Firmware modification D-Link DWR-M921 RTL8197F

D-Link DWR-M921 Firmware Teardown and Mod Guide (RTL8197F)

The D-Link DWR-M921 runs on the Realtek RTL8197F chipset with 128 MB DDR2 at 400 MHz and 8 MB SPI NOR flash from Winbond W25Q64. The MIPS 24Kc processor (00019385) clocks at 999 MHz under Linux 3.10.90, compiled with gcc 4.4.7 from Realtek's MSDK.

The onboard UART interface lets you snag the boot log, revealing the MTD partition layout:

• 0x00000-0x30000: "boot+cfg+linux"
• 0x30000-0x80000: "rootfs"
• 0x80000-0xb0000: "boot+cfg+linux2" (disabled)
• 0xb0000-0x100000: "rootfs2" (disabled)

Active bootbank=1. The kernel loads from 0x80a00000, with rootfs mounted as squashfs on /dev/mtdblock1.

Subsystem Initialization Breakdown

The boot log walks through sequential init:

• Memory and cache: 114 MB free out of 128 MB, SLUB with HWalign=32.
• USB controllers: EHCI (bus 1), OHCI (bus 2), DWC OTG (bus 3) with PHY patches for 40 MHz OSC.
• Networking: Realtek WLAN (RFE TYPE=0, 512 RX/TX descriptors), FastPath v1.03, VLAN 802.1Q.
• Filesystems: squashfs 4.0, exFAT 1.2.9, NTFS R/W.
• Drivers: PPP, L2TP, GobiNet/Serial for modems, nf_conntrack.

Specific USB PHY registers:

port 0 reg e0=e2, e1=31, e2=33, e3=8d, e4=c9, e5=19, e6=c1, e7=91
port 0 reg f0=fc, f1=8c, f2=0, f3=11, f4=9b, f5=4, f6=0

Ethernet ports eth0-eth4 map to VLANs with FastPath acceleration.

Firmware Layout and Roadblocks

Firmware uses a dual-bank setup, but bank 2 is locked out. No open-source D-Link code and spotty OpenWRT support for RTL8197F make custom builds tricky. Attempts with outdated Realtek SDK (rtl819x on SourceForge) flop.

Key boot log specs:

• Kernel command line: console=ttyS0,38400 root=/dev/mtdblock1
• DRAM: 128MB DDR2@400MHz
• Flash: w25q64@29MHz (max_speed_hz=29000000Hz)
• CPU: 660.68 BogoMIPS

Mod Attack Vectors

• UART/JTAG Dump: Grab full image for reverse engineering.
• Squashfs Patching: Unpack rootfs, inject AdGuardHome or custom packages.
• Bootloader Hooks: Tweak U-Boot or proprietary loader for alternate root.
• SDK Exploits: Leverage Realtek MSDK for compatible images.
• TFTP Recovery: Network-load modded images if enabled.

RTL8197F has PCIe (though linkup fails), USB OTG, and GPIO for low-level hacks.

Key Takeaways

• RTL8197F Chipset: MIPS 24Kc@999MHz, 128MB RAM, limited OpenWRT support.
• MTD Partitions: Only boot+cfg+linux (0x300KB) and rootfs (0x500KB) active.
• USB PHY Patches: Essential for stable EHCI/OHCI/DWC OTG.
• Realtek WLAN: RFE=0, 512 descriptors, Adaptivity 9.3.4.
• Kernel Version: 3.10.90 (2021), outdated drivers (gcc 4.4.7).

— Editorial Team