HooToo HT-TM06
- Travel router with an internal battery and 2 usb ports. B/G/N capabilties
- uses the MT7620N chipset
- “big brother” of the HT-TM01/03
Telnet enable for stock firmware
Save the following code as EnterRouterMode.sh on a USB stick and insert it into TM06.
#!/bin/sh export PATH=/bin:/sbin:/usr/bin:/usr/sbin ETCPATH="/etc" #ETCPATH="/data/UsbDisk1/Volume1/etc" #Start telnetd. Will only give access until reboot. $ETCPATH/init.d/teld.sh start #Delete this script so that it only runs once rm -- "$0"
Installation
EASIER METHOD - NO SERIAL NEEDED There is an undocumented recovery mode: press the power button until the first white light comes on. Then release the power button and press and hold the reset button for at least 25 seconds. It then looks for the files on a tftp server at 10.10.10.254 (so set your computer to this static ip, and setup tftp server). It is looking for a file called “kernel” (without quotes, no file extension), so rename the Gl-inet firmware here to “kernel”. Wait several minutes for it to transfer and write to flash. It will then start looking for a file called “rootfs”. But here you can just hold power button down and let it shut down, the gl-inet has everything already. Turn on and it should boot to Openwrt.
Flash Layout
OEM Flash Layout:
$ cat /proc/mtd dev: size erasesize name mtd0: 00800000 00010000 "ALL" mtd1: 00030000 00010000 "Bootloader" mtd2: 00010000 00010000 "Config" mtd3: 00010000 00010000 "Factory" mtd4: 00180000 00010000 "Kernel_RootFS" mtd5: 00010000 00010000 "params" mtd6: 00010000 00010000 "user_backup" mtd7: 00010000 00010000 "user" mtd8: 00600000 00010000 "Rootfs" $
Upgrading OpenWrt
These are generic instructions. Update with your router's specifics.
LuCI Web Upgrade Process
- Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL
- Upload image file for sysupgrade to LuCI
- Wait for reboot
Terminal Upgrade Process
If you don't have a GUI (LuCI) available, you can alternatively upgrade via the command line. There are two command line methods for upgrading:
sysupgrademtd
Note: It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.
sysupgrade
- Login as root via SSH on 192.168.1.1, then enter the following commands:
cd /tmp wget http://http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc sysupgrade /tmp/xxx.abc
mtd
If sysupgrade does not support this router, use mtd.
- Login as root via SSH on 192.168.1.1, then enter the following commands:
cd /tmp wget http://http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc mtd write /tmp/xxx.abc linux && reboot
Debricking
Failsafe mode
Basic configuration
→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.
Specific Configuration
Please fill in real values for this device, then remove the EXAMPLEs
Network interfaces
The default network configuration is:
| Interface Name | Description | Default configuration |
|---|---|---|
| br-lan | EXAMPLE LAN & WiFi | EXAMPLE 192.168.1.1/24 |
| vlan0 (eth0.0) | EXAMPLE LAN ports (1 to 4) | EXAMPLE None |
| vlan1 (eth0.1) | EXAMPLE WAN port | EXAMPLE DHCP |
| wl0 | EXAMPLE WiFi | EXAMPLE Disabled |
Switch Ports (for VLANs)
Please fill in real values for this device, then remove the EXAMPLEs
Numbers 0-3 are Ports 1-4 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 5 is the internal connection to the router itself. Don't be fooled: Port 1 on the unit is number 3 when configuring VLANs. vlan0 = eth0.0, vlan1 = eth0.1 and so on.
| Port | Switch port |
|---|---|
| Internet (WAN) | EXAMPLE 4 |
| LAN 1 | EXAMPLE 3 |
| LAN 2 | EXAMPLE 2 |
| LAN 3 | EXAMPLE 1 |
| LAN 4 | EXAMPLE 0 |
Buttons
→ hardware.button on howto use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.
Please fill in real values for this device, then remove the EXAMPLEs
The HooToo HT-TM06 has the following buttons:
| BUTTON | Event |
|---|---|
| EXAMPLE Reset | reset |
| EXAMPLE Secure Easy Setup | ses |
| EXAMPLE No buttons at all. | - |
Hardware
Info
Photos
Front:
Insert photo of front of the casing
Back:
Insert photo of back of the casing
Backside label:
Insert photo of backside label
Opening the case
Note: This will void your warranty!
To open the box, use a flat screwdriver and remove the part of the device where the hootoo brand is. The battery is stuck on the board you have to be carefull when you remove it. You can then unplug the battery from the board. To remove the board you have 3 screws to remove.
Main PCB:
Insert photo of PCB
You can get the pictures from this links
Front view DEAD LINK --- tmomas 2019/10/12 09:55
Serial
→ port.serial general information about the serial port, serial port cable, etc.
How to connect to the Serial Port of this specific device:
Insert photo of PCB with markings for serial port
| Serial connection parameters for HooToo HT-TM06 | 57600, 8N1 | login:admin no password |
|---|
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc.
How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port
Bootlogs
OEM bootlog
U-Boot 1.1.3 (May 7 2014 - 05:33:12) Board: Ralink APSoC DRAM: 32 MB relocate_code Pointer at: 81fac000 enable ephy clock...done. rf reg 29 = 5 SSC disabled. spi_wait_nsec: 29 spi device id: c2 20 17 c2 20 (2017c220) find flash: MX25L6405D raspi_read: from:1d4000 len:1000 *** Warning - bad CRC, using default environment ============================================ Ralink UBoot Version: 4.1.0.0 -------------------------------------------- ASIC 7620_MP (Port5<->None) DRAM component: 256 Mbits DDR, width 16 DRAM bus: 16 bit Total memory: 32 MBytes Flash component: SPI Flash Date:May 7 2014 Time:05:33:12 ============================================ icache: sets:512, ways:4, linesz:32 ,total:65536 dcache: sets:256, ways:4, linesz:32 ,total:32768 ##### The CPU freq = 580 MHZ #### estimate memory size =32 Mbytes raspi_read: from:40028 len:6 Initialize vs configure module raspi_read: from:1d0000 len:1000 Initialize GPIO Input i key to enter menu 0 raspi_read: from:50000 len:180000 ## Booting image at 80500000 ... Image Name: Linux Kernel Image Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 1556261 Bytes = 1.5 MB Load Address: 80000000 Entry Point: 8000c2f0 Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 8000c2f0) ... ## Giving linux memsize in MB, 32 Starting kernel ... LINUX started... THIS IS ASIC [ 0.104000] PROC INIT OK! [ 0.252000] gre: can't add protocol enter init Start rootfs mounted echo 7 > /proc/sys/kernel/printk init dev files mounted end [ 2.964000] tntfs: module license 'Commercial. For support email ntfs-support@tuxera.com.' taints kernel. [ 2.984000] Disabling lock debugging due to kernel taint [ 3.020000] Tuxera NTFS driver 3014.4.29 [Flags: R/W MODULE]. [ 3.196000] Tuxera exFAT driver version 3014.1.24 [Flags: R/W MODULE]. [ 3.284000] Tuxera FAT driver 3013.2.9 [Flags: R/W MODULE]. Sun Oct 11 21:28:14 UTC 2015 Get time information first tz_minuteswest=0 Set time information offset=0 tz.tz_minuteswest=0 Get time information again tz_minuteswest=0 GMT-00:00 Finish the check crc SSID_PREFIX:TripMateTM06 wireless port last two bytes:-4cc2! str_buf=4CC2 SSID:TripMateTM06-4CC2 init net /etc/initnet: line 29: wanMode_restore: not found [ 7.520000] Raeth v3.0 (Tasklet,SkbRecycle) [ 7.528000] [ 7.528000] phy_tx_ring = 0x01623000, tx_ring = 0xa1623000 [ 7.528000] [ 7.528000] phy_rx_ring0 = 0x01624000, rx_ring0 = 0xa1624000 [ 7.528000] SMACCR1 -- : 0x0000001c [ 7.528000] SMACCR0 -- : 0xc21f4cc2 [ 7.572000] CDMA_CSG_CFG = 81000000 [ 7.580000] GDMA1_FWD_CFG = 20710000 [ 7.680000] RX DESC a1e3a000 size = 2048 [ 7.692000] RTMP_TimerListAdd: add timer obj c00e3798! [ 7.704000] RTMP_TimerListAdd: add timer obj c00a58e8! [ 7.712000] RTMP_TimerListAdd: add timer obj c00a58bc! [ 7.724000] RTMP_TimerListAdd: add timer obj c00a5890! [ 7.732000] RTMP_TimerListAdd: add timer obj c004d018! [ 7.744000] RTMP_TimerListAdd: add timer obj c004cc0c! [ 7.756000] RTMP_TimerListAdd: add timer obj c004cfe8! [ 7.764000] RTMP_TimerListAdd: add timer obj c004d324! [ 7.776000] RTMP_TimerListAdd: add timer obj c004d264! [ 7.784000] RTMP_TimerListAdd: add timer obj c004d294! [ 7.796000] RTMP_TimerListAdd: add timer obj c00501e4! [ 7.804000] RTMP_TimerListAdd: add timer obj c004fdd8! [ 7.816000] RTMP_TimerListAdd: add timer obj c00501b4! [ 7.828000] RTMP_TimerListAdd: add timer obj c00504f0! [ 7.836000] RTMP_TimerListAdd: add timer obj c0050430! [ 7.848000] RTMP_TimerListAdd: add timer obj c0050460! [ 7.856000] RTMP_TimerListAdd: add timer obj c00533b0! [ 7.868000] RTMP_TimerListAdd: add timer obj c0052fa4! [ 7.876000] RTMP_TimerListAdd: add timer obj c0053380! [ 7.888000] RTMP_TimerListAdd: add timer obj c00536bc! [ 7.896000] RTMP_TimerListAdd: add timer obj c00535fc! [ 7.908000] RTMP_TimerListAdd: add timer obj c005362c! [ 7.920000] RTMP_TimerListAdd: add timer obj c005657c! [ 7.928000] RTMP_TimerListAdd: add timer obj c0056170! [ 7.940000] RTMP_TimerListAdd: add timer obj c005654c! [ 7.948000] RTMP_TimerListAdd: add timer obj c0056888! [ 7.960000] RTMP_TimerListAdd: add timer obj c00567c8! [ 7.968000] RTMP_TimerListAdd: add timer obj c00567f8! [ 7.980000] RTMP_TimerListAdd: add timer obj c0059748! [ 7.992000] RTMP_TimerListAdd: add timer obj c005933c! [ 8.000000] RTMP_TimerListAdd: add timer obj c0059718! [ 8.012000] RTMP_TimerListAdd: add timer obj c0059a54! [ 8.020000] RTMP_TimerListAdd: add timer obj c0059994! [ 8.032000] RTMP_TimerListAdd: add timer obj c00599c4! [ 8.040000] RTMP_TimerListAdd: add timer obj c005c914! [ 8.052000] RTMP_TimerListAdd: add timer obj c005c508! [ 8.060000] RTMP_TimerListAdd: add timer obj c005c8e4! [ 8.072000] RTMP_TimerListAdd: add timer obj c005cc20! [ 8.084000] RTMP_TimerListAdd: add timer obj c005cb60! [ 8.092000] RTMP_TimerListAdd: add timer obj c005cb90! [ 8.104000] RTMP_TimerListAdd: add timer obj c005fae0! [ 8.112000] RTMP_TimerListAdd: add timer obj c005f6d4! [ 8.124000] RTMP_TimerListAdd: add timer obj c005fab0! [ 8.132000] RTMP_TimerListAdd: add timer obj c005fdec! [ 8.144000] RTMP_TimerListAdd: add timer obj c005fd2c! [ 8.152000] RTMP_TimerListAdd: add timer obj c005fd5c! [ 8.164000] RTMP_TimerListAdd: add timer obj c0062cac! [ 8.176000] RTMP_TimerListAdd: add timer obj c00628a0! [ 8.184000] RTMP_TimerListAdd: add timer obj c0062c7c! [ 8.196000] RTMP_TimerListAdd: add timer obj c0062fb8! [ 8.204000] RTMP_TimerListAdd: add timer obj c0062ef8! [ 8.216000] RTMP_TimerListAdd: add timer obj c0062f28! [ 8.224000] RTMP_TimerListAdd: add timer obj c00a7cf0! [ 8.236000] RTMP_TimerListAdd: add timer obj c00a78e4! [ 8.248000] RTMP_TimerListAdd: add timer obj c00a7cc0! [ 8.256000] RTMP_TimerListAdd: add timer obj c00a7ffc! [ 8.268000] RTMP_TimerListAdd: add timer obj c00a7d20! [ 8.276000] RTMP_TimerListAdd: add timer obj c00a7d50! [ 8.288000] RTMP_TimerListAdd: add timer obj c00a7d80! [ 8.296000] RTMP_TimerListAdd: add timer obj c00ba104! [ 8.308000] RTMP_TimerListAdd: add timer obj c00ba220! [ 8.316000] RTMP_TimerListAdd: add timer obj c00ba130! [ 8.328000] RTMP_TimerListAdd: add timer obj c00a83ac! [ 8.340000] RTMP_TimerListAdd: add timer obj c004a4d8! [ 8.352000] RTMP_TimerListAdd: add timer obj c004d6a4! [ 8.360000] RTMP_TimerListAdd: add timer obj c0050870! [ 8.372000] RTMP_TimerListAdd: add timer obj c0053a3c! [ 8.380000] RTMP_TimerListAdd: add timer obj c0056c08! [ 8.392000] RTMP_TimerListAdd: add timer obj c0059dd4! [ 8.400000] RTMP_TimerListAdd: add timer obj c005cfa0! [ 8.412000] RTMP_TimerListAdd: add timer obj c006016c! [ 8.420000] RTMP_TimerListAdd: add timer obj c00a80bc! [ 8.536000] RT_CfgSetMacAddress : invalid length (0) [ 8.556000] APSDCapable[0]=0 [ 8.564000] APSDCapable[1]=0 [ 8.568000] APSDCapable[2]=0 [ 8.572000] APSDCapable[3]=0 [ 8.580000] APSDCapable[4]=0 [ 8.584000] APSDCapable[5]=0 [ 8.592000] APSDCapable[6]=0 [ 8.596000] APSDCapable[7]=0 [ 8.604000] APSDCapable[8]=0 [ 8.608000] APSDCapable[9]=0 [ 8.612000] APSDCapable[10]=0 [ 8.620000] APSDCapable[11]=0 [ 8.624000] APSDCapable[12]=0 [ 8.632000] APSDCapable[13]=0 [ 8.636000] APSDCapable[14]=0 [ 8.644000] APSDCapable[15]=0 [ 8.648000] default ApCliAPSDCapable[0]=0 [ 8.856000] Key1Str is Invalid key length(0) or Type(1) [ 8.864000] Key2Str is Invalid key length(0) or Type(0) [ 8.876000] Key3Str is Invalid key length(0) or Type(0) [ 8.888000] Key4Str is Invalid key length(0) or Type(0) [ 8.900000] APCli_WPAPSK_KEY, key string required 8 ~ 64 characters!!! [ 9.108000] c3:1b:28:72:26:ea:73:2d:2e:92:fd:f8:f7:d5:9b:50: [ 9.120000] 03:c7:6e:f6:6b:61:01:3e:c5:5e:d0:81:40:a1:8c:fb: [ 9.132000] [ 9.136000] I/F(apcli0) Key1Str is Invalid key length! [ 9.144000] I/F(apcli0) Key2Str is Invalid key length! [ 9.156000] I/F(apcli0) Key3Str is Invalid key length! [ 9.168000] I/F(apcli0) Key4Str is Invalid key length! [ 9.188000] Wrong OBSSScanParamtetrs format in dat file!!!!! Use default value. [ 9.220000] EntryLifeCheck=1024 [ 9.224000] 1. Phy Mode = 9 [ 9.232000] 2. Phy Mode = 9 [ 9.236000] E2PROM: D0 target power=0xffff [ 9.244000] E2PROM: 40 MW Power Delta= 0 [ 9.252000] 3. Phy Mode = 9 [ 9.260000] AntCfgInit: primary/secondary ant 0/1 [ 9.260000] Initialize RF Central Registers for E2 !!! [ 9.280000] Initialize RF Central Registers for E3 !!! [ 9.292000] Initialize RF Channel Registers for E2 !!! [ 9.300000] Initialize RF Channel Registers for E3 !!! [ 9.312000] Initialize RF DCCal Registers for E2 !!! [ 9.320000] Initialize RF DCCal Registers for E3 !!! [ 9.332000] D1 = -2, D2 = 12, CalCode = 33 !!! [ 9.344000] RT6352_Temperature_Init : BBPR49 = 0xfffffffe [ 9.352000] RT6352_Temperature_Init : TemperatureRef25C = 0xfffffff4 [ 9.368000] Current Temperature from BBP_R49=0xffffffee [ 9.380000] TX BW Filter Calibration !!! [ 9.500000] RX BW Filter Calibration !!! [ 9.732000] LOFT Calibration Done! [ 9.736000] IQCalibration Start! [ 9.756000] IQCalibration Done! CH = 0, (gain= f, phase= 2) [ 9.768000] IQCalibration Start! [ 9.784000] IQCalibration Done! CH = 1, (gain= 4, phase=1c) [ 9.796000] TX IQ Calibration Done! [ 9.808000] VGA Code idx overflow(19), AM_63(0) !!! [ 9.820000] VGA Code idx overflow(19), AM_63(0) !!! [ 9.860000] RXIQ Sigma_i=0, Sigma_q=0, R_iq=0 [ 9.868000] RXIQ calibration FAIL [ 9.876000] internal ALC is not enabled in NVM ! [ 9.884000] MCS Set = ff ff 00 00 01 [ 9.900000] VGA Code idx overflow(19), AM_63(0) !!! [ 9.912000] VGA Code idx overflow(19), AM_63(0) !!! [ 9.948000] RTMP_TimerListAdd: add timer obj c00b19e0! [ 9.968000] VGA Code idx overflow(19), AM_63(0) !!! [ 9.980000] VGA Code idx overflow(19), AM_63(0) !!! [ 10.020000] Main bssid = 00:1c:c2:1f:4c:c2 [ 10.028000] <==== rt28xx_init, Status=0 [ 10.040000] 0x1300 = 00064380 ifconfig: SIOCGIFFLAGS: No such device brctl: bridge br0: No such device or address vconfig: ioctl error for rem: No such device vconfig: ioctl error for rem: No such device [ 10.732000] device eth2 entered promiscuous mode restore RT6855 ESW to dump switch mode switch reg write offset=2004, value=ff0000 switch reg write offset=2104, value=ff0000 switch reg write offset=2204, value=ff0000 switch reg write offset=2304, value=ff0000 switch reg write offset=2404, value=ff0000 switch reg write offset=2504, value=ff0000 switch reg write offset=2604, value=ff0000 switch reg write offset=2704, value=ff0000 switch reg write offset=2010, value=810000c0 switch reg write offset=2110, value=810000c0 swi[ 10.936000] device ra0 entered promiscuous mode tch reg write offset=2210, value=810000c0 switch reg write offset=2310, value=810000c0 switch reg write offset=2410, value=810000c0 switch reg write offset=2510, value=810000c0 switch reg write offset=2610, value=810000c0 switch reg write offset=2710, value=810000c0 REG_ESW_WT_MAC_ATC is 0x7ff0002 done. /sbin/netinit.sh: line 288: addRax2Br0: not found [ 11.036000] br0: port 1(ra0) entering learning state [ 11.048000] br0: port 1(ra0) entering learning state [ 12.048000] br0: port 1(ra0) entering forwarding state Set: phy[0].reg[0] = 3900 Set: phy[4].reg[0] = 3900 Set: phy[0].reg[0] = 3100 Set: phy[4].reg[0] = 3100 udhcpc (v1.12.1) started iptables: Bad rule (does a matching rule exist in that chain?). iptables: Bad rule (does a matching rule exist in that chain?). iptables v1.4.10: can't initialize iptables table `mangle': Table does not exist (do you need to in[ 14.748000] hao: input argv = 1 smod?) Perhaps iptables or your kernel needs to be upgraded. [ 14.920000] udevd version 125 started /etc/rc.d/rc1.d/S34ntpclient start /etc/rc.d/rc1.d/S75fileserv start 0.pool.ntp.org: Unknown host 1.pool.ntp.org: Unknown host 2.pool.ntp.org: Unknown host 3.pool.ntp.org: Unknown host /etc/rc.d/rc1.d/S77qos start /etc/rc.d/rc: line 41: /etc/rc.d/rc1.d/S77qos: not found /etc/rc.d/rc1.d/S80webd start /etc/rc.d/rc1.d/S82upnpd start /etc/rc.d/rc1.d/S99local start ddddddddddddd /usr/sbin/listen_sleep & HT-TM06 login: [ 18.028000] RTMP_TimerListAdd: add timer obj c00f9540! [ 18.036000] RTMP_TimerListAdd: add timer obj c00f96f8! [ 18.048000] drivers/net/wireless/rt2860v2_ap/../rt2860v2/ap/ap_data.c:4354 assert pEntry->Aid == pRxWI->WirelessCliIDfailed [ 18.072000] RTMP_TimerListAdd: add timer obj c010d184! [ 25.184000] enable send the SIGUSR2 [ 25.464000] Rcv Wcid(1) AddBAReq [ 25.472000] Start Seq = 00000002 [ 25.476000] RTMP_TimerListAdd: add timer obj c010ef94! [ 25.528000] Rcv Wcid(1) AddBAReq [ 25.536000] Start Seq = 00000000 [ 25.540000] RTMP_TimerListAdd: add timer obj c010efe4! [ 27.276000] RTMP_TimerListAdd: add timer obj c010d1c0! [ 63.636000] Rcv Wcid(1) AddBAReq [ 63.644000] Start Seq = 00000000 [ 65.932000] Rcv Wcid(1) AddBAReq [ 65.940000] Start Seq = 00000003 [ 66.644000] a, flush one! [ 90.604000] RTMP_TimerListAdd: add timer obj c00f9f70! [ 90.616000] RTMP_TimerListAdd: add timer obj c00fa128! [ 90.936000] AP SETKEYS DONE - WPA2, AuthMode(7)=WPA2PSK, WepStatus(6)=AES, GroupWepStatus(4)=TKIP [ 90.936000] [ 91.372000] Rcv Wcid(2) AddBAReq [ 91.376000] Start Seq = 00000000 [ 91.384000] RTMP_TimerListAdd: add timer obj c010f034! [ 120.616000] RTMP_TimerListAdd: add timer obj c010d1fc! [ 189.116000] Rcv Wcid(2) AddBAReq [ 189.120000] Start Seq = 00000000 [ 189.128000] RTMP_TimerListAdd: add timer obj c010f084! [ 208.420000] Rcv Wcid(1) AddBAReq [ 208.424000] Start Seq = 00000000 [ 208.432000] RTMP_TimerListAdd: add timer obj c010f0d4! [ 208.480000] RTMP_TimerListAdd: add timer obj c010d238! [ 209.052000] Rcv Wcid(1) AddBAReq [ 209.056000] Start Seq = 00000001
OpenWrt bootlog
COPY HERE THE BOOTLOG ONCE OPENWRT IS INSTALLED AND RUNNING