e80b596c58
The Gemtek WVRTM-127ACN is an indoor dual band wifi router with internal antennas and 3 Gigabit Ethernet ports. The Gemtek WVRTM-130ACN is an indoor dual band wifi router with external antennas and 5 Gigabit Ethernet ports. Hardware of WVRTM-127ACN: - SoC: Mediatek MT7621AT (880 MHz, dual core) - RAM: 128 MB - Storage: 128 MB NAND SLC flash - Ethernet: 3x 10/100/1000 Mbps LAN1,LAN2 & WAN - Wireless: 2.4GHz: Mediatek MT7603EN (802.11b/g/n) - Wireless: 5GHz: Mediatek MT7612EN (802.11n/ac) - LEDs: 11x - Buttons: 2x WPS, reset - USB: 1x 3.0 - Power: 56 VDC, 0.54 A, PoE+ IN (WAN) - PoE: 1x PoE+ 802.3af/at (WAN) - Uart: GND RX TX VCC - J2 (GND near WAN) - Board silkscreen: "WVRTM-127ACN_V02" "19K-513-8500R" "RoHS" "1717" Hardware of WVRTM-130ACN: - SoC: Mediatek MT7621AT (880 MHz, dual core) - RAM: 128 MB (Kioxia TC58BVG0S3HTA00) - Storage: 128 MB NAND SLC (Winbond W971GG6SB-25) - Ethernet: 5x 10/100/1000 Mbps LAN1,LAN2,LAN3,LAN4 & WAN - Wireless: 2.4GHz and 5GHz Mediatek MT7615DN (802.11ac/b/g/n) (DBDC) - LEDs: 10x - Buttons: 3x Power, WPS, reset - USB: 1x 3.0 - Power: 56 VDC, 0.54 A, PoE+ (WAN) - PoE: 1x PoE+ 802.3af/at (WAN) - Uart: GND RX TX VCC - J2 (GND near WAN) - Board silkscreen: "WVRTM-130ACN_V01" "19K-515-4500R" "RoHS" "2112" Enable access to uboot menu (needed in wvrtm-130acn): - The access to uboot menu is blocked by `bootdelay = 0` set in ubootenv. With stock firmware version 01.01.02.163 and previous, you can use CVE 2020-24365 command injection https://nvd.nist.gov/vuln/detail/CVE-2020-24365 python3 exploit.py -t 192.168.1.1 -c "fw_setenv bootdelay 3; fw_saveenv" Backup the stock firmware: - Connect via uart - Connect via ethernet and assign your pc the address 192.168.15.x/24 - Power on the device; and start typing '4' to enter uboot menu - Set factory mode and boot MT7621 # setenv factory 2; saveenv MT7621 # nand read 2800000 2000000 81000000; bootm - Telnet and copy all mtd blocks telnet 192.168.15.1 - Copy all mtd blocks and start webserver for N in $(seq 0 6); do dd if=/dev/mtd$N of=/tmp/eeprom_mtd$N.bin; done mount -o bind /tmp /www lighttpd -f /etc/lighttpd.conf - Backup stock rootfs_data (optional) dd if=/dev/mtd7 of=/tmp/eeprom_mtd7.bin dd if=/dev/mtd8 of=/tmp/eeprom_mtd8.bin - Download to your pc from http://192.168.15.1/eeprom_mtd$N.bin Installation: - Connect via uart - Connect via ethernet and assign your pc the address 10.10.10.3/24 - Start a tftp server and serve the image initramfs-kernel.bin mkdir /tmp/ftpd; cp initramfs-kernel.bin /tmp/ftpd/kernel.bin dnsmasq --enable-tftp --tftp-root=/tmp/ftpd - Power on the device; and start typing '4' to halt the bootloader - Change the active mtd partition from mtd6 to mtd5 (needed by uboot) MT7621 # setenv mtddevnum 5; saveenv - Write the openwrt initramfs in ram via tftp and boot it MT7621 # tftpboot 81000000 kernel.bin; bootm - From the initramfs create the ubi device and install openwrt via sysupgrade ubiformat /dev/mtd11 -y sysupgrade -n -v /tmp/sysupgrade.bin Recovery: Restore the stock firmware from the backup of the mtd blocks mtd write eeprom_mtd5.bin firmware mtd write eeprom_mtd6.bin Kernel2 mtd write eeprom_mtd7.bin Storage1 mtd write eeprom_mtd8.bin Storage2 ubiformat /dev/mtd8 -y reboot Links to previous works on wvrtm-127acn: https://github.com/digiampietro/hacking-gemtek https://forum.openwrt.org/t/add-support-for-gemtek-wvrtm-127acn-linkem-provider/168757 Signed-off-by: Samuele Longhi <agave@dracaena.it> Link: https://github.com/openwrt/openwrt/pull/16685 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
222 lines
5.0 KiB
Bash
Executable File
222 lines
5.0 KiB
Bash
Executable File
#
|
|
# Copyright (C) 2010 OpenWrt.org
|
|
#
|
|
|
|
PART_NAME=firmware
|
|
REQUIRE_IMAGE_METADATA=1
|
|
|
|
RAMFS_COPY_BIN='fw_printenv fw_setenv'
|
|
RAMFS_COPY_DATA='/etc/fw_env.config /var/lock/fw_printenv.lock'
|
|
|
|
platform_check_image() {
|
|
local board=$(board_name)
|
|
local magic="$(get_magic_long "$1")"
|
|
|
|
[ "$#" -gt 1 ] && return 1
|
|
|
|
case "$board" in
|
|
buffalo,wsr-2533dhpl2|\
|
|
buffalo,wsr-2533dhpls)
|
|
buffalo_check_image "$board" "$magic" "$1" || return 1
|
|
;;
|
|
esac
|
|
|
|
return 0
|
|
}
|
|
|
|
platform_do_upgrade() {
|
|
local board=$(board_name)
|
|
|
|
case "$board" in
|
|
alfa-network,quad-e4g)
|
|
[ "$(fw_printenv -n dual_image 2>/dev/null)" = "1" ] &&\
|
|
[ -n "$(find_mtd_part backup)" ] && {
|
|
PART_NAME=backup
|
|
if [ "$(fw_printenv -n bootactive 2>/dev/null)" = "1" ]; then
|
|
fw_setenv bootactive 2 || exit 1
|
|
else
|
|
fw_setenv bootactive 1 || exit 1
|
|
fi
|
|
}
|
|
;;
|
|
ampedwireless,ally-00x19k|\
|
|
ampedwireless,ally-r1900k)
|
|
if [ "$(fw_printenv --lock / -n bootImage 2>/dev/null)" != "0" ]; then
|
|
fw_setenv --lock / bootImage 0 || exit 1
|
|
fi
|
|
;;
|
|
iptime,ax2004m)
|
|
if [ "$(fw_printenv -n boot_from 2>/dev/null)" != "firmware1" ]; then
|
|
fw_setenv boot_from firmware1 || exit 1
|
|
fi
|
|
;;
|
|
mikrotik,ltap-2hnd|\
|
|
mikrotik,routerboard-750gr3|\
|
|
mikrotik,routerboard-760igs|\
|
|
mikrotik,routerboard-m11g|\
|
|
mikrotik,routerboard-m33g)
|
|
[ "$(rootfs_type)" = "tmpfs" ] && mtd erase firmware
|
|
;;
|
|
asus,rt-ac65p|\
|
|
asus,rt-ac85p)
|
|
echo "Backing up firmware"
|
|
dd if=/dev/mtd4 bs=1024 count=4096 > /tmp/backup_firmware.bin
|
|
dd if=/dev/mtd5 bs=1024 count=52224 >> /tmp/backup_firmware.bin
|
|
mtd -e firmware2 write /tmp/backup_firmware.bin firmware2
|
|
;;
|
|
esac
|
|
|
|
case "$board" in
|
|
ampedwireless,ally-00x19k|\
|
|
ampedwireless,ally-r1900k|\
|
|
arcadyan,we420223-99|\
|
|
asus,rt-ac65p|\
|
|
asus,rt-ac85p|\
|
|
asus,rt-ax53u|\
|
|
asus,rt-ax54|\
|
|
beeline,smartbox-flash|\
|
|
beeline,smartbox-giga|\
|
|
beeline,smartbox-pro|\
|
|
beeline,smartbox-turbo|\
|
|
beeline,smartbox-turbo-plus|\
|
|
belkin,rt1800|\
|
|
dlink,covr-x1860-a1|\
|
|
dlink,dap-x1860-a1|\
|
|
dlink,dir-1960-a1|\
|
|
dlink,dir-2055-a1|\
|
|
dlink,dir-2150-a1|\
|
|
dlink,dir-2150-r1|\
|
|
dlink,dir-2640-a1|\
|
|
dlink,dir-2660-a1|\
|
|
dlink,dir-3040-a1|\
|
|
dlink,dir-3060-a1|\
|
|
dlink,dir-853-a3|\
|
|
elecom,wmc-x1800gst|\
|
|
elecom,wsc-x1800gs|\
|
|
etisalat,s3|\
|
|
h3c,tx1800-plus|\
|
|
h3c,tx1801-plus|\
|
|
h3c,tx1806|\
|
|
haier,har-20s2u1|\
|
|
hiwifi,hc5962|\
|
|
gemtek,wvrtm-127acn|\
|
|
gemtek,wvrtm-130acn|\
|
|
iptime,a3004t|\
|
|
iptime,ax2004m|\
|
|
iptime,t5004|\
|
|
jcg,q20|\
|
|
keenetic,kn-3510|\
|
|
linksys,e5600|\
|
|
linksys,e7350|\
|
|
linksys,ea6350-v4|\
|
|
linksys,ea7300-v1|\
|
|
linksys,ea7300-v2|\
|
|
linksys,ea7500-v2|\
|
|
linksys,ea8100-v1|\
|
|
linksys,ea8100-v2|\
|
|
mts,wg430223|\
|
|
netgear,eax12|\
|
|
netgear,r6220|\
|
|
netgear,r6260|\
|
|
netgear,r6350|\
|
|
netgear,r6700-v2|\
|
|
netgear,r6800|\
|
|
netgear,r6850|\
|
|
netgear,r6900-v2|\
|
|
netgear,r7200|\
|
|
netgear,r7450|\
|
|
netgear,wac104|\
|
|
netgear,wac124|\
|
|
netgear,wax202|\
|
|
netgear,wax214v2|\
|
|
netis,n6|\
|
|
netis,wf2881|\
|
|
raisecom,msg1500-x-00|\
|
|
rostelecom,rt-fe-1a|\
|
|
rostelecom,rt-sf-1|\
|
|
sercomm,na502|\
|
|
sercomm,na502s|\
|
|
sim,simax1800t|\
|
|
tplink,ec330-g5u-v1|\
|
|
wifire,s1500-nbn|\
|
|
xiaomi,mi-router-3g|\
|
|
xiaomi,mi-router-3-pro|\
|
|
xiaomi,mi-router-4|\
|
|
xiaomi,mi-router-ac2100|\
|
|
xiaomi,mi-router-cr6606|\
|
|
xiaomi,mi-router-cr6608|\
|
|
xiaomi,mi-router-cr6609|\
|
|
xiaomi,redmi-router-ac2100|\
|
|
z-router,zr-2660|\
|
|
zyxel,nwa50ax|\
|
|
zyxel,nwa55axe)
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
buffalo,wsr-2533dhpl2|\
|
|
buffalo,wsr-2533dhpls)
|
|
buffalo_do_upgrade "$1"
|
|
;;
|
|
dna,valokuitu-plus-ex400)
|
|
dna_do_upgrade "$1"
|
|
;;
|
|
elecom,wrc-x1800gs)
|
|
[ "$(fw_printenv -n bootmenu_delay)" != "0" ] || \
|
|
fw_setenv bootmenu_delay 3
|
|
iodata_mstc_set_flag "bootnum" "persist" "0x4" "1,2" "1"
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
iodata,wn-ax1167gr2|\
|
|
iodata,wn-ax2033gr|\
|
|
iodata,wn-dx1167r|\
|
|
iodata,wn-dx2033gr)
|
|
iodata_mstc_set_flag "debugflag" "factory" "0xfe75" "0,1" "1"
|
|
iodata_mstc_set_flag "bootnum" "persist" "0x4" "1,2" "1"
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
iodata,wn-deax1800gr)
|
|
iodata_mstc_set_flag "bootnum" "working" "0x4" "0,1" "0"
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
iodata,wn-dx1200gr)
|
|
iodata_mstc_set_flag "debugflag" "factory" "0x1fe75" "0,1" "1"
|
|
iodata_mstc_set_flag "bootnum" "persist" "0x4" "1,2" "1"
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
tplink,er605-v2)
|
|
echo "Upgrading tplink,er605-v2"
|
|
CI_UBIPART="firmware"
|
|
CI_KERNPART="kernel"
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
ubnt,edgerouter-x|\
|
|
ubnt,edgerouter-x-sfp)
|
|
platform_upgrade_ubnt_erx "$1"
|
|
;;
|
|
zyxel,lte3301-plus|\
|
|
zyxel,lte5398-m904|\
|
|
zyxel,nr7101)
|
|
fw_setenv CheckBypass 0
|
|
fw_setenv Image1Stable 0
|
|
[ "$(fw_printenv -n BootingFlag)" = "0" ] || fw_setenv BootingFlag 0
|
|
CI_KERNPART="Kernel"
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
zyxel,wap6805)
|
|
local kernel2_mtd="$(find_mtd_part Kernel2)"
|
|
[ "$(hexdump -n 4 -e '"%x"' $kernel2_mtd)" = "56190527" ] &&\
|
|
[ "$(hexdump -n 4 -s 104 -e '"%x"' $kernel2_mtd)" != "0" ] &&\
|
|
dd bs=4 count=1 seek=26 conv=notrunc if=/dev/zero of=$kernel2_mtd 2>/dev/null &&\
|
|
echo "Kernel2 sequence number was reset to 0"
|
|
CI_KERNPART="Kernel"
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
zyxel,wsm20)
|
|
zyxel_mstc_upgrade_prepare
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
*)
|
|
default_do_upgrade "$1"
|
|
;;
|
|
esac
|
|
}
|