Teardown Totolink EX200

Written on February 16, 2019 by thanh

totolink-ex200-mainboard

Hardware

Info

  • Power: 100-240 VAC ~ 50/60 Hz, 0.1 A
  • Connector type: AC (direct)
  • CPU1: Realtek RTL8196E (400 MHz)
  • FLA1: 4 MiB (Brand? Model?)
  • RAM1: 32 MiB (Brand? Model?)
  • WI1 chip1: Realtek RTL8192ER
  • WI1 802dot11 protocols: bgn
  • WI1 MIMO config: 2x2:2
  • WI1 antenna connector: none
  • ETH chip1: Realtek RTL8196E
  • LAN speed: 10/100
  • LAN ports: 1
  • Default IP address: 192.168.0.254

Serial

The serial port of the router can be accessed using the TTL pins. A voltage level converter (such as a CP2102 TTL-USB dongle) is required.

totolink-ex200-uart

The communication settings are: TTL voltage, 38400 bps, 8N1.

MTD output from stock firmware

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00130000 00001000 "boot+cfg+linux"
mtd1: 00290000 00001000 "root fs"
mtd2: 00040000 00001000 "userdata"

Bootlog

Boot log of firmware TOTOLINK_CS13KE_EX200_WX005_8196E_SPI_4M32M_V5.2.3c.5991_B20180409_VN.web

Booting...


@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@

@ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize

@ 0000000h 01c3016h 000001ch 0000030h 0000016h 0000000h 0000016h 0400000h

@ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName

@ 0010000h 0000040h 0001000h 0000400h 0000100h 0000010h 000004eh EN25Q32

@ 

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

 

---RealTek(RTL8196E)at 2014.10.24-17:33+0800 v1.2 [16bit](380MHz)

no sys signature at 00010000!

no sys signature at 00020000!

no rootfs signature at 000E0000!

no rootfs signature at 000F0000!

Jump to image start=0x80500000...

decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
start address: 0x80003470
Realtek WLAN driver - version 1.6 (2013-02-21)(SVN:5991M)
Adaptivity function - version 7.1


#######################################################
SKB_BUF_SIZE=2408 MAX_SKB_NUM=400
#######################################################




Probing RTL8186 10/100 NIC-kenel stack size order[3]...
chip name: 8196C, chip revid: 0
NOT YET
eth0 added. vid=9 Member port 0x10...
eth1 added. vid=8 Member port 0x10...
eth2 added. vid=9 Member port 0x2...
eth3 added. vid=9 Member port 0x4...
eth4 added. vid=9 Member port 0x8...
eth5 added. vid=9 Member port 0x0...
[peth0] added, mapping to [eth1]...
Realtek FastPath:v1.03

init started: BusyBox v1.13.4 (2018-04-09 14:16:13 CST)
cp: cannot stat '/bin/pppoe.sh': No such file or directory
Using ori config
Read hw setting header failed!
Invalid hw setting signature [sig=]!
Read hw setting header failed!
Invalid hw setting signature [sig=]!
Read hw setting header failed!
Invalid hw setting signature [sig=]!
[Notice]:Bak_hw is invaild and Ori_hw is valid,Save ori_hw to bak_hw
[Notice]:Bak_ds is invaild and Ori_ds is valid,Save ori_ds to bak_ds
[Notice]:Bak_cs is invaild and Ori_cs is valid,Save ori_cs to bak_cs
Init Start...
DEFAULT LANGUAGE_TYPE is [3][0:cn;1:en;2:tw;3:vn;4...]
Init bridge interface...


************* Initialize MAC/PHY parameter *************
Init Wlan application...

WiFi Simple Config v2.18-wps2.0 (2018.04.09-06:17+0000).

Register to wlan0
Register to wlan0-vxd
route: SIOCDELRT: No such process
iwcontrol RegisterPID to (wlan0)
IEEE 802.11f (IAPP) using interface br0 (v1.8)
killall: reload: no process killed
Start NTP daemon
sh: ntp_inet: not found

Init system...
sh: can't create /mnt/SysCurVerMd5: Read-only file system
killall: cs_daemon: no process killed
2018-04-09 14:21:31: (log.c.97) server started 


carystudio login:

Misc

# cat /proc/devices
Character devices:
  1 mem
  2 pty
  3 ttyp
  4 ttyS
  5 /dev/tty
  5 /dev/console
 10 misc
108 ppp

Block devices:
259 blkext
 31 mtdblock
# cat /proc/meminfo
MemTotal:          26024 kB
MemFree:           11180 kB
Buffers:            1724 kB
Cached:             4204 kB
SwapCached:            0 kB
Active:             4020 kB
Inactive:           3412 kB
Active(anon):       1504 kB
Inactive(anon):        0 kB
Active(file):       2516 kB
Inactive(file):     3412 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          1508 kB
Mapped:             1764 kB
Slab:               6512 kB
SReclaimable:        304 kB
SUnreclaim:         6208 kB
PageTables:          196 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       13012 kB
Committed_AS:       3404 kB
VmallocTotal:    1048404 kB
VmallocUsed:         580 kB
VmallocChunk:    1047812 kB
# top
Mem: 14840K used, 11184K free, 0K shrd, 1724K buff, 4208K cached
CPU:  20% usr  20% sys   0% nic  60% idle   0% io   0% irq   0% sirq
Load average: 0.68 0.26 0.09 4/27 1840
  PID  PPID USER     STAT   VSZ %MEM %CPU COMMAND
 1833   421 root     R     1004   4%   5% top 
  422     1 root     S     2572  10%   0% lighttpd -f /lighttp/lighttpd.conf -m
  398     1 root     S     2064   8%   0% cste_sub -h 127.0.0.1 -t totolink/rou
  403     1 root     S     1504   6%   0% cs_daemon 
  480     1 root     S     1188   5%   0% dnsmasq 
  387     1 root     S     1064   4%   0% cs_broker -c /etc/mosquitto.conf 
  421     1 root     S     1012   4%   0% -sh 
    1     0 root     S     1004   4%   0% init      
  335     1 root     S     1000   4%   0% timelycheck 
  293     1 root     S      924   4%   0% wscd -mode 2 -c /var/wsc-wlan0-vxd.co
  296     1 root     S      604   2%   0% iwcontrol wlan0 wlan0-vxd 
  316     1 root     S      584   2%   0% reload -k /var/wlsch.conf 
  284     1 root     S      584   2%   0% iapp br0 wlan0 
  331     1 root     S      124   0%   0% fwd 
   14     2 root     SW<      0   0%   0% [mtdblockd]
    3     2 root     SW<      0   0%   0% [ksoftirqd/0]
    4     2 root     SW<      0   0%   0% [events/0]
    5     2 root     SW<      0   0%   0% [khelper]
    2     0 root     SW<      0   0%   0% [kthreadd]
    7     2 root     SW<      0   0%   0% [kblockd/0]

# ifconfig
br0       Link encap:Ethernet  HWaddr XX:XX:XX:XX:XX:XX  
          inet addr:192.168.0.254  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:382 errors:0 dropped:0 overruns:0 frame:0
          TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:11844 (11.5 KiB)  TX bytes:2456 (2.3 KiB)

eth0      Link encap:Ethernet  HWaddr XX:XX:XX:XX:XX:XX  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:12 

eth1      Link encap:Ethernet  HWaddr XX:XX:XX:XX:XX:XX  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:12 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:72 errors:0 dropped:0 overruns:0 frame:0
          TX packets:72 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:4434 (4.3 KiB)  TX bytes:4434 (4.3 KiB)

wlan0     Link encap:Ethernet  HWaddr XX:XX:XX:XX:XX:XX  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1486 errors:0 dropped:0 overruns:0 frame:0
          TX packets:80 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:386097 (377.0 KiB)  TX bytes:20800 (20.3 KiB)
          Interrupt:11 

wlan0-vxd Link encap:Ethernet  HWaddr XX:XX:XX:XX:XX:XX 
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:392 errors:0 dropped:0 overruns:0 frame:0
          TX packets:44 errors:1496 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:32138 (31.3 KiB)  TX bytes:4436 (4.3 KiB)

# busybox
BusyBox v1.13.4 (2018-04-09 14:16:13 CST) multi-call binary
Copyright (C) 1998-2008 Erik Andersen, Rob Landley, Denys Vlasenko
and others. Licensed under GPLv2.
See source distribution for full notice.

Usage: busybox [function] [arguments]...
   or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable.  Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as!

Currently defined functions:
ash, awk, bunzip2, bzcat, cat, cp, cut, date, echo, expr, false,
free, getty, grep, halt, head, hostname, ifconfig, init, insmod,
ip, kill, killall, klogd, ln, login, ls, lsmod, md5sum, mkdir, mount,
nslookup, ping, poweroff, ps, reboot, renice, rm, rmmod, route, sed,
sh, sleep, syslogd, tail, telnetd, top, touch, true, umount, wc,
wget