Hacking AutoRCM Implementation by Reisyukaku

[Xandroz]

great news, i wouldnt mind a mod chip install or hardware mods but to ditch the pc part.

 

[Captainstryder]

So does this make it impossible to boot from anything other than a RCM payload ? If so that would essentially softboot your switch unless you had a payload delivery system on you (if the switch turns off).

Am I wrong?

 

[Wierd_w]

Just about any microcontroller with a gpio, and a USB interface would work if you stuck the tiny was7227q IC on. Seriously, the thing is damned tiny. So tiny it is meant exclusively for mechanical assembly. A custom PCB breakout for one would likely not be that expensive to have made to order from the usual suspects.

Hardware modchips are not my specialty though. I am much more interested in making a flashable image for a commodity device to serve as a replacement/alternative to the SX dongle.

 

[James310]

So does this make it impossible to boot from anything other than a RCM payload ? If so that would essentially softboot your switch unless you had a payload delivery system on you (if the switch turns off).

Am I wrong?

Yup, but you can always “unbrick” it to go back to normal...

 

[Billy Acuña]

This + a dogle with hekate ipl payload = perfect dual coldboot time

 

[Captainstryder]

This + a dogle with hekate ipl payload = perfect dual coldboot time

Hope someone produces the TX dongles for sale as a stand alone product. Dunno if I want to pay for their software, but I'll pay for a little gadget like that.

 

[Billy Acuña]

Hope someone produces the TX dongles for sale as a stand alone product. Dunno if I want to pay for their software, but I'll pay for a little gadget like that.

Someone is alreally working to get a open-source solution of the dongle

 

[Captainstryder]

Someone is alreally working to get a open-source solution of the dongle

Great news!

 

[Wierd_w]

Hope someone produces the TX dongles for sale as a stand alone product. Dunno if I want to pay for their software, but I'll pay for a little gadget like that.

Myself and others are working on a software payload for commodity devices!

A suitable candidate can be obtained right now from aliExpress and some other places. It does not have a brand name (being a chinese POS), but supports OpenWRT. A C implementation of the FG injector for embedded linux was recently released by one of our own, and the combination is ripe for exploitation.

Once I get the test article, and cook up the flashable image, it's off to the races.

 

[peteruk]

Always love Rei's work

 

[Deleted_444986]

Myself and others are working on a software payload for commodity devices!

A suitable candidate can be obtained right now from aliExpress and some other places. It does not have a brand name (being a chinese POS), but supports OpenWRT. A C implementation of the FG injector for embedded linux was recently released by one of our own, and the combination is ripe for exploitation.

Once I get the test article, and cook up the flashable image, it's off to the races.

Is this the mentionned releases ? https://github.com/atlas44/sam-fusee-launcher

 

[Wierd_w]

Is this the mentionned releases ? https://github.com/atlas44/sam-fusee-launcher

No.

Retroid made his own.
https://github.com/DavidBuchanan314/fusee-nano

It is purpose made for linux SoCs.

 

[Deleted_444986]

No.

Retroid made his own.
https://github.com/DavidBuchanan314/fusee-nano

It is purpose made for linux SoCs.

can you post the link of the product or pm me please

 

[Wierd_w]

can you post the link of the product or pm me please

The device has a rather cryptic identifier from OpenWRT, because it does not have a "Brand name." It is one of those horrible chinese no-name products.

That said, here is the OpenWRT page for the device..
https://wiki.openwrt.org/toh/unbranded/a5-v11

It lays bare the caveats about consistency of the product line... But it is still hard to pass up as a hardware candidate.

As for where to buy-- AliExpress, Ebay, etc.

 

[Deleted_444986]

The device has a rather cryptic identifier from OpenWRT, because it does not have a "Brand name." It is one of those horrible chinese no-name products.

That said, here is the OpenWRT page for the device..
https://wiki.openwrt.org/toh/unbranded/a5-v11

It lays bare the caveats about consistency of the product line... But it is still hard to pass up as a hardware candidate.

As for where to buy-- AliExpress, Ebay, etc.

your solution can run any payload ?

 

[Wierd_w]

your solution can run any payload ?

I still need to create (and test) the flashable image. However, that is the plan Stan. The C based injector accepts a payload file on the command line. While the space on the device is very limited, It isnt like the FG payload file is terribly large. I expect a very small JFF2 partition with pivot mount to be possible. New payloads could be placed there.

 

[Deleted_444986]

but it's a 3G router ???

I still need to create (and test) the flashable image. However, that is the plan Stan. The C based injector accepts a payload file on the command line. While the space on the device is very limited, It isnt like the FG payload file is terribly large. I expect a very small JFF2 partition with pivot mount to be possible. New payloads could be placed there.

 

[Ericthegreat]

This seems fine, if we had a way to flash boot, but according to the other thread, easy way to brick.

 

[Wierd_w]

but it's a 3G router ???

It is a small MIPS based SoC, with 4mb of SPI flash, and 32mb of RAM, with a USB2 host port and Wifi.
The device is a "3g router" in the sense that you can plug your own cellular USB dongle into the port, and then it bridges the connection over Wifi for you.

We intend to use that USB port for our own purposes. OpenWRT typically uses any unused space in the flash chip to create a writable partition with the JFFS2 file system. Since there is only 4mb of space TOTAL on this thing, the squashfs root image will gobble up most of it. However, I expect about 1mb-ish of space to be free for JFFS2. New payloads can be persistently saved there, if this holds true.

 

[subcon959]

Ah so is this how we will boot ReinandNX?

(I will never give up!)