Friday, 12 December 2014

Tiny hackable AR9331 router from china

Atheros AR9331 soc is well established and has been incorporated into many router designs ;  and while searching through the net for nice, inexpensive AR9331 board to play around with,  I  came across this one from china for £25 including postage.

Click to enlarge
Specification :
  • soc : Atheros AR9331 rev 1 MIPS 24kc v7.4
  • 64MB DRAM
  • 8MB SPI NOR Flash
  • One USB2.0 host port
  • One debug port - which also is the +5v power input to the board
  • ethernet - one 100Mbit/s port - usually used as the wan port
  • ethernet - two 100Mbits/s lan ports
  • 802.11 b/g/n wifi with a pretty effective built in printed antenna.
  • i2c and gpio - these are available via the tiny pads on the pcb
flip side showing the io pads - click to enlarge

NOR flash layout: (relative addresses)
 0x000000000000-0x000000020000 : "u-boot"  
 0x000000020000-0x0000007f0000 : "firmware"  
 0x0000007f0000-0x000000800000 : "art"  
BIG FAT WARNING : The board comes pre flashed and make sure never to touch the u-boot sectors, unless you really know what you are doing. The art partition carries the firmware for the wlan - and make sure this 64k sector is backed up. The wlan interface will not come up if this sector is wiped.

Here is the uboot interrupted and dump the help. The factory flashed uboot already has all the sub functions we need; hence no need to mess with it.
click to enlarge
The ethernet ports are not correctly configured in the shipped firmware,. My modified firmware bin file is here.  (md5sum : 43886d43758b69975778bd9722e94973a  openwrt-ar71xx-generic-som9331-squashfs-factory.bin)

absolute addresses (for u-boot):
 0x9f000000-0x9f01ffff : u-boot
 0x9f020000-0x9f7effff : kernel + rootfs 
 0x9f7f0000-0x9f7fffff : art - atheros firmware  

at u-boot prompt, the kernel +rootfs can be erased by:
 erase 0x9f020000 0x9f7effff   
frash erase - click to enlarge
The default u-boot environment setting are as follows :
  • ipaddres
  • server ip
  • filename f irmware.bin
setup the tftp server, and make sure the server ip is Connect the ethernel cable to one of the lan ports of som9331.  Rename the above file to firmware.bin and:
This will download the firmware.bin file from the tftp server
after the tftp transfer, the image is now in ram @ 0x80800000 
note the filesize in bytes transferred line  (0x7c0000) . Copy this to flash :
 cp.b 0x80800000 0x9f020000 0x7c0000   
finally, copy to flash 
once done, remove the ethernet cabe, and press reset button to boot the shiny new openwrt .. remember to set the root password.

No comments:

Post a Comment