Show pagesourceOld revisionsBacklinksBack to top × Table of Contents T-Home Speedport W 303V Versions Typ A Hardware Serial Port Accessing brnboot console Flash Layout Firmware Tags T-Home Speedport W 303V The T-Home Speedport W 303V is a IAD sold by T-Com with a ADSL2+ Annex B Modem, 11n Wifi and two FXS ports as well as a S0 bus connector. There are 2 models of it, “Typ A” and “Typ B”, having completely different hardware. Click here for "Typ B". Versions Model OpenWrt Version Supported Model Specific Notes Typ A not tested ? ? Typ B trunk broadcom based Note, that these two models are significantly different. You cannot use the same firmware image for both. Typ A Hardware SoC Infineon PSB 50702 E V1.3 DANUBE XWAY DANUBE + passive heatsink target Lantiq CPU MIPS 24KEc network processor 32-bit, 333 or 425 MHz RAM Qimonde HYB25DC256160CE-6 32 MiB Flash Macronix MX 29LV320CBTC-90G 4 MiB Ethernet ICplus IP101A 10/100 Mbit/s WLAN RaLink RT2860T a/b/g/n, 2 antennas, left & right ISDN Infineon, UMEC ... Serial Port yes details below JTAG not found although present according to SoC description USB not found although present according to SoC description preinstalled firmware ARV7525PW1-B-LF-23 V1.06.000 U25 MAIN 2969 similar routers: Arcadyan ARV7506, Easybox A 802, Airties WAV-281, and others the router may be watched booting via the serial console: http://pastebin.com/Ana5twd4 discussion of the OpenWRT development for this device: http://www.ip-phone-forum.de/showthread.php?t=206932&page=1 see also this disputation: http://permalink.gmane.org/gmane.law.gpl.violations.legal/2978 Serial Port internal, onboard 3.3V TTL 2×5 solder points 5 4 3 2 1 GND o TX RX o o o o o o 10 9 8 7 6 115200 bps 8N1 No flow control as found by byteeater on ip-phone-forum.de Accessing brnboot console during normal boot: press space 3x, enter first four letters of the default interface password (see back of router) with reset key held: press space 3x, enter password QT holding reset + wlan during boot seems to run the brnboot recovery Flash Layout --------------------------------------- Area Address Length --------------------------------------- [0] Boot 0xB0000000 128K [1] Configuration 0xB0020000 192K [2] Image 0 0xB0050000 3712K [3] Image 1 0xB0050000 3712K [4] Boot Params 0xB03F0000 64K [5] Flash Image 0xB0000000 4096K --------------------------------------- Firmware bootloader brnboot official firmware - firmware encryption LZMA based obfuscation, cracked by Andi_84 on ip-phone-forum.de Tags How to add tags lantiq, danube, 4Flash, 32RAM, ADSL2+, fxo, Unsupported devices This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.OKMore information about cookies lantiq danube 4Flash 32RAM adsl2 fxo Unsupported devices Last modified: 2022/01/17 15:55by w8970