D-Link DAP-1155 B1 - teardown and hardware review
About
Some time ago I bought this wireless device at local supermarket. Mostly because of it's price (it was on big sale for only €6.50). The plan was to upgrade it with custom firmware (OpenWrt) and find out if it is suitable for my Internet of Things (IoT) projects.
It appears that this device is based on Realtek RTL8196C system-on-chip, which is not officially supported by OpenWrt. But I found there is individual successful attempt to build OpenWrt for RTL8196C - https://git.nprove.in/rtl819xx/ (link currently dead).
Finally after several attempts I succeed building OpenWrt firmware for the DAP-1155 router. Additionally I made some useful hardware modifications.
Overview
Model name: DAP-1155
Part number RAP1155B1B...B1E
H/W:B1 F/W:1.0.0
The DAP-1155 device is a wireless access point supporting the router mode.
Specifications
- WAN Interface: One 10/100BASE-TX Ethernet port
- LAN Interface: One 10/100BASE-TX Ethernet port
- WLAN Interface: IEEE 802.11n (up to 150Mbps), IEEE 802.11b/g
- Antenna: detachable (Reverse SMA).
- LEDs: Power, WLAN, WPS, LAN, Internet
- Overall dimensions (without antenna): approximately 110x90x30mm
- Power requirements: 12V, 0.5A
Click to view close-up of the label
Quick disassembly instructions
- Remove the warranty label.
- Unscrew the hex nut from the RP-SMA antenna connector and remove the star washer.
- Remove 4 soft rubber feet from the bottom and unscrew 4 screws.
- Semi-open the case from the rear side and remove the PCB. (Opening the case too wide can break the soft front shield)
PCB
PCB size is 85x75mm.
Hardware specification
- Realtek RTL8196C
System-on-a-Chip (SoC) with embedded RLX4181 RISC CPU and a basic L2 5-port Ethernet switch. - Realtek RTL8188RE
Wireless LAN (WLAN) interface controller compatible with the 802.11n specification. - EtronTech EM63A165TS-6G
16M x 16bit (32MB) Synchronous DRAM (SDRAM), clock rate 166MHz - Winbond 25Q32BV
4MB SPI flash
Serial port
Serial port 4-pin header (unpopulated) is located between flash memory chip and WPS/Reset button (marked "J15"). Serial port operates at TTL levels. The pinout is the following:
COM port settings:
Bits per second: 38400
Data bits: 8
Stop bits: 1
Parity: None
Flow control: None
OEM boot log
========== SPI ============= SDRAM CLOCK:156MHZ ------------------------- Force into Single IO Mode ------------------------ |No chipID Sft chipSize blkSize secSize pageSize sdCk opCk chipName | | 0 ef4016h 0h 400000h 10000h 1000h 100h 104 39 W25Q32| ---------------------------------------------------------------------------- ---RealTek(RTL8196C)at 2012.06.29-11:17+0000 version v1.2 [16bit](390MHz) no sys signature at 00010000! no sys signature at 00020000! Jump to image start=0x80500000... decompressing kernel: Uncompressing Linux... done, booting the kernel. done decompressing kernel. start address: 0x80003600 Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Memory: 27052k/32768k available (2497k kernel code, 5716k reserved, 472k data, 108k init, 0k highmem) Calibrating delay loop... 389.12 BogoMIPS (lpj=1945600) Mount-cache hash table entries: 512 net_namespace: 524 bytes NET: Registered protocol family 16 bio: create slab <bio-0> at 0 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered NET: Registered protocol family 1 squashfs: version 4.0 (2009/01/31) Phillip Lougher msgmni has been set to 52 io scheduler noop registered io scheduler cfq registered (default) Realtek GPIO Driver for Flash Reload Default Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x18002000 (irq = 23) is a 16550A PPP generic driver version 2.4.2 MPPE/MPPC encryption/compression module registered NET: Registered protocol family 24 RTL8192C/RTL8188C driver version 1.4 (2010-12-22) =====>>INSIDE rtl8192cd_init_one <<===== 96C - 40MHz Clock Source vendor_deivce_id=819110ec =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== =====>>INSIDE rtl8192cd_init_one <<===== =====>>EXIT rtl8192cd_init_one <<===== Probing RTL8186 10/100 NIC-kenel stack size order[3]... chip name: 8196C, chip revid: 4 Set 8196C PHY Patch OK NOT YET Set threshould idx 0 eth0 added. vid=9 Member port 0x10... eth1 added. vid=8 Member port 0x108... eth2 added. vid=9 Member port 0x8... eth3 added. vid=9 Member port 0x4... eth4 added. vid=9 Member port 0x2... [peth0] added, mapping to [eth1]... SPI INIT flash device: 0x400000 at 0xbfe00000 ========================= Registed SPI Flash Model ========================= |No chipID Sft chipSize blkSize secSize pageSize sdCk opCk chipName | | 0 ef4016h 0h 400000h 10000h 1000h 100h 104 0 W25Q32| ============================================================================ SPI flash(W25Q32) was found at CS0, size 0x400000 flash_bank_1: squashfs filesystem found at offset 0x120000 Creating 7 MTD partitions on "flash_bank_1": 0x000000000000-0x000000010000 : "boot" 0x000000010000-0x000000020000 : "MAC" 0x000000020000-0x000000030000 : "config" 0x000000030000-0x000000130000 : "kernel" 0x000000120000-0x000000400000 : "rootfs" 0x000000030000-0x000000400000 : "Linux" 0x000000000000-0x000000400000 : "ALL" Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (512 buckets, 2048 max) ctnetlink v0.93: registering with nfnetlink. ip_tables: (C) 2000-2006 Netfilter Core Team TCP cubic registered NET: Registered protocol family 17 Bridge firewalling registered Ebtables v2.0 registered Netlink[Kernel] create socket for igmp ok. VFS: Mounted root (squashfs filesystem) readonly on device 31:4. Freeing unused kernel memory: 108k freed D-link init started Readind config from flash... load section result read config from flash is 2 Use /etc/config.default Lenght of avalible memory for title 142 bytes environ TERM=vt100 environ HOME=/ environ PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/sbin environ LD_LIBRARY_PATH=/lib:/lib/private:/usr/lib environ SHELL=/bin/sh environ USER=root resident starting... count_detected_rpc = 82 1. rpc - 0, type - 2, flags - 0x0000, glocks - 0x0000, version - 0, soname - "somovd", fname - "InternalAction" 2. rpc - 88, type - 3, flags - 0x0002, glocks - 0x0000, version - 1, soname - "/lib/private/libcommon.so", fname - "SetProxyAddr" 3. rpc - 19, type - 3, flags - 0x0002, glocks - 0x0000, version - 1, soname - "/lib/private/libcommon.so", fname - "GetConfigStatus" 4. rpc - 6, type - 3, flags - 0x0000, glocks - 0x0000, version - 1, soname - "/lib/private/libcommon.so", fname - "Reboot" 5. rpc - 25, type - 3, flags - 0x0001, glocks - 0x0000, version - 1, soname - "/lib/private/libcommon.so", fname - "DataUpload" 6. rpc - 26, type - 3, flags - 0x0000, glocks - 0x0000, version - 1, soname - "/lib/private/libcommon.so", fname - "DataDownload" 7. rpc - 46, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libcommon.so", fname - "conf_arp" 8. rpc - 145, type - 4, flags - 0x0000, glocks - 0x0000, version - 3, soname - "/lib/private/libcommon.so", fname - "conf_ping" 9. rpc - 163, type - 4, flags - 0x0000, glocks - 0x0000, version - 3, soname - "/lib/private/libcommon.so", fname - "salt_conf" 10. rpc - 166, type - 4, flags - 0x0000, glocks - 0x0000, version - 3, soname - "/lib/private/libcommon.so", fname - "conf_traceroute" 11. rpc - 33, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libcommon.so", fname - "route_table" 12. rpc - 143, type - 4, flags - 0x0000, glocks - 0x0000, version - 3, soname - "/lib/private/libcommon.so", fname - "conf_web_profiles" 13. rpc - 8, type - 3, flags - 0x0000, glocks - 0x0000, version - 1, soname - "/lib/private/libconfig.so", fname - "SaveAndReboot" 14. rpc - 20, type - 3, flags - 0x0000, glocks - 0x0000, version - 1, soname - "/lib/private/libconfig.so", fname - "save_config" 15. rpc - 9, type - 3, flags - 0x0000, glocks - 0x0000, version - 1, soname - "/lib/private/libconfig.so", fname - "ResetToDefault" 16. rpc - 10, type - 3, flags - 0x0000, glocks - 0x0000, version - 1, soname - "/lib/private/libconfig.so", fname - "ResetAndReboot" 17. rpc - 11, type - 3, flags - 0x0000, glocks - 0x0000, version - 1, soname - "/lib/private/libconfig.so", fname - "RestoreConfig" 18. rpc - 98, type - 3, flags - 0x0000, glocks - 0x0000, version - 1, soname - "/lib/private/libconfig.so", fname - "RestoreConfigFile" 19. rpc - 12, type - 3, flags - 0x0000, glocks - 0x0000, version - 1, soname - "/lib/private/libconfig.so", fname - "BackupConfig" 20. rpc - 93, type - 3, flags - 0x0000, glocks - 0x0000, version - 1, soname - "/lib/private/libconfig.so", fname - "BackupConfigFile" 21. rpc - 13, type - 3, flags - 0x0001, glocks - 0x0000, version - 2, soname - "/lib/private/libconfig.so", fname - "FirmwareUpload" 22. rpc - 14, type - 3, flags - 0x0001, glocks - 0x0000, version - 1, soname - "/lib/private/libconfig.so", fname - "FirmwareUpdate" 23. rpc - 40, type - 3, flags - 0x0001, glocks - 0x0000, version - 1, soname - "/lib/private/libconfig.so", fname - "FirmwareRemoteUpdate" 24. rpc - 38, type - 3, flags - 0x0000, glocks - 0x0000, version - 1, soname - "/lib/private/libconfig.so", fname - "CheckDefaultPass" 25. rpc - 41, type - 3, flags - 0x0002, glocks - 0x0000, version - 1, soname - "/lib/private/libconfig.so", fname - "CheckDefaultConf" 26. rpc - 34, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "dhcp_leases" 27. rpc - 1, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wan_conf" 28. rpc - 161, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wan_conf" 29. rpc - 28, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wan_conf" 30. rpc - 6, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "ddns_conf" 31. rpc - 7, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "dns_conf" 32. rpc - 10, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "vservers_conf" 33. rpc - 16, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "vservers_conf" 34. rpc - 23, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "vservers_conf" 35. rpc - 17, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "routing_conf" 36. rpc - 35, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 37. rpc - 36, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 38. rpc - 37, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 39. rpc - 38, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 40. rpc - 39, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 41. rpc - 40, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 42. rpc - 41, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 43. rpc - 42, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 44. rpc - 44, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 45. rpc - 105, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 46. rpc - 106, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 47. rpc - 107, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 48. rpc - 158, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 49. rpc - 159, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 50. rpc - 160, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 51. rpc - 64, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 52. rpc - 108, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 53. rpc - 109, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 54. rpc - 110, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 55. rpc - 111, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 56. rpc - 133, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wifi_conf" 57. rpc - 72, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "urlfilter_conf" 58. rpc - 71, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "urlfilter_conf" 59. rpc - 60, type - 4, flags - 0x0002, glocks - 0x0000, version - 1, soname - "/lib/private/libconfig.so", fname - "apprules_conf" 60. rpc - 68, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "igmp_conf" 61. rpc - 66, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "upnp_conf" 62. rpc - 67, type - 4, flags - 0x0002, glocks - 0x0000, version - 1, soname - "/lib/private/libconfig.so", fname - "dev_info_conf" 63. rpc - 148, type - 4, flags - 0x0000, glocks - 0x0000, version - 1, soname - "/lib/private/libconfig.so", fname - "dev_info_conf" 64. rpc - 73, type - 4, flags - 0x0002, glocks - 0x0000, version - 1, soname - "/lib/private/libconfig.so", fname - "scheduler_conf" 65. rpc - 74, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "macfilter_conf" 66. rpc - 69, type - 4, flags - 0x0000, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "pass_conf" 67. rpc - 112, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "device_params_conf" 68. rpc - 171, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "device_params_conf" 69. rpc - 87, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "get_ifaces_name" 70. rpc - 88, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "conf_ipfilter" 71. rpc - 104, type - 4, flags - 0x0000, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "stats" 72. rpc - 119, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "vlan_conf" 73. rpc - 120, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wan_ifaces_list" 74. rpc - 62, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "set_default_route" 75. rpc - 121, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wan_ifaces_list" 76. rpc - 122, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "wan_conf" 77. rpc - 103, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "ifaces_stats" 78. rpc - 65, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "ntpclient_conf" 79. rpc - 130, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "conf_log" 80. rpc - 63, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "conf_log" 81. rpc - 129, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "get_port_status" 82. rpc - 152, type - 4, flags - 0x0002, glocks - 0x0000, version - 3, soname - "/lib/private/libconfig.so", fname - "conf_telnetd" Event pipe size is 4096 bytes Initializing device... watchdog: child process ===INIT_DEVICE=== init_device: parent process, wait child Check SSID Do preinit ifaces Error ioctl Set mac 2C:AB:XX:XX:XX:XX on iface eth0 - OK Sedevice eth1 entered promiscuous mode t macdevice eth0 entered promiscuous mode 2C:AB:XX:XX:XX:XX on iface eth1 - OK device_mode: ap adddevice wlan0 entered promiscuous mode to device wlan0-vxd entered promiscuous mode br0-------> Set MIB from /etc/Wireless/RTL8192CD.dat eth1 <------- Set MIB from /etc/Wireless/RTL8192CD.dat Success add to br[PHY_ConfigMACWithParaFile][MACPHY_REG_92C] ===> Load_92C_Firmware <=== Load_92C_Firmware 0 eth0 Do clear ifaces set mac 2C:AB:XX:XX:XX:XX on br0 set mac 2C:AB:XX:XX:XX:XX on eth1 Have lan_array init_lan: iface = br0 start_ip: static ipv4 init macfilter start services start_telnet... Out init_device init_device: pid_status(WEXITSTATUS) = 0 route: ioctl 0x890b failed: Network is down route: ioctl 0xGPIO resident_pid=13 890c failed: No such process Done. br0: port 3(wlan0) entering learning state br0: port 2(eth0) entering learning state br0: port 1(eth1) entering learning state br0: port 3(wlan0) entering forwarding state br0: port 2(eth0) entering forwarding state br0: port 1(eth1) entering forwarding state Welcome to _______ ___ __ ____ _ _ ___ | ___ \ | | |__|| \ | || | / / | | | || ___ | |__ __ | \| || |/ / | |___| || |___| | || || |\ || \ |_______/ |______||__||_| \____||_|\___\ = Building Networks for People = D-link init done BusyBox v1.19.2 (2012-07-09 11:08:50 MSK) built-in shell (ash) Enter 'help' for a list of built-in commands. # # [ gzip login rm [[ halt logread rmmod arptables hexdump ls route ash httpd lsmod sh auth iapp lspci sleep basename ifconfig lsusb syslogd brctl igmpproxy md5sum tail busybox inetd mfc tar cat init miniupnpd telnetd cp insmod modprobe test crond ip mount timeout crontab iptables mtd_write top date iptables-multi nc touch dcd iptables-restore notify_all traceroute dcfg iptables-save ntpd true dd iptables-xml passwd udhcpc dnsmasq iwconfig ping umount drop_caches iwcontrol ping6 unzip ebtables iwlist poweroff urlfilterd echo iwpriv pppd vconfig event kill pptp volname ez-ipupdate killall ps wscd false klogd reboot zcat free l2tpd resident zebra grep ln resident_cli gunzip logger ripd #
Bootloader console
To enter bootloader console keep WPS/Reset button pressed while powering on the device. The unidentified proprietary bootloader is installed on this router.
---Escape booting by user Set 8196C PHY Patch OK ---Ethernet init Okay! <RealTek>? ----------------- COMMAND MODE HELP ------------------ HELP (?) : Print this help message D <Address> <Len> DB <Address> <Len> DW <Address> <Len> EW <Address> <Value1> <Value2>... EB <Address> <Value1> <Value2>... CMP: CMP <dst><src><length> IPCONFIG:<TargetAddress> AUTOBURN: 0/1 LOADADDR: <Load Address> J: Jump to <TargetAddress> FLW <dst_ROM_offset><src_RAM_addr><length_Byte> <SPI cnt#>: Write offset-data to SPI from RAM <RealTek>
References and links
Next
Part 2, DAP-1155 - Building and installing OpenWrt (coming soon)
Comments
Ivan
Tue, 07/07/2015 - 07:51
Permalink
What about Open-WRT?
What about Open-WRT?
Dennis C.
Mon, 08/29/2016 - 08:18
Permalink
After original firmware
After original firmware update I can't enter the bootloader anymore. What could be the problem?
axet
Fri, 11/27/2020 - 07:42
Permalink
openwrt building and
openwrt building and installing coming soon?
Add new comment