Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revisionBoth sides next revision | ||
| toh:netgear:wnr2000v4 [2015/01/06 02:59] – Cleaned this text a bit to make it easier to understand Umeaboy | toh:netgear:wnr2000v4 [2019/10/14 16:04] – 432 warning added tmomas | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | ====== Netgear WNR2000 v4 ====== | ||
| + | {{section> | ||
| + | |||
| + | ===== Supported Versions ===== | ||
| + | ---- datatable ---- | ||
| + | cols : Brand, Model, Versions, Supported Current Rel, OEM device homepage URL_url, OWrt Forum Topic URL_url, Device Techdata_pageid | ||
| + | headers : Brand, Model, Version, Current Release, OEM Info, Forum Topic, Technical Data | ||
| + | align : c, | ||
| + | filter | ||
| + | filter | ||
| + | ---- | ||
| + | |||
| + | |||
| + | ===== Hardware Highlights ===== | ||
| + | ---- datatable ---- | ||
| + | cols : Model, Versions, CPU, CPU MHz, Flash MB_mbflashs, | ||
| + | header | ||
| + | align : c, | ||
| + | filter | ||
| + | filter | ||
| + | ---- | ||
| + | |||
| + | |||
| + | ===== Installation ===== | ||
| + | ---- datatable ---- | ||
| + | cols : Model, Versions, Supported Current Rel, Firmware OpenWrt Install URL_url, Firmware OpenWrt Upgrade URL_url, Firmware OEM Stock URL_url | ||
| + | headers : Model, Version, Current Release, Firmware OpenWrt Install, Firmware OpenWrt Upgrade, Firmware OEM Stock | ||
| + | align : c,c,c | ||
| + | filter | ||
| + | filter | ||
| + | ---- | ||
| + | |||
| + | -> [[docs: | ||
| + | |||
| + | |||
| + | ====How to Install OpenWrt on the Netgear wnr2000v4 through u-boot-env modification on Linux:==== | ||
| + | |||
| + | **1.** Change the IP-Address of your computer into: 192.168.1.10 | ||
| + | |||
| + | **2.** Flash to Stock-Firmware version 1.0.0.58: | ||
| + | |||
| + | -> Here's where you can get it: http:// | ||
| + | |||
| + | **3.** Start running a TFTP Server on your local machine. | ||
| + | |||
| + | **4.** Download and use a pre-made u-boot-env image | ||
| + | |||
| + | Warning: There is a slight chance to brick your router by using this pre-made u-boot-env image. It is 100% your own decision to try this method at your own risk. However, it worked for me. | ||
| + | |||
| + | Download this u-boot-env into your TFTP downloads directory: https:// | ||
| + | |||
| + | | ||
| + | |||
| + | **5.** Download the current OpenWrt image (15.05.1 - Chaos Calmer): | ||
| + | |||
| + | wget http:// | ||
| + | |||
| + | Download this file into your TFTP downloads directory and maybe for usability rename it into: sysfsupgrade.bin | ||
| + | |||
| + | **6.** Create and Use the UDPtelnetenable.py Script | ||
| + | | ||
| + | In Linux there' | ||
| + | |||
| + | This is the source code for the UDPtelnetenable.py: | ||
| + | |||
| + | # Copyright (c) 2009 Paul Gebheim | ||
| + | # | ||
| + | # Permission is hereby granted, free of charge, to any person obtaining a copy | ||
| + | # of this software and associated documentation files (the " | ||
| + | # in the Software without restriction, | ||
| + | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell | ||
| + | # copies of the Software, and to permit persons to whom the Software is | ||
| + | # furnished to do so, subject to the following conditions: | ||
| + | # | ||
| + | # The above copyright notice and this permission notice shall be included in | ||
| + | # all copies or substantial portions of the Software. | ||
| + | # | ||
| + | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | ||
| + | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | ||
| + | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE | ||
| + | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | ||
| + | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, | ||
| + | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN | ||
| + | # THE SOFTWARE. | ||
| + | import sys | ||
| + | import socket | ||
| + | import array | ||
| + | from optparse import OptionParser | ||
| + | from Crypto.Cipher import Blowfish | ||
| + | from Crypto.Hash import MD5 | ||
| + | | ||
| + | TELNET_PORT = 23 | ||
| + | | ||
| + | # The version of Blowfish supplied for the telenetenable.c implementation | ||
| + | # assumes Big-Endian data, but the code does nothing to convert the | ||
| + | # little-endian stuff it's getting on intel to Big-Endian | ||
| + | # | ||
| + | # So, since Crypto.Cipher.Blowfish seems to assume native endianness, we need | ||
| + | # to byteswap our buffer before and after encrypting it | ||
| + | # | ||
| + | # This helper does the byteswapping on the string buffer | ||
| + | def ByteSwap(data): | ||
| + | a = array.array(' | ||
| + | if(a.itemsize < 4): | ||
| + | a = array.array(' | ||
| + | | ||
| + | if(a.itemsize != 4): | ||
| + | print "Need a type that is 4 bytes on your platform so we can fix the data!" | ||
| + | exit(1) | ||
| + | | ||
| + | a.fromstring(data) | ||
| + | a.byteswap() | ||
| + | return a.tostring() | ||
| + | | ||
| + | def GeneratePayload(mac, | ||
| + | # eventually reformat mac | ||
| + | mac = mac.replace(":","" | ||
| + | | ||
| + | # Pad the input correctly | ||
| + | assert(len(mac) < 0x10) | ||
| + | just_mac = mac.ljust(0x10, | ||
| + | | ||
| + | assert(len(username) <= 0x10) | ||
| + | just_username = username.ljust(0x10, | ||
| + | assert(len(password) <= 0x10) | ||
| + | just_password = password.ljust(0x10, | ||
| + | | ||
| + | cleartext = (just_mac + just_username + just_password).ljust(0x70, | ||
| + | md5_key = MD5.new(cleartext).digest() | ||
| + | | ||
| + | payload = ByteSwap((md5_key + cleartext).ljust(0x80, | ||
| + | | ||
| + | secret_key = " | ||
| + | return ByteSwap(Blowfish.new(secret_key, | ||
| + | | ||
| + | | ||
| + | def SendPayload(ip, | ||
| + | for res in socket.getaddrinfo(ip, | ||
| + | af, socktype, proto, canonname, sa = res | ||
| + | try: | ||
| + | s = socket.socket(af, | ||
| + | except socket.error, | ||
| + | s = None | ||
| + | continue | ||
| + | | ||
| + | try: | ||
| + | s.connect(sa) | ||
| + | except socket.error, | ||
| + | s.close() | ||
| + | s= None | ||
| + | continue | ||
| + | break | ||
| + | | ||
| + | if s is None: | ||
| + | print "Could not connect to ' | ||
| + | else: | ||
| + | s.send(payload) | ||
| + | s.close() | ||
| + | print "Sent telnet enable payload to ' | ||
| + | | ||
| + | def main(): | ||
| + | args = sys.argv[1: | ||
| + | if len(args) < 3 or len(args) > 4: | ||
| + | print " | ||
| + | | ||
| + | ip = args[0] | ||
| + | mac = args[1] | ||
| + | username = args[2] | ||
| + | | ||
| + | password = "" | ||
| + | if len(args) == 4: | ||
| + | password = args[3] | ||
| + | | ||
| + | payload = GeneratePayload(mac, | ||
| + | SendPayload(ip, | ||
| + | | ||
| + | main() | ||
| + | |||
| + | Now run the UDPtelnetenable through the following command: | ||
| + | |||
| + | python UDPtelnetenable.py 192.168.1.1 $(Your MAC-ADRESS found by running `arp -a` as root) admin password | ||
| + | |||
| + | **7.** Connect to your router through Telnet | ||
| + | |||
| + | telnet 192.168.1.1 | ||
| + | | ||
| + | | ||
| + | **8.** Flash the u-boot-env through TFTP | ||
| + | |||
| + | Now, from WNR2000V4 root shell, assuming TFTP server at 192.168.1.10: | ||
| + | |||
| + | cd /tmp | ||
| + | tftp -g -r uboot_env_bootcmd_nocrc.backup 192.168.1.10 69 | ||
| + | mtd -f write uboot_env_bootcmd_nocrc.backup u-boot-env | ||
| + | |||
| + | **9.** Upload the new sysupgrade bin file and reboot | ||
| + | |||
| + | To do so, we use the following commands: | ||
| + | |||
| + | tftp -g -r sysfsupgrade.bin 192.168.1.10 69 | ||
| + | mtd -f -r write sysfsupgrade.bin firmware | ||
| + | |||
| + | If everything worked, the router will reboot by itself with the new firmware. | ||
| + | |||
| + | |||
| + | ====Installing OpenWrt onto a RAMdisk on WNR2000v1==== | ||
| + | |||
| + | The original U-Boot bootloader runs a CRC check on the flash before it executes the bootcmd command. | ||
| + | This prevents OpenWrt from being run from flash. | ||
| + | As long as you do not replace the OEM bootloader, you can only create an OpenWrt ramdisk image and load it via tftp. | ||
| + | This requires access to the serial console which you can get by doing the following: | ||
| + | |||
| + | configure the NIC of a PC with a tftp server at 192.168.1.12 | ||
| + | copy openwrt-ar71xx-uImage-initramfs-lzma.bin into the directory of the tftp server (e.g. /tftpboot) | ||
| + | |||
| + | On the WNR2000v4 serial console: | ||
| + | |||
| + | Press any key after Hit any key to stop autoboot | ||
| + | tftpboot 0x81000000 openwrt-ar71xx-uImage-initramfs-lzma.bin - This should print a couple of # signs | ||
| + | setenv bootargs board=WNR2000v4 | ||
| + | bootm - This boots the kernel | ||
| + | |||
| + | |||
| + | ====Source code for the stock firmware versions==== | ||
| + | If you should happen to need source code for any of your current stock firmware versions you can get those from one of the following: | ||
| + | |||
| + | Main link to all Netgear GPL files (all devices): [[http:// | ||
| + | |||
| + | For 1.0.0.30 | ||
| + | |||
| + | http:// | ||
| + | |||
| + | For 1.0.0.40 | ||
| + | |||
| + | http:// | ||
| + | |||
| + | For 1.0.0.50 | ||
| + | |||
| + | http:// | ||
| + | |||
| + | For 1.0.0.58 | ||
| + | |||
| + | http:// | ||
| + | |||
| + | For 1.0.0.60 | ||
| + | |||
| + | http:// | ||
| + | | ||
| + | For 1.0.0.70 | ||
| + | http:// | ||
| + | | ||
| + | ===== Misc ===== | ||
| + | |||
| + | cat / | ||
| + | |||
| + | system type : Atheros AR934x | ||
| + | processor | ||
| + | cpu model : MIPS 74Kc V4.12 | ||
| + | BogoMIPS | ||
| + | wait instruction | ||
| + | microsecond timers | ||
| + | tlb_entries | ||
| + | extra interrupt vector | ||
| + | hardware watchpoint | ||
| + | ASEs implemented | ||
| + | shadow register sets : 1 | ||
| + | core : 0 | ||
| + | VCED exceptions | ||
| + | VCEI exceptions | ||
| + | |||
| + | cat / | ||
| + | |||
| + | 9.2.0_U10.1020 | ||
| + | |||
| + | cat / | ||
| + | |||
| + | Node 0, zone | ||
| + | |||
| + | cat / | ||
| + | Character devices: | ||
| + | 1 mem | ||
| + | 4 ttyS | ||
| + | 5 / | ||
| + | 5 / | ||
| + | 5 / | ||
| + | 10 misc | ||
| + | 77 ATH_GPIOC | ||
| + | 90 mtd | ||
| + | 108 ppp | ||
| + | 128 ptm | ||
| + | 136 pts | ||
| + | 240 atherosgpio | ||
| + | |||
| + | Block devices: | ||
| + | 259 blkext | ||
| + | 31 mtdblock | ||
| + | |||
| + | cat /proc/mtd shows: | ||
| + | dev: | ||
| + | mtd0: 00030000 00010000 | ||
| + | mtd1: 00010000 00010000 | ||
| + | mtd2: 000d0000 00010000 | ||
| + | mtd3: 00290000 00010000 | ||
| + | mtd4: 00060000 00010000 | ||
| + | mtd5: 00020000 00010000 | ||
| + | mtd6: 00010000 00010000 | ||
| + | mtd7: 00010000 00010000 | ||
| + | mtd8: 00010000 00010000 | ||
| + | mtd9: 00010000 00010000 | ||
| + | mtd10: 00360000 00010000 | ||
| + | | ||
| + | cat / | ||
| + | major minor # | ||
| + | 31 0 | ||
| + | 31 1 | ||
| + | 31 2 | ||
| + | 31 3 | ||
| + | 31 4 | ||
| + | 31 5 | ||
| + | 31 6 | ||
| + | 31 7 | ||
| + | 31 8 | ||
| + | 31 9 | ||
| + | 31 10 3456 mtdblock10 | ||
| + | |||
| + | cat / | ||
| + | rootfs / rootfs rw 0 0 | ||
| + | /dev/root / squashfs ro,relatime 0 0 | ||
| + | proc /proc proc rw,relatime 0 0 | ||
| + | sysfs /sys sysfs rw,relatime 0 0 | ||
| + | tmpfs /tmp tmpfs rw, | ||
| + | tmpfs /dev tmpfs rw, | ||
| + | devpts /dev/pts devpts rw, | ||
| + | root /tmp/root tmpfs rw,relatime 0 0 | ||
| + | /dev/root /mnt squashfs ro,relatime 0 0 | ||
| + | root /mnt tmpfs rw,relatime 0 0 | ||
| + | | ||
| + | ===== Tags ===== | ||
| + | [[meta: | ||
| + | {{tag> | ||