress(config))
 
 
def main():
    parser = argparse.ArgumentParser(description="Sercomm backup config packer/unpacker")
    group = parser.add_mutually_exclusive_group(required=True)
    group.add_argument("-u","--unpack", action='store_true', help="unpack .cfg file to .xml + header")
    group.add_argument("-p","--pack", action='store_true', help="pack .xml + header back to .cfg")
    parser.add_argument("-r","--raw", action='store_true', help="create additional file with raw unpacked data (optional)")
    parser.add_argument("-b","--big", action='store_true', help="pack for Big Endian arch (default is Little Endian)")
    parser.add_argument('file', type=str, help="path to .cfg/.xml file for unpacking/packing")
    args = parser.parse_args()
 
    if args.unpack:
        unpack(args.file, args.raw)
    elif args.pack:
        pack(args.file, args.big)
 
    print("Done!")
 
 
if __name__ == '__main__':
    main()

4. Open configurationBackup.xml and find the following line:

<PARAMETER name="Password" type="string" value="<your router serial is here>" writable="1" encryption="1" password="1"/>

5. Insert the following line after and save:

<PARAMETER name="Enable" type="boolean" value="1" writable="1" encryption="0"/>

6. Encode the configuration. For example, using cfgtool.py tool:

cfgtool.py -p configurationBackup.xml

7. Upload the changed configuration (configurationBackup_changed.cfg) to the router

8. Login to the router web interface (SuperUser:ETxxxxxxxxxx, where ETxxxxxxxxxx is the serial number from the backplate label)

9. Navigate to Settings → Access Control → Allow SSH (& Press apply)

10. Connect to the router using SSH shell under SuperUser account

11. Run in SSH shell:

sh

12. Make a mtd backup (optional, see related section)

13. Change bootflag to Sercomm1 and reboot:

printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
reboot

14. Login to the router web interface under admin account

15. Remove dots from the OpenWrt factory image filename

16. Update firmware via web using OpenWrt factory image

It's recommended to make a mtd backup before you start:

1. Set up a tftp server (e.g. tftpd64 for windows)

2. Connect to a router using SSH shell and run the following commands:

cd /tmp
for i in 0 1 2 3 4 5 6 7 8 9 10; do nanddump -f mtd$i /dev/mtd$i; \
tftp -l mtd$i -p 10.0.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done
tftp -l mtd.md5 -p 10.0.0.2

1. Change the bootflag to Sercomm1 in OpenWrt CLI and then reboot:

printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3

2. Optional: Update with any stock (Etisalat S3) firmware if you want to overwrite OpenWrt in Slot 0 completely.

See Installation section

Not applicable

→ generic.flashing.tftp

→ generic.sysupgrade

• Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL
• Upload image file for sysupgrade to LuCI
• Wait for reboot

If you don't have a GUI (LuCI) available, you can alternatively upgrade via the command line. There is a command line method for upgrading:

• sysupgrade

Note: It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

• Login as root via SSH on 192.168.1.1, copy images to /tmp using SCP and then enter the following commands:

cd /tmp
sysupgrade /tmp/sysupgrade.bin

→ generic.debrick

1. Compile sercomm-recovery under the Linux:

git clone https://github.com/danitool/sercomm-recovery.git
make

2. Connect the router with a cable and run sercomm-recovery:

sudo ./sercomm-recovery enp0s3 recovery_etisalat_s3_stock_slot1.bin

where enp0s3 - network interface connected the router, ifconfig - list on available network interfaces

3. Wait until the router is flashed and rebooted.

Download ready recovery images for Sercomm devices.

→ failsafe_and_factory_reset

→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

The default network configuration is:

→ hardware.button on howto use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.

The Etisalat S3 has the following buttons:

Front:
Insert photo of front of the casing

Back:
Insert photo of back of the casing

Backside label:
Insert photo of backside label

Note: This will void your warranty!

There are 2 crews behind the rubber feet. There are also clips around the edge of the case you will need to prize open, using, for example, a plastic card.

Main PCB:
Insert photo of PCB

→ port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of the Etisalat S3:

You need to connect R53 and R54 pins (marked red on the photo). For example using the solder.

→ port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

→ bootloader

None so far.

This appears to be the same device as the Vodacom S3, though the firmware on the Vodacom S3 saves an encrypted .rom file instead of a .cfg file and so is not able to be flashed using the same procedure.

• Community builds