D-Link DAP-1155 B1 - teardown and hardware review

D-Link DAP-1155 B1 Wireless router - frontal viewAbout

Some time ago I bought this wireless device at local supermarket. Mostly because of it's price (it was on big sale for only €6.50). The plan was to upgrade it with custom firmware (OpenWrt) and find out if it is suitable for my Internet of Things (IoT) projects.

It appears that this device is based on Realtek RTL8196C system-on-chip, which is not officially supported by OpenWrt. But I found there is individual successful attempt to build OpenWrt for RTL8196C - https://git.nprove.in/rtl819xx/ (link currently dead).

Finally after several attempts I succeed building OpenWrt firmware for the DAP-1155 router. Additionally I made some useful hardware modifications.

Overview

Model name: DAP-1155
Part number RAP1155B1B...B1E
H/W:B1 F/W:1.0.0

The DAP-1155 device is a wireless access point supporting the router mode.

Specifications

  • WAN Interface: One 10/100BASE-TX Ethernet port
  • LAN Interface: One 10/100BASE-TX Ethernet port
  • WLAN Interface: IEEE 802.11n (up to 150Mbps),  IEEE 802.11b/g
  • Antenna: detachable (Reverse SMA).
  • LEDs: Power, WLAN, WPS, LAN, Internet
  • Overall dimensions (without antenna): approximately 110x90x30mm
  • Power requirements: 12V, 0.5A

 

D-Link DAP-1155 B1 bottom viewD-Link DAP-1155 B1 rear view
Click to view close-up of the label

Quick disassembly instructions

  • Remove the warranty label.
  • Unscrew the hex nut from the RP-SMA antenna connector and remove the star washer.
  • Remove 4 soft rubber feet from the bottom and unscrew 4 screws.
  • Semi-open the case from the rear side and remove the PCB. (Opening the case too wide can break the soft front shield)

PCB

PCB size is 85x75mm.

D-Link DAP-1155 B1 PCB top view D-Link DAP-1155 B1 PCB bottom view
Click to view large image

Hardware specification

  • Realtek RTL8196C
    System-on-a-Chip (SoC) with embedded RLX4181 RISC CPU and a basic L2 5-port Ethernet switch.
  • Realtek RTL8188RE
    Wireless LAN (WLAN) interface controller compatible with the 802.11n specification.
  • EtronTech EM63A165TS-6G
    16M x 16bit (32MB) Synchronous DRAM (SDRAM), clock rate 166MHz
  • Winbond 25Q32BV
    4MB SPI flash

Serial port

Serial port 4-pin header (unpopulated) is located between flash memory chip and WPS/Reset button (marked "J15"). Serial port operates at TTL levels. The pinout is the following:

D-Link DAP-1155 B1 serial port pinout

COM port settings:

Bits per second: 38400
Data bits: 8
Stop bits: 1
Parity: None
Flow control: None

OEM boot log

========== SPI =============
SDRAM CLOCK:156MHZ
 ------------------------- Force into Single IO Mode ------------------------
|No chipID  Sft chipSize blkSize secSize pageSize sdCk opCk      chipName    |
| 0 ef4016h  0h  400000h  10000h   1000h     100h  104   39            W25Q32|
 ----------------------------------------------------------------------------
 
---RealTek(RTL8196C)at 2012.06.29-11:17+0000 version v1.2 [16bit](390MHz)
no sys signature at 00010000!
no sys signature at 00020000!
Jump to image start=0x80500000...
decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
start address: 0x80003600
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 27052k/32768k available (2497k kernel code, 5716k reserved, 472k data, 108k init, 0k highmem)
Calibrating delay loop... 389.12 BogoMIPS (lpj=1945600)
Mount-cache hash table entries: 512
net_namespace: 524 bytes
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 52
io scheduler noop registered
io scheduler cfq registered (default)
Realtek GPIO Driver for Flash Reload Default
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x18002000 (irq = 23) is a 16550A
PPP generic driver version 2.4.2
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
RTL8192C/RTL8188C driver version 1.4 (2010-12-22)
=====>>INSIDE rtl8192cd_init_one <<=====
96C - 40MHz Clock Source
vendor_deivce_id=819110ec
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====


Probing RTL8186 10/100 NIC-kenel stack size order[3]...
chip name: 8196C, chip revid: 4
  Set 8196C PHY Patch OK
NOT YET
Set threshould idx 0
eth0 added. vid=9 Member port 0x10...
eth1 added. vid=8 Member port 0x108...
eth2 added. vid=9 Member port 0x8...
eth3 added. vid=9 Member port 0x4...
eth4 added. vid=9 Member port 0x2...
[peth0] added, mapping to [eth1]...
SPI INIT
flash device: 0x400000 at 0xbfe00000
 ========================= Registed SPI Flash Model =========================
|No chipID  Sft chipSize blkSize secSize pageSize sdCk opCk      chipName    |
| 0 ef4016h  0h  400000h  10000h   1000h     100h  104    0            W25Q32|
 ============================================================================
SPI flash(W25Q32) was found at CS0, size 0x400000
flash_bank_1: squashfs filesystem found at offset 0x120000
Creating 7 MTD partitions on "flash_bank_1":
0x000000000000-0x000000010000 : "boot"
0x000000010000-0x000000020000 : "MAC"
0x000000020000-0x000000030000 : "config"
0x000000030000-0x000000130000 : "kernel"
0x000000120000-0x000000400000 : "rootfs"
0x000000030000-0x000000400000 : "Linux"
0x000000000000-0x000000400000 : "ALL"
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (512 buckets, 2048 max)
ctnetlink v0.93: registering with nfnetlink.
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 17
Bridge firewalling registered
Ebtables v2.0 registered
Netlink[Kernel] create socket for igmp ok.
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 108k freed
D-link init started
Readind config from flash...
load section
result read config from flash is 2
Use /etc/config.default
Lenght of avalible memory for title 142 bytes
environ TERM=vt100
environ HOME=/
environ PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/sbin
environ LD_LIBRARY_PATH=/lib:/lib/private:/usr/lib
environ SHELL=/bin/sh
environ USER=root
resident starting...
count_detected_rpc = 82
  1. rpc -   0, type -  2, flags - 0x0000, glocks - 0x0000, version -   0,  soname - "somovd", fname - "InternalAction"
  2. rpc -  88, type -  3, flags - 0x0002, glocks - 0x0000, version -   1,  soname - "/lib/private/libcommon.so", fname - "SetProxyAddr"
  3. rpc -  19, type -  3, flags - 0x0002, glocks - 0x0000, version -   1,  soname - "/lib/private/libcommon.so", fname - "GetConfigStatus"
  4. rpc -   6, type -  3, flags - 0x0000, glocks - 0x0000, version -   1,  soname - "/lib/private/libcommon.so", fname - "Reboot"
  5. rpc -  25, type -  3, flags - 0x0001, glocks - 0x0000, version -   1,  soname - "/lib/private/libcommon.so", fname - "DataUpload"
  6. rpc -  26, type -  3, flags - 0x0000, glocks - 0x0000, version -   1,  soname - "/lib/private/libcommon.so", fname - "DataDownload"
  7. rpc -  46, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libcommon.so", fname - "conf_arp"
  8. rpc - 145, type -  4, flags - 0x0000, glocks - 0x0000, version -   3,  soname - "/lib/private/libcommon.so", fname - "conf_ping"
  9. rpc - 163, type -  4, flags - 0x0000, glocks - 0x0000, version -   3,  soname - "/lib/private/libcommon.so", fname - "salt_conf"
 10. rpc - 166, type -  4, flags - 0x0000, glocks - 0x0000, version -   3,  soname - "/lib/private/libcommon.so", fname - "conf_traceroute"
 11. rpc -  33, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libcommon.so", fname - "route_table"
 12. rpc - 143, type -  4, flags - 0x0000, glocks - 0x0000, version -   3,  soname - "/lib/private/libcommon.so", fname - "conf_web_profiles"
 13. rpc -   8, type -  3, flags - 0x0000, glocks - 0x0000, version -   1,  soname - "/lib/private/libconfig.so", fname - "SaveAndReboot"
 14. rpc -  20, type -  3, flags - 0x0000, glocks - 0x0000, version -   1,  soname - "/lib/private/libconfig.so", fname - "save_config"
 15. rpc -   9, type -  3, flags - 0x0000, glocks - 0x0000, version -   1,  soname - "/lib/private/libconfig.so", fname - "ResetToDefault"
 16. rpc -  10, type -  3, flags - 0x0000, glocks - 0x0000, version -   1,  soname - "/lib/private/libconfig.so", fname - "ResetAndReboot"
 17. rpc -  11, type -  3, flags - 0x0000, glocks - 0x0000, version -   1,  soname - "/lib/private/libconfig.so", fname - "RestoreConfig"
 18. rpc -  98, type -  3, flags - 0x0000, glocks - 0x0000, version -   1,  soname - "/lib/private/libconfig.so", fname - "RestoreConfigFile"
 19. rpc -  12, type -  3, flags - 0x0000, glocks - 0x0000, version -   1,  soname - "/lib/private/libconfig.so", fname - "BackupConfig"
 20. rpc -  93, type -  3, flags - 0x0000, glocks - 0x0000, version -   1,  soname - "/lib/private/libconfig.so", fname - "BackupConfigFile"
 21. rpc -  13, type -  3, flags - 0x0001, glocks - 0x0000, version -   2,  soname - "/lib/private/libconfig.so", fname - "FirmwareUpload"
 22. rpc -  14, type -  3, flags - 0x0001, glocks - 0x0000, version -   1,  soname - "/lib/private/libconfig.so", fname - "FirmwareUpdate"
 23. rpc -  40, type -  3, flags - 0x0001, glocks - 0x0000, version -   1,  soname - "/lib/private/libconfig.so", fname - "FirmwareRemoteUpdate"
 24. rpc -  38, type -  3, flags - 0x0000, glocks - 0x0000, version -   1,  soname - "/lib/private/libconfig.so", fname - "CheckDefaultPass"
 25. rpc -  41, type -  3, flags - 0x0002, glocks - 0x0000, version -   1,  soname - "/lib/private/libconfig.so", fname - "CheckDefaultConf"
 26. rpc -  34, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "dhcp_leases"
 27. rpc -   1, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wan_conf"
 28. rpc - 161, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wan_conf"
 29. rpc -  28, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wan_conf"
 30. rpc -   6, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "ddns_conf"
 31. rpc -   7, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "dns_conf"
 32. rpc -  10, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "vservers_conf"
 33. rpc -  16, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "vservers_conf"
 34. rpc -  23, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "vservers_conf"
 35. rpc -  17, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "routing_conf"
 36. rpc -  35, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 37. rpc -  36, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 38. rpc -  37, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 39. rpc -  38, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 40. rpc -  39, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 41. rpc -  40, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 42. rpc -  41, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 43. rpc -  42, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 44. rpc -  44, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 45. rpc - 105, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 46. rpc - 106, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 47. rpc - 107, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 48. rpc - 158, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 49. rpc - 159, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 50. rpc - 160, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 51. rpc -  64, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 52. rpc - 108, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 53. rpc - 109, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 54. rpc - 110, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 55. rpc - 111, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 56. rpc - 133, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wifi_conf"
 57. rpc -  72, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "urlfilter_conf"
 58. rpc -  71, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "urlfilter_conf"
 59. rpc -  60, type -  4, flags - 0x0002, glocks - 0x0000, version -   1,  soname - "/lib/private/libconfig.so", fname - "apprules_conf"
 60. rpc -  68, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "igmp_conf"
 61. rpc -  66, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "upnp_conf"
 62. rpc -  67, type -  4, flags - 0x0002, glocks - 0x0000, version -   1,  soname - "/lib/private/libconfig.so", fname - "dev_info_conf"
 63. rpc - 148, type -  4, flags - 0x0000, glocks - 0x0000, version -   1,  soname - "/lib/private/libconfig.so", fname - "dev_info_conf"
 64. rpc -  73, type -  4, flags - 0x0002, glocks - 0x0000, version -   1,  soname - "/lib/private/libconfig.so", fname - "scheduler_conf"
 65. rpc -  74, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "macfilter_conf"
 66. rpc -  69, type -  4, flags - 0x0000, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "pass_conf"
 67. rpc - 112, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "device_params_conf"
 68. rpc - 171, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "device_params_conf"
 69. rpc -  87, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "get_ifaces_name"
 70. rpc -  88, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "conf_ipfilter"
 71. rpc - 104, type -  4, flags - 0x0000, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "stats"
 72. rpc - 119, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "vlan_conf"
 73. rpc - 120, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wan_ifaces_list"
 74. rpc -  62, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "set_default_route"
 75. rpc - 121, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wan_ifaces_list"
 76. rpc - 122, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "wan_conf"
 77. rpc - 103, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "ifaces_stats"
 78. rpc -  65, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "ntpclient_conf"
 79. rpc - 130, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "conf_log"
 80. rpc -  63, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "conf_log"
 81. rpc - 129, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "get_port_status"
 82. rpc - 152, type -  4, flags - 0x0002, glocks - 0x0000, version -   3,  soname - "/lib/private/libconfig.so", fname - "conf_telnetd"
Event pipe size is 4096 bytes
Initializing device...
watchdog: child process
===INIT_DEVICE===
init_device: parent process, wait child
Check SSID
Do preinit ifaces
Error ioctl
Set mac 2C:AB:XX:XX:XX:XX on iface eth0 - OK
Sedevice eth1 entered promiscuous mode
t macdevice eth0 entered promiscuous mode
 2C:AB:XX:XX:XX:XX on iface eth1 - OK
device_mode: ap
adddevice wlan0 entered promiscuous mode
 to device wlan0-vxd entered promiscuous mode
br0-------> Set MIB from /etc/Wireless/RTL8192CD.dat
 eth1
<------- Set MIB from /etc/Wireless/RTL8192CD.dat Success
add to br[PHY_ConfigMACWithParaFile][MACPHY_REG_92C]
===> Load_92C_Firmware
<=== Load_92C_Firmware
0 eth0
Do clear ifaces
set mac 2C:AB:XX:XX:XX:XX on br0
set mac 2C:AB:XX:XX:XX:XX on eth1
Have lan_array
init_lan: iface = br0
start_ip: static ipv4
init macfilter
start services
start_telnet...
Out init_device
init_device:  pid_status(WEXITSTATUS) = 0
route: ioctl 0x890b failed: Network is down
route: ioctl 0xGPIO resident_pid=13
890c failed: No such process
Done.
br0: port 3(wlan0) entering learning state
br0: port 2(eth0) entering learning state
br0: port 1(eth1) entering learning state
br0: port 3(wlan0) entering forwarding state
br0: port 2(eth0) entering forwarding state
br0: port 1(eth1) entering forwarding state
Welcome to
     _______          ___     __  ____   _  _   ___
    |  ___  \        |   |   |__||    \ | || | /  /
    | |   | ||  ___  |   |__  __ |     \| || |/  /
    | |___| || |___| |      ||  || |\     ||     \
    |_______/        |______||__||_| \____||_|\___\

                     = Building Networks for People =

D-link init done


BusyBox v1.19.2 (2012-07-09 11:08:50 MSK) built-in shell (ash)
Enter 'help' for a list of built-in commands.

#
# 
[                 gzip              login             rm
[[                halt              logread           rmmod
arptables         hexdump           ls                route
ash               httpd             lsmod             sh
auth              iapp              lspci             sleep
basename          ifconfig          lsusb             syslogd
brctl             igmpproxy         md5sum            tail
busybox           inetd             mfc               tar
cat               init              miniupnpd         telnetd
cp                insmod            modprobe          test
crond             ip                mount             timeout
crontab           iptables          mtd_write         top
date              iptables-multi    nc                touch
dcd               iptables-restore  notify_all        traceroute
dcfg              iptables-save     ntpd              true
dd                iptables-xml      passwd            udhcpc
dnsmasq           iwconfig          ping              umount
drop_caches       iwcontrol         ping6             unzip
ebtables          iwlist            poweroff          urlfilterd
echo              iwpriv            pppd              vconfig
event             kill              pptp              volname
ez-ipupdate       killall           ps                wscd
false             klogd             reboot            zcat
free              l2tpd             resident          zebra
grep              ln                resident_cli
gunzip            logger            ripd
#

 

Bootloader console

To enter bootloader console keep WPS/Reset button pressed while powering on the device. The unidentified proprietary bootloader is installed on this router.

---Escape booting by user
Set 8196C PHY Patch OK

---Ethernet init Okay!
<RealTek>?
----------------- COMMAND MODE HELP ------------------
HELP (?)                                    : Print this help message
D <Address> <Len>
DB <Address> <Len>
DW <Address> <Len>
EW <Address> <Value1> <Value2>...
EB <Address> <Value1> <Value2>...
CMP: CMP <dst><src><length>
IPCONFIG:<TargetAddress>
AUTOBURN: 0/1
LOADADDR: <Load Address>
J: Jump to <TargetAddress>
FLW <dst_ROM_offset><src_RAM_addr><length_Byte> <SPI cnt#>: Write offset-data to SPI from RAM
<RealTek>

 

References and links

 

Next

Part 2, DAP-1155 - Building and installing OpenWrt (coming soon)

 

Comments

What about Open-WRT?

After original firmware update I can't enter the bootloader anymore. What could be the problem?

Add new comment