I bought a cheap router at geeks.com and now I’m tinkering with it to see if it can run free and open source software.

They were also smart enough to use a somewhat random lan address: 192.168.61.0/24, and the admin is easy enough to figure out: admin, 1234. The webgui leaves much to be desired, but does what it needs. Would be nice to be able to flash the device with m0n0wall or openwrt but that’s unlikely. :-(

snb10864.JPG

I just opened it up and holy cow there is a host USB port!

snb10860.JPG

snb10863.JPG

The back of the board has a sticker that says “820-05905010”.

It has a RTL8208 chip in it, which is decent, and I think the processor is an SD SD9148-AB, whatever that is. :-) Looks to be a MIPS 200Mhz chip, from some similarly name board specs available at http://www.silicon-data.com/.

It also has an Etrontech em638325ts-6 chip, which supplies the ram for the board. Wow, it looks like that is actually 64MB of ram. Cool! Here’s the datasheet: PDF.

Found some other cool pages on related efforts:

http://soapbox.bartsplace.net/article.php/20050118211503648

http://forum.openwrt.org/viewtopic.php?pid=52367

Too bad, looks like the manufacturer is breaking the GPL rules:

http://lkml.org/lkml/2004/4/22/72

Even though the inexq website is down, I found a firmware image for another one of their products:

isw054t.zip

I found it via some stupid driver download site that makes you pay for or watch a gazillion ads so I can’t vouch for the validity or authenticity of the archive.

Also found this one at the same place:

is050t.zip

Looks like the router already is running linux:

0017700    0a  63  70  6c  65  6e  73  20  3d  20  00  00  0a  63  70  6c          nl   c   p   l   e   n   s  sp   =  sp nul nul  nl   c   p   l

0017720    65  78  74  20  3d  20  00  00  0a  62  6f  72  64  65  72  20           e   x   t  sp   =  sp nul nul  nl   b   o   r   d   e   r  sp

0017740    3d  20  00  00  0a  00  0a  0a  00  00  00  00  0a  0a  20  2d           =  sp nul nul  nl nul  nl  nl nul nul nul nul  nl  nl  sp   -

0017760    2d  20  53  79  73  74  65  6d  20  68  61  6c  74  65  64  00           -  sp   S   y   s   t   e   m  sp   h   a   l   t   e   d nul

0020000    62  79  74  65  5f  63  6f  75  6e  74  20  3d  20  00  00  00           b   y   t   e   _   c   o   u   n   t  sp   =  sp nul nul nul

0020020    55  6e  63  6f  6d  70  72  65  73  73  69  6e  67  20  4c  69           U   n   c   o   m   p   r   e   s   s   i   n   g  sp   L   i

0020040    6e  75  78  2e  2e  2e  20  0a  00  00  00  00  4f  6b  2c  20           n   u   x   .   .   .  sp  nl nul nul nul nul   O   k   ,  sp

0020060    62  6f  6f  74  69  6e  67  20  74  68  65  20  6b  65  72  6e           b   o   o   t   i   n   g  sp   t   h   e  sp   k   e   r   n

0020100    65  6c  2e  0a  00  00  00  00  1f  8b  08  08  dc  b9  5d  3f           e   l   .  nl nul nul nul nul  us  8b  bs  bs  dc  b9   ]   ?

0020120    02  0b  55  4e  45  58  2d  74  2d  30  30  2d  30  39  2d  30         stx  vt   U   N   E   X   -   t   -   0   0   -   0   9   -   0

0020140    37  50  5f  55  2e  62  69  6e  00  ec  5c  7f  70  1c  d5  7d           7   P   _   U   .   b   i   n nul  ec   \ del   p  fs  d5   }

The important part there is: U n c o m p r e s s i n g sp L i n u x . . .

I did some more digging and found with the help of this GPL violation page about how “Inexq/Unex use Linux kernel and other GPL software in their routers, yet refuse to distribute the source code…”, I was able to decompress the img file from the firmware, and file all sorts of neat stuff, like:

Firmware upgrade successful^@^@^@^@tftp server: moved %lu bytes %s ^@^@^@^@tftp server error: status %d, msg: %s, host:^@^@^@^@image^@^@^@octet^@^@^@TFTP Server: got req while off^@TFTP Server: Bad mode %s in req^@^@^@Transfers currently disabled.^@^@^@Transfer refused.^@^@^@TFTP Serve: Ignoring req, too many connections^@^@^@^@TFTP Server: bad init opcode %u^@^@^@^@TFTP Server: session Alloc failed^@^@netascii^@^@^@^@Bad mode^@^@^@^@TFTP Server: UDP listen error^@^@UDP send failed^@UDP alloc failed^@^@^@^@Bad len (too short)^@short data from peer^@^@^@^@Rcvd unexpected data block^@^@ ^@^@^@bogus tftp error text^@^@^@ ^@^@^@Unknown transfer ID^@File already

exists^@Disk full^@^@^@See text^@^@^@^@File not found^@^@Access violation^@^@^@^@Illegal TFTP operation^@^@No such user^@^@^@^@ ^@^@^@Retry limit exceeded, giving up^@retry limit exceeded^@^@^@^@zero length file^@^@^@^@Transferred %lu bytes in %u.%u seconds^@^@tfstate^@tftps^@^@^@tfsrv^@^@^@Toggle tftp server on/off^@^@^@tftp server menu^@^@^@^@Display tftp stats^@^@OFF^@ON^@^@tftp server %s^@usage: tf%s host sourcefile [destfile]^@put^@get^@TFTP host address error: %s^@^@^@^@TFTP client error: %s^@^@OFF^@ON^@^@put to^@^@tftp server state %s^@^@^@connection: %s %u.%u.%u.%u, state:%d, bytes moved: %ld^@^@^@^@get from^@^@^@^@%d connections open</pre></textarea>

Sounds like there is something with a tftp server or client going on there. Which if I call correctly is how some of the wrt routers get upgraded. Yup, you basically send the firmware as the router is booting up, as described here at the OpenWRT TFTP flashing page.

The current firmware is 00-10-04T2 updated in 2004, and I’m now trying to upload IS050t-S-00-09-07P.img. Well, it worked, but I just backgraded to 00-09-07P, Sep 09 2003 19:27:30. :-) At least I know it works!

There is a hidden page at /UE/Main (Allegro-Software-RomPager ^), and supposedly it is possible to get a shell.

I’m trying to figure out if I can get a shell ^, I don’t think so, there isn’t any telnet or shell keywords in the binary I could find. I think there is a console though, so there maybe some way to access that via a serial cable of some sorts. From what I read it appears that there is a voltage discrepancy of sorts.

The tftpd server works though, it is easy to update the firmware from the command line:

echo -e "binary\nrexmt 1\ntimeout 60\ntrace\nput IS050t-S-00-09-07P.img\n" | tftp 192.168.62.1

Only thing I could find about the CPU was in a patent application:

Patent number: 20040240425

I also found some information in Chinese about the system on chip (SoC):

http://www.dongxindz.cn/dongxindz_Product_1516572.html

Since the SD9148 is a MIPS3000, perhaps it can use the Realtek 8181 sdk?

Also found this here:

VIP会员价:VIP Member Price :请登陆才能看到报价Requests will be able to see the landing Price企业级路由器Enterprise Router 商 品 详 细 说 明Trade details

HL-RT8268 路由器(企业级)宽带路由器说明HL-RT8268 Router (Enterprise) Note Broadband Router系统规� �( System Specifications ):System specifications (System Specifications) :使用芯片:美国(processor)sd9148;内存:64M;Use Chip : United States (processor) sd9148; Memory : 64M;高速缓存:16K(指令缓存8K; 数据缓存8K);Cache : 16K (8K instruction cache; 8K data cache);

flash: 16MFlash : 16M处理器(Processor)Processor (Processor)

200Mhz 32bit MIPS SoC200Mhz 32bit MIPS SoC

NAT转换效能
最高可达 60Mbps 以上(LAN to WAN)NAT
conversion efficiency of up to 60Mbps over (LAN to WAN)系统管理
浏览器图形接口管理(IE4.0 以上版本)System Management
browser graphical interface management (odd versions)软件重置
内建重置按钮Built-in software replacement
RESET button固件升级
可升级式固件更新
Upgrading firmware-upgradable firmware update硬件规� �( Hardware Specifications )Hardware specifications (Hardware Specifications)局域网络接口(LAN)LAN interface (LAN)

4×10/100BaseT Switch;802.3/802.3U,4 × 10/100BaseT Switch; 802.3/802.3U.(Auto MDI/X)(Auto MDI / X)广域网络接口(WAN)Wide Area Network Interface (WAN)

1×10/100BaseT;1 × 10/100BaseT;

ADSL/VDSL/PPPoE/Cable/LAN,(Auto MDI/X),ADSL / VDSL / PPPoE / Cable / LAN, (Auto MDI / X)面板灯号显示
电源/开机自我测试/广域网络连接/广域网络�
Panel lights indicate power / boot self-test / wide area network connectivity / WAN networks -送/局域网络连接/局域网络� 送/连接速度Send / LAN connectivity / LAN transmission / connectivity speed尺寸与重量Size and Weight

1509825(mm);净重424g150 * 98 * 25 (mm); Weighing 424g架设方式
桌上型Erection way
Desktop冷却
自动冷却模式Cooling
automatic cooling mode电源Power

5V DC 2.0A 220VAC 50Hz5V DC 2.0A 220VAC 50Hz工作环境
作业温度:0-45C;相对湿度:25-85%Work environment
operating temperatures “:-)”,-Port; Relative humidity :25-85%软件功能( Firmware Specifications )Software (Firmware Specifications)通讯协议Communication Protocol

TCP/IP,DHCP Client/Server,PPP,PPPoE,TCP / IP, DHCP Client / Server, PPP, PPPoE,

ARP,ICMP,UTP,HTTP,NATARP, ICMP, UTP, HTTP, NAT网址过滤
可管制内部使用者连接不当网站或是只能连接特Address filtering
internal controls can connect users only inappropriate websites or special link定网页Scheduled website流量统计
记录过去进出内部局域网络的封包流量
Flow statistics from the past record of the internal local area network packet flow虚拟主机
提供12组虚拟主机设定,可提供使用者利用虚Virtual Host
provide 12 sets of virtual server settings, can provide users using virtual拟IP架设网站功能(Virtual Server)Terms of the proposed erection of IP functions (Virtual Server)防火墙
提供透通模式,NAT与NAPT功能,以及广域网络Firewall
provided through links model, NAT and NAPT function, and Wide Area Network阻断ICMP封包功能(DDoS).支持封包过滤、阻断Blocking ICMP packet functions (DDoS). Support for packet filtering, blocking服务(Denial of Service,DoS),SYN Ack,(Denial of Service, DoS), SYN Ack.状态封包检查(Stateful Packet Inspection-State packet inspection (Stateful Packet Inspection -

SPI),阻断Cookies,Java,Java script,SPI), block cookies, Java, Java script,

ActiveX,网络联机时间自订等功能ActiveX, on-line time since setting function

DDNS支援
支援DDNS(Dyndns.org),可使用动态网址转换DDNS support
support DDNS (Dyndns.org), the use of dynamic web site conversion功能,架设网站,最合适于� 动态IP位置的使Function, and have set up websites, in the most suitable location without the dynamic IP to enable用者,如计时制ADSL PPPoE或是Cable ModemUsers, such as system time PPPoE ADSL or Cable Modem用户Users虚拟私有网络(VPN)Virtual Private Network (VPN)支持PPTP/IPSec Pass through穿越功能Support PPTP / IPSec Pass through cross functional远程管理
提供远程进入系统管理(Remote AccessRemote Management
provide remote access to the system management (Remote Access

Management),支持远程重置。Management), support remote replacement.

MAC克隆
提供如Cable Modem使用者可变换广域网络实体MAC cloning
provide as Cable Modem Users can transform the wide area network entities层MAC Address防止ISP锁定功能MAC Address - lock function to prevent ISP

DHCP服务器
提供最高可发放PC端IP数量:253个DHCP server
provide maximum payment of PC-IP number : 253

IP状态监控
提供使用端IP位置扫描以及DHCP Client所使用IP Monitoring
provide IP-use scanning and location by the use of DHCP Client之IP位置,MAC位置,计算机名称等实时扫描与IP location, MAC location, and other real-time computer name and scanning监控Monitor

PPPoE联机
提供使用端使用计时制ADSL-PPPoE通讯,并可PPPoE available online
-time system using ADSL-PPPoE communications, may支持Dial-On-Demand或永远保持联机功能。Support Dial-On-Demand or permanently maintain on-line functions.网络日志
可在线纪录使用者连接网址等情况Network log
can connect users online records of the websites主要特点:Main features :可连接到宽带调制解调器或以太骨干网上Can be connected to the broadband modem or Ethernet Backbone Network多达253台计算机与INTERNET的同步连接As many as 253 computers with Internet connection synchronization具有防火墙功能以保护� 的计算机不受外部黑客的入侵Firewall function is to protect your computer from external hackers invasion内置4口10/100M交换机Built-4 10 / 100M switch高速交换可满足网络游戏和多媒体应用Meet the high-speed network to exchange games and multimedia applications全中文配置管理接口,可通过网络上的任一台计算机All Chinese configuration management interface, through the network of a computer     的Web浏览器进行配置管理Web browser for configuration management能作为DHCP服务器或客户Can act as a DHCP server or client遵从互联网应用的� �准Internet applications comply with the standards管理员能阻断指定的内部用户访问互联网Administrators can block specific internal users access to the Internet技术性能指针:Technical performance indicators :集成200MHz RISC w/MMUIntegrated 200 MHz RISC w / MMU内置网络交换机:4个10/100兆以太网局域网口Built-in network switches : four 10/100 Ethernet LAN I

1个10/100兆广域网口A 10/100 WAN I

DHCP服务器/客户、网络地址转换(NAT)、防火墙DHCP server / client, the Network Address Translation (NAT), firewall

Web管理设定Web administrators to set事件日志报告Event log report网络流量统计Network traffic statistics软件在线升级Online Software Upgrade� �准:IEEE 802.11b,Standards : IEEE 802.11b,线缆类型:10BaseT:3/5类非屏蔽/屏蔽双绞Cable types : 10BaseT : 3 / 5 categories of non-shielding / Shielded twisted-pair

100BaseTX:5类非屏蔽/屏蔽双绞100BaseTX : Category 5 unshielded / Shielded twisted-pair拓扑结构:星形Topology : Star外形尺寸:1509825 (深/宽/高)Dimensions : 150 * 98 * 25 (D / width / height)重量:424gWeight : 424g电源适配器:AC100-240V/50Hz输入,Power Adapter : AC100-240V/50Hz input,            DC 5V/2.0A输出Output DC 5V/2.0A工作温度:0℃ ~ 50℃Operating temperature : 0 ° C to 50 ° C存放温度:-20℃ ~ 70℃Storage temperature : -20 ° C to 70 ° C工作湿度:10% ~ 85%Working Humidity : 10% ~ 85% </pre></textarea>

Its really lame that a nice board like this, that uses GPL software, was manufactured by a company that never released the source code that they used to generate the firmware. And then they go out of business and its a waste of effort.

After reading the “help” page in the admin pages, it sounded like you can tftp the nvram settings, with the “get nvram_whatever.bin” command, so I tried it, and it worked. The nvram contains all the configuration settings of the router: ip address, username and password, and dhcp settings. Its in binary form, but the settings themselves are in ascii.

Before this post gets too big, I’ve created a new wiki page on the topic: INEXQ IS050t

Related Links:

http://www.e210.cn/views.asp?hw_id=672

http://www.euodeio.net/shortlinux.php

http://www.linux-mips.org/wiki/Realtek_SOC

http://rtl8181.sourceforge.net/

http://www.dongxindz.cn/dongxindz_Product_1516572.html

¥