Tiny hackable AR9331 router from china

Atheros AR9331 soc is well established and has been incorporated into many router designs ;  and while searching through the net for nice, inexpensive AR9331 board to play around with,  I  came across this one from china for £25 including postage.

Click to enlarge

Specification :

• soc : Atheros AR9331 rev 1 MIPS 24kc v7.4
• 64MB DRAM
• 8MB SPI NOR Flash
• One USB2.0 host port
• One debug port - which also is the +5v power input to the board
• ethernet - one 100Mbit/s port - usually used as the wan port
• ethernet - two 100Mbits/s lan ports
• 802.11 b/g/n wifi with a pretty effective built in printed antenna.
• i2c and gpio - these are available via the tiny pads on the pcb

flip side showing the io pads - click to enlarge

NOR flash layout: (relative addresses)

 0x000000000000-0x000000020000 : "u-boot"  
 0x000000020000-0x0000007f0000 : "firmware"  
 0x0000007f0000-0x000000800000 : "art"  

BIG FAT WARNING : The board comes pre flashed and make sure never to touch the u-boot sectors, unless you really know what you are doing. The art partition carries the firmware for the wlan - and make sure this 64k sector is backed up. The wlan interface will not come up if this sector is wiped.

Here is the uboot interrupted and dump the help. The factory flashed uboot already has all the sub functions we need; hence no need to mess with it.

click to enlarge

The ethernet ports are not correctly configured in the shipped firmware,. My modified firmware bin file is here.  (md5sum : 43886d43758b69975778bd9722e94973a  openwrt-ar71xx-generic-som9331-squashfs-factory.bin)

absolute addresses (for u-boot):

 0x9f000000-0x9f01ffff : u-boot
 0x9f020000-0x9f7effff : kernel + rootfs 
 0x9f7f0000-0x9f7fffff : art - atheros firmware  

at u-boot prompt, the kernel +rootfs can be erased by:

 erase 0x9f020000 0x9f7effff   

frash erase - click to enlarge

The default u-boot environment setting are as follows :

• ipaddres   192.168.1.1
• server ip   192.168.1.2
• filename f irmware.bin

setup the tftp server, and make sure the server ip is 192.168.1.2. Connect the ethernel cable to one of the lan ports of som9331.  Rename the above file to firmware.bin and:

 tftp   

This will download the firmware.bin file from the tftp server

after the tftp transfer, the image is now in ram @ 0x80800000 

note the filesize in bytes transferred line  (0x7c0000) . Copy this to flash :

 cp.b 0x80800000 0x9f020000 0x7c0000   

finally, copy to flash 

once done, remove the ethernet cabe, and press reset button to boot the shiny new openwrt .. remember to set the root password.