6c148116f7
Device specifications
* SoC: QCA9563 @ 775MHz (MIPS 74Kc)
* RAM: 128MiB DDR2
* Flash: 16MiB SPI-NOR (EN25QH128)
* Wireless 2.4GHz (SoC): b/g/n, 3x3
* Wireless 5Ghz (QCA9988): a/n/ac, 4x4 MU-MIMO
* IoT Wireless 2.4GHz (QCA6006): currently unusable
* Ethernet (AR8327): 3 LAN × 1GbE, 1 WAN × 1GbE
* LEDs: Internet (blue/orange), System (blue/orange)
* Buttons: Reset
* UART: through-hole on PCB ([VCC 3.3v](RX)(GND)(TX) 115200, 8n1)
* Power: 12VDC, 1,5A
MAC addresses map (like in OEM firmware)
art@0x0 88:C3:97:*:57 wan/label
art@0x1002 88:C3:97:*:2D lan/wlan2g
art@0x5006 88:C3:97:*:2C wlan5g
Obtain SSH Access
1. Download and flash the firmware version 1.3.8 (China).
2. Login to the router web interface and get the value of `stok=` from the
URL
3. Open a new tab and go to the following URL (replace <STOK> with the stok
value gained above; line breaks are only for easier handling, please put
together all four lines into a single URL without any spaces):
http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev
?bssid=any&user_id=any&ssid=-h%0Anvram%20set%20ssh_en%3D1%0Anvram%20commit
%0Ased%20-i%20%27s%2Fchannel%3D.%2A%2Fchannel%3D%5C%5C%22debug%5C%5C%22%2F
g%27%20%2Fetc%2Finit.d%2Fdropbear%0A%2Fetc%2Finit.d%2Fdropbear%20start%0A
4. Wait 30-60 seconds (this is the time required to generate keys for the
SSH server on the router).
Create Full Backup
1. Obtain SSH Access.
2. Create backup of all flash (on router):
dd if=/dev/mtd0 of=/tmp/ALL.backup
3. Copy backup to PC (on PC):
scp root@192.168.31.1:/tmp/ALL.backup ./
Tip: backup of the original firmware, taken three times, increases the
chances of recovery :)
Calculate The Password
* Locally using shell (replace "12345/E0QM98765" with your router's serial
number):
On Linux
printf "%s6d2df50a-250f-4a30-a5e6-d44fb0960aa0" "12345/E0QM98765" | \
md5sum - | head -c8 && echo
On macOS
printf "%s6d2df50a-250f-4a30-a5e6-d44fb0960aa0" "12345/E0QM98765" | \
md5 | head -c8
* Locally using python script (replace "12345/E0QM98765" with your
router's serial number):
wget https://raw.githubusercontent.com/eisaev/ax3600-files/master/scripts/calc_passwd.py
python3.7 -c 'from calc_passwd import calc_passwd; print(calc_passwd("12345/E0QM98765"))'
* Online
https://www.oxygen7.cn/miwifi/
Debricking (lite)
If you have a healthy bootloader, you can use recovery via TFTP using
programs like TinyPXE on Windows or dnsmasq on Linux. To switch the router
to TFTP recovery mode, hold down the reset button, connect the power
supply, and release the button after about 10 seconds. The router must be
connected directly to the PC via the LAN port.
Debricking
You will need a full dump of your flash, a CH341 programmer, and a clip
for in-circuit programming.
Install OpenWRT
1. Obtain SSH Access.
2. Create script (on router):
echo '#!/bin/sh' > /tmp/flash_fw.sh
echo >> /tmp/flash_fw.sh
echo '. /bin/boardupgrade.sh' >> /tmp/flash_fw.sh
echo >> /tmp/flash_fw.sh
echo 'board_prepare_upgrade' >> /tmp/flash_fw.sh
echo 'mtd erase rootfs_data' >> /tmp/flash_fw.sh
echo 'mtd write /tmp/openwrt.bin firmware' >> /tmp/flash_fw.sh
echo 'sleep 3' >> /tmp/flash_fw.sh
echo 'reboot' >> /tmp/flash_fw.sh
echo >> /tmp/flash_fw.sh
chmod +x /tmp/flash_fw.sh
3. Copy `openwrt-ath79-generic-xiaomi_aiot-ac2350-squashfs-sysupgrade.bin`
to the router (on PC):
scp openwrt-ath79-generic-xiaomi_aiot-ac2350-squashfs-sysupgrade.bin \
root@192.168.31.1:/tmp/openwrt.bin
4. Flash OpenWRT (on router):
/bin/ash /tmp/flash_fw.sh &
5. SSH connection will be interrupted - this is normal.
6. Wait for the indicator to turn blue.
Signed-off-by: Evgeniy Isaev <isaev.evgeniy@gmail.com>
[improve commit message formatting slightly]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
267 lines
7.5 KiB
Bash
267 lines
7.5 KiB
Bash
#!/bin/sh
|
|
|
|
[ -e /lib/firmware/$FIRMWARE ] && exit 0
|
|
|
|
. /lib/functions/caldata.sh
|
|
. /lib/functions/k2t.sh
|
|
|
|
board=$(board_name)
|
|
|
|
case "$FIRMWARE" in
|
|
"ath10k/cal-pci-0000:00:00.0.bin")
|
|
case $board in
|
|
allnet,all-wap02860ac|\
|
|
engenius,eap1200h|\
|
|
engenius,enstationac-v1|\
|
|
glinet,gl-x750)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) 2)
|
|
;;
|
|
avm,fritz1750e|\
|
|
avm,fritzdvbc)
|
|
caldata_extract "urlader" 0x198a 0x844
|
|
;;
|
|
comfast,cf-wr650ac-v1|\
|
|
comfast,cf-wr650ac-v2|\
|
|
devolo,dlan-pro-1200plus-ac|\
|
|
devolo,magic-2-wifi|\
|
|
qxwlan,e1700ac-v2-8m|\
|
|
qxwlan,e1700ac-v2-16m|\
|
|
qxwlan,e600gac-v2-8m|\
|
|
qxwlan,e600gac-v2-16m|\
|
|
ubnt,aircube-ac|\
|
|
ubnt,bullet-ac|\
|
|
ubnt,unifiac-lite|\
|
|
ubnt,unifiac-lr|\
|
|
ubnt,unifiac-mesh|\
|
|
ubnt,unifiac-mesh-pro|\
|
|
ubnt,lap-120|\
|
|
ubnt,litebeam-ac-gen2|\
|
|
ubnt,nanobeam-ac|\
|
|
ubnt,nanobeam-ac-gen2|\
|
|
ubnt,nanostation-ac|\
|
|
ubnt,nanostation-ac-loco|\
|
|
ubnt,powerbeam-5ac-500|\
|
|
ubnt,powerbeam-5ac-gen2|\
|
|
ubnt,rocket-5ac-lite|\
|
|
ubnt,unifiac-pro|\
|
|
yuncore,a770)
|
|
caldata_extract "art" 0x5000 0x844
|
|
;;
|
|
devolo,dvl1200e|\
|
|
devolo,dvl1200i|\
|
|
devolo,dvl1750c|\
|
|
devolo,dvl1750e|\
|
|
devolo,dvl1750i|\
|
|
devolo,dvl1750x)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) -1)
|
|
;;
|
|
dlink,dap-2660-a1|\
|
|
dlink,dap-2695-a1|\
|
|
dlink,dap-3662-a1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_ascii bdcfg wlanmac_a)
|
|
;;
|
|
dlink,dir-859-a1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_ascii devdata "wlan5mac")
|
|
;;
|
|
elecom,wrc-1750ghbk2-i)
|
|
caldata_extract "art" 0x5000 0x844
|
|
;;
|
|
engenius,ecb1200|\
|
|
engenius,ecb1750)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_ascii u-boot-env athaddr)
|
|
;;
|
|
engenius,epg5000|\
|
|
iodata,wn-ac1167dgr|\
|
|
iodata,wn-ac1600dgr2|\
|
|
sitecom,wlr-7100|\
|
|
zyxel,nbg6616)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) 1)
|
|
;;
|
|
engenius,ews511ap)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) 1)
|
|
;;
|
|
glinet,gl-ar750)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) 1)
|
|
;;
|
|
nec,wg800hp)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_text board_data 0x880)
|
|
;;
|
|
ocedo,koala|\
|
|
ocedo,ursus)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_binary art 0xc)
|
|
;;
|
|
openmesh,a40|\
|
|
openmesh,a60|\
|
|
openmesh,mr1750-v1|\
|
|
openmesh,mr1750-v2)
|
|
caldata_extract "ART" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) 16)
|
|
;;
|
|
openmesh,om5p-ac-v2)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) 16)
|
|
;;
|
|
qihoo,c301)
|
|
caldata_extract "radiocfg" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_ascii devdata wlan5mac)
|
|
;;
|
|
tplink,archer-a7-v5|\
|
|
tplink,archer-c2-v3|\
|
|
tplink,archer-c7-v4|\
|
|
tplink,archer-c7-v5|\
|
|
tplink,archer-c25-v1|\
|
|
tplink,tl-wr902ac-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) -1)
|
|
;;
|
|
tplink,archer-c5-v1|\
|
|
tplink,archer-c7-v2|\
|
|
tplink,tl-wdr7500-v3)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary u-boot 0x1fc00) -1)
|
|
;;
|
|
tplink,archer-d50-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary romfile 0xf100) 2)
|
|
;;
|
|
tplink,archer-d7-v1|\
|
|
tplink,archer-d7b-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary romfs 0xf100) 2)
|
|
;;
|
|
tplink,eap245-v1|\
|
|
tplink,re450-v2|\
|
|
tplink,re450-v3)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) 1)
|
|
;;
|
|
tplink,re350k-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) 2)
|
|
;;
|
|
tplink,re355-v1|\
|
|
tplink,re450-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) -2)
|
|
;;
|
|
tplink,tl-wpa8630-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary u-boot 0x0fc00) 1)
|
|
;;
|
|
esac
|
|
;;
|
|
"ath10k/cal-pci-0000:01:00.0.bin")
|
|
case $board in
|
|
sitecom,wlr-8100)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) 1)
|
|
;;
|
|
esac
|
|
;;
|
|
"ath10k/pre-cal-pci-0000:00:00.0.bin")
|
|
case $board in
|
|
comfast,cf-e313ac)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(mtd_get_mac_binary art 0x6)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
rm /lib/firmware/ath10k/QCA9888/hw2.0/board-2.bin
|
|
;;
|
|
comfast,cf-e375ac|\
|
|
comfast,cf-e560ac|\
|
|
comfast,cf-ew72|\
|
|
comfast,cf-wr752ac-v1)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) 2)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
rm /lib/firmware/ath10k/QCA9888/hw2.0/board-2.bin
|
|
;;
|
|
dlink,dap-2680-a1)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(mtd_get_mac_ascii bdcfg wlanmac_a)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
dlink,dir-842-c1|\
|
|
dlink,dir-842-c2|\
|
|
dlink,dir-842-c3)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
caldata_valid "202f" || caldata_extract "reserved" 0x15000 0x2f20
|
|
ath10k_patch_mac $(mtd_get_mac_ascii devdata wlan5mac)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
nec,wf1200cr|\
|
|
nec,wg1200cr)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(mtd_get_mac_ascii devdata wlan5mac)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
netgear,ex6400|\
|
|
netgear,ex7300)
|
|
caldata_extract "caldata" 0x5000 0x2f20
|
|
ath10k_patch_mac $(mtd_get_mac_binary caldata 0xc)
|
|
;;
|
|
phicomm,k2t)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(k2t_get_mac "5g_mac")
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
tplink,archer-c58-v1|\
|
|
tplink,archer-c59-v1|\
|
|
tplink,archer-c59-v2|\
|
|
tplink,archer-c60-v1|\
|
|
tplink,archer-c60-v2|\
|
|
tplink,archer-c60-v3|\
|
|
tplink,archer-c6-v2|\
|
|
tplink,archer-c6-v2-us)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) -1)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
tplink,eap225-outdoor-v1|\
|
|
tplink,eap225-v3|\
|
|
tplink,eap225-wall-v2|\
|
|
tplink,tl-wpa8630p-v2-int|\
|
|
tplink,tl-wpa8630p-v2.0-eu|\
|
|
tplink,tl-wpa8630p-v2.1-eu)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) 1)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
tplink,eap245-v3)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) 1)
|
|
;;
|
|
xiaomi,aiot-ac2350)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9984/hw1.0/board.bin
|
|
;;
|
|
yuncore,a782|\
|
|
yuncore,xd4200)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
esac
|
|
;;
|
|
*)
|
|
exit 1
|
|
;;
|
|
esac
|