T-Home Speedport W 303V
The T-Home Speedport W 303V is a IAD sold by T-Com with a ADSL2+ Annex B Modem, 11n Wifi and two FXS ports as well as a S0 bus connector.
There are 2 models of it, “Typ A” and “Typ B”, having completely different hardware. Click here for "Typ B".
Versions
Model | OpenWrt Version Supported | Model Specific Notes |
---|---|---|
Typ A | not tested ? | ? |
Typ B | trunk | broadcom based |
Note, that these two models are significantly different. You cannot use the same firmware image for both.
Typ A
Hardware
SoC | Infineon PSB 50702 E V1.3 DANUBE | XWAY DANUBE + passive heatsink |
---|---|---|
target | Lantiq | |
CPU | MIPS 24KEc network processor | 32-bit, 333 or 425 MHz |
RAM | Qimonde HYB25DC256160CE-6 | 32 MiB |
Flash | Macronix MX 29LV320CBTC-90G | 4 MiB |
Ethernet | ICplus IP101A | 10/100 Mbit/s |
WLAN | RaLink RT2860T | a/b/g/n, 2 antennas, left & right |
ISDN | Infineon, UMEC ... | |
Serial Port | yes | details below |
JTAG | not found | although present according to SoC description |
USB | not found | although present according to SoC description |
preinstalled firmware | ARV7525PW1-B-LF-23 V1.06.000 | U25 MAIN 2969 |
- the router may be watched booting via the serial console: http://pastebin.com/Ana5twd4
- discussion of the OpenWRT development for this device: http://www.ip-phone-forum.de/showthread.php?t=206932&page=1
- see also this disputation: http://permalink.gmane.org/gmane.law.gpl.violations.legal/2978
Serial Port
- internal, onboard
- 3.3V TTL
- 2×5 solder points
5 | 4 | 3 | 2 | 1 |
GND | o | TX | RX | o |
o | o | o | o | o |
10 | 9 | 8 | 7 | 6 |
- 115200 bps 8N1
- No flow control
as found by byteeater on ip-phone-forum.de
Accessing brnboot console
- during normal boot: press space 3x, enter first four letters of the default interface password (see back of router)
- with reset key held: press space 3x, enter password
QT
- holding reset + wlan during boot seems to run the brnboot recovery
Flash Layout
--------------------------------------- Area Address Length --------------------------------------- [0] Boot 0xB0000000 128K [1] Configuration 0xB0020000 192K [2] Image 0 0xB0050000 3712K [3] Image 1 0xB0050000 3712K [4] Boot Params 0xB03F0000 64K [5] Flash Image 0xB0000000 4096K ---------------------------------------
Firmware
bootloader | brnboot |
---|---|
official firmware | - |
firmware encryption | LZMA based obfuscation, cracked by Andi_84 on ip-phone-forum.de |