Microsoft MN700 hack project

[hsddlawley]

Just a quick thanks for the work on this project, which I did on one of my mn-700 this morning. hats off oleg,thanks.

will have another one to do, but for now let see how this performs this week.

[hsddlawley]

Just a quick thanks for the work on this project, which I did on one of my mn-700 this morning. hats off oleg,thanks.

will have another one to do, but for now let see how this performs this week.

Just another quick note, and THANKS. This has raised my 700 from the dead and possible trash heap. Did my second unit and now have WDS working in my home. Talk about a great way to recycle!

Off to locate couple of more if I can find them..

Thanks Oleg!

[pcbroch]

Unfortunatly no. Should be similar to wrt54g 1.x, which requires uart (read seattle wireless).

Woooohooooo!!!!!

[root@MN700-Shared root]$ cat /proc/tty/driver/serial
serinfo:1.0 driver:5.05c revision:2001-07-08
0: uart:ST16650 port:BF800000 irq:2 baud:120535 tx:606 rx:0 RTS|CTS|DTR|DSR|CD|RI
1: uart:ST16650 port:BF800008 irq:0 tx:0 rx:0 CTS|DSR|CD|RI




I haven't installed a MAX232 yet (and I'm missing 2 caps for the crystal), but the fact that the kernel sees it is encouraging.

[narwhal]

Oleg, thanks for the info and great work!

I figured out that it appeared to be a problem of too much EMI at the office. Works fine to flash the CFE I built at home, but not at work. Strange.

Anyway, I now can tftp to 192.168.1.1 and get the magic file name to set it to accept an image (and the power light goes from green/amber blink to green-solid). I then put my .trx file as ASUSSPACELINK. Lots of net activity for a couple of seconds, green/amber blink on power LED for a couple of secs, then amber solid power LED, and it sits there--forever (like I've given it hours and no change). In this case, no ping response either. I power cycle it, erase the nvram, power cycle it and back to the top of this paragraph. Argh!

Is it possible I build a bogus CFE? Anyone want to share one w/ me that is known good?

Any other ideas? I'm so close I can taste it, but still not there. Thanks again to all the players here, it's been a great project so far even if it's still not working. At least it doesn't have WinCE on it anymore ;-)

[Oleg]

Ok. Steps to be done.

1) Flash the bootloader, which I've prepared for you
2) Read it back to check, that it has byte to byte match.
3) run wrt54g utility again and erase nvram
4) off/on your device, so it would start blinking
5) Use ASUS Windows restoration tool from windows, do not use tftp and flash wl500g 1.9.2.7-6b firmware
6) Once flashed it should reboot and turn on AIR led, as well power led should switch to other color in the end of boot
7) Let me know of your progress

x) if it does not boot - use wrt54g utility to read kernel from the flash and send this image to me (or compare it with trx image - should be the same)

[hsddlawley]

Ok, you're out of luck then. It's seems USB port is not wired out of the chip.

Sorry to drag this post out again, but have an interest in using usb on this device as well if it can be hacked in.

I take your statement to mean that MS did not lay traces on the board for usb support? But could one carefully tie into the chip directly from the bottom of the board? If the chipset provides native support are any other support componets needed outside of a usb port? Is there pinout of the chipset posted anywhere on the net?

Thanks..

[Oleg]

I take your statement to mean that MS did not lay traces on the board for usb support?

They do not trace usb pins from the bottom of the chip

But could one carefully tie into the chip directly from the bottom of the board?

Unlikely.

If the chipset provides native support are any other support componets needed outside of a usb port? Is there pinout of the chipset posted anywhere on the net?

Well, yes several resistors are needed. The pinout is as following

USB1+ P20
USB1- P21
USB1ctrl P22
USB2+ N21
USB2- N22
USB2ctrl N20

For the first you should try grounding + or - via 15K resistors, so dmesg should stop saying can't assign address. Can't remember which line exactly should be grounded - for now it acts as presense indicator, due to a missing grounding.

[hsddlawley]

They do not trace usb pins from the bottom of the chip

Cool thanks for fast reply, some careful googling did turn up post elsewhere within your site of needed info of whats needed.. just needed to be more skillful with my searches..

http://wl500g.info/showthread.php?t=846

[narwhal]

Thanks to Oleg and a corrected CFE.BIN file, my MN-700 is up and running. Ran out of time to play with it before work this morning, so no comments on how it works yet. More updates as they occur.

-tv
PS. The tftp process of loading a .trx image works fine...

[robjective]

First, thanks to Oleg for the cfe, and thanks to sbyers77 for the detailed guide.

I'm not very good with a soldering iron...the longest part of the whole process was trying to clean out the plugs for the pin header. After 4 hours of trying 15W and 25W irons, desoldering braid, desoldering bulb, and even trying to dig the melted solder out with a dental pick, I gave up and just soldered the jtag wires directly to the board. It wasn't pretty but it was effective.

I was able to use wrtjtag-modified.exe to backup cfe and write the new one, but it wouldn't let me do anything else (i.e. erase NVRAM). It just seemed to get stuck. In searching for some help, I came across another guide that is a good supplement for the one here.

http://www.liamm.com/blogtest4/archi...ft_mn-700.html

Reading the comments section, I saw that other people were having the same problem. There's a posting from July 4 that links to a Windows GUI version of wrtjtag. Not only was that version faster for flashing cfe, it also erased NVRAM without a problem.

Once I used the GUI tool, it was a breeze. Thanks again to everyone who developed this project.

[Oleg]

http://www.liamm.com/blogtest4/archi...ft_mn-700.html

Well, nice guide, except it does not mention the origin of the info (both my site and this forum) and the original author as well...
Preparing bootloader was not so simple and required A LOT of work. This guide has no credits at all... Also some info provided is just a wild guesses...

[hsddlawley]

Well, nice guide, except it does not mention the origin of the info (both my site and this forum) and the original author as well...
Preparing bootloader was not so simple and required A LOT of work. This guide has no credits at all... Also some info provided is just a wild guesses...

I do think there was a link there to your site(not here but your own), but agree, should be more credit given where it is due.

Again, thanks for restoring value to this orphaned router....

[hsddlawley]

Adding mmc/sd memory an option?

Just came across this on the openwrt site and was wondering if something like this could be applied to our mn-700s?

Not sure if this would be easier to do than trying to add usb or not. Just was looking for a way for extra memory...

adding mcc/sd memory card

[Oleg]

Yes, this is possible in the way similar to wrt54g. Probably you will need to change gpio numbers in the kernel module.
BCM5325M pins:

5 MISO GPIO5
6 MOSI GPIO4
7 SCK GPIO3
8 SS# GPIO2

[hsddlawley]

Yes, this is possible in the way similar to wrt54g. Probably you will need to change gpio numbers in the kernel module.
[/code]

no fear of hardware mods, but not having a good programming background this might be just beyond my reach. Maybe a wishlist item in the future if enough folks show interest? I need to find the reader slot gizmo to load the sd card first anyway.