Home Page

	Sign In Sign-Up

Router Boxes being Analyzed

Home Page
Opened Boxes
My Robots

Visitors :

Analyzing Router Platforms

My goal here was inspired by seeing the many sites implementing public source/firmwares for assorted routers (besides other devices). I had wanted to add my own ideas and modifications into my own router, such as for I/O Devices, and possibly use it for a developement platform. After studying some of these, I found it a major task (needing to compile the whole router system firmware under Linux -varying about 100MB).

My goal is to develop a simple Assembler and C-Compiler for these Platforms. So that developers can compile patches to quickly embed into their own Platforms using Serial-Port or JTAG.

WRT54GX2 Router

Chips found :
* Cpu : RTL8651B
* Ram : k4s641632h-tc75 (x2) - SDRAM (64Mbit)4banksx1048576x16bits 133MHz
* Flash 29LV320abtc-90 - Flash (2Mx16)

* Serial : 'UART0 - 4pin(V+,Gnd,Tx,Rx) 115200,8N1'
* Pads :

WRT54GX2 Router Web Page
RTL865X Processor Web Page

Serial Boot Loader Menu Output :

(c)Copyright Realtek, Inc. 2003
Project ROME LOADER
Version 00.00.18(uClinux) (Jun 21 2005 19:38:14)
LDR version 1.00.05 for identification
[865xB] CPU Clock Rate: 200MHz, Memory Clock Rate: 130MHz
AMD/Fujitsu Standard CFI Query Table v1.1 at 0x0040
Detected flash size: total 4MB.
SDRAM size: 16MB
+TFTP +Auto UART +Bank1:ROM 
Here we try to capture the default reset button:  None.

--== Loader Menu ==--
	'r' to update run image
	'a' to change config
	'l' to update loader
	'g' to load run image without updating Flash
	'o' to update flash with ROM file
	's' to test SDRAM memory
	't' to test flash memory
	'e' to erase flash memory
	'i' to test led on/off
>i
LED test...done.

--== Loader Menu ==--
'r' to update run image
'a' to change config
'l' to update loader
'g' to load run image without updating Flash
'o' to update flash with ROM file
's' to test SDRAM memory
't' to test flash memory
'e' to erase flash memory
'i' to test led on/off
>a

!! Change configuration !!
Input MAC address(00-16-b6-6b-06-85):
Input run image start address in ram, default 0x80000400 (0x80000400):
Input run image start offset in flash, default 0x20000 (0x20000):
Input run image max size, default 0x3e0000 (0x3e0000):
Input Boot Sequence, 0:BOOT_FROM_FLASH 1:BOOT_FROM_BOOTP 2:L2 Switch(50A)
3:L2 Switch(50B) 4:Hub Mode, default 0 (-1):-1
Writing FlashROM...
SUCCESS

Press any key to RESTART ...

--== Loader Menu ==--
'r' to update run image
'a' to change config
'l' to update loader
'g' to load run image without updating Flash
'o' to update flash with ROM file
's' to test SDRAM memory
't' to test flash memory
'e' to erase flash memory
'i' to test led on/off
>g

!!Load Run Image Without Updating Flash !!
Press 'i' for ICE raw mode, or 'b' for BOOTP ... (b)
MAC: 00-16-b6-6b-06-85.
BOOTP request sent
BOOTP request sent
BOOTP request sent

Loading runtime image ...

Unzip image from address: 0xbe020000

Start runtime image at 80000400.

************************************
Powered by Realtek RTL8651B SoC, rev 1
************************************
SDRAM size: 16MB
CPU revision is: 0000ff00
Init MMU (16 entries)
Primary instruction cache 0kB, linesize 0 bytes.
Primary data cache 0kB, linesize 0 bytes.
Linux version 2.4.26-uc0 (shixiang@compile-server) (gcc version 3.3.3) #332 Fri Jan 20 21:23:52 CST 2006
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
NOFS reserved @ 0x802e11d0
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock4
IRR(0)=c0000000
Calibrating delay loop... 199.06 BogoMIPS
Memory: 13248k/16384k available (2391k kernel code, 3136k reserved, 108k data, 104k init, 0k highmem)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction...  unavailable.
POSIX conformance testing by UNIFIX
NEW PCI Driver...isLinuxCompliantEndianMode=False(Big Endian)
Found Airgo PCI, function=0!
Memory Space 0 data=0xfffe4000 size=0x4000
Memory Space 1 data=0xfff84000 size=0x4000
Memory Space 2 data=0x4000 size=0x4000
Memory Space 3 data=0x4000 size=0x4000
Memory Space 4 data=0x4000 size=0x4000
Memory Space 5 data=0x4000 size=0x4000
PCI device exists: slot 0 function 0 VendorID 17cb DeviceID 0 bbd40000
Found Airgo PCI, function=1!
Found Airgo PCI, function=2!
Found Airgo PCI, function=3!
Found Airgo PCI, function=4!
Found Airgo PCI, function=5!
Found Airgo PCI, function=6!
Found Airgo PCI, function=7!
memory mapping BAnum=0 slot=0 func=0
memory mapping BAnum=1 slot=0 func=0
memory mapping BAnum=2 slot=0 func=0
memory mapping BAnum=3 slot=0 func=0
memory mapping BAnum=4 slot=0 func=0
memory mapping BAnum=5 slot=0 func=0
assign mem base 1bf00000~1bf03fff at bbd40010 size=16384
assign mem base 1bf04000~1bf07fff at bbd40014 size=16384
assign mem base 1bf08000~1bf0bfff at bbd40018 size=16384
assign mem base 1bf0c000~1bf0ffff at bbd4001c size=16384
assign mem base 1bf10000~1bf13fff at bbd40020 size=16384
assign mem base 1bf14000~1bf17fff at bbd40024 size=16384
Find Total 1 PCI functions
Found 00:00 [17cb/0001] 000200 00
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x0
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SERIAL_PCI enabled
Probing RTL8651 home gateway controller...
chip name: 8651B, chip revid: 1
===> Request IRQ 6 for eth0, ret=0
PPP generic driver version 2.4.2
PPP BSD Compression module registered
flash device: 3e0000 at be000000
AMD/Fujitsu Standard CFI Query Table v1.1 at 0x0040
 Amd/Fujitsu Extended Query Table v1.1 at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00006000 : "boot1"
0x00010000-0x00020000 : "boot2"
0x00000000-0x00400000 : "boot3"
0x00020000-0x00120000 : "kernel"
0x00120000-0x00400000 : "rootfs"
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
GRE over IPv4 tunneling driver
ip_conntrack version 2.1 (128 buckets, 1024 max) - 344 bytes per conntrack
ip_conntrack_pptp version $Revision: 1.1.1.1 $ loaded
ip_nat_pptp version $Revision: 1.1.1.1 $ loaded
ip_tables: (C) 2000-2002 Netfilter core team
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
VFS: Mounted root (cramfs filesystem) readonly.
Freeing unused kernel memory: 104k freed
Bad boy: serial (at 0x8009d9fc) called us without a dev_id!
IRR(4)=c0c40000
===> Request IRQ 4 for serial, ret=0

BusyBox v1.00-pre2 (2006.01.18-02:33+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# System initializing...AMD/Fujitsu Standard CFI Query Table v1.1 at 0x0040

cfgmgr_integrityCheck: ok
cfgmgr_init: romeCfgParam size: 24232(0x5ea8)
cfgmgr_init: pRomeCfgParam addr: 715853824(0x2aab1rtl8651_user_pid set to 18
000)
AMD/Fujitsu Standard CFI Query Table v1.1 at 0x0040
cfg wan toAMD/Fujitsu Standard CFI Query Table v1.1 at 0x0040
 dhcp client ...
pRomeCfgParam->ifCfgParam[0].mtu =1500

Set IGMP Default Upstream interface (eth0) ... SUCCESS!!
info, client (v0.9.9-pre) started
dhcpc client deconfig
ifCfgParam[0].ipAddr: 0.0.0.0
ifCfgParam[0].ipMask: 0.0.0.0
ifCfgParam[0].gwAddr: 0.0.0.0
ifCfgParam[0].dnsPrimaryAddr: 0.0.0.0
ifCfgParam[0].dnsSecondaryAddr: 0.0.0.0
ifCfgParam[0].winsPrimaryAddr: 0.0.0.0
ifCfgParam[0].winsSecondaryAddr: 0.0.0.0
rtl8651_delNaptMapping: ret -6
rtl8651_delRoute(default): ret -3
rtl8651_delIpIntf: ret -2710
Using /lib/modules/2.4.26-uc0/kernel/drivers/net/led/led.o
PPPoE Passthru disabled.
Drop Unknown PPPoE PADT disabled.
IPv6 Passthru disabled.
Using /lib/modules/2.4.26-uc0/kernel/drivers/net/askey/airgo/ccd.o
killall: upnp: no process killed
/proc/sys/net/ipv4/ip_masq_udp_dloose: No such file or directory
target 239.0.0.0
SIOCDELRT: No such process
Using /lib/modules/2.4.26-uc0/kernel/drivers/net/askey/airgo/wns_mod.o
Using /lib/modules/2.4.26-uc0/kernel/drivers/net/askey/airgo/pol_nosdram.o
debug, Sending discover...
# MAC Monitoring Register = 0x00000000
# Setup System Clock Rate for Watch Dog
plm probe (plm_dump_buf @ C0029100)
&bdh 805F0170 bdh A05E0000
np->hif_regs->bus_slave.hif_ctrl.val 00010000
np->hif_regs->bus_slave.hif_ctrl.val 00000000
wlan0: PCI Revision = 3, Slot Name[00:00.0], Slot#[0]
wlan0: at BAR0 = 0xbbf00000, BAR1 = 0xbbf00000, IRQ 5.
IRR(5)=c0c40000
===> Request IRQ 5 for wlan0, ret=0
wlan0: request_irq, err = 0
wlan0: plm_reg_init Succeeded 
wlan0: Failed CRC Check on EEPROM Data:
	Read[00000000]/Computed[FA695FCF]/crcDataSize[0E0B]/eepTypeFlag[0]
wlan0: plm_get_radio_eeprominfo(), err = -1
PLMAC: Error: pum_mod_init: pci_module_init() failed !!!
debug, Sending discover...
insmod: init_module: pol_nosdram: No such device
find_pid_by_name(): 0
ssid=linksys
Unable to handle kernel paging request at virtual address c002fb08,
epc == c002fb08, ra == 801a09ec
Oops in fault.c::do_page_fault, line 206:
$0 : 00000000 00000002 c002fb08 00000333 805f0000 805f0000 80240336 00000000
$8 : 00000000 00000000 00000002 80bdf332 fffffffd ffffffff 0000000a 00000000
$16: 805f0000 80bdf333 00000000 00000c00 00000000 80bdf000 00000c00 80cb3ed0
$24: 80cb3d48 ffffffff                   80cb2000 80cb3e20 7fff7c38 801a09ec
Hi : 00000000
Lo : 00000000
epc   : c002fb08    Not tainted
Status: 1000fc04
Cause : 00000008
PrId  : 0000c601
Process ani8021x_aa (pid: 47, stackpage=80cb2000)
Stack:    80f1a00a 00000003 80f57c00 00000000 00000000 00000000 00000000
 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
 00000000 00000000 00000000 00000000 10019ba0 00000333 805f0000 801a0a5c
 be00024c 7fff7c38 800356ec 00000000 00000c00 00000c00 80bdf000 00001000
 10019ba0 8036aab0 00000000 8025b990 be00024c 8006d20c 80f1a000 00000000
 100040c0 ...
Call Trace:   [<801a0a5c>] [<800356ec>] [<8006d20c>] [<8003e094>] [<8003ede4>]
 [<80056354>] [<8003e6a0>] [<800064b4>] [<8000826c>] [<8000508c>] [<8006dde4>]

Code: (Bad address in epc)

debug, Sending discover...
CCD: Unknown WNI Netlink Msg [0x1]
CCD: Unknown WNI Netlink Msg [0x1]
Applied commit-all global settings
killall: udhcpd: no process killed
info, server (v0.9.9-pre) started
error, max_leases value (254) not sane, setting to 50 instead
error, Unable to open /var/udhcpd.leases for reading

Some of Filesystem BIX Image File :

00000000:  07 02 82 00  59 a0 e8 42  d9 2f 01 00  07 d7 03 15  ....Y..B./......
00000010:  0f 34 10 00  00 3b 3f e8  00 00 df 7a  59 a0 e8 42  .4...;?....zY..B
00000020:  8d c9 01 00  07 d7 03 15  0f 34 0f 00  00 0f 2a fa  ..........4....*.
00000030:  00 00 99 a2  1f 8b 08 08  2c e4 00 46  02 03 6b 65  .........,..F..ke
00000040:  72 6e 65 6c  2e 62 69 6e  00 ec 5a 7d  6c 1c 65 7a  rnel.bin..Z}1.ez.
...
00100000:  00 00 00 00  45 3d cd 28  00 00 01 00  00 00 00 00  ....E=.(........
00100010:  00 00 00 00  43 6f 6d 70  72 65 73 73  65 64 20 52  ....Compressed R
00100020:  4f 4d 46 53  70 91 c4 22  0a bd d5 01  91 9c f1 16  OMFSp.."........
00100030:  b5 8c a2 94  43 6f 6d 70  72 65 73 73  65 64 00 00  ....Compressed..
00100040:  00 00 00 00  ed 41 0d 02  d4 00 00 0d  c0 04 00 00  .....A..........
00100050:  ed 41 0d 02  2c 02 00 0d  01 12 00 00  6c 69 62 00  .A..,.......lib.
00100060:  fd 41 0d 02  58 05 00 0d  81 45 00 00  62 69 6e 00  .A..X....E..bin.
00100070:  fd 41 0d 02  00 0a 00 0d  01 9b 00 00  64 65 76 00  .A..........dev.
00100080:  fd 41 0d 02  ac 01 00 0d  01 3b 01 00  65 74 63 00  .A.......;..etc.
00100090:  fd 41 0d 02  14 00 00 0d  01 67 01 00  68 6f 6d 65  .A.......g..home
001000A0:  fd 41 0d 02  00 00 00 0d  01 00 00 00  6d 6e 74 00  .A..........mnt.
001000B0:  fd 41 0d 02  00 00 00 0d  01 00 00 00  70 72 6f 63  .A..........proc
001000C0:  fd 41 0d 02  00 00 00 0d  01 00 00 00  75 73 72 00  .A..........usr.
001000D0:  fd 41 0d 02  00 00 00 0d  01 00 00 00  76 61 72 00  .A..........var.
001000E0:  fd 41 0d 02  dc 04 00 0d  c1 69 01 00  77 77 77 00  .A.......i..www.
001000F0:  ff a1 0d 02  07 00 00 0d  41 7d b2 02  74 6d 70 00  .A......A}..tmp.
00100100:  ff a1 0d 02  03 00 00 0d  81 7e b2 02  73 62 69 6e  .A.......~..sbin
00100110:  fd 81 0d 02  c8 36 00 0d  82 7f b2 02  63 6c 65 73  .A..........cles
00100120:  68 65 6c 6c  a4 81 0d 02  cc 38 00 0d  85 13 02 00  hell....8.......
00100130:  6c 69 62 63  72 79 70 74  2d 30 2e 39  2e 32 36 2e  libcrypt-0.9.26.
00100140:  73 6f 00 00  a4 81 0d 02  b8 20 00 0d  84 dd 03 00  so....... ......
00100150:  6c 69 62 64  6c 2d 30 2e  39 2e 32 36  2e 73 6f 00  libdl-0.9.26.so.
... etc

Send an email

Links to Related Sites :

- Links -

Notes
Note: All of the notes here are taken from unfinished Analysis, and may include Inaccuracies or Errors or missing info. No resposibility or guarantee are assumed from Info on this page nor from the author.

Help would be appreciated
Looking for Binaries such as Bootloader for analysis. Also looking for specs for CPUs in these these Routers, including OpCodes for the Assembler. The Assemblers and C-Compilers are hoped to be posted here in the future.

Any Questions:

http://jlc.iwarp.com/home.html