Pronto Networks Wavespot
Jump to navigation
Jump to search
Pronto Networks Wavespot
Manuf (OEM/ODM): Tensun tek Electronic
Type: wireless router
FCC ID: ZT6TS-PHR300
Power: 9 VDC, 1 A
Connector type: barrel
CPU1: Ralink RT3052 (384 MHz)
FLA1: 8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br /> (Macronix MX29LV640DBTC-90G)
RAM1: 64 MiB67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br /> (ISSI IC42S16160C-7TL × 2)
Expansion IFs: USB 2.0
USB ports: 1
Serial: yes, (57600,8,N,1)
WI1 chip1: Ralink RT3052
WI1 802dot11 protocols: bgn
WI1 MIMO config: 2x2:2
WI1 antenna connector: none
ETH chip1: Ralink RT3052
Switch: Ralink RT3052
LAN speed: 100M
LAN ports: 4
WAN speed: 100M
WAN ports: 1
bgn
Additional chips
2.4GHz Power Amplifier IC;Richwave;RTC6691;;2;
Stock bootloader: U-Boot 3.4 Ralink
Stock FW OS: Linux 2.6.21.7
Flags: schematics, boot log
Default SSID: Wavespot
, Wavespot-Free-Internet
Default IP address: 192.168.4.1
For a list of all currently documented Ralink chipsets with specifications, see Ralink.
Product homepage
Quick start guide
Manufactured by Tensun tek Electronic, same hardware appears to be used for the ProntoPoint-AP (FCC ID: TVVPPAP-USB ?)
The device is pictured with a label showing a MAC address of 00:25:22:2F:?0:00 in the FCC internal photos. This is corroborated with WiGLE data for the default SSIDs.
"QK-IP2202 V1.1" is silkscreened on the board.
The power adapter included with the device is a HB12-09010SPA (9V, 1A).
Defaults
The manual mentions the default AP passkey as being the last 6 digits of the MAC address printed on the label (w/ upper case letters).
The manual also mentions that 'Wavespot' has IP addresses in the 192.168.4.x range and Wavespot-Free-Internet has addresses in the 192.168.3.x range.
Images
- from Pronto
overview shot
LEDs
back
box
in box
- not from Pronto
angled
bottom
power adapter
board top
board bottom
Serial
Pinout
J2 [VCC] (Tx) (Rx) (GND) |------| | | |RT3052| | | |------|
Boot log
U-Boot 1.1.3 (Oct 21 2010 - 15:03:00)
Board: Ralink APSoC DRAM: 64 MB
relocate_code Pointer at: 83fb0000
config usb..
flash_protect ON: from 0xBF000000 to 0xBF01E507
flash_protect ON: from 0xBF030000 to 0xBF030FFF
*** Warning - bad CRC, using default environment
============================================
Ralink UBoot Version: 3.4.0.0
--------------------------------------------
ASIC 3052_MP2 (Port5<->None)
DRAM component: 256 Mbits SDR
DRAM bus: 32 bit
Total memory: 64 MBytes
Flash component: NOR Flash
Date:Oct 21 2010 Time:15:03:00
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384
##### The CPU freq = 384 MHZ ####
SDRAM bus set to 32 bit
SDRAM size =64 Mbytes
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP. 0
3: System Boot system code via Flash.
## Booting image at bf050000 ...
Image Name: Airspot
Created: 2011-03-18 11:16:01 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 3096512 Bytes = 3 MB
Load Address: 80000000
Entry Point: 80311000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80311000) ...
## Giving linux memsize in MB, 64
Starting kernel ...
LINUX started...
THIS IS ASIC
Linux version 2.6.21.7 (root@super-micro) (gcc version 3.4.2) #1 PREEMPT Fri Mar 18 04:15:57 PDT 2011
The CPU feqenuce set to 384 MHz
CPU revision is: 0001964c
DetectRAMsequence
MAX memory:32[32]
RAM after check region:32
FullviewRAM:33554432
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Built 1 zonelists. Total pages: 16256
Kernel command line: nosmp console=ttyS1,57600n8 root=31:4
start_kernel(): bug: interrupts were enabled *very* early, fixing it
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 800060, status = 1100ff00
PID hash table entries: 256 (order: 8, 1024 bytes)
calculating r4koff... 0005dc00(384000)
CPU frequency 384.00 MHz
Using 192.000 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 61512k/65536k available (2684k kernel code, 3960k reserved, 451k data, 1 28k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
softirq RT prio: 24.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
Load RT2880 Timer Module(Wdg/Soft)
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
io scheduler noop registered
io scheduler deadline registered (default)
Ralink gpio driver initialized
Generic RTC Driver v1.07
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V0.17
PPTP driver version 0.8.4
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ralink flash device: 0x800000 at 0x1f000000
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Creating 6 MTD partitions on "Ralink SoC physically mapped flash":
0x00000000-0x00030000 : "Bootloader"
0x00030000-0x00040000 : "Config"
0x00040000-0x00050000 : "Factory"
0x00050000-0x00150000 : "Kernel"
0x00150000-0x00700000 : "RootFS"
0x00700000-0x00800000 : "RW-FS"
block2mtd: version $Revision: 1.1.1.1 $
usbmon: debugfs is not available
usbcore: registered new interface driver cdc_acm
drivers/usb/class/cdc-acm.c: v0.25:USB Abstract Control Model driver for USB mod ems and ISDN adapters
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver libusual
usbcore: registered new interface driver usbserial
drivers/usb/serial/usb-serial.c: USB Serial support registered for generic
usbcore: registered new interface driver usbserial_generic
drivers/usb/serial/usb-serial.c: USB Serial Driver core
drivers/usb/serial/usb-serial.c: USB Serial support registered for GSM modem (1- port)
usbcore: registered new interface driver option
drivers/usb/serial/option.c: USB Driver for GSM modems: v0.7.1
dwc_otg: version 2.72a 24-JUN-2008
DWC_otg: Core Release: 2.66a
DWC_otg: Periodic Transfer Interrupt Enhancement - disabled
DWC_otg: Multiprocessor Interrupt Enhancement - disabled
DWC_otg: Using DMA mode
DWC_otg: Device using Buffer DMA mode
dwc_otg lm0: DWC OTG Controller
dwc_otg lm0: new USB bus registered, assigned bus number 1
dwc_otg lm0: irq 18, io mem 0x00000000
DWC_otg: Init: Port Power? op_state=1
DWC_otg: Init: Power Port (0)
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
dummy_hcd dummy_hcd: USB Host+Gadget Emulator, driver 02 May 2005
dummy_hcd dummy_hcd: Dummy host controller
dummy_hcd dummy_hcd: new USB bus registered, assigned bus number 2
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
ether gadget: using random self ethernet address
ether gadget: using random host ethernet address
usb0: Ethernet Gadget, version: May Day 2005
usb0: using dummy_udc, OUT ep-b IN ep-a STATUS ep-c
usb0: MAC 9e:08:1b:3a:bb:9f
usb0: HOST MAC 2a:9f:73:5f:0a:30
usb0: RNDIS ready
GACT probability on
Mirror/redirect action on
u32 classifier
input device check on
Actions configured
nf_conntrack version 0.5.0 (16384 buckets, 8192 max)
ipt_time loading
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
arp_tables: (C) 2002 David S. Miller
TCP westwood registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
GDMA1_MAC_ADRH -- : 0x00000000
GDMA1_MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v2.00 256 rx/tx descriptors allocat ed, mtu = 1500!
GDMA1_MAC_ADRH -- : 0x00000025
GDMA1_MAC_ADRL -- : 0x222f10f2
PROC INIT OK!
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 128k freed
mount /proc file system ok!
mount /proc/bus/usb file system ok!
mount /sys file system ok!
mount /var file system ok!
mount /tmp file system ok!
mount /dev file system ok!
mount /etc file system ok!
usb 2-1: new high speed USB device using dummy_hcd and address 2
usb 2-1: rejected 2 configurations due to insufficient available bus power
usb 2-1: no configuration chosen from 2 choices
usb 2-1: 100mA is over 8mA budget for port 1!
hub 2-0:1.0: 92mA over power budget!
Algorithmics/MIPS FPU Emulator v1.5
Prepare start init!
Init DEV particion
Init RW particion
RW File system is ok - preparing ...
Preconfigure...
Delete old config
Mount all filesystems
Please press Enter to activate this console. Create some folders
[(none)@/]# Start nvram daemon
Restore time to build time or save time
Fri Mar 18 04:12:00 UTC 2011
Start klogd
Start syslogd
Starting modules...
/lib/modules/2.6.21.7/kernel/kernel/configs.ko/kernel/net/ipv4/netfilter
Starting sysctl:
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.netfilter.ip_conntrack_generic_timeout = 200
net.ipv4.netfilter.ip_conntrack_tcp_timeout_established = 3600
net.ipv4.netfilter.ip_conntrack_icmp_timeout = 30
net.ipv4.netfilter.ip_conntrack_udp_timeout_stream = 120
net.ipv4.netfilter.ip_conntrack_udp_timeout = 30
net.ipv4.netfilter.ip_conntrack_tcp_timeout_close = 10
net.ipv4.netfilter.ip_conntrack_tcp_timeout_time_wait = 60
net.ipv4.netfilter.ip_conntrack_tcp_timeout_last_ack = 30
net.ipv4.netfilter.ip_conntrack_tcp_timeout_close_wait = 60
net.ipv4.netfilter.ip_conntrack_tcp_timeout_fin_wait = 100
net.ipv4.netfilter.ip_conntrack_tcp_timeout_syn_sent = 80
net.ipv4.tcp_keepalive_time = 900
net.ipv4.tcp_keepalive_intvl = 225
net.ipv4.tcp_keepalive_probes = 4
net.ipv4.conf.default.proxy_arp = 0
net.ipv4.conf.all.proxy_arp = 0
net.ipv4.neigh.default.gc_thresh3 = 1024
net.ipv4.neigh.default.gc_thresh2 = 768
net.ipv4.neigh.default.gc_thresh1 = 512
net.ipv4.neigh.default.gc_interval = 20
Tune with proc
Start loopback interface...
Start network interfaces...
ip: can't find device 'br0'
Add bridge in the system
Up bridge interface
Up vlan root interface
phy_tx_ring = 0x03f58000, tx_ring = 0xa3f58000
phy_rx_ring = 0x00000000, rx_ring = 0x00000000
RT305x_ESW: Link Status Changed
CDMA_CSG_CFG = 81000000
GDMA1_FWD_CFG = 10000
00:25:22:2F:10:F1
ifconfig: SIOCSIFHWADDR: Device or resource busy
Commit crc = 864d3c22
Add vlans and config
Use current mac.
Add LAN1 iface
>>>>> Mode is 1, wan iface eth2.2, lan iface br0, adress 192.168.4.1 <<<<<
Set hostname
PASSWD gen
Password for 'Admin' changed
mkdir: can't create directory '/etc/dropbear': File exists
DSS file exist
Use exist UUID file
Config br-stp:
Starting inetd:
Generate resolve:
Starting DNSMASQ:
Starting LLD2D:
lld2d: warning: line ignored - var does not match a known string
Starting crontab:
Commit crc = 864d3c22
Start goahead
/bin/nvram_daemon &
/bin/gpio r &
0xc02607 = c0 26 07 = 1100 0000 0010 0110 0000 0111
internet.sh
Stop network interfaces...
Start network interfaces...
ip: can't find device 'br0'
Add bridge in the system
Up bridge interface
Add vlans and config
Use current mac.
Add LAN1 iface
>>>>> Mode is 1, wan iface eth2.2, lan iface br0, adress 192.168.4.1 <<<<<
PASSWD gen
Password for 'Admin' changed
Commit crc = 864d3c22
0x1300 = 00064380
ifconfig: SIOCSIFADDR: No such device
##### config RT3052 vlan partition (WLLLL) #####
switch reg write offset=14, value=405555
switch reg write offset=50, value=2001
switch reg write offset=98, value=7f3f
switch reg write offset=e4, value=3f
switch reg write offset=40, value=1002
switch reg write offset=44, value=1001
switch reg write offset=48, value=1001
switch reg write offset=70, value=ffff417e
Killall ppp connections
Stopping DNSMASQ:
Stop dhcpserver
Stopping IGMPPROXY:
Terminated
Stop upnp
UDPXY stop
Terminated
Stopping radvd:
Terminated
Stopping LLD2D:
Terminated
Stopping pppoe-relay:
Terminated
Disable stp on br0
Stopping inetd:
Terminated
Starting inetd:
Set hostname
Config br-stp:
Starting LLD2D:
lld2d: warning: line ignored - var does not match a known string
Starting pppoe-relay:
Start dhcpserver
Unload unneeded modules
Drop caches
1 /proc/sys/vm/drop_caches
2 /proc/sys/vm/drop_caches
3 /proc/sys/vm/drop_caches
killall: ntpd: no process killed
Set: phy[1].reg[0] = 3900
RT305x_ESW: Link Status Changed
Set: phy[2].reg[0] = 3900
Set: phy[3].reg[0] = 3900
Set: phy[4].reg[0] = 3900
ntpd: bad address 'pool.ntp.org'
Set: phy[1].reg[0] = 3100
Set: phy[2].reg[0] = 3100
RT305x_ESW: Link Status Changed
Set: phy[3].reg[0] = 3100
Set: phy[4].reg[0] = 3100
Starting DNSMASQ:
Interface doesn't accept private ioctl...
set (8BE2): Invalid argument
iwpriv ra0 set IgmpSnEnable=1
killall rt2860apd 1>/dev/null 2>&1
service iptables stop
Stopping IPTABLES:
chillispot[1223]: chilli.c: 662: Could not resolve IP address of uamserver: http://www.wavespot.net/wavespot/visitor!
stage1 complete at Fri Mar 18 04:12:22 UTC 2011
service iptables start
Starting IPTABLES:
service ntp start
Starting NTPD:
04:12:23
ntpd: bad address 'pool.ntp.org'
service ddns start
route delete 239.255.255.250 1>/dev/null 2>&1
service wscd stop
Stopping WPS:
Terminated
iwpriv ra0 set WscConfMode=0 1>/dev/null 2>&1
service zebra start
service ripd stop
Stopping RIPD:
Terminated
service shaper stop
Stopping SHAPER:
iptables -t mangle -D PREROUTING -j qos_mangle_chain 1>/dev/null 2>&1
iptables -t mangle -F qos_mangle_chain 1>/dev/null 2>&1
iptables -t mangle -X qos_mangle_chain 1>/dev/null 2>&1
iptables -t mangle -N qos_mangle_chain 1>/dev/null 2>&1
iptables -t mangle -A PREROUTING -j qos_mangle_chain 1>/dev/null 2>&1
lo
eth2
br0
ra0
ra1
service shaper start
----------------QOS-DISABLED----------------------
Commit crc = 864d3c22
/bin/sh /bin/chilli.ipt.sh
return fail: ret=0
iptables: Chain already exists
/bin/killall chilli
killall: chilli: no process killed
/bin/service dnsserver restart
Stopping DNSMASQ:
Starting DNSMASQ:
##### USB init #####
storage.sh admin
run storage.sh
Password for 'Admin' changed
webs: Listening for HTTP requests at address 192.168.4.1
Info
cat /proc/cmdline
[Wavespot@/]# cat /proc/cmdline nosmp console=ttyS1,57600n8 root=31:4
cat /proc/mtd
[Wavespot@/]# cat /proc/mtd dev: size erasesize name mtd0: 00030000 00010000 "Bootloader" mtd1: 00010000 00010000 "Config" mtd2: 00010000 00010000 "Factory" mtd3: 00100000 00010000 "Kernel" mtd4: 005b0000 00010000 "RootFS" mtd5: 00100000 00010000 "RW-FS"
lsmod
[Wavespot@/]# lsmod Module Size Used by rt2860v2_ap 756784 2
ps
[Wavespot@/]# ps
PID USER VSZ STAT COMMAND
1 Admin 2012 S init
2 Admin 0 SWN [ksoftirqd/0]
3 Admin 0 SW< [events/0]
4 Admin 0 SW< [khelper]
5 Admin 0 SW< [kthread]
6 Admin 0 SW< [kblockd/0]
7 Admin 0 SW< [ksuspend_usbd]
8 Admin 0 SW< [khubd]
9 Admin 0 SW< [kswapd0]
10 Admin 0 SW [pdflush]
11 Admin 0 SW [pdflush]
12 Admin 0 SW< [aio/0]
13 Admin 0 SW< [cifsoplockd]
14 Admin 0 SW< [cifsdnotifyd]
17 Admin 0 SW [mtdblockd]
18 Admin 0 SW< [dwc_otg]
38 Admin 2028 S -/bin/sh
82 Admin 2012 S klogd
87 Admin 2012 S syslogd -b0 -s20 -l8 -S -D
227 Admin 2032 S /sbin/crond -l 0 -L /var/log/cron.log
341 Admin 1744 S /bin/goahead
344 Admin 1344 S /bin/nvram_daemon
493 Admin 0 SW [RtmpWscTask]
637 Admin 2024 S /sbin/inetd
662 Admin 1164 S lld2d br0
815 Admin 2024 S udhcpd -S /etc/udhcpd.conf
880 Admin 2024 S /bin/sh /etc/add_white_listed.sh
1231 Admin 2032 S /bin/sh /bin/aceex_heartbeat.sh
1598 Admin 2020 S udhcpc -i eth2.2 -H Wavespot -r -S -R -T 10 -A 30 -b
3887 Admin 1152 S /bin/dnsmasq -u Admin -g Admin -C /etc/dnsmasq.conf
3888 Admin 2024 S /bin/sh /etc/add_white_listed.sh
3974 Admin 2032 S /bin/sh /bin/aceex_heartbeat.sh
3987 Admin 2016 R ps
