ipTIME G204

From TechInfoDepot
Jump to navigationJump to search
bg (G54)
wireless router
3rd Party Firmware
dd-wrt
OpenWrt
Incompatible
Tomato any flavor
Incompatible
Platform
Brand • Model • Rev
ipTIME G204
FCC ID
none specified
Type
wireless router
CPU1
Micrel KS8695P
CPU1 Type
ARM922T
CPU1 Speed
166 MHz
Flash1 Chip
Spansion S29AL016D70TFI02
Flash1 Size
2 MiB2,097,152 B <br />16,384 Kib <br />2,048 KiB <br />16 Mib <br />0.00195 GiB <br />
RAM1 Size
16 MiB16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br />
RAM1 Chip
Brand? Model?
ETH chip1
Micrel KS8695P
Switch
Micrel KS8695P
Ethernet Port Count
1-100MbE-WAN
4-100MbE-LAN
Wired Standard
IEEE 802.3i/3u

802dot11 OUI: 00:08:9F (-, 1 W)
Ethernet OUI: 00:08:9F (-, 1 W)

Stock FW OS
Linux 2.4.19-rmk4
Expansion IF types
none specified
Power
7.5 VDC, 1.5 A
Connector type
barrel
Serial Port (UART)
yes, (38400 8N1)
Flags:
boot log
Other

Default SSID: iptime (1 addl. devices)
Default IP address: 192.168.0.1
the IP 192.168.0.1 is used by 799 additional devices
of which 1 are ipTIME devices

Manuf/OEM/ODM
Zioncom IP0477.B
Retail
Country of manuf China
Radio 1
Chip1
Ralink RT2561S
Chip2
Ralink RT2527
Wireless interface OUI
00:08:9F
Antenna Connector Type
RP-SMA
Wireless Standard
IEEE 802.11b/g
802.11g
up to 54 Mbps
802.11b
up to 11 Mbps
WiFi Operating Frequency
2.4 GHz

For a list of all currently documented Micrel (Kendin) chipsets with specifications, see Micrel.
For a list of all currently documented Ralink chipsets with specifications, see Ralink.

For a list of all currently documented ipTIME device with specifications, see ipTIME.

• 54 Mbps - 2.4GHz 802.11g = G54 class

Overview

"ZC-IP0477.B" is on the board.

Review on kbench.com

specifies processor as ARM9 based @ 166MHz

The device is using 2.4.19-rmk4 - an ARM kernel released 2002-08-25.

The SoC used appears to be 22 (labeled A through U) x 17 (individually marked numbers) in a PBGA package.

It is presumed to be a Micrel KS8695P.. .. also relevant.

Info on shell access at kldp.org (KR)

Shell commands can be sent to the device via /cgi-bin/timepro.cgi?flag=bluesky w/ firmware version 5.16.
Older FW versions may use flag=debug instead of bluesky..
FTP access to the device can be attained by running /sbin/ftpd and logging in w/ bin:efm-sw credentials.

JTAG-Serial Info

Serial

Shell info dump

cat /etc/passwd

root::0:0:root::/bin/sh 
nobody::99:0:nobody:/:/bin/sh 
bin::99:0:efm-sw:/bin:/bin/sh

cat /proc/version

Linux version 2.4.19-rmk4 (nvwl@perrier) (gcc version 2.95.3 20010315 (release)) #7 Tue Jul 24 14:45:58 KST 2007

cat /proc/cpuinfo

Processor	: ARM/ALTERA Arm922Tid(wb) rev 0 (v4l)
BogoMIPS	: 83.14
Features	: swp half thumb 

Hardware	: Micrel-KS8695
Revision	: 0000
Serial		: 0000000000000000

cat /proc/pci

PCI devices found:
  Bus  0, device   0, function  0:
    Host bridge: PCI device 16c6:8695 (rev 0).
      IRQ 2.
      Master Capable.  Latency=32.  
      Non-prefetchable 32 bit memory at 0x60000000 [0x63ffffff].
  Bus  0, device   5, function  0:
    Network controller: PCI device 1814:0301 (rev 0).
      IRQ 2.
      Master Capable.  Latency=32.  
      Non-prefetchable 32 bit memory at 0x64000000 [0x64007fff].

cat /proc/mtd

dev: size erasesize name 
mtd0: 00200000 00010000 "Physically mapped flash" 
mtd1: 00020000 00010000 "savefs"

cat /proc/meminfo

        total:    used:    free:  shared: buffers:  cached:
Mem:  15101952 13111296  1990656        0   208896  6774784
Swap:        0        0        0
MemTotal:        14748 kB
MemFree:          1944 kB
MemShared:           0 kB
Buffers:           204 kB
Cached:           6616 kB
SwapCached:          0 kB
Active:           1700 kB
Inactive:         6968 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:        14748 kB
LowFree:          1944 kB
SwapTotal:           0 kB
SwapFree:            0 kB

cat /proc/ksyms

c1ac78e4 ppp_mppe_cleanup	[ppp_mppe]
c1ac78c8 ppp_mppe_init	[ppp_mppe]
c1ac9c64 SHA1_Init	[ppp_mppe]
c1ac9d74 SHA1_Final	[ppp_mppe]
c1ac9e70 arcfour_setkey	[ppp_mppe]
c1ac9ff0 ppp_mppe	[ppp_mppe]
c1ac9cb4 SHA1_Update	[ppp_mppe]
c1ac9f10 arcfour_encrypt	[ppp_mppe]
c1a5ac24 next_key	[rt61ap]
c1a63244 ApStartUp	[rt61ap]
c1a4f700 RTMPSetLED	[rt61ap]
c1a42134 AuthStateMachineInit	[rt61ap]
c1a67630 NUM_OF_5225_CHNL_1	[rt61ap]
c1a5e54c CountGTK	[rt61ap]
c1a38e08 AsicResetBbpTuning	[rt61ap]
c1a560a4 RTMPIoctlStatistics	[rt61ap]
c1a676b4 A_BAND_REGION_2_CHANNEL_LIST	[rt61ap]
c1a5afac WpaStateMachineInit	[rt61ap]
c1a5ed80 RTMPMakeRSNIE	[rt61ap]
c1a3fefc getCfgWmmCapable	[rt61ap]
c1a5298c Set_TxRate_Proc	[rt61ap]
c1a64a7c ApUpdateAccessControlList	[rt61ap]
c1a6d840 try_mac_list	[rt61ap]
c1a593c4 ShiftOutBits	[rt61ap]
c1a5d5f0 WPAHardTransmit	[rt61ap]
c1a4f84c RTMPBuildDesireRate	[rt61ap]
c1a3a870 AsicSetRxAnt	[rt61ap]
c1a39cf8 BssTableInit	[rt61ap]
c1a58e14 ATEAsicSwitchChannel	[rt61ap]
c1a5b568 WpaEAPPacketAction	[rt61ap]
c1a5abf8 xor_128	[rt61ap]
c1a52d6c Set_TxBurst_Proc	[rt61ap]
c1a5e05c GREKEYPeriodicExec	[rt61ap]
c1a335e4 macauth_add_trylist	[rt61ap]
c1a4a94c NICInitTxRxRingAndBacklogQueue	[rt61ap]
c1a52c44 Set_TxAntenna_Proc	[rt61ap]
c1a3ff38 getCfgAPAifsn	[rt61ap]
c1a5854c Set_ATE_SA_Proc	[rt61ap]
c1a3c800 MlmeRadioOn	[rt61ap]
c1a595f8 RTMP_EEPROM_READ16	[rt61ap]
c1a42194 MlmeDeauthReqAction	[rt61ap]
c1a4e3a8 NICLoadFirmware	[rt61ap]
c1a403a0 getCfgNoForwarding	[rt61ap]
c1a679a0 BBPRegTable	[rt61ap]
c1a58b1c Set_ATE_TX_FREQOFFSET_Proc	[rt61ap]
c1a5861c Set_ATE_BSSID_Proc	[rt61ap]
c1a678d8 SNAP_AIRONET	[rt61ap]
c1a52b20 Set_DtimPeriod_Proc	[rt61ap]
c1a65938 PeerDlsTearDownAction	[rt61ap]
c1a361c8 MlmeQueueDestroy	[rt61ap]
c1a67014 RateIdTo500Kbps	[rt61ap]
c1a325d4 RT61_open	[rt61ap]
c1a50638 ChannelSanity	[rt61ap]
c1a40058 getCfgAPTxop	[rt61ap]
c1a543c8 Set_AccessControlList_Proc	[rt61ap]
c1a5478c Set_dfstest_Proc	[rt61ap]
c1a33344 RT61_get_ether_stats	[rt61ap]
c1a3f970 ConvertToRssi	[rt61ap]
c1a58d58 Set_ATE_TX_COUNT_Proc	[rt61ap]
c1a52e2c Set_WmmCapable_Proc	[rt61ap]
c1a538e4 Set_Key2_Proc	[rt61ap]
c1a513f0 PeerDlsReqSanity	[rt61ap]
c1a62fd0 F	[rt61ap]
c1a36480 LfsrInit	[rt61ap]
c1a4f07c NdisFillMemory	[rt61ap]
c1a39a0c AsicAddPairwiseKeyEntry	[rt61ap]
c1a63e18 MacTableReset	[rt61ap]
c1a3da88 ScanTimeout	[rt61ap]
c1a52f14 Set_HideSSID_Proc	[rt61ap]
c1a4053c getCfgAuthMode	[rt61ap]
c1a3329c rt_abs	[rt61ap]
c1a5a78c RTMPSoftDecryptAES	[rt61ap]
c1a4f6d8 RTMPAddTimer	[rt61ap]
c1a38d4c AsicSetSlotTime	[rt61ap]
c1a38ae0 AsicEnableBssSync	[rt61ap]
c1a676ed A_BAND_REGION_9_CHANNEL_LIST	[rt61ap]
c1a401f4 getCfgBSSCwmax	[rt61ap]
c1a4a35c RTMPAllocDMAMemory	[rt61ap]
c1a41bd4 Cls3errAction	[rt61ap]
c1a32f84 VirtualIF_close	[rt61ap]
c1a52b9c Set_OLBCDetection_Proc	[rt61ap]
c1a59cdc rotr1	[rt61ap]
c1a5f5d4 hmac_md5	[rt61ap]
c1a3fdb8 getCfgDisableOLBC	[rt61ap]
c1a5cf9c Wpa1PeerPairMsg4Action	[rt61ap]
c1a58dc4 Set_ATE_RX_FER_Proc	[rt61ap]
c1a41a80 PeerDisassocReqAction	[rt61ap]
c1a5159c RTMPEncryptData	[rt61ap]
c1a545d8 Set_WPAPSK_Proc	[rt61ap]
c1a51800 RTMP_CALC_FCS32	[rt61ap]
c1a5f42c RTMPSearchPMKIDCache	[rt61ap]
c1a5f830 MD5Final	[rt61ap]
c1a52a50 Set_Channel_Proc	[rt61ap]
c1a549e8 Set_SiteSurvey_Proc	[rt61ap]
c1a35df0 MlmeEnqueue	[rt61ap]
c1a676e9 A_BAND_REGION_8_CHANNEL_LIST	[rt61ap]
c1a48aac RTMPCalcDuration	[rt61ap]
c1a52fb4 Set_IEEE8021X_Proc	[rt61ap]
c1a530c4 Set_VLANID_Proc	[rt61ap]
c1a596a4 RTMP_EEPROM_WRITE16	[rt61ap]
c1a6db44 Rtmp_Irq_Lock	[rt61ap]
c1a67ac4 WPA_OUI	[rt61ap]
c1a52d34 Set_TxQueueSize_Proc	[rt61ap]
c1a5f1e8 RTMPAddPMKIDCache	[rt61ap]
c1a40340 getCfgAckPolicy	[rt61ap]
c1a519f0 RTMPQueryInformation	[rt61ap]
c1a39bf8 AsicSendCommandToMcu	[rt61ap]
c1a3fddc getCfgBGProtection	[rt61ap]
c1a630d8 PasswordHash	[rt61ap]
c1a3998c AsicRemoveSharedKeyEntry	[rt61ap]
c1a322c8 RT61_Init_MSSID	[rt61ap]
c1a3bef0 RadarDetectPeriodic	[rt61ap]
c1a52678 Set_DriverVersion_Proc	[rt61ap]
c1a491c4 RTMPUpdateTupleCache	[rt61ap]
c1a3c788 MlmeRadioOff	[rt61ap]
c1a39d94 BssTableDeleteEntry	[rt61ap]
c1a5d210 Wpa2PeerPairMsg4Action	[rt61ap]

cat /proc/cmdline

console=ttyAM0

Serial

Pinout

(GND) (TX) (RX) [???] -> LED section, antennas, RT2561S, etc

Boot log




Check Firmware CRC =======> [OK]


Uncompressing Linux.................................................................done.
Transferring kernel ...complete
Transferring initrd ...complete
Transferring parms ...complete
Transferring control! ---------> Booting
Stage 2 flash detecting...................
Flash detecting(BUS:16bit,TYPE:16bit)... detected
 Amd/Fujitsu Extended Query Table v1.0 at 0x0040
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
NET4: Ethernet Bridge 008 for NET4.0
alias:g204 version:5.16
Restore Default
insmod: /lib/modules/2.4.19-rmk4: No such file or directory
insmod: bridge.o: no module by that name found
Bridge Init


=========================================
RALINK WIRELESS MODULE DETECTED!!
=========================================


AsicAntennaSelect(ch=6) - Tx=Ant-A, Rx=Ant-A
Check EEPROM contents .. [OK]



=================================================================
press magic key to change default setting ...
  LAN MAC : 00:08:9F:62:57:94
  WAN MAC : 00:08:9F:63:57:94
PPTP Server Start!!
insmod: /lib/modules/2.4.19-rmk4: No such file or directory
gzip: /etc/messages.gz: No such file or directory
copy_file:/etc/messages not found
Check Firmware Integrity ........ - size : 256
[OK]
Please press Enter to activate this console. => AUTH : 4:23:30
Retrieved from "https://techinfodepot.shoutwiki.com/w/index.php?title=IpTIME_G204&oldid=389685"