mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-22 23:12:32 +00:00
9ac1523062
Comfast CF-E393AX is a dual-band Wi-Fi 6 POE ceiling mount access point.
Oem firmware is a custom openwrt 21.02 snapshot version.
We can gain access via ssh once we remove the root password.
Hardware specification:
SoC: MediaTek MT7981A 2x A53
Flash: 128 MB SPI-NAND
RAM: 256MB DDR3
Ethernet: 1x 10/100/1000 Mbps built-in PHY (WAN)
1x 10/100/1000/2500 Mbps MaxLinear GPY211C (LAN)
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976D
LEDS: 1x (Red, Blue and Green)
Button: Reset
UART: 3.3v, 115200n8
--------------------------
| Layout |
| ----------------- |
| 4 | VCC GND TX RX | <= |
| ----------------- |
--------------------------
Gain SSH access:
1. Login into web interface (http://apipaddress/computer/login.html),
and download the
configuration(http://apipaddress/computer/config.html).
2. Rename downloaded backup config - 'backup.file to backup.tar.gz',
Enter 'fakeroot' command then decompress the configuration:
tar -zxf backup.tar.gz
3. Edit 'etc/shadow', update (remove) root password:
With password =
'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
to
Without password =
'root::0:99999:7:::'
'root::0:99999:7:::'
4. Repack 'etc' directory back to a new backup file:
tar -zcf backup-ssh.tar.gz etc/
5. Rename new config tar.gz file to 'backup-ssh.file'
Exit fakeroot - 'exit'
6. Upload new configuration via web interface, now you
can SSH with the following:
'ssh -vv -o HostKeyAlgorithms=+ssh-rsa \
-o PubkeyAcceptedAlgorithms=+ssh-rsa root@192.168.10.1'.
Backup the mtd partitions
- https://openwrt.org/docs/guide-user/installation/generic.backup
7. Copy openwrt factory firmware to the tmp folder to install via ssh:
'scp -o HostKeyAlgorithms=+ssh-rsa \
-o PubkeyAcceptedAlgorithms=+ssh-rsa \
*-mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin \
root@192.168.10.1:/tmp/'
'sysupgrade -n -F \
/tmp/*--mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin'
8. Once led has stopped flashing - Connect via ssh with the
default openwrt ip address - 'ssh root@192.168.1.1'
9. SSH copy the openwrt sysupgrade firmware and upgrade
as per the default instructions.
Signed-off-by: David Bentham <db260179@gmail.com>
(cherry picked from commit d8f4453bf2)
127 lines
3.8 KiB
Plaintext
127 lines
3.8 KiB
Plaintext
#
|
|
# Copyright (C) 2021 OpenWrt.org
|
|
#
|
|
|
|
[ -e /etc/config/ubootenv ] && exit 0
|
|
|
|
touch /etc/config/ubootenv
|
|
|
|
. /lib/uboot-envtools.sh
|
|
. /lib/functions.sh
|
|
|
|
board=$(board_name)
|
|
|
|
case "$board" in
|
|
asus,rt-ax59u)
|
|
ubootenv_add_uci_config "/dev/mtd0" "0x100000" "0x20000" "0x20000"
|
|
;;
|
|
bananapi,bpi-r3)
|
|
rootdev="$(cmdline_get_var root)"
|
|
rootdev="${rootdev##*/}"
|
|
rootdev="${rootdev%%p[0-9]*}"
|
|
case "$rootdev" in
|
|
mmc*)
|
|
local envdev=$(find_mmc_part "ubootenv" $rootdev)
|
|
ubootenv_add_uci_config "$envdev" "0x0" "0x40000" "0x40000" "1"
|
|
ubootenv_add_uci_config "$envdev" "0x40000" "0x40000" "0x40000" "1"
|
|
;;
|
|
mtd*)
|
|
local envdev=/dev/mtd$(find_mtd_index "u-boot-env")
|
|
ubootenv_add_uci_config "$envdev" "0x0" "0x20000" "0x20000" "1"
|
|
ubootenv_add_uci_config "$envdev" "0x20000" "0x20000" "0x20000" "1"
|
|
;;
|
|
ubi*)
|
|
. /lib/upgrade/nand.sh
|
|
local envubi=$(nand_find_ubi ubi)
|
|
local envdev=/dev/$(nand_find_volume $envubi ubootenv)
|
|
local envdev2=/dev/$(nand_find_volume $envubi ubootenv2)
|
|
ubootenv_add_uci_config "$envdev" "0x0" "0x1f000" "0x1f000" "1"
|
|
ubootenv_add_uci_config "$envdev2" "0x0" "0x1f000" "0x1f000" "1"
|
|
;;
|
|
esac
|
|
;;
|
|
cmcc,rax3000m)
|
|
case "$(cmdline_get_var root)" in
|
|
/dev/mmc*)
|
|
local envdev=$(find_mmc_part "ubootenv" "mmcblk0")
|
|
ubootenv_add_uci_config "$envdev" "0x0" "0x40000" "0x40000" "1"
|
|
ubootenv_add_uci_config "$envdev" "0x40000" "0x40000" "0x40000" "1"
|
|
;;
|
|
*)
|
|
. /lib/upgrade/nand.sh
|
|
local envubi=$(nand_find_ubi ubi)
|
|
local envdev=/dev/$(nand_find_volume $envubi ubootenv)
|
|
local envdev2=/dev/$(nand_find_volume $envubi ubootenv2)
|
|
ubootenv_add_uci_config "$envdev" "0x0" "0x1f000" "0x1f000" "1"
|
|
ubootenv_add_uci_config "$envdev2" "0x0" "0x1f000" "0x1f000" "1"
|
|
;;
|
|
esac
|
|
;;
|
|
comfast,cf-e393ax)
|
|
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x80000"
|
|
;;
|
|
cetron,ct3003|\
|
|
netgear,wax220|\
|
|
zbtlink,zbt-z8102ax|\
|
|
zbtlink,zbt-z8103ax)
|
|
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000"
|
|
;;
|
|
h3c,magic-nx30-pro|\
|
|
jcg,q30-pro|\
|
|
qihoo,360t7|\
|
|
tplink,tl-xdr4288|\
|
|
tplink,tl-xdr6086|\
|
|
tplink,tl-xdr6088|\
|
|
xiaomi,mi-router-ax3000t-ubootmod|\
|
|
xiaomi,mi-router-wr30u-ubootmod|\
|
|
xiaomi,redmi-router-ax6000-ubootmod)
|
|
. /lib/upgrade/nand.sh
|
|
local envubi=$(nand_find_ubi ubi)
|
|
local envdev=/dev/$(nand_find_volume $envubi ubootenv)
|
|
local envdev2=/dev/$(nand_find_volume $envubi ubootenv2)
|
|
ubootenv_add_uci_config "$envdev" "0x0" "0x1f000" "0x20000" "1"
|
|
ubootenv_add_uci_config "$envdev2" "0x0" "0x1f000" "0x20000" "1"
|
|
;;
|
|
glinet,gl-mt3000)
|
|
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x80000" "0x20000"
|
|
;;
|
|
glinet,gl-mt6000)
|
|
local envdev=$(find_mmc_part "u-boot-env")
|
|
ubootenv_add_uci_config "$envdev" "0x0" "0x80000"
|
|
;;
|
|
mercusys,mr90x-v1|\
|
|
routerich,ax3000)
|
|
local envdev=/dev/mtd$(find_mtd_index "u-boot-env")
|
|
ubootenv_add_uci_config "$envdev" "0x0" "0x20000" "0x20000" "1"
|
|
;;
|
|
ubnt,unifi-6-plus)
|
|
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x80000" "0x10000"
|
|
;;
|
|
xiaomi,mi-router-ax3000t|\
|
|
xiaomi,mi-router-wr30u-stock|\
|
|
xiaomi,redmi-router-ax6000-stock)
|
|
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x10000" "0x20000"
|
|
ubootenv_add_uci_sys_config "/dev/mtd2" "0x0" "0x10000" "0x20000"
|
|
;;
|
|
zyxel,ex5601-t0)
|
|
local envdev=/dev/mtd$(find_mtd_index "u-boot-env")
|
|
ubootenv_add_uci_config "$envdev" "0x0" "0x20000" "0x40000" "2"
|
|
;;
|
|
zyxel,ex5601-t0-ubootmod)
|
|
. /lib/upgrade/nand.sh
|
|
local envubi=$(nand_find_ubi ubi)
|
|
local envdev=/dev/$(nand_find_volume $envubi ubootenv)
|
|
local envdev2=/dev/$(nand_find_volume $envubi ubootenv2)
|
|
ubootenv_add_uci_config "$envdev" "0x0" "0x1f000" "0x20000" "1"
|
|
ubootenv_add_uci_config "$envdev2" "0x0" "0x1f000" "0x20000" "1"
|
|
;;
|
|
zyxel,ex5700-telenor)
|
|
ubootenv_add_uci_config "/dev/ubootenv" "0x0" "0x4000" "0x4000" "1"
|
|
;;
|
|
esac
|
|
|
|
config_load ubootenv
|
|
config_foreach ubootenv_add_app_config
|
|
|
|
exit 0
|