Howto install OpenWRT Kamikaze on a Fonera


Step 1: Get a root shell

Connect an ethernet cable between your PC and la Fonera, and the configure the ethernet interface on your linux laptop with the following IP address:

ifconfig eth0 broadcast netmask

Test your connexion with the router with ping

ping -c 3

Then you can activate the SSH dropbear server on la Fonera with the following command (works for version below 0.7.xx) (local copy of

echo -e '/usr/sbin/iptables -I INPUT 1 -p tcp —dport 22 -j ACCEPT\n/etc/init.d/dropbear' | perl admin

Then you are able to have a shell on the box

ssh 1.552.452.961|toor#1.552.452.961|toor
Password: admin
root shell!

Step 2: Install fon-telnet-redboot

Once you have a shell on the box, download on your laptop fon-telnet-for-redboot_1_mips.ipk (local copy), and upload the package to the router fonera via scp:

zoobab@mylaptop$ scp fon-telnet-for-redboot_1_mips.ipk 1.552.452.961|toor#1.552.452.961|toor:/tmp
Password: admin

Then login to the router

ssh 1.552.452.961|toor#1.552.452.961|toor
Password: admin

And install the package via the following command:

root@Fon$ ipkg install /tmp/fon-telnet-for-redboot_1_mips.ipk

It takes 10 seconds and you get a root shell back. Reboot the router by typing:

root@Fon$ reboot

Step3: Reflash with AP51 utils

Download the 3 following files on your harddisk: openwrt-atheros-2.6-root.jffs2-64k,openwrt-atheros-2.6-vmlinux.lzma, and ap51-flash-1.0-42.

Then launch the ap-utils:

chmod +x ap51-flash-1.0-38
sudo ./ap51-flash-1.0-38 eth0 openwrt-atheros-2.6-root.jffs2-64k openwrt-atheros-2.6-vmlinux.lzma

It takes 10 minutes or so, go drink a coffee or tea.

Step 4: JTAG La Fonera




Apparently the TRST and VCC pins needs to be connected together with a 100ohms resistor:



I used Tjtag3, which has SPI support for the flash. You can find the sources and the binaries for Linux 32bits, 64bits and Windows in

root@lehne /home/zoobab [21]# ./tjtag3 -probeonly /fc:25

 EJTAG Debrick Utility v3.0 RC1 Tornado-MOD 

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000000000000000000000000000001 (00000001)
*** Found a Atheros AR531X/231X CPU chip ***

    - EJTAG IMPCODE ....... : 01000000010000000100000000000000 (40404000)
    - EJTAG Version ....... : 2.6
    - EJTAG DMA Support ... : No
    - EJTAG Implementation flags: R4k ASID_8 NoDMA MIPS32

Issuing Processor / Peripheral Reset ...  ECR: 0x00000008 Done
Enabling Memory Writes ... Skipped
Halting Processor ... 
00000000000100010000000000001000 (00110008)
00000000000000000000000000001000 (00000008)
<Processor Entered Debug Mode!> ... Done
root@lehne /home/zoobab [22]#

Flash dumps

You need sometimes to power on/off the Fonera to have the dump working correctly with the command:

root@lehne /home/zoobab [22]# ./tjtag3 -backup:wholeflash /fc:25

Reflashing with dumps

It takes a while (8 hours for me!) to reflash the complete flash chip with the simple jtag adaptor on parallel port.

From the following webpage Autopsy of a Fonera, you can read:

Two memory ICs are available on the Fonera, the first is an ST M25P64 serial flash, with a 50MHz SPI bus and 64Mbit capacity (8MB), in 300mil SO16 format. The fact that SPI has been chosen has the advantage that extra memory devices could be attached to the bus, but it has the caveat that it is slower than a parallel bus. Thus, flashing a new firmware could take a rather long time.

Reflash only the bootloader

Since reflashing the whole chip with JTAG and a parallel port takes too much time for most people, it is useful to reflash only the bootloader (256KB=30mins instead of 8MB=8hours). I still have to try to reflash the dumped bootloader on a virgin flash to see if I can easily use ap51 to rescue the machine.

Write the bootloader — Work In Progress — tjtag3 is segfaulting:

Manual Flash Selection ... Done

Flash Vendor ID: 00000000000000000000000000100000 (00000020)
Flash Device ID: 00000000000000000010000000010111 (00002017)
*** Manually Selected a STMicro M25P64             (8MB) Serial Flash Chip ***

    - Flash Chip Window Start .... : 1c000000
    - Flash Chip Window Length ... : 00800000
    - Selected Area Start ........ : a8000000
    - Selected Area Length ....... : 00040000

*** You Selected to Flash the AR-CFE.BIN ***

Flashing Routine Started
Total Blocks to Erase: 0

Loading AR-CFE.BIN to Flash Memory...
[  0% Flashed]   a8000000: 00000000 00000000 00000000 00000000
[  0% Flashed]   a8000010: 00000000 00000000 00000000 00000000
[  0% Flashed]   a8000020: 00000000 00000000 00000000 00000000


[ 63% Flashed]   a8028ee0: 00000000 00000000 00000000 00000000
[ 63% Flashed]   a8028ef0: 00000000 00000000 00000000 00000000
[ 63% Flashed]   a8028f00: 00000000 Segmentation fault


On the todolist:

  • blank the flash — does not seem to work…
  • test it with ap51
  • find if OpenOCD or UrJTAG support SPI flashes

Hardware list

  • zoo03 00:18:84:24:07:78
  • zoo20 00:18:84:24:A1:D0


root@buzek /home/zoobab [3]# jtag

UrJTAG 0.9 #1476
Copyright (C) 2002, 2003 ETC s.r.o.
Copyright (C) 2007, 2008 Kolja Waschk and the respective authors

UrJTAG is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for UrJTAG.

WARNING: UrJTAG may damage your hardware!
Type "quit" to exit, "help" for help.

jtag> cable JTAGkey
Connected to libftdi driver.
jtag> detect
IR length: 5
Chain length: 1
Device Id: 00000000000000000000000000000001 (0x0000000000000001)
  Unknown manufacturer!
chain.c(149) Part 0 without active instruction
chain.c(200) Part 0 without active instruction
chain.c(149) Part 0 without active instruction
jtag> initbus ejtag
ejtag.c(292) EJCONTROL or EJIMPCODE register not found
bus initialization failed!

Following the steps mentioned here:

jtag> instruction length 5
jtag> register IMP 32
jtag> instruction IMPCODE 00011 IMP
jtag> instruction IMPCODE
jtag> shift ir
jtag> shift dr
jtag> dr
01000000010000000100000000000000 (0x40404000)



Add a New Comment
or Sign in as Wikidot user
(will not be published)
- +