Sitecom WLR-7100

Supported, both variants (v1 001 and v1 002), since 1bc921f419df508c57dc07cd3e43cdf0408c17dd with errata 474aa3237c1bac86b475c3b2955e9501353a87f5.

Architecture MIPS32
Target ar7xxx/ar9xxx
Vendor Sitecom
Bootloader u-boot
CPU Model AR1022
CPU Speed ???MHz
Flash size 8MB
RAM size 64MB
WAN 1x RJ45
Ethernet QCA8337 (4xGbe)
Wireless AR1022(Integrated 2.4GHz)+QCA9882(5GHz)
Serial yes
Buttons power switch, WPS button
Power external 12V 1A



Note: This will void your warranty!

  • To remove the cover, unscrew four screws found under the rubber feet on the backside of the device.
  • Then, on the frontside (the side with the indicator lights) pull the (long) side outward slightly to release four catches and pull off the front cover.

Cover (both sides shown in edited image):

Main PCB:

Backside of PCB:

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

Serial connection parameters 115200, 8N1

Serial Port is labeled JP1 on the board and is a standard 2.54mm pin header footprint without connector soldered.

Pin 1 has 3.3V, but the signal on the TxD pin is 2.65V, so the processor probably runs at 2.65V. Putting 3.3V on the RxD pin (i.e. using a 3.3V serial adapter) might be problematic (there also seems to be a footprint on the PCB for a resistor divider, but it had a 0Ω), so add a resistor divider or level shifter to be sure.

When TxD line on UART is connected on power-on, the DDR memory training may fail (you will see some output on serial, but booting does not continue). A workaround is to disconnect TxD, power on and then directly connect TxD to catch most of the output and/or interact with uboot.

After the original firmware has booted, you can login to the shell using password: SitecomSenao

Pin Out
Pins 1 2 3 4
Function 3v3 Gnd TxD RxD

The original source code for firmware version 1.1.2 can be found at (be patient, it can take few moments for file to be prepared).


# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00800000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00750000 00010000 "Kernel"
mtd4: 00590000 00010000 "apps"
mtd5: 00040000 00010000 "manufacture"
mtd6: 00010000 00010000 "backup"
mtd7: 00050000 00010000 "storage"
mtd8: 00010000 00010000 "caldata"
WLR-7100 Flash Layout stock firmware (v1.8)
Layer0 8192KiB
Layer1 mtd1 Bootloader 192KiB mtd2 Config 64KiB mtd3 Kernel 7488KiB mtd6 backup 64KiB mtd7 storage 320KiB mtd8 caldata 64KiB
Layer2 1792KiB mtd4 apps 5696KiB
mountpoint none none none /apps none /storage none
filesystem none none none SquashFS none JFFS2 none

Partition placement was deduced by localizing each partition's data in a backup. mtd5 manufacture 256KiB is not listed, since it contained only 0xff bytes and was impossible to exactly locate. The only place with enough 0xff bytes to accomodate it was mtd4, so mtd5 likely overlaps with the end of mtd4.

generic.backup general information about backups.

If you have serial access, you can create a backup of the original flash contents (see above for instructions and the login password). However, the stock firmware is very limited (it has no cut, ssh, dd and read requires an explicit argument), so the backup script in the generic backup article does not work here.

So to make a backup while running the stock firmware, insert an USB stick, login to serial and run the below script to write backup files to the USB stick:

cat /proc/mtd | tail -n+2 | while read REPLY; do
  MTD_DEV=$(echo ${REPLY} | awk -F':' '{print $1}')
  MTD_NAME=$(echo ${REPLY} | awk -F'"' '{print $2}')
  echo "Backing up ${MTD_DEV} (${MTD_NAME})"
  cat /dev/${MTD_DEV} > /tmp/usb/sda1/${MTD_DEV}_${MTD_NAME}.backup
  1. SSH into device
  2. mtd erase “kernel”
  3. reboot
  4. now the device hangs at boot with ip, set any other and then access via web to
  5. upload the .dlf from sitecom site and wait

Full bootlog can be obtained by keeping TX disconnected at poweron, connecting it, entering the u-boot console with “4” and then giving a “reset” command to reset the MCU (skipping the DRAM check that reportedly prevents boot from completing when TX is connected at poweron).

U-Boot 2.0.0 (May 22 2013 - 13:25:23)

Wasp 1.1
wasp_ddr_initial_config(276): Wasp (16bit) ddr1 init
wasp_ddr_initial_config(426): Wasp ddr init done
Top of RAM usable for U-Boot at: 80400000
Reserving 236k for U-Boot at: 803c4000
Reserving 192k for malloc() at: 80394000
Reserving 44 Bytes for Board Info at: 80393fd4
Reserving 36 Bytes for Global Data at: 80393fb0
Reserving 128k for boot params() at: 80373fb0
Stack Pointer at: 80373f98
Now running in RAM - U-Boot at: 83fc4000
id read 0xc216
SPI Flash [MXIC-MX25L 6406E/6405D]: Size: 0x800000 bytes.
flash size 8388608, sector count = 128
Flash:  8 MB
In:    serial
Out:   serial
Err:   serial
Net:   ag934x_enet_initialize...
No valid address in Flash. Using fixed address
 wasp  reset mask:c03300 
WASP  ----> S17 PHY *
: cfg1 0x7 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs17_reg_init: complete
eth0 up
No valid address in Flash. Using fixed address
 wasp  reset mask:c03300 
WASP  ----> S17 PHY *
: cfg1 0xf cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
3: System Boot system code via Flash.
## Booting image at 9f040000 ...
   Image Name:   Linux Kernel Image
   Created:      2015-12-09   9:35:22 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1834635 Bytes =  1.7 MB
   Load Address: 80002000
   Entry Point:  80006110
   Verifying Checksum at 0x9f040040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80006110) ...
## Giving linux memsize in bytes, 67108864

Starting kernel ...

Booting Atheros AR934x
init started: BusyBox v1.7.5 (2015-12-09 17:30:42 CST)
starting pid 809, tty '/dev/console': '/sbin/config_init'
mknod: /dev/ttyS0: File exists
mknod: /dev/ttyS1: File exists
Config Init version: date: 2015/12/09
Thu Jan  1 00:00:00 UTC 2015
ln: /lib/./modules: File exists
insmod: can't open '/lib/ar8327_drv.ko': No such file or directory
starting pid 864, tty '/dev/ttyS0': '/sbin/config_term'
*                                 WLR-7100                             *

KernelApp/Ramdisk Ver:                    Date:2015/12/09
U-Boot 2.0.0 (May 22 2013 - 13:25:23)
ar7240> printenv
lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize;cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}${bc}-jffs2&&erase 0x9f050000 +$filesize;cp.b $fileaddr 0x9f050000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux_${bc}.lzma.uImage&&erase 0x9f300000 +$filesize;cp.b $fileaddr 0x9f300000 $filesize
bootargs=console=ttyS0,115200 root=31:03 rootfstype=jffs2 init=/sbin/init mtdparts=ath-nor0:192k(u-boot),64k(u-boot-env),896k(uImage),6912k(rootfs),64k(NVRAM),64k(ART)

Environment size: 855/65532 bytes
ar7240> imls
Image at 9F040000:
   Image Name:   Linux Kernel Image
   Created:      2015-12-09   9:35:22 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1834635 Bytes =  1.7 MB
   Load Address: 80002000
   Entry Point:  80006110
   Verifying Checksum ... OK
This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2020/12/20 19:06
  • by matthijs