Edimax wireless AP/ Ralink RT2880 SoC

Hi, sorry if this is the best place to ask but if not perhaps someone
can point me in the right direction...

The other day I attempted to flash an updated firmware to my Edimax
EW-7416APn wireless access point/bridge. Unfortunately something has got
corrupted and I've lost access.

The manual states that the password should be "1234" after a factory
reset but even if I do a hard factory reset (hold a switch down for 10
seconds or whatever) it still won't accept this password. It also sets
the ip address to 0.0.0.0 rather than the default again given in the
manual. (edimax provide a tool for initial set-up that communicates over
raw ethernet frames so that it doesn't matter what subnet your machine
is on. This finds the AP and reports the blank ip address etc, so the
system is running and talking on the lan, I just have no way to
communicate with it).

The PCB has several unused pads and I know the RT2880 SoC has various
interfaces like serial so I'm wondering if I might be able to solder a
serial port to it and get a root terminal? Nothing on the board has any
useful labels just "J1" "S4" etc.


Any thoughts or should I just send it back to the manufacturer?

Alistair.

On 6/26/2011 3:41 PM, Guesser wrote:
> Hi, sorry if this is the best place to ask but if not perhaps someone
> can point me in the right direction...
>
> The other day I attempted to flash an updated firmware to my Edimax
> EW-7416APn wireless access point/bridge. Unfortunately something has got
> corrupted and I've lost access.
>
> The manual states that the password should be "1234" after a factory
> reset but even if I do a hard factory reset (hold a switch down for 10
> seconds or whatever) it still won't accept this password. It also sets
> the ip address to 0.0.0.0 rather than the default again given in the
> manual. (edimax provide a tool for initial set-up that communicates over
> raw ethernet frames so that it doesn't matter what subnet your machine
> is on. This finds the AP and reports the blank ip address etc, so the
> system is running and talking on the lan, I just have no way to
> communicate with it).
>
> The PCB has several unused pads and I know the RT2880 SoC has various
> interfaces like serial so I'm wondering if I might be able to solder a
> serial port to it and get a root terminal? Nothing on the board has any
> useful labels just "J1" "S4" etc.
>
>
> Any thoughts or should I just send it back to the manufacturer?
>
> Alistair.
Sounds like the "tool" that is reporting the box as existing is using
the MAC address info to contact it.

Try username/password of admin/admin and see if that works for you as I
have seen that used as the defaults mentioned in some RT2280
documentation in the past. Others that might work are root/admin or
just two carriage returns.

Here is something worth trying to see if it will reset the box for you.
Hold in the reset button for 30 seconds, keeping it held in unplug the
power for 30 seconds, and then still while holding in the reset button
power it back on and continue holding the reset button for a last 30
seconds.

The other thought is to set your PC's interface to a fixed IP of
10.10.10.55 (or end it in any value below 254) with a netmask of
255.255.255.0 and see if you can contact the web page at 10.10.10.254
after the above hard reset.

On 26/06/2011 22:37, GlowingBlueMist wrote:
> Sounds like the "tool" that is reporting the box as existing is using
> the MAC address info to contact it.

indeed

> Here is something worth trying to see if it will reset the box for you.
> Hold in the reset button for 30 seconds, keeping it held in unplug the
> power for 30 seconds, and then still while holding in the reset button
> power it back on and continue holding the reset button for a last 30
> seconds.

As I said the reset appears to work but I think that wherever the
defaults are stored has been corrupted. I'll have a go at your various
suggestions tomorrow but I've tried several times different credentials
etc and I'm fairly sure I'll not be able to get in through the network
login any more.

How do they write the initial firmware to the device I wonder, the first
time the board is powered the flash is presumably all 0xFF or random.
How is the initial kernel loaded into ram.

On 26/06/2011 23:30, Guesser wrote:
> How is the initial kernel loaded into ram.

actually the ralink chip has a jtag interface apparently, I guess the
flash may be programmed over that.

On 26/06/2011 22:37, GlowingBlueMist wrote:
> Here is something worth trying to see if it will reset the box for you.
> Hold in the reset button for 30 seconds, keeping it held in unplug the
> power for 30 seconds, and then still while holding in the reset button
> power it back on and continue holding the reset button for a last 30
> seconds.

Well the good news is that after numerous power cycles and holding down
the button for various lengths of time etc the box went insane flashing
its lights in patterns for a minute or so, then powered up normally and
now works fine!

Sadly I can't report exactly what I did to fix it, just that it reset to
the correct defaults eventually after enough prodding of the reset button!

On 6/27/2011 12:16 PM, Guesser wrote:
> On 26/06/2011 22:37, GlowingBlueMist wrote:
>> Here is something worth trying to see if it will reset the box for you.
>> Hold in the reset button for 30 seconds, keeping it held in unplug the
>> power for 30 seconds, and then still while holding in the reset button
>> power it back on and continue holding the reset button for a last 30
>> seconds.
>
> Well the good news is that after numerous power cycles and holding down
> the button for various lengths of time etc the box went insane flashing
> its lights in patterns for a minute or so, then powered up normally and
> now works fine!
>
> Sadly I can't report exactly what I did to fix it, just that it reset to
> the correct defaults eventually after enough prodding of the reset button!

Glad that you were able to wake the beast from it's stupor at last.

Like you I hate it when things start working and I have no idea what
offering to which deity actually made it work.