Option Globesurfer III

20150402: What is the target? What is the name of the image? I don't find GlobeSurfer3 among Barrier Breaker images. Also 12.09.1 was listed in Table of Hardware as version? That sounds wrong - was it supported for AA? Please clearify. /Zo0ok

Globesurfer III is a wireless router with 3G modem and RJ11 port for analog phone by default.

It was replaced by Globesurfer III+ after some time. Main differences are faster 3G card (GTM661W) and removal of LCD, the rest is same.

GlobeSurfer III is not officially supported by OpenWRT. See Forum.

OpenWRT 12.09 14.07 15.05 RC2
GlobeSurfer III Tested stable Works
(somewhat unstable)
GlobeSurfer 3+ Tested stable Not tested
Image III/3+ Attitude Adjustment
md5sum f12c8ae9088d167263b90efde5ba4b87
LuCI, USB, Full Modem Support
Chaos Calmer for GS
Initramfs Only

GlobeSurfer III specifications are more details on WikiDevi

GlobeSurfer III GlobeSurfer 3+
CPU: Broadcom BCM5354 @ 240MHz
Broadcom BMIPS3300 V2.9
Bootloader: CFE
Flash-Chip: K8P5516UZB-EI4E
Flash size: 32MB
Wireless: BCM4318 802.11bg
Ethernet: 2 RJ45 Ports
USB: 1 external USB Port
1 internal USB on miniPCI-e
USB Only
SIM Card Slot
GTM382 GTM661W
Serial: 1 external serial on pads
PSU: 5V 3A
Antenna: 2 internal 3G antennas
2 internal WiFi antennas
1 external 3G antenna connector
Extra: Phone Jack RJ11
Phone Jack RJ11

The serial port and JTAG pads are on the pcb. Remove the 4 Torx 10 screws and lift the cover.

Serial and JTAG Pad

See the forum for more info : JTAG Post

Please read the article flash.layout for a better understanding.

GlobeSurfer 3 Flash Layout stock firmware
Layer0 K8P5516UZB 64Kword x 256 32MiB
Layer1 mtd0 cfe 256KiB mtd1 fw 1 8192KiB mtd2 fw 2 8192KiB mtd3 rootfs 15744KiB mtd4 conf 1 128KiB mtd5 conf 2 128KiB mtd6 factory config 64KiB mtd7 nvram 64KiB
mountpoint none none none unknown unknown unknown unknown none
filesystem none none none unknown unknown unknown unknown none
GlobeSurfer 3 Flash Layout OpenWRT 12.04
Layer0 physmap-flash.0 K8P5516UZB 64Kword x 256 32MiB
Layer1 mtd0 cfe 256KiB mtd1 firmware ~31MiB mtd4 nvram 128KiB
Layer2 loader + kernel ~940KiB mtd2 rootfs ~31MiB
Layer3 1.5-3MiB mtd3 rootfs_data 28-29.5MiB
GlobeSurfer 3 Flash Layout OpenWRT 15.05
Layer0 physmap-flash.0 K8P5516UZB 64Kword x 256 32MiB
Layer1 mtd0 cfe 256KiB mtd1 firmware ~31MiB mtd6 nvram 128KiB
Layer2 mtd2 loader ~2KiB mtd3 linux ~938KiB mtd4 rootfs ~31MiB
mountpoint /
filesystem overlayfs
Layer3 1.5-3MiB mtd5 rootfs_data 28-29.5MiB
mountpoint none none none /rom /overlay none
filesystem none none none SquashFS JFFS2 none

The factory firmware is composed of multiple sections

  • Section 00 : CFE Bootloader
  • Section 01 : First bootable image
  • Section 02 : Second bootable image ( recovery )
  • Section 03
  • Section 04 : OpenRG Configuration
  • Section 05 : OpenRG Configuration
  • Section 06 : OpenRG Factory Configuration
  • Section 07
  • Section 08 : NVRAM
CFE> flash_layout
Flash layout:

Section 00 Type UNKNOWN    Range 0x00000000-0x00040000 MaxSize 0x00040000
        No more information.

Section 01 Type IMAGE      Range 0x00040000-0x00840000 MaxSize 0x007FFF6C
        Size 0x007D6000 Name 'Downloaded at: Tue Dec 31 19:07:03 2002'
        Checksum 0x3F5C2EEA Counter 0x00000113 Start Offset 0x00000000

Section 02 Type IMAGE      Range 0x00840000-0x01040000 MaxSize 0x007FFF6C
        Size 0x007D6000 Name 'Downloaded at: Tue Dec 31 19:11:23 2002'
        Checksum 0x3F5903FC Counter 0x0000010E Start Offset 0x00000000

Section 03 Type UNKNOWN    Range 0x01040000-0x01FA0000 MaxSize 0x00F5FF6C
        Size 0x0079AD4E Name 'Downloaded at: Tue Dec 31 19:07:03 2002'
        Checksum 0x3C97916A Counter 0x00000112 Start Offset 0x00000000

Section 04 Type CONF       Range 0x01FA0000-0x01FC0000 MaxSize 0x0001FF6C
        Size 0x00004593 Name 'rg_conf'
        Checksum 0x0022E78C Counter 0x00000139 Start Offset 0x00000000

Section 05 Type CONF       Range 0x01FC0000-0x01FE0000 MaxSize 0x0001FF6C
        Size 0x00004590 Name 'rg_conf'
        Checksum 0x00231B6A Counter 0x0000013B Start Offset 0x00000000

Section 06 Type FACTORY    Range 0x01FE0000-0x01FF0000 MaxSize 0x0000FF6C
        Size 0x00001152 Name 'rg_factory'
        Checksum 0x00049B12 Counter 0x00000118 Start Offset 0x00000000

Section 07 Type UNKNOWN    Range 0x01FF0000-0x01FF8000 MaxSize 0x00008000
        No more information.

Section 08 Type UNKNOWN    Range 0x01FF8000-0x02000000 MaxSize 0x00008000
        No more information.

Total 9 sections found.
*** command status = 0
  1. Download the image Supported Version and move it to TFTP folder (use program called TFTPD32 for flashing from windows (TFTPD64 if your system is 64bit)
  2. Set your PC's card to and subnet, plug the ethernet cable to the second port on router, the one next to antenna connector
  3. Start TFTP server
  4. Connect with telnet to (with PuTTY)
  5. Flash the image with command
     flash load -u tftp:// -r 0x00040000 
  6. After uploading image, you should restart the router with simple command
    system reboot
  7. After a few minutes it should boot with openwrt image

Note: This router have two boot sections (we flashed the first one), so if your router won't start openwrt at this point, you should flash openwrt image to second section with this command:

flash load -u tftp:// -r 0x00840000

This image contains drivers for USB, WLAN, 3G card and everything works very stable.


Note : CFE bootloader is accessible via the serial pad.
The serial configuration is 115200 with 8-bits data, no parity, 1-bit stop.

The bootloader process can be interrupted with Ctrl+C combination.


The device can boot an initramfs image. This is a quick way to test the system before flashing.
The procedure for booting a such image is described at BCM47XX CFE

Static Address DHCP
ifconfig eth0 -addr=
ifconfig eth0 -auto
boot -elf


The flash layout of the device can be printed to the console :

CFE> flash_layout

Note : Do not erase or flash the bootloader, i.e Section 00, unless you know what you are doing.

Prior flashing, the flash can be saved via tftp. For saving, the flash start address is 0xbc000000. The following command saves the whole 32MiB of flash.

save bc000000 2000000

To flash an image onto the device. Section 01 has to be re-written with the new image. Section 02 may need to be erased if the image is too small. CFE may boot to the secondary OpenRG image on the device if present.

flash -offset=0x00040000 -noheader flash0

There is no need to install additional drivers for Option 3G card.

This card works as HSO device, so it's not yet configurable via LuCI, you must edit network file instead:


it should look like this:

config interface 'option'
	option proto 'hso'
	option ifname 'hso0'
	option device '/dev/ttyHS3'
	option service 'umts'
	option apn 'your_apn'
	option pincode 'your pin'

then assign new interface to firewall zone WAN

After pressing connect, wait about 30 secounds and you are good to go, log should look like this:

OpenWrt daemon.notice netifd: option (15351): SIM ready
OpenWrt daemon.notice netifd: option (15351): PIN set successfully
OpenWrt daemon.notice netifd: option (15351): ATZFeb 26 13:14:34 OpenWrt daemon.notice netifd: option (15351): OKCalling UMTS/GPRS^M
OpenWrt daemon.notice netifd: option (15351): AT+CGDCONT=1,"IP","data.vip.hr"
OpenWrt daemon.notice netifd: option (15351): OK
OpenWrt daemon.notice netifd: option (15351): AT_OPSYS=3,2
OpenWrt daemon.notice netifd: option (15351): OK
OpenWrt daemon.notice netifd: option (15351): AT_OWANCALL=1,1,0
OpenWrt daemon.notice netifd: option (15351): OK
OpenWrt daemon.notice netifd: option (15351): AT_OWANDATA=1
OpenWrt daemon.notice netifd: option (15351): _OWANDATA: 1,,,,,,, 72000
OpenWrt daemon.notice netifd: Interface 'option' is now up


  • be aware that modem must be unlocked to your operator
  • if you swap the SIM card while router is on, you must restart it because the card hotplug doesn't work without extra commands I don't know now
  • usb_modeswitch will try to switch device but it fails, you can delete this file to prevent this:

The CFE bootloader will boot an image in a specific format. An OpenRG section needs to have a OpenRG Header. The OpenRG header is followed by a TRX header containing the bootable firmware. CFE checks the OpenRG checksum and the TRX CRC32.

The OpenRG header checksum is the sum of all bytes in header + data. The checksum is done with the OpenRG Checksum bytes being zero. The amount of data is set in length. The OpenRG checksum and length value are stored in Big-Endian. The TRX header part offsets are relative to the start of the TRX header. The TRX CRC32 and length value are stored in Little-Endian.

00 01 02 03
00 OpenRG Magic (FEEDBABE)
04 OpenRG Length
Exclude Header
08 OpenRG Checksum
Inlcude Header
Checksum Excluded
0C Counter
Not Used
10 Start Offset
Not Used
14 Name
128 Bytes
firmware label
94 TRX Magic ('HDR0')
98 TRX Length
Include Header
A0 TRX Flags TRX Version
A4 TRX Part Off[0] loader off
A8 TRX Part Off[1] kernel off
AC TRX Part Off[2] rootfs off
B0 Data

OpenRG image header hexdump

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00040000  FE ED BA BE 00 7D 60 00 3F 5C 2E EA 00 00 01 13  þíº¾.}`.?\.ê....
00040010  00 00 00 00 44 6F 77 6E 6C 6F 61 64 65 64 20 61  ....Downloaded a
00040020  74 3A 20 54 75 65 20 44 65 63 20 33 31 20 31 39  t: Tue Dec 31 19
00040030  3A 30 37 3A 30 33 20 32 30 30 32 00 00 00 00 00  :07:03 2002.....
00040090  00 00 00 00 48 44 52 30 00 60 7D 00 8A 9E 18 B5  ....HDR0.`}.Šž.µ
000400A0  00 00 01 00 1C 00 00 00 00 00 00 00 00 00 00 00  ................
000400B0  1F 8B 08 08 36 F6 C3 4D 02 03 6A 6D 70 5F 62 6F  .‹..6öÃM..jmp_bo

OpenWRT firmware image hexdump.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000  FE ED BA BE 00 3F FF 6C 1F B3 F5 62 00 00 00 00  þíº¾.?ÿl.³õb....
00000010  00 00 00 00 4F 70 65 6E 52 47 20 4F 70 65 6E 57  ....OpenRG OpenW
00000020  52 54 20 31 35 2E 30 35 20 43 43 00 00 00 00 00  RT 15.05 CC.....
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000090  00 00 00 00 48 44 52 30 6C FF 3F 00 0D C6 A2 1F  ....HDR0lÿ?..Æ¢.
000000A0  00 00 01 00 1C 00 00 00 38 09 00 00 6C 13 11 00  ........8...l...
000000B0  1F 8B 08 00 00 00 00 00 02 03 8D 57 51 68 1C D7  .‹.........WQh.×
This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2019/10/14 22:44
  • by tmomas