A few days ago I got this device for free and I thought that maybe I could run OpenWrt on it, so that I could use it alongside with my other WPA3 OpenWrt hotspots.
A quick search for OpenWrt support came up empty but wikidevi has many interesting informations about this device:
Here's what’s inside this access point:
On a closer look you may have noticed that there's a smaller daughter board, on the left of the heatsink. It’s a 256 MB USB DOM (Disk on Module) manufactured by A-DATA, and that’s another similarity with the ER-Lite.
Dumping the DoM however reveals a different situation than the EdgeRouter, that has a 4MB onboard flash that contains a bootloader that boots from the DoM plus a 4GB disk on module that contains the kernel and the rootfs, because there’s no kernel partition and the two partitions appear to contain only configuration data and some binary images that I wasn’t (binwalk wasn't I should say) able to analyse.
After poking around a bit with ZySh (the built in shell) and having found no way to get a regular shell (none of this worked, even if maybe my hopes were a little too high), I’ve decided to have a look at the official firmware upgrade files.
They’re a ZIP archive containing different binary files, but more interestingly this PDF, where it’s stated how to interact with the bootloader.
Note: there’s a root account which maybe has a true shell, but I didn’t know the password (and there was none in the configuration files) so I couldn’t use it. If you happen to find out what the password is, you can ssh root@zyxel and probably find some useful informations.
The board has a JTAG header (JP4) and an RS232 serial port that’s accessible via a mini DIN 6 connector located on the left of the RJ45 jack. The pinout is the following:
This piece of information was gathered by probing between the RS232 to TTL chip and the serial port.
My journey ends here today, but this project isn’t finished yet and I hope to be able to boot OpenWrt on this AP soon.
The next thing to do is to figure out how to interact with the bootloader and make the device boot a ramdisk image, as Borromini said
In the meantime I want to thank Borromini from the OpenWrt forum for pointing me in the right direction and you for having read this article.