Posted by It was no more used, thus it was time to open it…
Jumper JP2, 1->RX, 2->3.3v, 3->TX, 4->GND
JP1 may be a JTAG connector (12 pins).
The device has a BCM5354, 2MB Flash (serial), 8MB SDRAM.
Using Bus Pirate, UART mode, (I had to define custom baudrate, since 115200 was not working : I used a BRG raw value = 33)
Output looks like this :
Decompressing.........done
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Wed, 09 Jul 2008 11:16:19 +0800 (everytime@localhost.localdomain)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
Initializing Arena
Initializing Devices.
Boot partition size = 131072(0x20000)
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.150.10.15
CPU type 0x29029: 240MHz
Total memory: 8192 KBytes
Total memory used by CFE: 0x80700000 – 0x807B7380 (750464)
Initialized Data: 0x8072D1F0 – 0x8072F960 (10096)
BSS Area: 0x8072F960 – 0x80751380 (137760)
Local Heap: 0x80751380 – 0x807B5380 (409600)
Stack Area: 0x807B5380 – 0x807B7380 (8192)
Text (code) segment: 0x80700000 – 0x8072D1F0 (184816)
Boot area (physical): 0x006BF000 – 0x006FF000
Relocation Factor: I:00000000 – D:00000000
SC CFE Ver: R1.5
FLASH: Base 0x0 size 0x200000 type 0x100 flags 0x1
mac in flash:00:22:6b:de:3a:82
Get eRcOmM at 001e0000
have eRcOmM
wait. press ctrl-c to cancel autostart
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .......... 3312988 bytes read
Entry at 0x80001000
Starting program at 0x80001000
PCI: no core
et_pci_init: found PCI device, devid=00004713
et_pci_init: Ethernet MAC found, devid=00000800, vendor=14e4, device=4713
et_pci_init: irq=2, base=0x000
sb_doattach: incoming bus is PCI but it's a lie, switching to SB devid:0x4713
vlan0: MAC Address=00:22:6b:de:3a:82
eth0: MAC Address=00:22:6b:de:3a:82
wl_drv_init: found device wl0
wired to HAL vector 0
sb_doattach: incoming bus is PCI but it's a lie, switching devid:0x4318
wl_drv_init: wlc_attch passed for device 0
boaCrMdD n>ame:WRT54G
================================================================
Welco WRT54GCv3
===========================================================
Timer init...
rate=6553700,size=4
FLASH Driver init...
Read NVRAM from FLASH ...
GetNVFromFlash copied data
Usock init...
GetNVFromFlash copied data
Init LAN MAC address: 00:22:6B:DE:3A:82
vlan0 opened
[bridge.c,450] WirelessInit()::
Init WAN MAC address: 00:22:6B:DE:3A:83
eth0 opened
GetNVFromFlash copied data
Init bridge...
[rtadd.c,30] rtadd()::Add Routing Entry: [0]192.168.1.0/255.255.255.0 ==> 192.168.1.1 M:1 TTL:999
[rtadd.c,30] rtadd()::Add Routing Entry: [0]192.168.1.1/255.25.255 ==> 192.168.1.1 M:1 TTL:999
[rtadd.c,30] rtadd()::Add Routing Entry: [1]0.0.0.0/255.255.255==> 192.168.0.1 M:1 TTL:999
Current DNS IPs: 192.168.0.1
HTTP init...
sizeof(AdmRam) is <18K> Now: 8sec
Init sucess!
[ipiface.c,364] interface_event()::ip_mtu[1] is <1500>
WLAN_start(1)
wl0: link up
wl0: link down event_flags=0x00
Disable Ethernet QoS
Current DNS IPs: 192.168.0.1
[rtadd.c,30] rtadd()::Add Routing Entry: [1]192.168.0.101/255.255.255.255 ==> 192.168.0.101 M:1 TTL:999
[rtadd.c,30] rtadd()::Auting Entry: [1]192.168.0.0/255.255.255.0 ==> 192.168.0.101 M:1 TTL:999
[rtadd.c,30] rtadd()::Adting Entry: [1]0.0.0.0/0.0.0.0 ==> 192.168.0.1 M:1 TTL:999
[adm_srv.c,3459] DoSomethingAfterWANUWAN IP: 192.168.0.101
Dump IP routing table
Destination Mask Gateway Metric Iface
192.wl0nk up
No i1n6t8e.r0f.ac0e s p e ci f i e d.2 5Q5ui.t2t5i5ng..2.5.5
.0 2.168.0.101 1 WAN
192.168.1.0 255.255.255.0 192.168.1.1 LAN
192.168.1.1 255.255.255.255 192.168.1.1 1 LAN 192.168.0.101 255.255.255.255 192.168.0.101
0.0.0.0 0.0.0.0 192.168.0.1 1 WAN
[dhcpc.c,226] ddaemon()::
[dhcpc.c,232] dhcpc_daemon()::
[iparp.c,500] arp_pending_timer()::Send ARP request for <192.168.0.1>
[iparp.c,500] arp_pending_timer()::Send ARP request for <192.168.0.1>
[iparp.c,500] arp_pending_timer()::Send ARP request for <192.168.0.1>