ipTIME G204

From TechInfoDepot
Jump to navigationJump to search
bg (G54)
wireless router
3rd Party Firmware
dd-wrt
OpenWrt
Incompatible
Tomato any flavor
Incompatible
Platform
BrandModelRev
ipTIME G204
FCC ID
none specified
Type
wireless router
CPU1
Micrel KS8695P
CPU1 Type
ARM922T
CPU1 Speed
166 MHz
Flash1 Chip
Spansion S29AL016D70TFI02
Flash1 Size
2 MiB2,097,152 B <br />16,384 Kib <br />2,048 KiB <br />16 Mib <br />0.00195 GiB <br />
RAM1 Size
16 MiB16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br />
RAM1 Chip
Brand? Model?
ETH chip1
Micrel KS8695P
Switch
Micrel KS8695P
Ethernet Port Count
1-100MbE-WAN
4-100MbE-LAN
Wired Standard
IEEE 802.3i/3u

802dot11 OUI: 00:08:9F (-, 1 W)
Ethernet OUI: 00:08:9F (-, 1 W)

Stock FW OS
Linux 2.4.19-rmk4
Expansion IF types
none specified
Power
7.5 VDC, 1.5 A
Connector type
barrel
Serial Port (UART)
yes, (38400 8N1)
Flags:
boot log
Other

Default SSID: iptime (1 addl. devices)
Default IP address: 192.168.0.1
the IP 192.168.0.1 is used by 793 additional devices
of which 1 are ipTIME devices

Manuf/OEM/ODM
Zioncom IP0477.B
Retail
Country of manuf China
Radio 1
Chip1
Ralink RT2561S
Chip2
Ralink RT2527
Wireless interface OUI
00:08:9F
Antenna Connector Type
RP-SMA
Wireless Standard
IEEE 802.11b/g
802.11g
up to 54 Mbps
802.11b
up to 11 Mbps
WiFi Operating Frequency
2.4 GHz

For a list of all currently documented Micrel (Kendin) chipsets with specifications, see Micrel.
For a list of all currently documented Ralink chipsets with specifications, see Ralink.

For a list of all currently documented ipTIME device with specifications, see ipTIME.

54 Mbps - 2.4GHz 802.11g = G54 class

Overview

"ZC-IP0477.B" is on the board.

Review on kbench.com

specifies processor as ARM9 based @ 166MHz

The device is using 2.4.19-rmk4 - an ARM kernel released 2002-08-25.

The SoC used appears to be 22 (labeled A through U) x 17 (individually marked numbers) in a PBGA package.

It is presumed to be a Micrel KS8695P.. .. also relevant.

Info on shell access at kldp.org (KR)

Shell commands can be sent to the device via /cgi-bin/timepro.cgi?flag=bluesky w/ firmware version 5.16.
Older FW versions may use flag=debug instead of bluesky..
FTP access to the device can be attained by running /sbin/ftpd and logging in w/ bin:efm-sw credentials.

JTAG-Serial Info

Serial

Shell info dump

cat /etc/passwd

root::0:0:root::/bin/sh 
nobody::99:0:nobody:/:/bin/sh 
bin::99:0:efm-sw:/bin:/bin/sh 

cat /proc/version

Linux version 2.4.19-rmk4 (nvwl@perrier) (gcc version 2.95.3 20010315 (release)) #7 Tue Jul 24 14:45:58 KST 2007 

cat /proc/cpuinfo

Processor	: ARM/ALTERA Arm922Tid(wb) rev 0 (v4l)
BogoMIPS	: 83.14
Features	: swp half thumb 

Hardware	: Micrel-KS8695
Revision	: 0000
Serial		: 0000000000000000

cat /proc/pci

PCI devices found:
  Bus  0, device   0, function  0:
    Host bridge: PCI device 16c6:8695 (rev 0).
      IRQ 2.
      Master Capable.  Latency=32.  
      Non-prefetchable 32 bit memory at 0x60000000 [0x63ffffff].
  Bus  0, device   5, function  0:
    Network controller: PCI device 1814:0301 (rev 0).
      IRQ 2.
      Master Capable.  Latency=32.  
      Non-prefetchable 32 bit memory at 0x64000000 [0x64007fff].

cat /proc/mtd

dev: size erasesize name 
mtd0: 00200000 00010000 "Physically mapped flash" 
mtd1: 00020000 00010000 "savefs" 

cat /proc/meminfo

        total:    used:    free:  shared: buffers:  cached:
Mem:  15101952 13111296  1990656        0   208896  6774784
Swap:        0        0        0
MemTotal:        14748 kB
MemFree:          1944 kB
MemShared:           0 kB
Buffers:           204 kB
Cached:           6616 kB
SwapCached:          0 kB
Active:           1700 kB
Inactive:         6968 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:        14748 kB
LowFree:          1944 kB
SwapTotal:           0 kB
SwapFree:            0 kB

cat /proc/ksyms

c1ac78e4 ppp_mppe_cleanup	[ppp_mppe]
c1ac78c8 ppp_mppe_init	[ppp_mppe]
c1ac9c64 SHA1_Init	[ppp_mppe]
c1ac9d74 SHA1_Final	[ppp_mppe]
c1ac9e70 arcfour_setkey	[ppp_mppe]
c1ac9ff0 ppp_mppe	[ppp_mppe]
c1ac9cb4 SHA1_Update	[ppp_mppe]
c1ac9f10 arcfour_encrypt	[ppp_mppe]
c1a5ac24 next_key	[rt61ap]
c1a63244 ApStartUp	[rt61ap]
c1a4f700 RTMPSetLED	[rt61ap]
c1a42134 AuthStateMachineInit	[rt61ap]
c1a67630 NUM_OF_5225_CHNL_1	[rt61ap]
c1a5e54c CountGTK	[rt61ap]
c1a38e08 AsicResetBbpTuning	[rt61ap]
c1a560a4 RTMPIoctlStatistics	[rt61ap]
c1a676b4 A_BAND_REGION_2_CHANNEL_LIST	[rt61ap]
c1a5afac WpaStateMachineInit	[rt61ap]
c1a5ed80 RTMPMakeRSNIE	[rt61ap]
c1a3fefc getCfgWmmCapable	[rt61ap]
c1a5298c Set_TxRate_Proc	[rt61ap]
c1a64a7c ApUpdateAccessControlList	[rt61ap]
c1a6d840 try_mac_list	[rt61ap]
c1a593c4 ShiftOutBits	[rt61ap]
c1a5d5f0 WPAHardTransmit	[rt61ap]
c1a4f84c RTMPBuildDesireRate	[rt61ap]
c1a3a870 AsicSetRxAnt	[rt61ap]
c1a39cf8 BssTableInit	[rt61ap]
c1a58e14 ATEAsicSwitchChannel	[rt61ap]
c1a5b568 WpaEAPPacketAction	[rt61ap]
c1a5abf8 xor_128	[rt61ap]
c1a52d6c Set_TxBurst_Proc	[rt61ap]
c1a5e05c GREKEYPeriodicExec	[rt61ap]
c1a335e4 macauth_add_trylist	[rt61ap]
c1a4a94c NICInitTxRxRingAndBacklogQueue	[rt61ap]
c1a52c44 Set_TxAntenna_Proc	[rt61ap]
c1a3ff38 getCfgAPAifsn	[rt61ap]
c1a5854c Set_ATE_SA_Proc	[rt61ap]
c1a3c800 MlmeRadioOn	[rt61ap]
c1a595f8 RTMP_EEPROM_READ16	[rt61ap]
c1a42194 MlmeDeauthReqAction	[rt61ap]
c1a4e3a8 NICLoadFirmware	[rt61ap]
c1a403a0 getCfgNoForwarding	[rt61ap]
c1a679a0 BBPRegTable	[rt61ap]
c1a58b1c Set_ATE_TX_FREQOFFSET_Proc	[rt61ap]
c1a5861c Set_ATE_BSSID_Proc	[rt61ap]
c1a678d8 SNAP_AIRONET	[rt61ap]
c1a52b20 Set_DtimPeriod_Proc	[rt61ap]
c1a65938 PeerDlsTearDownAction	[rt61ap]
c1a361c8 MlmeQueueDestroy	[rt61ap]
c1a67014 RateIdTo500Kbps	[rt61ap]
c1a325d4 RT61_open	[rt61ap]
c1a50638 ChannelSanity	[rt61ap]
c1a40058 getCfgAPTxop	[rt61ap]
c1a543c8 Set_AccessControlList_Proc	[rt61ap]
c1a5478c Set_dfstest_Proc	[rt61ap]
c1a33344 RT61_get_ether_stats	[rt61ap]
c1a3f970 ConvertToRssi	[rt61ap]
c1a58d58 Set_ATE_TX_COUNT_Proc	[rt61ap]
c1a52e2c Set_WmmCapable_Proc	[rt61ap]
c1a538e4 Set_Key2_Proc	[rt61ap]
c1a513f0 PeerDlsReqSanity	[rt61ap]
c1a62fd0 F	[rt61ap]
c1a36480 LfsrInit	[rt61ap]
c1a4f07c NdisFillMemory	[rt61ap]
c1a39a0c AsicAddPairwiseKeyEntry	[rt61ap]
c1a63e18 MacTableReset	[rt61ap]
c1a3da88 ScanTimeout	[rt61ap]
c1a52f14 Set_HideSSID_Proc	[rt61ap]
c1a4053c getCfgAuthMode	[rt61ap]
c1a3329c rt_abs	[rt61ap]
c1a5a78c RTMPSoftDecryptAES	[rt61ap]
c1a4f6d8 RTMPAddTimer	[rt61ap]
c1a38d4c AsicSetSlotTime	[rt61ap]
c1a38ae0 AsicEnableBssSync	[rt61ap]
c1a676ed A_BAND_REGION_9_CHANNEL_LIST	[rt61ap]
c1a401f4 getCfgBSSCwmax	[rt61ap]
c1a4a35c RTMPAllocDMAMemory	[rt61ap]
c1a41bd4 Cls3errAction	[rt61ap]
c1a32f84 VirtualIF_close	[rt61ap]
c1a52b9c Set_OLBCDetection_Proc	[rt61ap]
c1a59cdc rotr1	[rt61ap]
c1a5f5d4 hmac_md5	[rt61ap]
c1a3fdb8 getCfgDisableOLBC	[rt61ap]
c1a5cf9c Wpa1PeerPairMsg4Action	[rt61ap]
c1a58dc4 Set_ATE_RX_FER_Proc	[rt61ap]
c1a41a80 PeerDisassocReqAction	[rt61ap]
c1a5159c RTMPEncryptData	[rt61ap]
c1a545d8 Set_WPAPSK_Proc	[rt61ap]
c1a51800 RTMP_CALC_FCS32	[rt61ap]
c1a5f42c RTMPSearchPMKIDCache	[rt61ap]
c1a5f830 MD5Final	[rt61ap]
c1a52a50 Set_Channel_Proc	[rt61ap]
c1a549e8 Set_SiteSurvey_Proc	[rt61ap]
c1a35df0 MlmeEnqueue	[rt61ap]
c1a676e9 A_BAND_REGION_8_CHANNEL_LIST	[rt61ap]
c1a48aac RTMPCalcDuration	[rt61ap]
c1a52fb4 Set_IEEE8021X_Proc	[rt61ap]
c1a530c4 Set_VLANID_Proc	[rt61ap]
c1a596a4 RTMP_EEPROM_WRITE16	[rt61ap]
c1a6db44 Rtmp_Irq_Lock	[rt61ap]
c1a67ac4 WPA_OUI	[rt61ap]
c1a52d34 Set_TxQueueSize_Proc	[rt61ap]
c1a5f1e8 RTMPAddPMKIDCache	[rt61ap]
c1a40340 getCfgAckPolicy	[rt61ap]
c1a519f0 RTMPQueryInformation	[rt61ap]
c1a39bf8 AsicSendCommandToMcu	[rt61ap]
c1a3fddc getCfgBGProtection	[rt61ap]
c1a630d8 PasswordHash	[rt61ap]
c1a3998c AsicRemoveSharedKeyEntry	[rt61ap]
c1a322c8 RT61_Init_MSSID	[rt61ap]
c1a3bef0 RadarDetectPeriodic	[rt61ap]
c1a52678 Set_DriverVersion_Proc	[rt61ap]
c1a491c4 RTMPUpdateTupleCache	[rt61ap]
c1a3c788 MlmeRadioOff	[rt61ap]
c1a39d94 BssTableDeleteEntry	[rt61ap]
c1a5d210 Wpa2PeerPairMsg4Action	[rt61ap]

cat /proc/cmdline

console=ttyAM0

Serial

Pinout

(GND) (TX) (RX) [???] -> LED section, antennas, RT2561S, etc

Boot log




Check Firmware CRC =======> [OK]


Uncompressing Linux.................................................................done.
Transferring kernel ...complete
Transferring initrd ...complete
Transferring parms ...complete
Transferring control! ---------> Booting
Stage 2 flash detecting...................
Flash detecting(BUS:16bit,TYPE:16bit)... detected
 Amd/Fujitsu Extended Query Table v1.0 at 0x0040
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
NET4: Ethernet Bridge 008 for NET4.0
alias:g204 version:5.16
Restore Default
insmod: /lib/modules/2.4.19-rmk4: No such file or directory
insmod: bridge.o: no module by that name found
Bridge Init


=========================================
RALINK WIRELESS MODULE DETECTED!!
=========================================


AsicAntennaSelect(ch=6) - Tx=Ant-A, Rx=Ant-A
Check EEPROM contents .. [OK]



=================================================================
press magic key to change default setting ...
  LAN MAC : 00:08:9F:62:57:94
  WAN MAC : 00:08:9F:63:57:94
PPTP Server Start!!
insmod: /lib/modules/2.4.19-rmk4: No such file or directory
gzip: /etc/messages.gz: No such file or directory
copy_file:/etc/messages not found
Check Firmware Integrity ........ - size : 256
[OK]
Please press Enter to activate this console. => AUTH : 4:23:30