DragonK wrote:
Ivo van Geel wrote:
Hi DragonK,
The CPU seems to be a Ralink RT2880
(http://www.ralinktech.com/ralink/data/RT2880.pdf).
This kind of CPU is also used in the T-Com Speedport W700V (see
http://wiki.openwrt.org/TableOfHardware).
Support for this CPU is a Work In Progress, there is no running version
of OpenWRT available for this CPU, yet.
(http://wiki.openwrt.org/OpenWrtDocs/Hardware/T-Com/Speedport_W700V)
It is going to be very, very difficult to create a running version of
OpenWRT for your router.
Kind regards,
Ivo van Geel.
Hello everybody,
I've made a little progress since the last mail.
Here is the thing:
I'm trying to reverse engineer the firmware image (
http://www.belkin.com/support/article/?lid=en&pid=f5d8231-4&aid=5927&scid=854&fid=4063&fn=f5d8231v5_ww_5.01.05.bin
) for
this router in order to modify it and perhaps enable the telnet daemon.
This is what I've found until now:
1) The device uses U-Boot
2) The firmware image has the following structure: Belkin header +
U-Boot header + gzipped kernel + squashfs image.
I've created a template for WinHEX (attached to this mail) which
decodes the information I've identified in the firmware file.
The problems I'm facing now are the following
- I can't exactly determine the offset of the SquashFS inside the fw
img based on header information (but it can be located based on its
signature 'hsqs').
- I don't seem to be able to mount the extracted filesystem.
When I attempt to mount the FS, I get the following:
------------------------------------------------------------------------------
root# mount ./fw_squash_stripped.bin ./a -o loop
mount: wrong fs type, bad option, bad superblock on /dev/loop2,
....
root# dmesg | tail
squashfs: version 3.3 (2007/10/31) Phillip Lougher
SQUASHFS error: zlib_inflate returned unexpected result 0xfffffffd,
srclength 8192, avail_in 596, avail_out 8192
SQUASHFS error: sb_bread failed reading block 0x712
SQUASHFS error: Unable to read cache block [1c41a8:1d95]
SQUASHFS error: Unable to read inode [1c41a8:1d95]
------------------------------------------------------------------------------
Can anybody help me out here? Has anybody seen anything similar before?
From what I understand squashfs is able to mount both little endian
and big endian filesystems so I don't think this is the problem.
Also, my kernel doesn't have the squashfs-lzma patch, but I've tried
to mount the image using a lzma-enabled kernel and that's not it either.
Also, I have another question:
In this image of the router's board (
http://img411.imageshack.us/img411/1251/a31ndiua5sp4.jpg ) , the
encircled red thing could be a serial port?
If so, how could I connect to it (because the "pins" are only on the
board, there's no connector) ?
Thanks!
....And of course, I've forgot to attach the template...sorry.
template "Belkin F5D8213-4 Firmware"
description "Belkin firmware image"
applies_to file
requires 0x4 "0E"
// GZip data
requires 0x53 "1F 8B"
begin
hex 4 "Unknown 4 bytes"
uint8 "Length of product string (?)"
char[14] "Product string"
section "U-Boot image"
hex 4 "Signature 0x27051956"
hex 4 "Header CRC-32" // Computed over the U-Boot header with
this field set to 0
hex 4 "Creation time"
hex 4 "Data size"
hex 4 "Load address"
hex 4 "Entry point"
hex 4 "Data CRC-32"
uint8 "Operating System"
uint8 "CPU Architecture"
uint8 "Image Type"
uint8 "Compression Type"
char[32] "Description string"
endsection
section "GZip data"
hex 2 "GZip Signature"
hex 1 "Method (08 = deflate)"
section "Flags"
uint_flex "0" "FTEXT"
move -4
uint_flex "1" "FHCRC"
move -4
uint_flex "2" "FEXTRA"
move -4
uint_flex "3" "FNAME"
move -4
uint_flex "4" "FCOMMENT"
move -4
uint_flex "5" "Reserved"
move -4
uint_flex "6" "Reserved"
move -4
uint_flex "7" "Reserved"
endsection
UNIXDateTime "Modification time"
hex 1 "Extra flags"
hex 1 "Operating System"
zstring "Original file name"
endsection
end
_______________________________________________
openwrt-users mailing list
[email protected]
http://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-users
