{"id":1504,"date":"2014-12-29T20:59:35","date_gmt":"2014-12-29T12:59:35","guid":{"rendered":"http:\/\/www.computersolutions.cn\/blog\/?p=1504"},"modified":"2014-12-30T00:41:04","modified_gmt":"2014-12-29T16:41:04","slug":"flashing-a-mercury-mac1200r-wifi-router","status":"publish","type":"post","link":"https:\/\/www.computersolutions.cn\/blog\/2014\/12\/flashing-a-mercury-mac1200r-wifi-router\/","title":{"rendered":"Flashing a Mercury MAC1200R Wifi Router"},"content":{"rendered":"

The Mercury MAC1200R (TPLINK WR6300) is one of the cheapest AC based routers on the planet, as I have a few AC devices I thought I’d buy one to try out. They’re available for under RMB120 or so online.<\/p>\n

Mercury hardware is TPLink hardware, albeit using a different name. Same stuff, same factory, different casing.<\/p>\n

The router has 64M ram, and 8M flash. CPU \/ Wifi AR9344 \/ QCA9882<\/p>\n

\"\"<\/p>\n

OpenWRT says it has support, so I had a quick go at taking a look at flashing one.<\/p>\n

First steps:<\/p>\n

Open up the unit (remove the 2 screws underneath, then use a spare credit card or similar to jam open the plastic case).<\/p>\n

The serial headers are to the right of the SoC.
\nYou’ll need a rs232 to ttl or usb to ttl adaptor.<\/p>\n

\"pl2303\"<\/p>\n

\"gnd,<\/p>\n

Pin 1 is GND
\nPin 2 is TX (connect to rx)
\nPin 3 is RX (connect to tx)
\nPin 4 is VCC (don’t connect).<\/p>\n

Port speeds are 115200,8,n,1<\/p>\n

Connect up, and you should see a flurry of activity on boot.<\/p>\n

To get into the bootloader (uBoot), you’ll need to type tpl
\nMay take a few tries, so prepare to pull power and retry again, and again till you get in.<\/p>\n

\"uboot\"<\/p>\n

You’ll need a TFTPD server running on 192.168.1.100 to push files over. My Mac no haz ethernet (and Thunderbolt to Ethernet is crud), so I use my venerable X40 and tftpd software.<\/p>\n

Firmware is up here. (Or you can compile your own) -> http:\/\/pan.baidu.com\/s\/1hqkVOfa<\/a><\/p>\n

Firmware locations in flash (see below)
\nprintenv
\nbootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=\/sbin\/init mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),6336k(rootfs),1408k(uImage),64k(mib0),64k(ART)
\nbootcmd=bootm 0x9f020000
\nbootdelay=1
\nbaudrate=115200
\nethaddr=0xba:0xbe:0xfa:0xce:0x08:0x41
\nipaddr=192.168.1.111
\nserverip=192.168.1.100
\ndir=
\nlu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize
\nlf=tftp 0x80060000 ${dir}db12x${bc}-jffs2&&erase 0x9f050000 +0x630000&&cp.b $fileaddr 0x9f050000 $filesize
\nlk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f680000 +$filesize&&cp.b $fileaddr 0x9f680000 $filesize
\nstdin=serial
\nstdout=serial
\nstderr=serial
\nethact=eth0<\/p>\n

Environment size: 686\/65532 bytes<\/code><\/p>\n

Upload to the uBoot<\/p>\n

U-Boot 1.1.4--LSDK-10.1.389 (Apr 9 2014 - 15:23:02)<\/p>\n

U-Boot DB120
\nWasp 1.2<\/p>\n

DRAM: 64 MB
\nFlash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
\nflash size 8MB, sector count = 128
\nFlash: 8 MB
\nUsing default environment<\/p>\n

In: serial
\nOut: serial
\nErr: serial
\nNet: ag934x_enet_initialize...
\nNo valid address in Flash. Using fixed address
\nNo valid address in Flash. Using fixed address
\n wasp reset mask:c02200
\nWASP ----> S27 PHY
\ns27 reg init
\n: cfg1 0x80000000 cfg2 0x7114
\neth0: ba:be:fa:ce:08:41
\nathrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
\nathrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
\neth0 up
\nWASP ----> S27 PHY
\ns27 reg init lan
\nATHRS27: resetting s27
\nATHRS27: s27 reset done
\n: cfg1 0x800c0000 cfg2 0x7214
\neth1: ba:be:fa:ce:08:41
\nathrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
\nathrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
\nathrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
\nathrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
\nathrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
\nathrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
\nathrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
\nathrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
\neth1 up
\neth0, eth1
\nSetting 0xb8116290 to 0x30602d0f
\nAutobooting in 1 seconds
\ndb12x><\/p>\n

db12x> tftpboot 0x81000000 image.bin
\neth1 link down
\nenet0 port4 up
\ndup 1 speed 100
\nUsing eth0 device
\nTFTP from server 192.168.1.100; our IP address is 192.168.1.111
\nFilename 'image.bin'.
\nLoad address: 0x81000000
\nLoading: #################################################################
\n #################################################################
\n #################################################################
\n #################################################################
\n #################################################################
\n #################################################################
\n #################################################################
\n #################################################################
\n #################################################################
\n ##############################
\ndone
\nBytes transferred = 3145732 (300004 hex)
\ndb12x> erase 0x9f020000 +0x3c0000
\nErasing flash... ............................................................
\nErased 60 sectors
\ndb12x> cp.b 0x81000000 0x9f020000 0x3c0000
\nCopy to Flash... ............................................................done
\ndb12x> bootm 9f020000<\/p>\n

<\/code><\/p>\n

It should boot into OpenWRT, you can flash from there. <\/p>\n


\n...[long kernel bootlogs redacted]<\/p>\n

- init complete -<\/p>\n

BusyBox v1.22.1 (2014-12-15 18:46:26 CST) built-in shell (ash)
\nEnter 'help' for a list of built-in commands.<\/p>\n

_______ ________ __
\n | |.-----.-----.-----.| | | |.----.| |_
\n | - || _ | -__| || | | || _|| _|
\n |_______|| __|_____|__|__||________||__| |____|
\n |__| W I R E L E S S F R E E D O M
\n -----------------------------------------------------
\n BARRIER BREAKER (14.07, r42625)
\n -----------------------------------------------------
\n * 1\/2 oz Galliano Pour all ingredients into
\n * 4 oz cold Coffee an irish coffee mug filled
\n * 1 1\/2 oz Dark Rum with crushed ice. Stir.
\n * 2 tsp. Creme de Cacao
\n -----------------------------------------------------<\/p>\n

cat \/proc\/mtd
\ndev: size erasesize name
\nmtd0: 00020000 00010000 \"u-boot\"
\nmtd1: 0010206c 00010000 \"kernel\"
\nmtd2: 006cdf94 00010000 \"rootfs\"
\nmtd3: 004d0000 00010000 \"rootfs_data\"
\nmtd4: 00010000 00010000 \"art\"
\nmtd5: 007d0000 00010000 \"firmware\"<\/p>\n

<\/code><\/p>\n

I highly recommend replacing the bootloader with an unlocked one.
\ni.e. this one – https:\/\/github.com\/pepe2k\/u-boot_mod<\/p>\n

Bootloader sits at 0x9f000000 and is 64kb in size.
\nSuggest load in ram at 0x80060000 like they do, and flash from there.<\/p>\n

eg from the bootloader – <\/p>\n

tfpboot 0x80060000 uboot.bin
\nerase 0x9f000000 +0x20000
\ncp.b 0x80060000 0x9f000000 0x20000
\n<\/code><\/p>\n

Pray that it didn’t mess up (or you need an spi flasher…), and reboot!<\/p>\n

Other bits n bobs –<\/p>\n

You’ll need to adjust the opkg.conf file<\/p>\n

ssh into the router @ 192.168.1.1 \/ root \/ root<\/p>\n

mv \/etc\/opkg.conf \/etc\/opkg.conf.orig<\/p>\n

echo 'dest root \/
\ndest ram \/tmp
\nlists_dir ext \/var\/opkg-lists
\noption overlay_root \/overlay
\nsrc\/gz barrier_breaker_base http:\/\/downloads.openwrt.org\/barrier_breaker\/14.07\/ar71xx\/generic\/packages\/base
\nsrc\/gz barrier_breaker_management http:\/\/downloads.openwrt.org\/barrier_breaker\/14.07\/ar71xx\/generic\/packages\/management
\nsrc\/gz barrier_breaker_oldpackages http:\/\/downloads.openwrt.org\/barrier_breaker\/14.07\/ar71xx\/generic\/packages\/oldpackages
\nsrc\/gz barrier_breaker_packages http:\/\/downloads.openwrt.org\/barrier_breaker\/14.07\/ar71xx\/generic\/packages\/packages
\nsrc\/gz barrier_breaker_routing http:\/\/downloads.openwrt.org\/barrier_breaker\/14.07\/ar71xx\/generic\/packages\/routing
\nsrc\/gz barrier_breaker_telephony http:\/\/downloads.openwrt.org\/barrier_breaker\/14.07\/ar71xx\/generic\/packages\/telephony
\nsrc\/gz barrier_breaker_luci http:\/\/downloads.openwrt.org\/barrier_breaker\/14.07\/ar71xx\/generic\/packages\/luci<\/p>\n

#src\/gz barrier_breaker_base http:\/\/downloads.openwrt.org\/snapshots\/trunk\/ar71xx\/packages\/base
\n#src\/gz barrier_breaker_management http:\/\/downloads.openwrt.org\/snapshots\/trunk\/ar71xx\/packages\/management
\n#src\/gz barrier_breaker_oldpackages http:\/\/downloads.openwrt.org\/snapshots\/trunk\/ar71xx\/packages\/oldpackages
\n#src\/gz barrier_breaker_packages http:\/\/downloads.openwrt.org\/snapshots\/trunk\/ar71xx\/packages\/packages
\n#src\/gz barrier_breaker_routing http:\/\/downloads.openwrt.org\/snapshots\/trunk\/ar71xx\/packages\/routing
\n#src\/gz barrier_breaker_telephony http:\/\/downloads.openwrt.org\/snapshots\/trunk\/ar71xx\/packages\/telephony' >> \/etc\/opkg.conf<\/code><\/p>\n

…and install Luci (the openwrt webui)<\/p>\n

opkg update
\nopkg install luci
\n<\/code><\/p>\n

You should be able to visit http:\/\/192.168.1.1 and start changing settings.<\/p>\n

\"Screen<\/a><\/p>\n

\"Screen<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

The Mercury MAC1200R (TPLINK WR6300) is one of the cheapest AC based routers on the planet, as I have a few AC devices I thought I’d buy one to try out. They’re available for under RMB120 or so online. Mercury hardware is TPLink hardware, albeit using a different name. Same stuff, same factory, different casing. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[282,25,4],"tags":[197,241,507],"class_list":["post-1504","post","type-post","status-publish","format-standard","hentry","category-firmware-2","category-technical-mumbo-jumbo","category-useful-info","tag-firmware","tag-hacking","tag-mac1200r"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts\/1504","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/comments?post=1504"}],"version-history":[{"count":12,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts\/1504\/revisions"}],"predecessor-version":[{"id":1518,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts\/1504\/revisions\/1518"}],"wp:attachment":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/media?parent=1504"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/categories?post=1504"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/tags?post=1504"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}