Sitecom WLR-4100 V1 002

The V1 001 variant is equipped with different HW: Ralink 3352F + RTL8367RB

  1. Connect to one of LAN (yellow) ethernet ports,
  2. Open router configuration interface, go to Toolbox > Firmware
  3. Browse for OpenWrt factory image with dlf extension and hit Apply
  4. Wait few minutes, after the Power LED will stop blinking, the router is ready for configuration.

Download OEM WLR-4100v1002-firmware-v27.dlf firmware file to /tmp on your PC.

Decode .dlf via mkseanofw found in staging_dir/host/bin of OpenWrt buildroot

./mksenaofw -d /tmp/WLR-4100v1002-firmware-v27.dlf -o /srv/tftp/uImageWLR-5100v1002.bin

The file name matches the TFTP name stored in boot-env (bootfile=uImageWLR-5100v1002.bin).

binwalk of the resulting file:

binwalk /srv/tftp/uImageWLR-5100v1002.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x3CACD51F, created: 2015-12-15 03:17:56, image size: 1828528 bytes, Data Address: 0x80000000, Entry Point: 0x8000C110, data CRC: 0xF7AB3F67, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
64            0x40            LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 4662392 bytes
1830912       0x1BF000        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 3313008 bytes, 359 inodes, blocksize: 131072 bytes, created: 2015-12-15 03:17:40

generic.flashing.tftp

  • Boot Serial Console and Press Key 2
  • Use TFTP server with Image oem.bin

Copy decoded firmware to the device and access in it

scp /srv/tftp/uImageWLR-5100v1002.bin root@192.168.1.1:/tmp
ssh root@192.168.1.1

Force sysupgrade:

-F because factory firmware does not match openwrt standard

-n clearing configuration

sysupgrade -n -v -F /tmp/uImageWLR-5100v1002.bin
Architecture mipsel_24kc
Vendor MediaTek
Bootloader U-Boot
System-On-Chip MediaTek MT7620A - MIPS 24K
CPU/Speed 580 MHz but OpenWrt log shows 600 MHz.
Flash-Chip MX25L6406E
Flash size 8 MiB
RAM 64 MiB
Wireless MT7620A 2.4GHz 802.11bgn
Ethernet 1 Gbit/s with VLAN support
Switch Qualcomm Atheros QCA8337
USB 1x 2.0
Serial Yes
JTAG Not populated
Layer0 raw flash
Layer1 bootloader
(192K)
Config
(64K)
Factory
(64K)
OpenWrt firmware partition Backup
(64K)
Storage
(64K)
Layer2 Linux Kernel rootfs
mounted: “/”, OverlayFS with /overlay
Layer3 /dev/root
mounted: “/rom”, SquashFS
size depends on selected packages
rootfs_data
mounted: “/overlay”, JFFS2
“free” space

The external case is like some others Sitecom switches (i.e. wlr-7100 except for the 5GHz WiFi led)

In fact behind the cover we can see a kind of selector:

The blue Ethernet RJ45 connector (WAN) is connected to port 5 of QCA 8337 then we have other 4 yellow RJ45 connector below:

  • LAN 1 connected to port 4 of QCA8337
  • LAN 2 connected to port 3 of QCA8337
  • LAN 3 connected to port 2 of QCA8337
  • LAN 4 connected to port 1 of QCA8337

PCB

The PCB looks the same as WLR-5100 with missing 5GHz WiFi chip.

Remove the 4 rubber adhesive feet:

Unscrew the screws behind. Then pull on the 2 teeth on the long side:

and on a single tooth on the short side

port.serial general information about the serial port, serial port cable, etc.

Serial connection parameters 115200, 8N1

Serial port is labeled J2 on the board and is a standard 2.54mm pin header footprint with connector.

Pin Out
Pin 1 2 3 4
Function 3v3 GND TxD RxD

port.jtag general information about the JTAG port, JTAG cable, etc.

No connector on JTAG pads :

U-boot Ver:1.0.0.1 2013/05/23 14:40:54 Board: Ralink APSoC DRAM: 64 MB spi_wait_nsec: 28 spi device id: c2 20 17 c2 20 (2017c220) find flash: MX25L6405D Flash size 8MB, sector count = 128 ============================================ ASIC 7620_MP (Port5<->GigaSW) Product Name: WLR-4100v1002 Please choose the operation: 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 9: Load Boot Loader code then write to Flash via TFTP. You choosed 3  0 3: System Boot system code via Flash. ## Booting image at bc050000 ... Image Name: Linux Kernel Image Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 1826190 Bytes = 1.7 MB Load Address: 80000000 Entry Point: 8000c110 Verifying Checksum ... OK Uncompressing Kernel Image ... OK Starting kernel ... LINUX started... THIS IS ASIC init started: BusyBox v1.13.3 (2014-02-21 19:07:17 CST) starting pid 746, tty '/dev/console': '/sbin/config_init' mknod: /dev/ttyS0: File exists mknod: /dev/ttyS1: File exists Config Init version: 1.4.1.24 date: 2014/02/21 Wed Jan 1 00:00:00 UTC 2014 ln: /lib/./modules: File exists starting pid 795, tty '/dev/ttyS1': '/sbin/config_term' ************************************************************************ * WLR-4100v1002 * ************************************************************************ KernelApp/Ramdisk Ver:1.4.1.24 Date:2014/02/21 password:


After the original firmware has booted, you can login to the shell using password: SitecomSenao

The U-Boot menu has some extra unlisted option like:

0: System Load Linux then write to Flash via Serial.

1: System Load Linux to SDRAM via TFTP.

4: System Enter Boot Command Line Interface.

8: System Load UBoot to SDRAM via TFTP.

Allowing the execution of the code in RAM without touching the Flash

The TFTP client (192.168.99.9) looks for a uImageWLR-5100v1002.bin file on Server (192.168.99.8).

I played with option 4:

MT7620 # help ? - alias for 'help' bootm - boot application image from memory cp - memory copy erase - erase SPI FLASH memory go - start application at address 'addr' help - print online help loadb - load binary file over serial line (kermit mode) md - memory display mdio - Ralink PHY register R/W command !! mm - memory modify (auto-incrementing) nm - memory modify (constant address) printenv- print environment variables reset - Perform RESET of the CPU rf - read/write rf register saveenv - save environment variables to persistent storage setenv - set environment variables tftpboot- boot image via network using TFTP protocol version - print monitor version MT7620 # bootm ## Booting image at 80100000 ... Bad Magic Number,FFBFFBFF MT7620 # printenv bootcmd=tftp bootdelay=1 baddrate=115200 ethaddr="xx:xx:xx:xx:xx:xx" ipaddr=192.168.99.9 serverip=192.168.99.8 sn=xxxxxxxxx hw_ver=1.0.0 hw_id=0222104A pro_id=000 country=000 domain=1 op_mode=0 wanaddr=xx:xx:xx:xx:xx:xx wlanaddr=xx:xx:xx:xx:xx:xx iNICaddr=xx:xx:xx:xx:xx:xx eth_en=0 snextra=********* bootfile=uImageWLR-5100v1002 uboot_ver=1.0.0.1 sku_table=0 language_code=uk stdin=serial stdout=serial stderr=serial Environment size: 429/4092 bytes MT7620 # version U-Boot 1.1.3 (May 23 2013 - 14:40:54)


Starting kernel ... [ 0.000000] Linux version 4.14.180 (andrea@tubo-wd) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r11063-85e04e9f46)) #0 Sat May 16 18:32:20 2020 [ 0.000000] Board has DDR2 [ 0.000000] Analog PMU set to hw control [ 0.000000] Digital PMU set to hw control [ 0.000000] SoC Type: MediaTek MT7620A ver:2 eco:3 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 00019650 (MIPS 24KEc) [ 0.000000] MIPS: machine is Sitecom sw48 WLR-4100 v1 002 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 04000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] random: get_random_bytes called from start_kernel+0x90/0x478 with crng_init=0 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16256 [ 0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2 [ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes) [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Writing ErrCtl register=0006f7fa [ 0.000000] Readback ErrCtl register=0006f7fa [ 0.000000] Memory: 58684K/65536K available (3709K kernel code, 174K rwdata, 864K rodata, 1196K init, 208K bss, 6852K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS: 256 [ 0.000000] CPU Clock: 600MHz [ 0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 583261500 ns [ 0.000000] systick: enable autosleep mode [ 0.000000] systick: running - mult: 214748, shift: 32 [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6370868154 ns [ 0.000011] sched_clock: 32 bits at 300MHz, resolution 3ns, wraps every 7158278654ns [ 0.007588] Calibrating delay loop... 398.13 BogoMIPS (lpj=1990656) [ 0.073573] pid_max: default: 32768 minimum: 301 [ 0.078295] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.084657] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.097595] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.107154] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.113114] pinctrl core: initialized pinctrl subsystem [ 0.118684] NET: Registered protocol family 16 [ 0.148974] rt2880_gpio 10000600.gpio: registering 24 gpios [ 0.154370] rt2880_gpio 10000600.gpio: registering 24 irq handlers [ 0.160768] rt2880_gpio 10000638.gpio: registering 16 gpios [ 0.166144] rt2880_gpio 10000638.gpio: registering 16 irq handlers [ 0.172502] rt2880_gpio 10000660.gpio: registering 32 gpios [ 0.177876] rt2880_gpio 10000660.gpio: registering 32 irq handlers [ 0.184248] rt2880_gpio 10000688.gpio: registering 1 gpios [ 0.189538] rt2880_gpio 10000688.gpio: registering 1 irq handlers [ 0.200542] clocksource: Switched to clocksource systick [ 0.206840] NET: Registered protocol family 2 [ 0.211865] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.218586] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.224813] TCP: Hash tables configured (established 1024 bind 1024) [ 0.231096] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.236722] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.243101] NET: Registered protocol family 1 [ 0.249977] rt-timer 10000100.timer: maximum frequency is 1220Hz [ 0.256661] Crashlog allocated RAM at address 0x3f00000 [ 0.263468] workingset: timestamp_bits=30 max_order=14 bucket_order=0 [ 0.275355] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.281003] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.300378] io scheduler noop registered [ 0.304186] io scheduler deadline registered (default) [ 0.309997] gpio-export gpio_export: 1 gpio(s) exported [ 0.315299] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled [ 0.322571] console [ttyS0] disabled [ 0.326022] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103 [ 0.335695] console [ttyS0] enabled [ 0.335695] console [ttyS0] enabled [ 0.342726] bootconsole [early0] disabled [ 0.342726] bootconsole [early0] disabled [ 0.356307] spi spi0.0: force spi mode3 [ 0.361061] m25p80 spi0.0: mx25l6405d (8192 Kbytes) [ 0.366096] 6 fixed-partitions partitions found on MTD device spi0.0 [ 0.372631] Creating 6 MTD partitions on "spi0.0": [ 0.377529] 0x000000000000-0x000000030000 : "uboot" [ 0.383423] 0x000000030000-0x000000040000 : "config" [ 0.389309] 0x000000040000-0x000000050000 : "factory" [ 0.395350] 0x000000050000-0x0000007e0000 : "firmware" [ 0.404366] 2 uimage-fw partitions found on MTD device firmware [ 0.410419] Creating 2 MTD partitions on "firmware": [ 0.415558] 0x000000000000-0x000000185d40 : "kernel" [ 0.421513] 0x000000185d40-0x000000790000 : "rootfs" [ 0.427341] mtd: device 5 (rootfs) set to be root filesystem [ 0.434718] 1 squashfs-split partitions found on MTD device rootfs [ 0.441102] 0x000000398000-0x000000790000 : "rootfs_data" [ 0.447481] 0x0000007e0000-0x0000007f0000 : "backup" [ 0.453447] 0x0000007f0000-0x000000800000 : "storage" [ 0.460173] libphy: Fixed MDIO Bus: probed [ 0.473613] libphy: mdio: probed [ 0.477681] Probe mdio address:0 [ 0.482441] Phy probe: switch0: Atheros AR8337 rev. 2 switch registered on mdio-bus [ 0.490962] ar8327_phy_fixup phy:0 chip_rev2 [ 0.495795] ar8327_phy_fixup phy:1 chip_rev2 [ 0.500623] ar8327_phy_fixup phy:2 chip_rev2 [ 0.505452] ar8327_phy_fixup phy:3 chip_rev2 [ 0.510278] ar8327_phy_fixup phy:4 chip_rev2 [ 0.736201] mtk_soc_eth 10100000.ethernet: using fixed link parameters [ 0.743051] mtk_soc_eth 10100000.ethernet: loaded mt7620 driver [ 0.749764] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5 [ 0.758688] rt2880_wdt 10000120.watchdog: Initialized [ 0.765169] NET: Registered protocol family 10 [ 0.773735] Segment Routing with IPv6 [ 0.777585] NET: Registered protocol family 17 [ 0.782246] 8021q: 802.1Q VLAN Support v1.8 [ 0.803226] VFS: Mounted root (squashfs filesystem) readonly on device 31:5. [ 0.816781] Freeing unused kernel memory: 1196K [ 0.821444] This architecture does not have kernel memory protection. [ 2.059378] random: fast init done [ 2.240486] init: Console is alive [ 2.244197] init: - watchdog - [ 4.381977] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 4.642174] usbcore: registered new interface driver usbfs [ 4.647861] usbcore: registered new interface driver hub [ 4.653465] usbcore: registered new device driver usb [ 4.664656] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 4.679636] SCSI subsystem initialized [ 4.688647] ehci-platform: EHCI generic platform driver [ 4.697161] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 4.704896] ohci-platform: OHCI generic platform driver [ 4.720570] phy phy-usbphy.0: remote usb device wakeup disabled [ 4.726617] phy phy-usbphy.0: UTMI 16bit 30MHz [ 4.731180] ohci-platform 101c1000.ohci: Generic Platform OHCI controller [ 4.738140] ohci-platform 101c1000.ohci: new USB bus registered, assigned bus number 1 [ 4.746323] ohci-platform 101c1000.ohci: irq 26, io mem 0x101c1000 [ 4.780338] hub 1-0:1.0: USB hub found [ 4.784563] hub 1-0:1.0: 1 port detected [ 4.796336] usbcore: registered new interface driver usb-storage [ 4.803211] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 4.812069] init: - preinit - [ 6.176894] mtk_soc_eth 10100000.ethernet eth0: port 5 link up (1000Mbps/Full duplex) [ 6.185655] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready [ 6.191616] 8021q: adding VLAN 0 to HW filter on device eth0 [ 6.197687] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 6.346075] random: procd: uninitialized urandom read (4 bytes read) [ 8.131767] jffs2: notice: (407) jffs2_build_xattr_subsystem: complete building xattr subsystem, 3 of xdatum (2 unchecked, 1 orphan) and 10 of xref (1 dead, 0 orphan) found. [ 8.150126] mount_root: switching to jffs2 overlay [ 8.192042] overlayfs: upper fs does not support tmpfile. [ 8.210023] urandom-seed: Seeding with /etc/urandom.seed [ 8.326614] mtk_soc_eth 10100000.ethernet eth0: port 5 link down [ 8.343646] procd: - early - [ 8.347505] procd: - watchdog - [ 8.782988] procd: - watchdog - [ 8.786562] procd: - ubus - [ 8.862486] random: ubusd: uninitialized urandom read (4 bytes read) [ 8.872753] random: ubusd: uninitialized urandom read (4 bytes read) [ 8.879839] random: ubusd: uninitialized urandom read (4 bytes read) [ 8.887310] procd: - init - Please press Enter to activate this console. [ 9.819185] kmodloader: loading kernel modules from /etc/modules.d/* [ 9.843413] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 9.873554] Loading modules backported from Linux version v4.19.120-0-gfdc072324f3c [ 9.881451] Backport generated by backports.git v4.19.120-1-0-g60c3a249 [ 9.911594] hso: drivers/net/usb/hso.c: Option Wireless [ 9.917074] usbcore: registered new interface driver hso [ 9.939673] ip_tables: (C) 2000-2006 Netfilter Core Team [ 9.966010] nf_conntrack version 0.5.0 (1024 buckets, 4096 max) [ 10.113440] xt_time: kernel timezone is -0000 [ 10.129949] usbcore: registered new interface driver cdc_ether [ 10.334088] PPP generic driver version 2.4.2 [ 10.349197] NET: Registered protocol family 24 [ 10.356330] usbcore: registered new interface driver rndis_host [ 10.395991] urngd: jent-rng init failed, err: 2 [ 10.421112] rt2800_wmac 10180000.wmac: loaded eeprom from mtd device "factory" [ 10.428567] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 6352, rev 0500 detected [ 10.436483] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 7620 detected [ 10.458359] kmodloader: done loading kernel modules from /etc/modules.d/* [ 19.695128] mtk_soc_eth 10100000.ethernet eth0: port 5 link up (1000Mbps/Full duplex) [ 19.704072] 8021q: adding VLAN 0 to HW filter on device eth0 [ 19.764875] br-lan: port 1(eth0.1) entered blocking state [ 19.770468] br-lan: port 1(eth0.1) entered disabled state [ 19.776359] device eth0.1 entered promiscuous mode [ 19.781253] device eth0 entered promiscuous mode [ 19.838690] br-lan: port 1(eth0.1) entered blocking state [ 19.844217] br-lan: port 1(eth0.1) entered forwarding state [ 19.850196] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready [ 20.706562] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready [ 24.788417] ieee80211 phy0: rt2800_rf_self_txdc_cal: Info - RF Tx self calibration start [ 24.797232] ieee80211 phy0: rt2800_rf_self_txdc_cal: Info - RF Tx self calibration end [ 27.034836] ieee80211 phy0: rt2800_loft_iq_calibration: Info - LOFT Calibration Done! [ 27.046812] ieee80211 phy0: rt2800_iq_search: Info - IQCalibration Start! [ 27.068102] ieee80211 phy0: rt2800_iq_search: Info - IQCalibration Done! CH = 0, (gain= 1, phase=3d) [ 27.078344] ieee80211 phy0: rt2800_iq_search: Info - IQCalibration Start! [ 27.099617] ieee80211 phy0: rt2800_iq_search: Info - IQCalibration Done! CH = 1, (gain= 0, phase=3e) [ 27.108973] ieee80211 phy0: rt2800_loft_iq_calibration: Info - TX IQ Calibration Done! [ 27.157457] ieee80211 phy0: rt2800_rxiq_calibration: Info - RXIQ G_imb=0, Ph_rx=2 [ 27.177768] ieee80211 phy0: rt2800_rxiq_calibration: Info - RXIQ G_imb=0, Ph_rx=4 [ 27.195241] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready [ 27.208881] br-lan: port 2(wlan0) entered blocking state [ 27.214467] br-lan: port 2(wlan0) entered disabled state [ 27.220295] device wlan0 entered promiscuous mode [ 27.845603] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 27.852337] br-lan: port 2(wlan0) entered blocking state [ 27.857763] br-lan: port 2(wlan0) entered forwarding state [ 51.617053] random: crng init done [ 51.620544] random: 6 urandom warning(s) missed due to ratelimiting


This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/12 08:58
  • by 127.0.0.1