Hacking COMPLETED Fusee-LEDE Dongle (6$ payload injector)

[FGFlann]

that didnt work, its just flashing blue slowly again

It takes a few attemps for me when I try to do this. I'd recommend trying it a dozen times or so. (Seriously.) But this is the only advice I have to offer, short of disassembling your device and flashing it through the serial interface, which you would have to ask someone else to guide you through because I've never done it. Sorry I can't be of more assistance.

 

[SexiestManAlive]

It takes a few attemps for me when I try to do this. I'd recommend trying it a dozen times or so. (Seriously.) But this is the only advice I have to offer, short of disassembling your device and flashing it through the serial interface, which you would have to ask someone else to guide you through because I've never done it. Sorry I can't be of more assistance.

the usb is suppose to be fat32 formatted correct and theres a red light in it as well, its solid red and blue

 

[FGFlann]

the usb is suppose to be fat32 formatted correct

I would recommend FAT16 as it's the only one I've used for this but FAT32 should work as well.

 

[SexiestManAlive]

I would recommend FAT16 as it's the only one I've used for this but FAT32 should work as well.

its not working, im just gonna buy a phone and use that version

--------------------- MERGED ---------------------------

thats 10 dollars down the drain, oh well

 

[FGFlann]

@capitaineflam25

I think we need to update the OP and stress the importance of updating the bootloader in big bold letters rather than updating from the web interface. Also better links to the various firmwares available and what their features are.

 

[FGFlann]

thanks

Here is the MPR-A1 image as requested. Again this is completely untested, so please be careful and make sure you have the ability to perform emergency recovery before proceeding.

 

[0000ff]

http://r.ebay.com/vR9Rnq

Are these good to go? Just add firmware & USB c cable?

 

[Waip]

http://r.ebay.com/vR9Rnq

Are these good to go? Just add firmware & USB c cable?

It really is some kind of a gamble. The outer shell may be similar, but who knows what's exactly inside / what firmware they flashed on it.

For example I have one that looks EXACTLY like the one in your picture, that I have never been able to use for lack of a valid telnet login

Could be a total walk in the park, could be impossible

 

[0000ff]

It really is some kind of a gamble. The outer shell may be similar, but who knows what's exactly inside / what firmware they flashed on it.

For example I have one that looks EXACTLY like the one in your picture, that I have never been able to use for lack of a valid telnet login

Could be a total walk in the park, could be impossible

Cool. Thanks!!

 

[lufeig]

Here is the MPR-A1 image as requested. Again this is completely untested, so please be careful and make sure you have the ability to perform emergency recovery before proceeding.

thanks! I have a clone unit that has some peculiarities. it's been bricked and unbricked dozens of times, literally.

it has no clear uart soldering points, the stock firmware allowed no telnet or ssh sessions, so things were more difficult than I could anticipate.

last, but not least, its mtp partition size and erase size are a little different from the majority of units I see on the forums

but yesterday I finally managed to make the bootloaders compatible with it.

now it's time to make a firmware work on it too. thanks!!

 

[GnK23]

David Buchanan already explained his great work on this thread but it is now mixed up with other projects so i created this dedicated thread.

The router i bought is this one from AliExpress.

View attachment 133104

I followed David's instructions without any issues
Find attached the already compiled binary file (firmware.bin) for those who want to save some time on compiling.

The update method from the original router website failed (seems common), so i used the USB drive method explained here.
(Only difference was my USB Flash drive popped on /dev/sda and not /dev/sda1)

After rebooting it, the router IP is set to static as 192.168.1.1 so you may need to connect it with an ethernet cable to your computer and force its IP address to 192.168.1.2

Then using WinSCP to connect to the new IP of the router, you can edited /etc/config/network to change it back to DHCP :

config interface 'lan'
    option type 'bridge'
    option ifname 'eth0'
    option proto 'dhcp'

To change the payload (which is fusee by default), use WinSCP to connect to the router and replace /usr/share/fusee-nano/payload.bin

View attachment 133105

Edit : Please find a new default firmware with WiFi enabled at startup (SSID is LEDE, no password), DHCP client enabled by default for ethernet, and SXOS payload as default

Edit 2 : You'll find better images in the following topic that include USB key payload update.

Hi I read your post and I find it very helpful. I just want to ask if this process could work on windows 10? There is an option on windows 10 to turn on telnet. When I read your link it was mentioned there to use the linux pc /laptop. Thank you. Looking forward to try this on my pc since I dont know how to use linux

 

[FGFlann]

Hi I read your post and I find it very helpful. I just want to ask if this process could work on windows 10? There is an option on windows 10 to turn on telnet. When I read your link it was mentioned there to use the linux pc /laptop. Thank you. Looking forward to try this on my pc since I dont know how to use linux

Windows is fine for this process. You will only need a linux environment or equivalent if you want to compile an image yourself.

 

[kruy]

Here is the MPR-A1 image as requested. Again this is completely untested, so please be careful and make sure you have the ability to perform emergency recovery before proceeding.

Can you make flash bin for Hame MPR-A2(A100)?
Thank you.

 

[FGFlann]

Can you make flash bin for Hame MPR-A2(A100)?
Thank you.

Sure thing. I'll post it up when I get home from work.

 

[RazorX2014]

when i connect mine to the pc i get this:

but when i try the upgrade firmware option and select something like openwrt-15.05-ramips-rt305x-a5-v11-squashfs-factory.bin it starts the flashing then the page stops working and even if i leave it awhile nothing happens so i reset it and it takes me back to the same webpage as in the screenshot.

i bought this what do i do?

 

[FGFlann]

when i connect mine to the pc i get this:

but when i try the upgrade firmware option and select something like openwrt-15.05-ramips-rt305x-a5-v11-squashfs-factory.bin it starts the flashing then the page stops working and even if i leave it awhile nothing happens so i reset it and it takes me back to the same webpage as in the screenshot.

i bought this what do i do?

Try the English (Qualcomm) instructions instead. Flashing a new uboot is better than using the web interface because it (mostly) guarantees you have a way to flash a recovery image if something goes wrong. Failing that you should try to identify exactly what the innards of your dongle are so we can try a different image and/or solution if necessary.

 

[RazorX2014]

Try the English (Qualcomm) instructions instead. Flashing a new uboot is better than using the web interface because it (mostly) guarantees you have a way to flash a recovery image if something goes wrong. Failing that you should try to identify exactly what the innards of your dongle are so we can try a different image and/or solution if necessary.

i tried following those instructions the best i could but it says it can't find the mtd_write command

 

[Wierd_w]

i tried following those instructions the best i could but it says it can't find the mtd_write command

That is not all that surprising. It may be necessary to make a statically built mtd_write for this SoC, and include it in the package. That way one could execute the local binary to do the needful, even if the system lacks a copy itself from the factory (Statically built, so there are no missing library dependencies)

The missing mtd_write thing is probably going to be pretty commonplace. Many devices on the market running embedded linux are missing that command. (End users normally have no need of it. It being present means their shitty firmware becomes easily pwn'd by botnets and hackers once the front door gets kicked in using the hard-coded usernames and passwords these kids are so fond of.)

 

[FGFlann]

i tried following those instructions the best i could but it says it can't find the mtd_write command

Could you post the output of "ls /bin/mtd*" and "ls /sbin/mtd*" just to make sure it's not there under a slightly different name?

 

[cracker]

I bricked mine the other day a few minutes after opening it. There is a brief flash of the red led and long blinking of the blue, no wifi, LAN connects but doesn't receive packets. I'm taking a look at the different unbricking methods to see which I should attempt first.