I bought a cheap router at geeks.com and now I’m tinkering with it to see if it can run free and open source software.
They were also smart enough to use a somewhat random lan address: 192.168.61.0/24, and the admin is easy enough to figure out: admin, 1234. The webgui leaves much to be desired, but does what it needs. Would be nice to be able to flash the device with m0n0wall or openwrt but that’s unlikely. 
I just opened it up and holy cow there is a host USB port!
The back of the board has a sticker that says “820-05905010″.
It has a RTL8208 chip in it, which is decent, and I think the processor is an SD SD9148-AB, whatever that is. 
Looks to be a MIPS 200Mhz chip, from some similarly name board specs available at http://www.silicon-data.com/.
It also has an Etrontech em638325ts-6 chip, which supplies the ram for the board. Wow, it looks like that is actually 64MB of ram. Cool! Here’s the datasheet: PDF.
Found some other cool pages on related efforts:
http://soapbox.bartsplace.net/article.php/20050118211503648
http://forum.openwrt.org/viewtopic.php?pid=52367
Too bad, looks like the manufacturer is breaking the GPL rules:
http://lkml.org/lkml/2004/4/22/72
Even though the inexq website is down, I found a firmware image for another one of their products:
isw054t.zip
I found it via some stupid driver download site that makes you pay for or watch a gazillion ads so I can’t vouch for the validity or authenticity of the archive.
Also found this one at the same place:
is050t.zip
Looks like the router already is running linux:
0017700 0a 63 70 6c 65 6e 73 20 3d 20 00 00 0a 63 70 6c
nl c p l e n s sp = sp nul nul nl c p l
0017720 65 78 74 20 3d 20 00 00 0a 62 6f 72 64 65 72 20
e x t sp = sp nul nul nl b o r d e r sp
0017740 3d 20 00 00 0a 00 0a 0a 00 00 00 00 0a 0a 20 2d
= sp nul nul nl nul nl nl nul nul nul nul nl nl sp -
0017760 2d 20 53 79 73 74 65 6d 20 68 61 6c 74 65 64 00
- sp S y s t e m sp h a l t e d nul
0020000 62 79 74 65 5f 63 6f 75 6e 74 20 3d 20 00 00 00
b y t e _ c o u n t sp = sp nul nul nul
0020020 55 6e 63 6f 6d 70 72 65 73 73 69 6e 67 20 4c 69
U n c o m p r e s s i n g sp L i
0020040 6e 75 78 2e 2e 2e 20 0a 00 00 00 00 4f 6b 2c 20
n u x . . . sp nl nul nul nul nul O k , sp
0020060 62 6f 6f 74 69 6e 67 20 74 68 65 20 6b 65 72 6e
b o o t i n g sp t h e sp k e r n
0020100 65 6c 2e 0a 00 00 00 00 1f 8b 08 08 dc b9 5d 3f
e l . nl nul nul nul nul us 8b bs bs dc b9 ] ?
0020120 02 0b 55 4e 45 58 2d 74 2d 30 30 2d 30 39 2d 30
stx vt U N E X - t - 0 0 - 0 9 - 0
0020140 37 50 5f 55 2e 62 69 6e 00 ec 5c 7f 70 1c d5 7d
7 P _ U . b i n nul ec \ del p fs d5 }
The important part there is:
U n c o m p r e s s i n g sp L i n u x . . .
I did some more digging and found with the help of this GPL violation page about how “Inexq/Unex use Linux kernel and other GPL software in their routers, yet refuse to distribute the source code…”, I was able to decompress the img file from the firmware, and file all sorts of neat stuff, like:
Sounds like there is something with a tftp server or client going on there. Which if I call correctly is how some of the wrt routers get upgraded. Yup, you basically send the firmware as the router is booting up, as described here at the OpenWRT TFTP flashing page.
The current firmware is 00-10-04T2 updated in 2004, and I’m now trying to upload IS050t-S-00-09-07P.img. Well, it worked, but I just backgraded to 00-09-07P, Sep 09 2003 19:27:30. At least I know it works!
There is a hidden page at /UE/Main (Allegro-Software-RomPager ^), and supposedly it is possible to get a shell.
I’m trying to figure out if I can get a shell ^, I don’t think so, there isn’t any telnet or shell keywords in the binary I could find. I think there is a console though, so there maybe some way to access that via a serial cable of some sorts. From what I read it appears that there is a voltage discrepancy of sorts.
The tftpd server works though, it is easy to update the firmware from the command line:
echo -e "binary\nrexmt 1\ntimeout 60\ntrace\nput IS050t-S-00-09-07P.img\n" | tftp 192.168.62.1
Only thing I could find about the CPU was in a patent application:
Patent number: 20040240425
I also found some information in Chinese about the system on chip (SoC):
http://www.dongxindz.cn/dongxindz_Product_1516572.html
Since the SD9148 is a MIPS3000, perhaps it can use the Realtek 8181 sdk?
Also found this here:
Its really lame that a nice board like this, that uses GPL software, was manufactured by a company that never released the source code that they used to generate the firmware. And then they go out of business and its a waste of effort.
After reading the “help” page in the admin pages, it sounded like you can tftp the nvram settings, with the “get nvram_whatever.bin” command, so I tried it, and it worked. The nvram contains all the configuration settings of the router: ip address, username and password, and dhcp settings. Its in binary form, but the settings themselves are in ascii.
Before this post gets too big, I’ve created a new wiki page on the topic: INEXQ IS050t
Related Links:
http://www.e210.cn/views.asp?hw_id=672
http://www.euodeio.net/shortlinux.php
http://www.linux-mips.org/wiki/Realtek_SOC
http://rtl8181.sourceforge.net/
http://www.dongxindz.cn/dongxindz_Product_1516572.html
Note the ram chip is 64Mb (Megabit, not MegaByte). 8MB junker, next!
Good job, looks like a nice little machine…
I made the same mistake that you did and downgraded to the 2003 FW-Version. Cannot find the 2004 FW anywhere on the net.
Any suggestions where to find another working FW ?
Thank you.
Hi Peter! I’m sorry I haven’t touched the router in awhile, not sure….
Hi, great story. I have a ISW054t, and your trick with reading the nvram worked. Nice.
I’m a bit stuck. I found this page while searching for a tip on how to reset the password back to admin/1234. I can’t work aout how to restore factory defaults. Do you have any idea? I read the nvram file and found the ‘admin’ string but it looks like the password is encrypted.
Cheers,
Mike.
Found it :o)
Press and hold the reset button for 10s. I should have guessed.
Interestingly, when I downloaded the nvram again, I saw that the default password 1234 stored in plaintext. Same when I changed it. So I must have been doing something wrong when I copied the password field from the nvram. Anyway, back in working order now.
Mike.
Cool! I was going to suggest maybe re-flashing the nvram with the image that’s still floating around. Glad to hear you are back up and running!
Hi, just posting randomly after stumbling across this page via google (I realize it’s quite old).
Interesting stuff. IIRC I flashed my ISW054t with the ISW054u firmware, which adds a print server (hence the USB port) configurable via the web interface.
It’s a shame the assholes never released any source.
Hey Mov, I totally agree - they should have released the source (and breached the GPL by not doing so).