Pheenet WAP-654G

From TechInfoDepot
Jump to navigationJump to search
bg (G54)
802.11g 54Mbps High Power AP / Bridge
3rd Party Firmware
Status Unknown
Status Unknown
Tomato any flavor
Status Unknown
Pheenet WAP-654G
none specified
access point, repeater
CPU1 Type
Lexra LX5280
CPU1 Speed
180 MHz
Flash1 Chip
Macronix MX29LV160CBTC-70G
Flash1 Size
2 MiB2,097,152 B <br />16,384 Kib <br />2,048 KiB <br />16 Mib <br />0.00195 GiB <br />
RAM1 Size
16 MiB16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br />
RAM1 Chip
ISSI IS42S16800A-7TL
ETH chip1
Realtek RTL8201CP
Ethernet Port Count

802dot11 OUI: 00:1A:50

Stock bootloader
Stock FW OS
Linux 2.4.18 MIPS-01.00
Expansion IF types
none specified
12 VDC, 1 A
Connector type
Serial Port (UART)
yes, 4-pin header, JPU1
yes, 12-pad header, J1
high power

Default SSID: PheeNet
Default IP address:
the IP is used by 155 additional devices
of which 0 are Pheenet devices
Default login user: admin
Default login password: admin
admin:admin credentials used by 1316 additional devices
of which 0 are Pheenet devices

3rd Party Firmware Support
(Est.) release date 2007
(Est.) initial retail price (in USD): $50
Country of manuf Taiwan
Radio 1
Wireless interface OUI
Antenna Connector Type
Wireless Standard
IEEE 802.11b/g
up to 54 Mbps
up to 11 Mbps
WiFi Operating Frequency
2.4 GHz

For a list of all currently documented Realtek chipsets with specifications, see Realtek.

54 Mbps - 2.4GHz 802.11g = G54 class


See also Pheenet WAP-654GP (int. splitter PoE)

2.2dBi detachable antenna (RP-SMA conn.)

Base Platform: RTL8186 + RL2560 (MIPS R3000 ISA-1) Spec.

Very simple access point with WIFI high output power (200mW)

that allows several wifi modes:
  • AP, WDS, AP + WDS, Client bridged, Ad-hoc
  • AP + Client bridged (aka Universal Repeater)

The original firmware doesn't have Telnet or other remote CLI interface.

It only can be configured via web interface.

It is worth mentioning the web interface doesn't allow to reboot the router,

however there is a hidden page that allows to execute custom commands:


Some useful commands:

  • Change the MAC adresss
    flash set HW_WLAN0_WLAN_ADDR 001122334455
    flash set HW_NIC0_ADDR 001122334455
  • Change the regulatory domain
    flash set HW_WLAN0_REG_DOMAIN 6

Links of Interest

Product page (Old) (New)
Support page


Tested firmwares

Third party firmwares like Wive-NG were successfully tested in this unit.

Version Link Notes
OEM 1.4c WAP-654G(P) doesn't seem to flash via tftp
OEM 1.4b WAP-654G(P), F v1.4b 070228.rar
Wive-NG 0.3.18 wive-ng-0.3.18.tar.7z no web interface
Dlink 1.41-1 modded firmware from Dlink DAP1160A1 GPL

Flash backup

  1. Connect the serial UART Adapter. Also connect the ethernet cable.
  2. Set a static IP on your computer, use (or any compatible)
  3. Press the reset button, don't release it yet
  4. Plug the power cord, and wait 5 seconds
  5. Release the reset button
  6. On the serial console execute the command: flr 80300000 0 200000
  7. On your computer execute: tftp -m binary -c get flash-backup.bin

You should see something like this at the serial console

<RealTek>flr 80300000 0 200000
Flash read from 00000000 to 80300000 with 00200000 bytes ?
(Y)es , (N)o ? --> y
Flash Read Successed!
File Start: 80300000,length=00200000

**TFTP GET File flbackup.bin,Size 00200000 Byte
*TFTP Client Download Success! File Size = 00200000 Bytes


If you bricked the router by flashing a bad firmware follow these steps:

  1. Connect the ethernet cable from your computer to the device.
  2. Set a static IP on your computer, use (or any compatible)
  3. Press the reset button, don't release it yet
  4. Plug the power cord, and wait 5 seconds
  5. Release the reset button
  6. On your computer execute: tftp -m binary -c put valid-firmware.bin

valid-firmware.bin is supposed to be a known firmware working ok on this device


Boot log

UART1 output test ok
Uart init
mfid=000000c2 devid=00002249
Found 1 x 2M flash memory

---RealTek(RTL8186)at 2006.02.20-12:02+0800 version 1.4a [16bit](180MHz)
no sys signature at 00010000!
Jump to image start=0x80350000...
decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
early printk enabled 
Determined physical RAM map:
 memory: 00800000 @ 00000000 (usable)
Initial ramdisk at: 0x80173000 (1843200 bytes)
On node 0 totalpages: 2048
zone(0): 2048 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/ram console=0 ramdisk_start=0 single
Calibrating delay loop... 178.99 BogoMIPS
Memory: 4628k/8192k available (1292k kernel code, 3564k reserved, 
1932k data, 44k init, 0k highmem)
Dentry-cache hash table entries: 1024 (order: 1, 8192 bytes)
Inode-cache hash table entries: 512 (order: 0, 4096 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
check_wait... unavailable.
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Serial driver version 6.02 (2003-03-12) with no serial options enabled
ttyS00 at 0x00c3 (irq = 3) is a rtl_uart1
Realtek GPIO Driver for Flash Reload Default
block: 64 slots per queue, batch=16
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
RealTek E-Flash System Driver. (C) 2002 RealTek Corp.
Found 1 x 2M Byte MXIC MX29LV160AB at 0xbe000000
RTL8185 driver version 1.11 (2006-08-01)
8186NIC Ethernet driver v0.0.5 (Mar 3, 2006)
eth0: RTL8186-NIC at 0xbd200000, 00:01:02:03:04:05, IRQ 4
eth1: RTL8186-NIC at 0xbd300000, 04:05:06:07:08:09, IRQ 5
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
RAMDISK: ext2 filesystem found at block 0
RAMDISK: Loading 1800 blocks [1 disk] into ram disk... done.
Freeing initrd memory: 1800k freed
VFS: Mounted root (ext2 filesystem).
Freeing unused kernel memory: 44k freed
mount /proc file system ok!
serial console detected.  Disabling virtual terminals.
init started:  BusyBox v1.00-pre8 (2005.09.16-02:17+0000) multi-call binary

BusyBox v1.00-pre8 (2005.09.16-02:17+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

Initialize wlan0 interface
killall: syslogd: no process killed
killall: klogd: no process killed
SIOCGIFFLAGS: No such device
bridge br0 doesn't exist; can't delete it
Setup bridge...
device eth0 entered promiscuous mode
eth0:phy is 8201
SIOCDELRT: No such process
device wlan0 entered promiscuous mode
SIOCDELRT: No such process
br0: port 2(wlan0) entering listening state
br0: port 1(eth0) entering listening state
br0: port 2(wlan0) entering learning state
br0: port 2(wlan0) entering forwarding state
br0: topology change detected, propagating
br0: port 1(eth0) entering learning state
br0: port 1(eth0) entering forwarding state
br0: topology change detected, propagating
SIOCDELRT: No such process
SIOCDELRT: No such process
Auto-Discovery (ver 1.01) 
# auth uses obsolete (PF_INET,SOCK_PACKET)
IEEE 802.1x (WPA) daemon, version 1.7b
# cat /proc/version 
Linux version 2.4.18-MIPS-01.00 (root@lnx103) 
(gcc version 3.3.3) #5 Thu Aug 10 13:14:01 CST 2006

# cat /proc/cpuinfo
system type             : Philips Nino
processor               : 0
cpu model               : R3000 V0.0
BogoMIPS                : 178.99
wait instruction        : no
microsecond timers      : no
tlb_entries             : 64
extra interrupt vector  : no
hardware watchpoint     : no
VCED exceptions         : not available
VCEI exceptions         : not available
ll emulations           : 0
sc emulations           : 0


User Images


Power regulators

  • AnaChip AP1506-50 (U9 silkcreened): Main power regulator,12V input, 5V output
  • BS33P (U38 silkcreened): Low dropout regulator, 5V input, 3.3V output
  • BS17P (U10 silkcreened): Low dropout regulator (adjustable), 5V input, 3.1V output
  • BS18P (U8 silkcreened): Low dropout regulator, 5V input, 1.8V output. It runs extremely hot, probably causing unstability problems. It's recommended to install the bigger heat sink as possible.

Wap-654g-power regulators.jpg