Repair D-link DVG-N5204SP via UART
The topic of router firmware via the UART interface is heavily poured out, chewed, but I could not find information on my router, so I think that this topic will be useful, especially since there are several questions on the forums about this and remained unanswered.
I got into the hands of a sabzhevy router, got on a freebie, because "something did not work."
Bringing home, I found that the router flatly refuses to raise the LAN ports, despite the fact that it blinks with the remaining indicators when it boots up, and the WAN port picks up. Resetting with the Reset button did not help, although the bulbs behaved the same way as when resetting.
Well, a freebie is a freebie, and I really wanted to use this router to access the Internet via 3G \ 4G carrier flash drives in a country house. Yes, and with the possibility of raising it SIP Megaphone for fun.
Having read the manuals, I realized that none of the described methods for entering Emergency mode worked, although when the power was turned on and the Reset button was held down, the router clearly entered into some mode in which the LAN ports normally went up, but described in the network manuals 192.168.80.20 / 24, 192.168.1.2/24, 192.168.0.2/24, 192.168.8.10/24 did not fit, no address answered ( 192.168.80.21, 192.168.1.1, 192.168.0.1, 192.168.8.254 ).
I thought it was time to open this piece of iron to look at the insides:
I was already seen solderedUART , in the lower left corner, above the WAN LED , it remained only to pick up the adapter and use it.
In a local store, a DCU-15 cable was bought on PL2303 for 30 rubles, disassembled and soldered to the necessary pins (do not swear for soldering, everything was done with a Chinese gas soldering iron for 150 rubles, which barely heats up, just wanted to give him a chance to live his life for good reason):
There are a lot of manuals for connecting telephone data cables to UART ports, so I will not describe it again.
I used Putty for the connection, an adequate transmission started at a speed of 38,400 baud , it must be set in Putty and in the USB-COM port settings:
Settings
When I turned on, the router cheerfully issued a list asking me what I would like to do:
DDR DRAM 32 MB @ 195 MHz, SPI FLASH 8 M
--- Octtel (RTL89xxB) at 2011.05.16-13: 42 + 0800 version 1.1.26.0 [16bit] (390MHz)
--- Wireless regDomain --- MAC Address: 84: c9: b2: xx: xx: xx
Press 'i' to update system image.
Press 'k' to update kernel image.
Press 'r' to update root fs image.
Press 'l' to update loader.
Press 'c' to change target IP
Press 't' to change TFTP server IP
Press 'z' to change network MAC number config.
Press 'm' to change MAC and SN config.
Press 'y' to change wireless regDomain config.
There are many manuals on the network for updating / restoring firmware for the D-link DIR-300 and the like, it describes how to restore the firmware directly by downloading from the tftp server, but not a single update point of this router requested the required file (firmware file downloaded from FTP D-link 'a has the extension .pack, and was already waiting for downloads on the tftp server).
I fell temporarily discouraged, and thought, maybe I can get something out of the router’s boot logs. If anyone wants to look, I post it on a well-known resource:
http://pastebin.com/hS9zVx5z
For some reason, the log spoiler did not want to work, if someone tells me why, I will be grateful and transfer it to the article.
I did not find any mention in the logs about the available networks.
After the device was fully loaded, it became possible to use the command input, which was implemented:
# ifconfig
br0 Link encap: Ethernet HWaddr 84: C9: B2: XX: XX: XX
inet addr: 192.168.8.254 Bcast: 192.168.8.255 Mask: 255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU: 1500 Metric: 1
RX packets: 0 errors: 0 dropped: 0 overruns: 0 frame: 64
TX packets: 41 errors: 0 dropped: 0 overruns: 0 carrier: 0
collisions: 0 txqueuelen: 0
RX bytes : 23275 (22.7 KiB) TX bytes: 0 (0.0 B)
eth0 Link encap: Ethernet HWaddr 84: C9: B2: XX: XX: XX
UP BROADCAST RUNNING MULTICAST MTU: 1500 Metric: 1
RX packets: 0 errors: 0 dropped: 0 overruns: 0 frame: 0
TX packets: 41 errors: 0 dropped: 0 overruns: 0 carrier: 0
collisions: 0 txqueuelen: 128
RX bytes: 0 (0.0 B) TX bytes: 1722 (1.6 KiB)
Interrupt: 15
eth1 Link encap: Ethernet HWaddr 84: C9: B2: XX: XX: XX
inet addr: 192.168.8.254 Bcast: 192.168.8.255 Mask: 255.255.255.252
UP BROADCAST RUNNING MULTICAST MTU: 1500 Metric: 1
RX packets: 6320 errors: 0 dropped: 0 overruns: 0 frame: 0
TX packets: 1562 errors: 0 dropped: 0 overruns: 0 carrier: 0
collisions: 0 txqueuelen: 128
RX bytes: 1176595 (1.1 MiB) TX bytes: 1301150 (1.2 MiB)
Interrupt: 15
lo Link encap: Local Loopback
inet addr: 127.0.0.1 Mask: 255.0.0.0
UP LOOPBACK RUNNING MTU: 16436 Metric: 1
RX packets: 14 errors: 0 dropped: 0 overruns: 0 frame: 0
TX packets: 14 errors: 0 dropped: 0 overruns: 0 carrier: 0
collisions: 0 txqueuelen: 0
RX bytes: 1100 (1.0 KiB) TX bytes: 1100 (1.0 KiB)
As you can see, the br0 and eth1 interfaces have the same IP, but in the case of eth1, the usual link network \ 30 is configured.
It was decided to connect the cable to the WAN port to test this network. The router lifted the port, but in the console it deduced:
NCS: Connection WAN established, IP = 192.168.8.254 Subnet Mask = 255.255.255.252
With the thoughts "well, now you are not hiding from me anywhere", I climbed into the network card 192.168. 8.253 / 30
All 4 sent packets did not return alive, but the router in the console responded:
NCS: Icmp-Smurf attack detected, SA = 192.168.8.253 DA = 192.168.8.254
NCS: Icmp-Smurf attack detected, SA = 192.168.8.253 DA = 192.168.8.254
NCS: Icmp-Smurf attack detected, SA = 192.168.8.253 DA = 192.168.8.254
NCS: Icmp-Smurf attack detected, SA = 192.168.8.253 DA = 192.168.8.254
The next attempt to log in through telnet out of habit was successful, it immediately got into the browser to launch the web-face. Launched !!! Joy knew no bounds. Now we had to try to reset it via the interface, these routers agree to upload firmware via tftp only with IP 192.168.8.56 , so at this stage it was too early to think about the firmware.
What is strange is the settings of his WAN interface, which he shone:
After a reset via the web face, the router stopped glowing through the WAN, and the LAN interfaces did not rise either. But the WLAN rose.
It was decided to put it on his forehead:
# ifconfig br0 down
# ifconfig br0 up
After connecting the cable to the LAN port, the light bulb blinked merrily.
The router was successfully flashed, connected to the Internet via a 3G modem. On it was raised SIP Megaphone, dreams come true.
Then he will have a lifetime rest in the open air outside the city, he will be guarded by a webcam.
Thanks for attention! I will be glad to adequate criticism.