D-Link DIR-100 rev A

D-Link DIR-100 A

Manuf (OEM/ODM): Alpha Networks RG-03

(Est.) release date: August 2006

Type: router

Power: 5 VDC, 2 A
Connector type: barrel

CPU1: Realtek RTL8650B
FLA1: 2 MiB 2,097,152 B <br />16,384 Kib <br />2,048 KiB <br />16 Mib <br />0.00195 GiB <br /> (Spansion S29AL016D70TFI02)
RAM1: 16 MiB 16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br /> (Hynix HY57V281620ETP-H)

Expansion IFs: USB 1.1
USB ports: 1
Serial: yes, (38400,8,N,1)

ETH chip1: Realtek RTL8650B
Switch: Realtek RTL8650B
LAN speed: 100M
LAN ports: 4
WAN speed: 100M
WAN ports: 1

Ethernet OUI: none specified

	CPU1 brand	FLA1	RAM1
D-Link DIR-100 rev A	Realtek	2 MiB2,097,152 B <br />16,384 Kib <br />2,048 KiB <br />16 Mib <br />0.00195 GiB <br />	16 MiB16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br />
D-Link DIR-100 rev B1	WavePlus	1 MiB1,048,576 B <br />8,192 Kib <br />1,024 KiB <br />8 Mib <br />9.765625e-4 GiB <br />	8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br />

For a list of all currently documented Realtek chipsets with specifications, see Realtek.

---

D-link DIR-100 UART on hwmayer.blogspot.com

Alpha Networks RG-03 (8RG03....3A1G <??>), date code 0633 (August 2006),

sticker on the board reads 1DI604+EU.B1G or something

Reviews

• On pcpop.com

"8RG03...."<...> SSed on the board, 1DIR100CN.A1G sticker on the board,

S29AL016D70TFI02 Flash

Known security vulnerabilities

• This device appears to be affected by the xmlset_roodkcableoj28840ybtide backdoor.
• after connecting to serial interface on pcb, password for http login can be seen

in bootlog on firmware 1.12

Serial

Bootlog

• bootlog

#Loading runtime image ... Imag Start Address =0xbe030000 Find a 7zip self-decompressed kernel image, Just GO! Powered by Realtek RTL8650B SoC, rev 1 CPU revision is: 0000ff00 Init MMU (16 entries) Primary instruction cache 0kB, linesize 0 bytes. Primary data cache 0kB, linesize 0 bytes. Linux version 2.4.26-uc0 (root@FCompiler) (gcc version 3.3.3) #1 Fri Apr 25 16:48:56 CST 2008 Determined physical RAM map: memory: 01000000 @ 00000000 (usable) NOFS reserved @ 0x8033bba0 On node 0 totalpages: 4096 zone(0): 4096 pages. zone(1): 0 pages.</code> zone(2): 0 pages. Kernel command line: root=/dev/mtdblock3 rootfstype=squashfs IRR(0)=c0000000 Calibrating delay loop... 178.99 BogoMIPS Memory: 12888k/16384k available (2285k kernel code, 3496k reserved, 104k data, 104k init, 0k highmem) Dentry cache hash table entries: 2048 (order: 2, 16384 bytes) Inode cache hash table entries: 1024 (order: 1, 8192 bytes) Mount cache hash table entries: 512 (order: 0, 4096 bytes) Buffer cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) Checking for 'wait' instruction... unavailable. POSIX conformance testing by UNIFIX NEW PCI Driver...isLinuxCompliantEndianMode=False(Big Endian) [PCI] Reset Bridge ..... Finish! No PCI device exist!! Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd pty: 256 Unix98 ptys configured Serial driver version 5.05c (2001-07-08) with MANY_PORTS SERIAL_PCI enabled Probing RTL8651 home gateway controller... Initialize RTL865x ASIC and driver chip name: 8650B, chip revid: 1 Initialize mbuf... creating default 2 interfaces...eth0 IRR(6)=c0040000 eth1 ...OK >>>now is rome 3.4 running ........ DQoS module initialization success! PPP generic driver version 2.4.2 PPP BSD Compression module registered Amd/Fujitsu Extended Query Table v1.0 at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling fast programming due to code brokenness. Looking for mtd device mtd1: Found a mtd1 image (0x20000), with size (0x10000). Looking for mtd device mtd2: Found a mtd2 image (0x30000), with size (0x9daa0). Looking for mtd device mtd3: Found a mtd3 image (0xcdaa0), with size (0xfe000). Creating 4 MTD partitions on "Physically mapped flash": 0x00000000-0x00020000 : "ldr" 0x00020000-0x00030000 : "alphafs" 0x00030000-0x000cdaa0 : "kernel" 0x000cdaa0-0x001cbaa0 : "squashfs" NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP, IGMP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 1024 bind 2048) GRE over IPv4 tunneling driver ip_conntrack version 2.1 (128 buckets, 1024 max) - 344 bytes per conntrack ip_tables: (C) 2000-2002 Netfilter core team NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 104k freed IRR(3)=c3040000 initial console created on /dev/ttyS1 Shell invoked to run file: /etc/rc Command: mount -t proc proc /proc Command: mount -t ramfs ramfs /var Command: mkdir /var/tmp Command: mkdir /var/ppp/ Command: mkdir /var/log Command: mkdir /var/run Command: mkdir /var/lock Command: mkdir /var/flash Command: #iwcontrol is required for RTL8185 Wireless driver Command: #iwcontrol auth & Command: Command: #busybox insmod /lib/modules/2.4.26-uc0/kernel/drivers/usb/quickcam.o Command: Command: /bin/webs -u root -d /www -i /var/run/thttpd.pid & [9] Command: Command: #ifconfig wlan0 up promisc Command: Command: Command: Execution Finished, Exiting Sash command shell (version 1.1.1) /> System initializing...Check the crc=0x2402916d,file_des->chksum=0x2402916d! Config info: table total size[58120|0xe308] === max[196608|0x30000]! rtl8651_user_pid set to 9 WAN/LAN, Rx shift=10002 runDNSProxy session 0 do not have dns server ip... [16] cfg wan to dhcp client ... Set IGMP Default Upstream interface (eth0) ... SUCCESS!! [22] info, client (v0.9.9-pre) started [24] url filter default set to accept PPPoE Passthru disabled. Drop Unknown PPPoE PADT disabled. IPv6 Passthru disabled. IPX Passthru disabled. NETBIOS Passthru disabled. WebReset drule=0 moteAccessConfig ReadPPPoESessionInfo: idx=0 id = 0 ReadPPPoESessionInfo: idx=1 id = 0 /www/Status/st_blocked.htm: No such file or directory killall: neaps: no process killed pid 27: failed 256 [29] [31] get lan ip c0a86501 enable 1 my host is =routers.dlink.com=buffer from user space=QoSEnable=0 DetectWanBand=0 ! Find a pair, argumenit=QoSEnable, value=0!pBuf=DetectWanBand=0 ! Find a pair, argumenit=DetectWanBand, value=0!pBuf=! tmpUpBW=0, tmpRsBW=0! get parameter: DQoS_enable= 0! get parameter: upLinkBandWidth=0 kbits! get parameter: VoIP reserved bandwidth=0 kbits! interface: eth1 config : /var/neap.conf get vendor = ALPHA get model = DIR-100 get version = v0.5.0 get secret = admin123 <== password for http login eth1: ip:192.168.101.1, mask:255.255.255.0, mac 00:24:01:20:e8:3c eth1 (ip) = 192.168.101.1, (netmask) = 255.255.255.0, adapter index 3 adapter hardware address 00:24:01:20:e8:3c Into Server listen!! nothing to monitor [35] info, server (v0.9.9-pre) started error, max_leases value (254) not sane, setting to 99 instead error, Unable to open /var/udhcpd.leases for reading auto ,en ,dir = /www dhcpc client deconfig ifCfgParam[0].ipAddr: 0.0.0.0 ifCfgParam[0].ipMask: 0.0.0.0 ifCfgParam[0].gwAddr: 0.0.0.0 ifCfgParam[0].dnsPrimaryAddr: 0.0.0.0 rtl8651_delNaptMapping: ret -6 rtl8651_delRoute(default): ret -3 rtl8651_delIpIntf: ret -2710 target 239.0.0.0 SIOCDELRT: No such process