Resurrection of the D-Link DWL-2100AP
I work in a small provider company that provides Internet in the field, including in the private sector. As the last mile technology, Wi-Fi with directional antennas and access points on both sides (in WDS and "client" modes) was selected. Energy supply in the private sector leaves much to be desired - tension surges and quite often disappears altogether. Of course, such conditions have an extremely negative effect on the equipment - the points often fail, and many of them fall into a cyclic reboot due to failures in the firmware. We have accumulated a couple of dozen such points. The authorities decided that it would cost more to repair points than to buy new ones. But it is a pity when so much equipment is dead weight, but it can still serve the homeland.
Having unscrewed the point, I found on the board two groups of contact pads. One of them resembled a JTAG connector, the other was not signed, but I suggested that it might be an RS-232 interface. The Internet confirmed my assumption, in addition, there was a soldering of conclusions. To connect these outputs to a computer, we need a level converter - a MAX232 chip (or any similar one with an index of 232). Happy owners of laptops without COM-ports can purchase and gut the data-cable for old Siemens phones (models of the times c62 and earlier). Such a cable can be soldered directly to the connector on the access point board without assembling the converters. I will not consider this option, since I do not have a cable, but by googling, you can find the necessary information yourself.
The converter will also require five capacitors - four capacitors with a capacity of 10 μF and one with a capacity of 1 μF. Here is his diagram (by the way, the typical MAX232 usage diagram): My converter looks much more complicated than it should, since I assembled it much earlier for other purposes. On the breadboard there are two MAX232 microcircuits and some more "extra" elements. Also, for convenience, when connecting, I placed the DB-9 "mother" connector on the board: we solder the TX, RX and "ground" wires from the converter directly to the access point board.
Open any terminal program (I use PuTTY, but HyperTerminal is also suitable) and configure the serial port connection (COM1 or COM2) with the following parameters: speed 9600 bps, 8 data bits, 1 stop bit, parity disabled, flow control - disconnected. We connect a point and a converter to the configured port. After supplying power to the converter and the point, you should see that in the terminal program window the process of loading the point is displayed - memory testing, searching and downloading the firmware file. If this does not happen - check the converter, also try to swap the wires soldered to TX and RX. To restore the firmware, we need a TFTP server (tftpd), an FTP server (Small HTTP Server or FileZilla) and a set of working firmware files (apimg1, art, backup, apcfg, apcfg.bak)
.
By default, the access point address in recovery mode is 192.168.1.20. Configure the ip-address of the computer as 192.168.1.1 with the mask 255.255.255.0 and connect it to the access point. Reboot the point with the "Reset" button. Immediately after the lines appear in the terminal that the bootloader is testing memory, we repeatedly press the ESC key until the bootloader gives us the following prompt:
Now we can see and change the settings of the bootloader and the access point itself. A complete list of commands is displayed if you enter the character "?" and press enter. Changing the settings is done with the “c” command. Conclusion of current ones - with the p command. From the help we learn that the bootloader can run firmware from local memory (tffs) and via TFTP. This is what we need. We enter the “c” command and in turn determine the bootloader settings:
We configure TFTPd so that its root directory points directly to the folder with the unpacked firmware files. Enter the command "@" and press Enter. If everything is configured correctly, the bootloader will download and download the art file. After that, we will see the shell of the VxWorks operating system.
Press Enter to open the invitation. Now configure the FTP server. It should also point to firmware files. In addition, in the ftp server settings you need to add a user under whom we will upload files, for example, guest with the password 12345.
First, initialize the flash memory (that is, we recreate the file system of the access point, while deleting the firmware and configuration) .
In the terminal, enter the following command:
If successful, the terminal will issue a result code 0x0. Continue: Now let's check if the FTP server is working. Enter the ls command. If the command returned a list of firmware files lying on the ftp server, copy them to the flash memory of the point:
After each command, the system should return the code 0x0 and the size of the recorded file. We reboot the access point and call the bootloader prompt, as we did at the beginning. We bring the bootloader's settings to the initial state: The next operation is not necessary, but my point refused to load until I did it. Turn off the power of the point, hold down the Reset button, turn on the power and wait until the point gives an inscription in the terminal that the factory settings have been loaded: “resetting to factory config”. Release Reset. That's all. After a repeated reboot, the point will start in normal mode and after downloading it will be available externally at the factory IP address: 192.168.0.50.
If the bootloader displays “boardData checksum error”, the following operation should be performed before loading VxWorks. At the bootloader’s prompt, enter the “B” command (entering the “board” settings) and go over all the items with the Enter key, without entering anything else. This should be done with great care. If you suspect that an error has occurred, do it again without rebooting.
Autopsy
Having unscrewed the point, I found on the board two groups of contact pads. One of them resembled a JTAG connector, the other was not signed, but I suggested that it might be an RS-232 interface. The Internet confirmed my assumption, in addition, there was a soldering of conclusions. To connect these outputs to a computer, we need a level converter - a MAX232 chip (or any similar one with an index of 232). Happy owners of laptops without COM-ports can purchase and gut the data-cable for old Siemens phones (models of the times c62 and earlier). Such a cable can be soldered directly to the connector on the access point board without assembling the converters. I will not consider this option, since I do not have a cable, but by googling, you can find the necessary information yourself.
The converter will also require five capacitors - four capacitors with a capacity of 10 μF and one with a capacity of 1 μF. Here is his diagram (by the way, the typical MAX232 usage diagram): My converter looks much more complicated than it should, since I assembled it much earlier for other purposes. On the breadboard there are two MAX232 microcircuits and some more "extra" elements. Also, for convenience, when connecting, I placed the DB-9 "mother" connector on the board: we solder the TX, RX and "ground" wires from the converter directly to the access point board.
Loading
Open any terminal program (I use PuTTY, but HyperTerminal is also suitable) and configure the serial port connection (COM1 or COM2) with the following parameters: speed 9600 bps, 8 data bits, 1 stop bit, parity disabled, flow control - disconnected. We connect a point and a converter to the configured port. After supplying power to the converter and the point, you should see that in the terminal program window the process of loading the point is displayed - memory testing, searching and downloading the firmware file. If this does not happen - check the converter, also try to swap the wires soldered to TX and RX. To restore the firmware, we need a TFTP server (tftpd), an FTP server (Small HTTP Server or FileZilla) and a set of working firmware files (apimg1, art, backup, apcfg, apcfg.bak)
.
By default, the access point address in recovery mode is 192.168.1.20. Configure the ip-address of the computer as 192.168.1.1 with the mask 255.255.255.0 and connect it to the access point. Reboot the point with the "Reset" button. Immediately after the lines appear in the terminal that the bootloader is testing memory, we repeatedly press the ESC key until the bootloader gives us the following prompt:
[Boot]: Now we can see and change the settings of the bootloader and the access point itself. A complete list of commands is displayed if you enter the character "?" and press enter. Changing the settings is done with the “c” command. Conclusion of current ones - with the p command. From the help we learn that the bootloader can run firmware from local memory (tffs) and via TFTP. This is what we need. We enter the “c” command and in turn determine the bootloader settings:
boot device : ae1
processor number: 0
host name :
file name : art
inet on ethernet (e) : 192.168.1.20:0xffffff00
inet on backplane (b) :
host inet (h) : 192.168.1.1 (ip адрес компьютера с TFTP-сервером)
gateway inet (g) :
user (u) :
ftp password (pw) :
flags (f) : 0x80
target name (tn) :
startup script (s) :
other (o): aeWe configure TFTPd so that its root directory points directly to the folder with the unpacked firmware files. Enter the command "@" and press Enter. If everything is configured correctly, the bootloader will download and download the art file. After that, we will see the shell of the VxWorks operating system.
Firmware
Press Enter to open the invitation. Now configure the FTP server. It should also point to firmware files. In addition, in the ftp server settings you need to add a user under whom we will upload files, for example, guest with the password 12345.
First, initialize the flash memory (that is, we recreate the file system of the access point, while deleting the firmware and configuration) .
In the terminal, enter the following command:
diskInit "/fl"If successful, the terminal will issue a result code 0x0. Continue: Now let's check if the FTP server is working. Enter the ls command. If the command returned a list of firmware files lying on the ftp server, copy them to the flash memory of the point:
hostAdd "pc", "192.168.1.1"
netDevCreate "pc:", "pc", 1
cd "pc:"
iam "guest", "12345"copy "pc:/apimg1", "/fl/apimg1"
copy "pc:/apcfg", "/fl/apcfg"
copy "pc:/apcfg.bak", "/fl/apcfg.bak"
copy "pc:/art", "/fl/art"
copy "pc:/backup", "/fl/backup"After each command, the system should return the code 0x0 and the size of the recorded file. We reboot the access point and call the bootloader prompt, as we did at the beginning. We bring the bootloader's settings to the initial state: The next operation is not necessary, but my point refused to load until I did it. Turn off the power of the point, hold down the Reset button, turn on the power and wait until the point gives an inscription in the terminal that the factory settings have been loaded: “resetting to factory config”. Release Reset. That's all. After a repeated reboot, the point will start in normal mode and after downloading it will be available externally at the factory IP address: 192.168.0.50.
boot device : tffs0
processor number: 0
host name :
file name : /fl/apimg1
inet on ethernet (e) : 192.168.1.20:0xffffff00
inet on backplane (b) :
host inet (h) : .
gateway inet (g) :
user (u) :
ftp password (pw) :
flags (f) : 0x0
target name (tn) :
startup script (s) :
other (o): aeNotes
If the bootloader displays “boardData checksum error”, the following operation should be performed before loading VxWorks. At the bootloader’s prompt, enter the “B” command (entering the “board” settings) and go over all the items with the Enter key, without entering anything else. This should be done with great care. If you suspect that an error has occurred, do it again without rebooting.