求助 TP-LINK WR742N v5.1 硬改

hackp***

最近买了个 WR742N v5.1，拆开后发现尼玛配置超级缩水
芯片：Atheros AR9331-AL3A
FLASH: cFeon F80-100HCR，容量 1MB
内存：Winbond W9464GJH-5，DDR400 8M，16bit

有几个疑问，求老鸟支招：

1. 这个主板上找不到 TTL 接口，但在背面有两个可疑的接点 TP17、TP18，这两个可能是 TX 和 RX 吗？
2. 这个主板能用 Winbond 的 FLASH 吗？我打算把 FLASH 换为 8M 的，把内存换为 64MB。
3. 对固件数据的疑惑（无法分析出固件的准确布局）：
        我用编程器读取了这个固件，发现其引导程序只有不到64KB,且不带任何文字信息，因此接TTL肯定也看不到任何 Boot 的输出。因此。。这个Boot程序是什么？？
        这个固件也没有单独的Linux Kernel部分和文件系统部分，只有文件系统部分。不知其是否为Linux系统。猜测其有912KB。
        猜测NVRAM区只有32KB。ART 16KB。这个固件数据在附件中。。。。有没有大神能帮忙分析一下。

固件数据信息：
MAC 地址：BC-D1-77-8E-74-9E
PIN：56794687


以下是拆机图(FLASH 芯片已被我取下)：
正面：



背面：


背面芯片处放大图：

ZHIZ***

TTL是背面TP17、TP18，和740V5差不多
应该可以，要补上22欧的R59
这个应该是vxworks的系统

zy90***

150r参考

hackp***

ZHIZAI100 发表于 2013-6-1 20:49
TTL是背面TP17、TP18，和740V5差不多
应该可以，要补上22欧的R59
这个应该是vxworks的系统

我在网查查了一下，发现WR740NV5和WR742NV5背面确实挺像的。。。WR742NV5的R59上确实没有焊电阻，这个能直接短接吗

ZHIZ***

hackpascal 发表于 2013-6-1 21:25
我在网查查了一下，发现WR740NV5和WR742NV5背面确实挺像的。。。WR742NV5的R59上确实没有焊电阻，这个能 ...

据说不行

hackp***

ZHIZAI100 发表于 2013-6-1 21:34
据说不行

那看来明天我就去买电阻了

simpl***

不用买 可以直接短接R59   

bnn***

直接上编程器，换4M 32M 至少可以玩OPEN

hackp***

bnnyygy 发表于 2013-6-2 15:54
直接上编程器，换4M 32M 至少可以玩OPEN

我今天已经去买了22欧的贴片电阻，把它焊上去了，而且路由也正常运行。
我买的8M的FLASH。。还没到货。。

hackp***

bnnyygy 发表于 2013-6-2 15:54
直接上编程器，换4M 32M 至少可以玩OPEN

那怎么确定ART数据呢

hackp***

ZHIZAI100 发表于 2013-6-1 20:49
TTL是背面TP17、TP18，和740V5差不多
应该可以，要补上22欧的R59
这个应该是vxworks的系统

成功地把内存换了。。。原系统的TTL输出的信息如下，感觉没太大用处啊

flashInit():Flash already init.


Press Ctrl+C or Shift+C to stop auto-boot...
1
auto-booting...
Uncompressing...done
Starting at 0x80001000...

Attaching interface lo0... done
Rx clbufs 768 each of size 1660
eth_rx_netpool_init: allocated, pDmaBuf=0x8055b8e0, buffend = 806944e4
ATHRS26: resetting s26
ATHRS26: s26 reset done
Arm the watchdog timer for the GMAC hang detect
eth_rx_netpool_init: done already!
Moduler MODULER-CONTROL: start working.


All config data size = 23516, srart address= 0x8043eea0.
Moduler MODULER-CONTROL: size = 16, srtart address = 0x8043eea0.
Moduler SYSTEM-LOG: size = 280, srtart address = 0x8043eeb0.
Moduler TDDP-AGENT: size = 0, srtart address = 0x8043efc8.
Moduler OEMDEF: size = 604, srtart address = 0x8043efc8.
Moduler BRIDGE: size = 0, srtart address = 0x8043f224.
Moduler ACCOUNT: size = 40, srtart address = 0x8043f224.
Moduler WEB-V4: size = 0, srtart address = 0x8043f24c.
Moduler wizard: size = 0, srtart address = 0x8043f24c.
Moduler OPMODE: size = 4, srtart address = 0x8043f24c.
Moduler LAN: size = 16, srtart address = 0x8043f250.
Moduler UPnP: size = 0, srtart address = 0x8043f260.
Moduler WLAN: size = 3376, srtart address = 0x8043f260.
Moduler MAC-CLONE: size = 0, srtart address = 0x8043ff90.
Moduler DHCPS: size = 1964, srtart address = 0x8043ff90.
Moduler IF-NAT: size = 0, srtart address = 0x8044073c.
Moduler WAN: size = 4, srtart address = 0x8044073c.
Moduler LINKMODE: size = 4, srtart address = 0x80440740.
Moduler STATIC-IP: size = 32, srtart address = 0x80440744.
Moduler DHCPC: size = 104, srtart address = 0x80440764.
Moduler PPPoE: size = 600, srtart address = 0x804407cc.
Moduler L2TP: size = 392, srtart address = 0x80440a24.
Moduler PPTP: size = 392, srtart address = 0x80440bac.
Moduler 8021x: size = 536, srtart address = 0x80440d34.
Moduler VIRTSVR: size = 840, srtart address = 0x80440f4c.
Moduler IGDV2: size = 4, srtart address = 0x80441294.
Moduler DMZ-HOST: size = 8, srtart address = 0x80441298.
Moduler STATIC-ROUTER: size = 328, srtart address = 0x804412a0.
Moduler Statistics: size = 20, srtart address = 0x804413e8.
Moduler AccessCtrl: size = 10860, srtart address = 0x804413fc.
Moduler Security: size = 44, srtart address = 0x80443e68.
Moduler ARPBIND: size = 648, srtart address = 0x80443e94.
Moduler ADDITIONDNS: size = 0, srtart address = 0x8044411c.
Moduler DNS-PROXY: size = 0, srtart address = 0x8044411c.
Moduler TP-DOMAIN: size = 0, srtart address = 0x8044411c.
Moduler DDNS: size = 1740, srtart address = 0x8044411c.
Moduler IPQOS: size = 572, srtart address = 0x804447e8.
Moduler LOGIN-PASSWORD: size = 0, srtart address = 0x80444a24.
Moduler USER-REBOOT: size = 0, srtart address = 0x80444a24.
Moduler RESET: size = 0, srtart address = 0x80444a24.
Moduler DIAGNOSTIC: size = 0, srtart address = 0x80444a24.
Moduler BAKNRESTORE: size = 0, srtart address = 0x80444a24.
Moduler HTTP-FIRMWARE: size = 0, srtart address = 0x80444a24.
Moduler IGMP: size = 4, srtart address = 0x80444a24.
Moduler ANTI-SNIFFER: size = 0, srtart address = 0x80444a28.
Moduler SNTPC: size = 84, srtart address = 0x80444a28.

Moduler SYSTEM-LOG: start working.
Moduler TDDP-AGENT: start working.
Moduler OEMDEF: start working.
Moduler BRIDGE: start working.
Moduler ACCOUNT: start working.
Moduler WEB-V4: start working.
Moduler wizard: start working.
Moduler OPMODE: start working.
Moduler LAN: start working.
Moduler UPnP: start working.
Moduler WLAN: start working.
Restoring Cal data from Flash
wlanSecFliterStart : install Wlan Sec filter.
Moduler MAC-CLONE: start working.
Moduler DHCPS: start working.
Moduler IF-NAT: start working.
Moduler WAN: start working.
Moduler LINKMODE: start working.
Set phy 4 link mode 0x01.
Moduler STATIC-IP: start working.
Moduler DHCPC: start working.
add net 0.0.0.0: gateway 169.254.118.166
Moduler PPPoE: start working.
Moduler L2TP: start working.
Moduler PPTP: start working.
Moduler 8021x: start working.
Moduler VIRTSVR: start working.
Moduler IGDV2: start working.
Moduler DMZ-HOST: start working.
Moduler STATIC-ROUTER: start working.
Moduler Statistics: start working.
Moduler AccessCtrl: start working.
Moduler Security: start working.
Moduler ARPBIND: start working.
Moduler ADDITIONDNS: start working.
Moduler DNS-PROXY: start working.
Moduler TP-DOMAIN: start working.
Moduler DDNS: start working.
Moduler IPQOS: start working.
Moduler LOGIN-PASSWORD: start working.
Moduler USER-REBOOT: start working.
Moduler RESET: start working.
Moduler DIAGNOSTIC: start working.
Moduler BAKNRESTORE: start working.
Moduler HTTP-FIRMWARE: start working.
Moduler IGMP: start working.
Moduler ANTI-SNIFFER: start working.
Moduler SNTPC: start working.




                                      Version2.0
                            Software Platform for PNE2.2
              Copyright(C) 2001-2011 by TP-LINK TECHNOLOGIES CO., LTD.
                      Creation date: Apr 17 2013, 20:31:36
#

eef***

hackpascal 发表于 2013-6-6 22:34
成功地把内存换了。。。原系统的TTL输出的信息如下，感觉没太大用处啊

flashInit():Flash already ini ...

VX works的系统，你想有什么用处呢？直接编程器就可以了。

hackp***

eeff11 发表于 2014-2-9 19:16
VX works的系统，你想有什么用处呢？直接编程器就可以了。

我都已经硬改了3个742Nv5路由了。。
这些问题都已经解决了。。。

龙凤***

hackpascal 发表于 2014-2-9 19:34
我都已经硬改了3个742Nv5路由了。。
这些问题都已经解决了。。。

楼主求教你个问题，我不想学改，我的也是WR742N的路由器，排除了连线和猫的问题，给你上个图帮我分析下好吗？会提示，拨号失败：服务器无响应！的问题！WAN口绝对的没坏，他还可以收发数据呢！先谢谢你了

eef***

龙凤游民 发表于 2014-2-9 20:45
楼主求教你个问题，我不想学改，我的也是WR742N的路由器，排除了连线和猫的问题，给你上个图帮我分析下好 ...

这个是你那边运营商的问题，经常拨不上号，我朋友新买个路由也是这样，过好大一会儿才拨上号。。。。电信的adsl....