the_return_of_fon

https://www.google.com.tw/search?q=FON+AP+SW1&tbm=isch&tbs=rimg:CTulQLzYCtAnIjid6sQTxORRcwbrizFPPD8opQt7sJbY0Rp0QtLWSKW1TfjY3-Ek6wFH848r5gQtKJcBvNQly7RjrioSCZ3qxBPE5FFzEetIVPc6oh4qKhIJBuuLMU88PygRPkBrvXSvAuwqEgmlC3uwltjRGhHpBs9Z46BDVCoSCXRC0tZIpbVNEenzt-LCGSEzKhIJ-Njf4STrAUcRbBte5x12CtQqEgnzjyvmBC0olxH8d3QPxZ_1eBSoSCQG81CXLtGOuEbduYeOlXLvS&tbo=u&sa=X&ved=0ahUKEwjyitmIifDXAhUCmZQKHUslChgQ9C8IHw&biw=1024&bih=734&dpr=1.25

https://www.slideshare.net/Flashdomain/geekevening-0x0f-fonera-hack-eservedd-lettoken-how-to

https://www.google.com.tw/imgres?imgurl=https%3A%2F%2Fimage.slidesharecdn.com%2Fgeekevening-0x0f-fonera-hack-eservedd-lettoken-how-to4674%2F95%2Fgeekevening-0x0f-fonera-hack-eservedd-lettoken-how-to-28-728.jpg%3Fcb%3D1271317573&imgrefurl=https%3A%2F%2Fwww.slideshare.net%2FFlashdomain%2Fgeekevening-0x0f-fonera-hack-eservedd-lettoken-how-to&docid=SzVns2tEF-hRKM&tbnid=qZLmQn-uug2LcM%3A&vet=10ahUKEwjA2ZH8iPDXAhXHipQKHR30AQwQMwhHKBkwGQ..i&w=728&h=547&itg=1&bih=734&biw=1024&q=FON%20AP%20SW1&ved=0ahUKEwjA2ZH8iPDXAhXHipQKHR30AQwQMwhHKBkwGQ&iact=mrc&uact=8

https://www.google.com.tw/imgres?imgurl=https%3A%2F%2Fwiki.openwrt.org%2F_media%2Fmedia%2Ffon%2Ffon2200-2nd-antenna-mod-soldering-detail.jpg%3Fw%3D400%26tok%3D55e584&imgrefurl=https%3A%2F%2Fwiki.openwrt.org%2Ftoh%2Ffon%2Ffonera&docid=tRmxPZfe6615VM&tbnid=goUNrGZnkSN5bM%3A&vet=10ahUKEwjA2ZH8iPDXAhXHipQKHR30AQwQMwhDKBUwFQ..i&w=400&h=304&bih=734&biw=1024&q=FON%20AP%20SW1&ved=0ahUKEwjA2ZH8iPDXAhXHipQKHR30AQwQMwhDKBUwFQ&iact=mrc&uact=8

http://www.larsen-b.com/Article/262.html

https://wiki.openwrt.org/toh/fon/fonera

https://www.google.com.tw/imgres?imgurl=https%3A%2F%2Fwiki.openwrt.org%2F_media%2Fmedia%2Ffon%2Ffon2200-pcb-front-highlighted.jpg%3Fw%3D600%26tok%3Dfca4d0&imgrefurl=https%3A%2F%2Fwiki.openwrt.org%2Ftoh%2Ffon%2Ffonera&docid=tRmxPZfe6615VM&tbnid=B9Y6WNQEHd31VM%3A&vet=10ahUKEwjA2ZH8iPDXAhXHipQKHR30AQwQMwgpKAUwBQ..i&w=600&h=450&bih=734&biw=1024&q=FON%20AP%20SW1&ved=0ahUKEwjA2ZH8iPDXAhXHipQKHR30AQwQMwgpKAUwBQ&iact=mrc&uact=8

http://www.pragti.ch/kippycam/2012/08/15/Adding-an-I2C-interface-to-the-TL-WR703N/

http://www.chpohl.de/fonera/webifdemo/cgi_bin/webif/connection_qrm.htm

https://jackchkuo.blogspot.com/2009/03/fon-freewlan.html

http://jchuang1977.pixnet.net/blog/post/31308229-gargoyle-in-fon-2100-%E4%B8%80%E4%BB%A3

https://www.mobile01.com/topicdetail.php?f=110&t=837898&p=2

https://www.ptt.cc/bbs/MOD_AP/M.1329974516.A.4C6.html

http://www.netadmin.com.tw/article_content.aspx?sn=1711070001

+PHY ID is 0022:5521

Ethernet eth0: MAC address 00:18:84:18:e1:e8

IP: 0.0.0.0/255.255.255.255, Gateway: 0.0.0.0

Default server: 0.0.0.0

RedBoot(tm) bootstrap and debug environment [ROMRAM]

Non-certified release, version v1.3.0 - built 16:57:58, Aug 7 2006

Board: ap51

RAM: 0x80000000-0x81000000, [0x80040450-0x80fe1000] available

FLASH: 0xa8000000 - 0xa87f0000, 128 blocks of 0x00010000 bytes each.

== Executing boot script in 1.000 seconds - enter ^C to abort

RedBoot> ^C

RedBoot>

RedBoot> ?

** Error: Illegal command: "?"

RedBoot> help

Manage aliases kept in FLASH memory

alias name [value]

Set/Query the system console baud rate

baudrate [-b <rate>]

Move Atheros Board Data information

bdmove

Restore Atheros Board Data information

bdrestore

Display Atheros Board Data information

bdshow

Manage machine caches

cache [ON | OFF]

Display/switch console channel

channel [-1|<channel number>]

Compute a 32bit checksum [POSIX algorithm] for a range of memory

cksum -b <location> -l <length>

Display (hex dump) a range of memory

dump -b <location> [-l <length>] [-s] [-1|2|4]

Execute an image

exec [-b <argv addr>] [-c "kernel command line"] [-w <timeout>]

[<entry point>]

Manage FLASH images

fis {cmds}

Manage configuration kept in FLASH memory

fconfig [-i] [-l] [-n] [-f] [-d] | [-d] nickname [value]

Execute code at a location

go [-w <timeout>] [-c] [-n] [entry]

Help about help?

help [<topic>]

Display command history

history

Set/change IP addresses

ip_address [-l <local_ip_address>[/<mask_len>]] [-h <server_address>]

Load a file

load [-r] [-v] [-d] [-h <host>] [-p <TCP port>][-m <varies>] [-c <channel_number>]

[-b <base_address>] <file_name>

Compare two blocks of memory

mcmp -s <location> -d <location> -l <length> [-1|-2|-4]

Copy memory from one address to another

mcopy -s <location> -d <location> -l <length> [-1|-2|-4]

Fill a block of memory with a pattern

mfill -b <location> -l <length> -p <pattern> [-1|-2|-4]

Network connectivity test

ping [-v] [-n <count>] [-l <length>] [-t <timeout>] [-r <rate>]

[-i <IP_addr>] -h <IP_addr>

Reset the system

reset

Display RedBoot version information

version

Display (hex dump) a range of memory

x -b <location> [-l <length>] [-s] [-1|2|4]

RedBoot>

RedBoot> version

RedBoot(tm) bootstrap and debug environment [ROMRAM]

Non-certified release, version v1.3.0 - built 16:57:58, Aug 7 2006

Board: ap51

RAM: 0x80000000-0x81000000, [0x80040450-0x80fe1000] available

FLASH: 0xa8000000 - 0xa87f0000, 128 blocks of 0x00010000 bytes each.

RedBoot> reset

+PHY ID is 0022:5521

Ethernet eth0: MAC address 00:18:84:18:e1:e8

IP: 0.0.0.0/255.255.255.255, Gateway: 0.0.0.0

Default server: 0.0.0.0

RedBoot(tm) bootstrap and debug environment [ROMRAM]

Non-certified release, version v1.3.0 - built 16:57:58, Aug 7 2006

Board: ap51

RAM: 0x80000000-0x81000000, [0x80040450-0x80fe1000] available

FLASH: 0xa8000000 - 0xa87f0000, 128 blocks of 0x00010000 bytes each.

== Executing boot script in 1.000 seconds - enter ^C to abort

RedBoot> fis load -l vmlinux.bin.l7

Image loaded from 0x80041000-0x801ba000

RedBoot> exec

Now booting linux kernel:

Base address 0x80030000 Entry 0x80041000

Cmdline :

CPU revision is: 00019064

Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.

Primary data cache 16kB, 4-way, linesize 16 bytes.

Linux version 2.4.32 (iurgi@ropero) (gcc version 3.4.6 (OpenWrt-2.0)) #9 jue nov 23 12:11:45 UTC 2006

Determined physical RAM map:

memory: 01000000 @ 00000000 (usable)

On node 0 totalpages: 4096

zone(0): 4096 pages.

zone(1): 0 pages.

zone(2): 0 pages.

Kernel command line: console=ttyS0,9600 rootfstype=squashfs,jffs2

Using 92.000 MHz high precision timer.

Calibrating delay loop... 183.50 BogoMIPS

Memory: 14188k/16384k available (1327k kernel code, 2196k reserved, 92k data, 68k init, 0k highmem)

Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)

Inode cache hash table entries: 1024 (order: 1, 8192 bytes)

Mount cache hash table entries: 512 (order: 0, 4096 bytes)

Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)

Page-cache hash table entries: 4096 (order: 2, 16384 bytes)

Checking for 'wait' instruction... available.

POSIX conformance testing by UNIFIX

Linux NET4.0 for Linux 2.4

Based upon Swansea University Computer Society NET3.039

Initializing RT netlink socket

Starting kswapd

devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)

devfs: boot_options: 0x1

squashfs: version 3.0 (2006/03/15) Phillip Lougher

pty: 256 Unix98 ptys configured

Serial driver version 5.05c (2001-07-08) with no serial options enabled

ttyS00 at 0xb1100003 (irq = 37) is a 16550A

eth0: Dropping NETIF_F_SG since no checksum feature.

eth0: Atheros AR2313: 00:18:84:18:e1:e8, irq 4

MTD driver for SPI flash.

spiflash: Probing for Serial flash ...

spiflash: Found SPI serial Flash.

8388608: size

Creating 8 MTD partitions on "spiflash":

0x00000000-0x00030000 : "RedBoot"

0x00030000-0x00720000 : "rootfs"

eth0: Configuring MAC for full duplex

0x001b0000-0x00720000 : "rootfs1"

0x00720000-0x00730000 : "config"

0x00730000-0x007e0000 : "vmlinux.bin.l7"

0x007e0000-0x007ef000 : "FIS directory"

mtd: partition "FIS directory" doesn't end on an erase block -- force read-only

0x007ef000-0x007f0000 : "RedBoot config"

mtd: partition "RedBoot config" doesn't start on an erase block boundary -- force read-only

0x007f0000-0x00800000 : "board_config"

Initializing Cryptographic API

NET4: Linux TCP/IP 1.0 for NET4.0

IP Protocols: ICMP, UDP, TCP, IGMP

IP: routing cache hash table of 512 buckets, 4Kbytes

TCP: Hash tables configured (established 1024 bind 2048)

ip_conntrack version 2.1 (5953 buckets, 5953 max) - 328 bytes per conntrack

NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.

NET4: Ethernet Bridge 008 for NET4.0

802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>

All bugs added by David S. Miller <davem@redhat.com>

VFS: Mounted root (squashfs filesystem) readonly.

Mounted devfs on /dev

Freeing unused kernel memory: 68k freed

init started: BusyBox v1.1.3 (2006.11.21-19:49+0000) multi-call binary

Algorithmics/MIPS FPU Emulator v1.5

Please press Enter to activate this console.

Image loaded from 0x80041000-0x801ba000

RedBoot> exec

Now booting linux kernel:

Base address 0x80030000 Entry 0x80041000

Cmdline :

CPU revision is: 00019064

Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.

Primary data cache 16kB, 4-way, linesize 16 bytes.

Linux version 2.4.32 (iurgi@ropero) (gcc version 3.4.6 (OpenWrt-2.0)) #9 jue nov 23 12:11:45 UTC 2006

Determined physical RAM map:

memory: 01000000 @ 00000000 (usable)

On node 0 totalpages: 4096

zone(0): 4096 pages.

zone(1): 0 pages.

zone(2): 0 pages.

Kernel command line: console=ttyS0,9600 rootfstype=squashfs,jffs2

Using 92.000 MHz high precision timer.

Calibrating delay loop... 183.50 BogoMIPS

Memory: 14188k/16384k available (1327k kernel code, 2196k reserved, 92k data, 68k init, 0k highmem)

Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)

Inode cache hash table entries: 1024 (order: 1, 8192 bytes)

Mount cache hash table entries: 512 (order: 0, 4096 bytes)

Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)

Page-cache hash table entries: 4096 (order: 2, 16384 bytes)

Checking for 'wait' instruction... available.

POSIX conformance testing by UNIFIX

Linux NET4.0 for Linux 2.4

Based upon Swansea University Computer Society NET3.039

Initializing RT netlink socket

Starting kswapd

devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)

devfs: boot_options: 0x1

squashfs: version 3.0 (2006/03/15) Phillip Lougher

pty: 256 Unix98 ptys configured

Serial driver version 5.05c (2001-07-08) with no serial options enabled

ttyS00 at 0xb1100003 (irq = 37) is a 16550A

eth0: Dropping NETIF_F_SG since no checksum feature.

eth0: Atheros AR2313: 00:18:84:18:e1:e8, irq 4

MTD driver for SPI flash.

spiflash: Probing for Serial flash ...

spiflash: Found SPI serial Flash.

8388608: size

Creating 8 MTD partitions on "spiflash":

0x00000000-0x00030000 : "RedBoot"

0x00030000-0x00720000 : "rootfs"

eth0: Configuring MAC for full duplex

0x001b0000-0x00720000 : "rootfs1"

0x00720000-0x00730000 : "config"

0x00730000-0x007e0000 : "vmlinux.bin.l7"

0x007e0000-0x007ef000 : "FIS directory"

mtd: partition "FIS directory" doesn't end on an erase block -- force read-only

0x007ef000-0x007f0000 : "RedBoot config"

mtd: partition "RedBoot config" doesn't start on an erase block boundary -- force read-only

0x007f0000-0x00800000 : "board_config"

Initializing Cryptographic API

NET4: Linux TCP/IP 1.0 for NET4.0

IP Protocols: ICMP, UDP, TCP, IGMP

IP: routing cache hash table of 512 buckets, 4Kbytes

TCP: Hash tables configured (established 1024 bind 2048)

ip_conntrack version 2.1 (5953 buckets, 5953 max) - 328 bytes per conntrack

NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.

NET4: Ethernet Bridge 008 for NET4.0

802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>

All bugs added by David S. Miller <davem@redhat.com>

VFS: Mounted root (squashfs filesystem) readonly.

Mounted devfs on /dev

Freeing unused kernel memory: 68k freed

init started: BusyBox v1.1.3 (2006.11.21-19:49+0000) multi-call binary

Algorithmics/MIPS FPU Emulator v1.5

Please press Enter to activate this console.

BusyBox v1.1.3 (2006.11.21-19:49+0000) Built-in shell (ash)

Enter 'help' for a list of built-in commands.

_______ _______ _______

| ____|| || _ |

| ____|| - || | | |

| | |_______||__| |__|

|___|

Fonera Firmware (Version 0.7.1 rev 1) -------------

* Based on OpenWrt - http://openwrt.org

* Powered by FON - http://www.fon.com

---------------------------------------------------

jffs2_scan_eraseblock(): End of filesystem marker found at 0x0

jffs2_build_filesystem(): unlocking the mtd device... done.

jffs2_build_filesystem(): erasing all blocks after the end marker...

root@(none):/#

root@(none):/# ls

bin etc lib proc sbin tmp var

dev jffs mnt rom sys usr www

root@(none):/# cd

root@(none):/# top

Mem: 4524K used, 9732K free, 0K shrd, 456K buff, 1120K cached

Load average: 3.00, 2.98, 1.75 (State: S=sleeping R=running, W=waiting)

PID USER STATUS RSS PPID %CPU %MEM COMMAND

52 root R 328 24 99.9 2.3 mount

20 root S 488 1 0.0 3.4 ash

24 root S 436 21 0.0 3.0 mount_root

21 root S 432 17 0.0 3.0 boot

17 root S 420 1 0.0 2.9 rcS

54 root R 408 20 0.0 2.8 top

1 root S 396 0 0.0 2.7 init

16 root S 388 1 0.0 2.7 syslogd

22 root S 360 1 0.0 2.5 klogd

18 root S 344 1 0.0 2.4 logger

8 root SW 0 1 0.0 0.0 mtdblockd

4 root SW 0 1 0.0 0.0 kswapd

5 root SW 0 1 0.0 0.0 bdflush

6 root DW 0 1 0.0 0.0 kupdated

2 root SW 0 1 0.0 0.0 keventd

3 root SWN 0 1 0.0 0.0 ksoftirqd_CPU0

Mem: 4528K used, 9728K free, 0K shrd, 456K buff, 1120K cached

Load average: 3.00, 2.98, 1.75 (State: S=sleeping R=running, W=waiting)

root@(none):/# ps -ef | more

PID Uid VmSize Stat Command

1 root 396 S init

2 root SW [keventd]

3 root SWN [ksoftirqd_CPU0]

4 root SW [kswapd]

5 root SW [bdflush]

6 root DW [kupdated]

8 root SW [mtdblockd]

16 root Registering mini_fo version $Id$

388 S syslogd -C 16

1mini_fo: using base directory: /

7 root 42mini_fo: using storage directory: /jffs

0 S /bin/sh /etc/init.d/rcS

18 root 344 S logger -s -p 6 -t

20 root 488 S /bin/ash --login

21 root 432 S /bin/sh /etc/init.d/boot

22 root 360 S klogd

24 root 436 S /bin/sh /sbin/mount_root

52 root 328 R mount -t jffs2 /dev/mtdblock/2 /jffs

55 root 328 R mount -t jffs2 /dev/mtdblock/2 /jffs

56 root 368 R ps -ef

57 root 488 R /bin/ash --login

root@(none):/#

jffs2.bbc: SIZE compression mode activated.

wlan: 0.8.4.2 (0.9.0)

ath_hal: 0.9.17.1 (AR5212, AR5312, RF5112, RF2316, RF2317, TX_DESC_SWAP)

wlan: mac acl policy registered

ath_rate_sample: 1.2 (0.9.0)

ath_ahb: 0.9.4.5 (0.9.0)

ath_pci: switching rfkill capability off

wifi0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps

wifi0: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps

wifi0: H/W encryption support: WEP AES AES_CCM TKIP

wifi0: mac 11.0 phy 4.8 radio 7.0

wifi0: Use hw queue 1 for WME_AC_BE traffic

wifi0: Use hw queue 0 for WME_AC_BK traffic

wifi0: Use hw queue 2 for WME_AC_VI traffic

wifi0: Use hw queue 3 for WME_AC_VO traffic

wifi0: Use hw queue 8 for CAB traffic

wifi0: Use hw queue 9 for beacons

wifi0: Atheros 2315 WiSoC: mem=0xb0000000, irq=3

device eth0 entered promiscuous mode

Load average: 1.08, 1.79, 1.65 (State: S=sleeping R=running, W=waiting)

PID USER STATUS RSS PPID %CPU %MEM COMMAND
498 root R 424 20 0.9 2.9 top
20 root S 488 1 0.0 3.4 ash
229 root S 476 1 0.0 3.3 hostapd
17 root S 436 1 0.0 3.0 rcS
445 root S 424 1 0.0 2.9 crond
462 root S 424 1 0.0 2.9 httpd
406 root S 420 1 0.0 2.9 httpd
260 nobody S 412 1 0.0 2.8 dnsmasq
1 root S 396 0 0.0 2.7 init
16 root S 396 1 0.0 2.7 syslogd
269 root S 388 1 0.0 2.7 udhcpc
18 root S 380 1 0.0 2.6 logger
22 root S 360 1 0.0 2.5 klogd
466 root D 328 465 0.0 2.3 watchdog
465 root S 328 1 0.0 2.3 watchdog
123 root S 284 1 0.0 1.9 lock
121 root S 284 1 0.0 1.9 lock
464 root S 276 17 0.0 1.9 lock
8 root SW 0 1 0.0 0.0 mtdblockd
2 root SW 0 1 0.0 0.0 keventd

root@(none):/# ifconfig

ath1 Link encap:Ethernet HWaddr 00:18:84:18:E1:EA

inet addr:192.168.10.1 Bcast:192.168.10.255 Mask:255.255.255.0

UP BROADCAST RUNNING MULTICAST MTU:2290 Metric:1

RX packets:27 errors:0 dropped:0 overruns:0 frame:0

TX packets:45 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:0

RX bytes:3699 (3.6 KiB) TX bytes:4248 (4.1 KiB)

eth0 Link encap:Ethernet HWaddr 00:18:84:18:E1:E8

UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1

RX packets:0 errors:0 dropped:0 overruns:0 frame:0

TX packets:69 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:0 (0.0 B) TX bytes:40710 (39.7 KiB)

Interrupt:4 Base address:0x1000

eth0:1 Link encap:Ethernet HWaddr 00:18:84:18:E1:E8

inet addr:169.254.255.1 Bcast:169.254.255.255 Mask:255.255.0.0

UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1

Interrupt:4 Base address:0x1000

lo Link encap:Local Loopback

inet addr:127.0.0.1 Mask:255.0.0.0

UP LOOPBACK RUNNING MTU:16436 Metric:1

RX packets:0 errors:0 dropped:0 overruns:0 frame:0

TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:0

RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

wifi0 Link encap:Ethernet HWaddr 00:18:84:18:E1:E9

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:8122 errors:0 dropped:0 overruns:0 frame:482

TX packets:375 errors:26 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:199

RX bytes:1540637 (1.4 MiB) TX bytes:48139 (47.0 KiB)

Interrupt:3 Memory:b0000000-b00ffffc

[光通訊時代] - 不見蒼寰一流星，唯有光速傲疾風。

2017/12/4

the_return_of_fon

沒有留言:

張貼留言