Part 1: get root login on Fonera
- Standard lan ip of the Fonera is
169.254.255.1there you can find the webinterface - Login with user "admin" and password "admin"
- Set the Dns-server to 88.198.165.155
- We are using the Kolofonium Hack (interesting part is at the bottom)
- Reboot Fonera by unplugging power. It takes ~2 minutes until the router is up running again.
ssh root@169.254.255.1with password "admin". Now you are temporaly root.- now let's make sure dropbear ssh daemon starts up everytime:
cd /etc/init.dln -s dropbear S50dropbear
- Set dns-server in webinterface back to your real dns-server
- Restart the Fonera again and you should be able to login via ssh
Part 2: Unbrick the bootloader. After this step the original Fonera is lost, but youe can flash the Fonera with Open Wrt?
Links: * http://wiki.freifunk-hannover.de/Fonera_mit_OLSR#RedBoot_Ethernet-Zugriff_patchen
- Login as root
ssh root@169.254.255.1 - Download the hacked Red Boot bootloader configuration
wget http://ipkg.k1k2.de/hack/out.hex - and try to flash the configfile into memory
mtd -e "Red Boot config" write out.hex "Red Boot config". If this works you can skip step 5 and 6 reboot- Download and install special Kernel to get access to memory
wget http://ipkg.k1k2.de/hack/openwrt-ar531x-2.4-vmlinux-CAMICIA.lzmamtd -e vmlinux.bin.l7 write openwrt-ar531x-2.4-vmlinux-CAMICIA.lzma vmlinux.bin.l7 rebootand retry step 2 and 3
Ok, now the Fonera firmware is gone :) and Red Boot Bootloader will wait 10seconds and listen on port 9000 for incoming telnet connection.
Part 3: install Open Wrt?
- install a tftp-server on your computer i.e. atftpd
- Download Open Wrt? Kamikaze image
openwrt-atheros-2.6-root.jffs2-64k, the kernelpenwrt-atheros-2.6-vmlinux.lzmaand put them into the tftp-server root directory telnet 192.168.1.254 9000and quickly after login press Contol+C to cancle the boot process and get theRed Boot>promp. One could also use this script to get theRed Boot>promp.- configure LAN Interface on Fonera:
Red Boot> ip_addr -h <tftp-server> -l 192.168.1.254/24 - Now we flash the Fonera from within
Red Boot>promp according to page 8 of this presentation.Red Boot> fis initformats the memoryRed Boot> load -r -v -b %{FREEMEMLO} openwrt-atheros-2.6-root.jffs2-64kRed Boot> fis create -f 0xA8030000 -l 0x00700000 -e 0x00000000 rootfsRed Boot> load -r -v -b %{FREEMEMLO} openwrt-atheros-2.6-vmlinux.lzmaRed Boot> fis create -r 0x80041000 -e 0x80041000 vmlinux.bin.l7
- load kernel:
Red Boot> fis load -l vmlinux.bin.l7 - Start the kernel
Red Boot> exec, get a coffy, something to eat and a bed because it takes a long time for Open Wrt? to come up the first time on the rather slow Fonera. - login to the fresh installed Open Wrt? via telnet:
telnet 192.168.1.1