Zoom 4506 Router

Post new topic   Reply to topic    DD-WRT Forum Index -> Ralink SoC based Hardware
Author Message
jbreitfeller
DD-WRT Novice


Joined: 26 Apr 2010
Posts: 2

PostPosted: Mon Apr 26, 2010 16:12    Post subject: Zoom 4506 Router Reply with quote
Hi I am trying to figure out which firmware I could use to flash onto the Zoom 4506 travel router.

The FCC ID is: PBLCDM530AM

I have found out that it has a Ralink processor and 4 MB of flash, but I don't know which firmware would be compatible with it.

Any help would be appreciated. Thanks!
Sponsor
jbreitfeller
DD-WRT Novice


Joined: 26 Apr 2010
Posts: 2

PostPosted: Fri Apr 30, 2010 16:09    Post subject: Reply with quote
Here are some of the specs I managed to get if this helps:

Processor: Ralink RT3050F
Flash: EON EN29LV320AT-70TCP (32mbit/ 4meg flash)
Ethernet: FPE H16105DF-R

I understand that the 3G functionality of the router probably won't work with DD-WRT, but I'd like to try the firmware for other purposes.
kcrk
DD-WRT Novice


Joined: 17 May 2015
Posts: 2

PostPosted: Sun May 17, 2015 14:43    Post subject: Cross compiling of adb/dd-wrt port Reply with quote
I've tried to get Zoom support to help me with tethering support for android 4.2+, but they have been nothing but unhelpful and have ignored my emails and repeatedly told me that "the root password is for engineers only!". Well I am an engineer! Very Happy

Port scan of their router shows a telnetd running on port 2300. After zoom didn't help I felt like I had no choice but to disect their firmware.

Code:
DECIMAL      HEX          DESCRIPTION
-------------------------------------------------------------------------------------------------------
136          0x88         LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 3122840 bytes
1022599      0xF9A87      Squashfs filesystem, little endian, non-standard signature,  version 3.0, size: 2585457 bytes,  1170 inodes, blocksize: 65536 bytes, created: Mon Apr 16 08:25:28 2012
3611367      0x371AE7     Squashfs filesystem, little endian, non-standard signature,  version 3.0, size: 194753 bytes,  159 inodes, blocksize: 65536 bytes, created: Thu May 17 10:54:41 2012

I'm not sure what the LZMA bit contains, but the first squashfs(squashfs-3.2-r2-lzma) holds the rootfs and the second one the web interface.

After extraction with the firmware-toolkit I used dd to split the header.img into the actual rootfs.squashfs and the actual header.

In order to get telnet access I got the hash from /etc/passwd:
Code:
root:$1$$N76hdwGfg11g0KdKbtyh21:0:0:root:/root:/bin/ash
and set oclhashcat loose on it and waited a week! Brute-force wasn't the wisest of ideas after all. Well the password is: amittima!

Inspecting the adb I get:
Code:
./fw-t/rootfs2/sbin/adb: ELF 32-bit LSB  executable, MIPS, MIPS-II version 1 (SYSV), dynamically linked (uses shared libs), stripped

After connecting to the router I can run adb from the terminal. adb devices says that my phone is offline, which is what you'd expect with adb 1.0.29 and a 4.4 android.

So basically I need to cross compile a newer adb and drop that in instead of the old one. That's where my problems start:

1) Do I have to cross-compile for MIPS or is it MIPS-II? Where do I get the toolchain from?
2) Will it work with the dynamically linked outdated libraries and how do I debug that if neccesary?
3) Can I emulate the router in quemu first? I have only one router and I really don't want to brick it!
4) I split the binary with dd. How do I merge it again after modificaiton and squashing?

5) How would I go about replacing the rootfs with dd-wrt?

Any help is highly appreciated!
RAH66
DD-WRT Novice


Joined: 20 May 2015
Posts: 1

PostPosted: Wed May 20, 2015 6:55    Post subject: AMIT CDM530AM & analogs Reply with quote
Amit CDM530AM
4G-Systems XsBox Move
Aluratek CDM530AM
Dlink DWR-131
Olive Nexus V-R9
Skylink Team
TrendNet TEW-655BR3G
Upvel UR-703N3G
Zalip CDM530AM
Zoom 4506 3G

Dear kcrk on your stage of research can use other firmware from analogs? I have a TrendNet Tew-655BR3G, and want to install the firmware from Upvel UR-703N3G. Need update/upgrade bootloader.

p.s. GPL for TrendNet TEW-655BR3G and firmware
http://downloads.trendnet.com/GPL/
http://downloads.trendnet.com/TEW-655BR3G/firmware/
kcrk
DD-WRT Novice


Joined: 17 May 2015
Posts: 2

PostPosted: Wed Jun 17, 2015 15:24    Post subject: Using other firmware Reply with quote
I'm sorry to say that I've not tried to flash any other firmware. I'm not sure how big the flash memory is, but I'll open up my router and check what hardware it has and I may consider the "No risk, no fun!" option and try to force a flash with a different firmware anyway.
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Ralink SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum