Hacking COMPLETED Fusee-LEDE Dongle (6$ payload injector)

[capitaineflam25]

You can actually use the dongle's wifi to do the initial setup, no need for ethernet at all. You just won't be able to connect to it afterwards when it's done. But you can still change firmwares using a flash drive going forward.

Maybe it’s possible to create an image with payload injection and WiFi activated by defaut ?

 

[FGFlann]

Maybe it’s possible to create an image with payload injection and WiFi activated by defaut ?

I'm sure it's possible in theory. In practice I don't know if it can be done with the amount of storage space on the device. Defintely something to try though.

 

[capitaineflam25]

I'm sure it's possible in theory. In practice I don't know if it can be done with the amount of storage space on the device. Defintely something to try though.

An alternative could be a hotplug script that automatically mount any USB key it detects and take the file « payload.bin » and replace it on the router.
It would make an easy payload update method.

 

[valyndaslayer]

can I release a full tutorial for the noobs?

As a noob myself I feel this tutorial is kinda hard, and not really helpful especially if you want to change the payload to TX one...

The only thing helpful is the compiled file, it is amazing! thanks op!

 

[capitaineflam25]

can I release a full tutorial for the noobs?

As a noob myself I feel this tutorial is kinda hard, and not really helpful especially if you want to change the payload to TX one...

The only thing helpful is the compiled file, it is amazing! thanks op!

Very good idea, i was just sharing my personal experience and compiled file, i'm not very good for explaining.

 

[nasune]

Can anyone give me a hand with this? I've gone through the steps and the dongle does not work at all (no LED, no payload injection, and the ethernet port has stopped functioning as well). Is there anything that can be done?

 

[valyndaslayer]

Can anyone give me a hand with this? I've gone through the steps and the dongle does not work at all (no LED, no payload injection, and the ethernet port has stopped functioning as well). Is there anything that can be done?

brick?... whoa..

Very good idea, i was just sharing my personal experience and compiled file, i'm not very good for explaining.

okay, should I just make new thread and point the credit and download for the file here?

 

[capitaineflam25]

okay, should I just make new thread and point the credit and download for the file here?

Maybe a new thread will be clearer

 

[FGFlann]

Can anyone give me a hand with this? I've gone through the steps and the dongle does not work at all (no LED, no payload injection, and the ethernet port has stopped functioning as well). Is there anything that can be done?

Temporarily change your ethernet settings to manual as in the attached image and see if you can get a response from the dongle through SSH (port 22) or Telnet (port 23).

Failing that you can attempt to reflash by inserting a FAT formatted usb drive containing a stock or custom firmware.bin, and holding the reset button as you turn on the dongle.

If still no response, you've probably bricked it somehow. Maybe incorrect bootloader.

 

[nasune]

brick?... whoa..

Vefore anyone panics, let me reiterate that this is a problem with the dongle, my switch is fine. I must also admit to not knowing whether this is a brick or something else. I'm technically stuck at the change the ip to *.*.*.2 step since I can't connect to the dongle anymore.
edit.

Temporarily change your ethernet settings to manual as in the attached image and see if you can get a response from the dongle through SSH (port 22) or Telnet (port 23).

Failing that you can attempt to reflash by inserting a FAT formatted usb drive containing a stock or custom firmware.bin, and holding the reset button as you turn on the dongle.

If still no response, you've probably bricked it somehow. Maybe incorrect bootloader.View attachment 134490

I'm going to give it a try right away, I'll post the results.

 

[valyndaslayer]

Maybe a new thread will be clearer

oh wait, my version is only tested with the built-in battery version of the router (google Hame-A1). I think your version of router (a5-v11) is untested with the method i use..

 

[stewacide]

Maybe it’s possible to create an image with payload injection and WiFi activated by defaut ?

This would be glorious. An image to load SX, another for Hekate, etc. Given everyone wants to do the same simple thing, a pre-rolled image seems ideal.

 

[nasune]

Well that didn't work either (thanks though). However after opening it up I'm fairly certain that it got damaged (physically) somehow. Either in the mail, or before it left the factory (there are some loose solder joints, hell the reset button had actually come loose). I guess it completely broke down when I was making my attempt.

 

[FGFlann]

Wireless is working fine with the default lede. I turned it back on simply by editing '/etc/config/wireless', thusly:

config wifi-device 'radio0'
option type 'mac80211'
option channel '11'
option hwmode '11g'
option path 'platform/10180000.wmac'
option htmode 'HT20'
option disabled '0'

config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid '3GWIFI_XXXX'
option encryption 'psk2'
option key '12345678'

 

[capitaineflam25]

Nice !

From the image available on this thread, you can just comment the option disabled '1' line by adding a # in front of it and after rebooting you will have access to the dongle with a WiFi called "LEDE" without password.

If someone know how can i modify this file before building the image i can make a new one.

 

[FGFlann]

I tried setting up usb storage and ran out of space on the device.

* opkg_conf_write_status_files: Can't open status file //usr/lib/opkg/status: No space left on device

So that's not happening, lol.

 

[capitaineflam25]

I found a solution to override some files when compiling OpenWRT/LEDE

Please find a new default firmware with WiFi enabled at startup (SSID is LEDE, no password), DHCP client enabled by default for ethernet, and SXOS payload as default.

This has been not tested, use it at your own risks.

 

[Waip]

This is a bit slow on the response time, and I apologize.

I have been digging into the "WD LOGIN" variant, and found a site about hacking these devices that is in Russian, where they discuss the devices briefly. Sadly, they suggest that this model ALSO lacks a serial debug header. If you would be so kind as to validate this with a disassembly of your affected model, it would be great.

Just gently disassemble the shell, and take a good quality photo of the board, and upload it, if you can.

But of course
Man I love your dedication, russian hardware hacking sites are not your average Joe's source of info
If you end up finding the login, I'd be sooo grateful

 

[z10m]

that guide doesn't seem to work for me...
at that step:
"Upgrade uboot - be careful, do not reset router during and after this operation !
mtd_write write /mnt/uboot_usb_256_03.img Bootloader"

I'm getting: "mtd_write: not found"

any ideas guys..?

 

[FGFlann]

that guide doesn't seem to work for me...
at that step:
"Upgrade uboot - be careful, do not reset router during and after this operation !
mtd_write write /mnt/uboot_usb_256_03.img Bootloader"

I'm getting: "mtd_write: not found"

any ideas guys..?

Can you share the model of router you're trying this on?