See 'WikiDevi' @ the Internet Archive (MW XML, Files, Images)
upgraded MW to 1.30 - maybe things are slightly less broken

TRENDnet TEW-432BRP D2.0R / D2.1R

From WikiDevi
Jump to: navigation, search

TRENDnet TEW-432BRP D2.0R / D2.1R

Manuf/OEM/ODM Zioncom IP04135

FCC approval date: 03 January 2008
Country of manuf.: China

Type: wireless router

FCC ID: S9ZTEW432BRPD
Industry Canada ID: 6337A-432BRP

Power: 9 VDC, 0.8 A
Connector type: barrel

CPU1: Realtek RTL8186 (180 MHz)
FLA1: 2 MiB
2,097,152 B
16,384 Kib
2,048 KiB
16 Mib
0.00195 GiB
(Macronix MX29LV160DBTI-70G)
RAM1: 16 MiB
16,777,216 B
131,072 Kib
16,384 KiB
128 Mib
0.0156 GiB
(EtronTech EM639165TS-6G)

Expansion IFs: none specified
Serial: yes, 4-pin header, populated, J1, (38400,8,N,1)

WI1 chip1: Realtek RTL8186
WI1 chip2: Realtek RTL8225
WI1 802dot11 protocols: bg
WI1 antenna connector: RP-SMA

ETH chip1: Realtek RTL8186
Switch: Realtek RTL8305SC
LAN speed: 10/100
LAN ports: 4
WAN speed: 10/100
WAN ports: 1

bg

Stock FW OS: Linux 2.4.18 MIPS-01.00

Third party firmware supported: Wive-NG (sfstudio) • (blog)

Default SSID: TRENDnet_432
Default IP address: 192.168.10.1
the IP 192.168.10.1 is used by 100 additional devices
of which 45 are TRENDnet devices
Default login user: admin
Default login password: admin
admin:admin credentials used by 1178 additional devices
of which 48 are TRENDnet devices

802dot11 OUI: 00:14:D1 (34 E, 47 W, 2008)
Ethernet OUI: 00:14:D1 (34 E, 47 W, 2008)

 FCC ID
TRENDnet TEW-432BRP D1.0R / D1.1RS9ZTEW432BRPD
NHPWLG2212V
For a list of all currently documented Realtek chipsets with specifications, see Realtek.
Regarding third party firmware support, Realtek SoC support in OpenWrt
+ (success) RTL8196C port status. on the OpenWrt Forum
and the Realtek thread on the DD-WRT Forum may be of interest.


This revision isn't listed by TRENDnet! trendnet.ru had some info and firmware before 2014.

"ZC-IP04135.C" is imprinted under the solder mask.

It has antenna connector on the left of Reset button, 16 MiB of RAM, but an older 8305 switch chip.

Also in white plastic for a local ISP. Mine is unfortunately standard blue, I bought it through retail.

Stock firmware[edit]

V1.2.06_B101101

Local ISP is probably the only source of firmware left now. I've dumped V1.2.06_B100813 from the retail version of mine and compared those. There's no ISP branding whatsoever in 101101 provided, so feel free to upgrade/unbrick your device. The kernel is almost identical though, with maybe only some minor driver updates.

Realtek bootloader accepts CSYS firmware images through TFTP server on 192.168.1.6. RTL8186 with 2 MiB flash chip makes Wive-NG the only 3rd party firmware supported.

Serial[edit]

[ 3.3V ] ( TX ) ( RX ) ( GND )

Pinout from the rear / LAN side (reversed), see J1 on silkscreen and square pin on the back of the PCB! TX are logs from router to PC (-> RX on PC side), RX commands back (<- TX).

Trendnet TEW-432BRP on OpenWrt wiki features D2 revision too (16 MiB RAM, same pinout). "Auto-Discovery (ver 1.01)" in the boot log is a sort of backdoor. It also phones home to zioncom.gnway.net on port 1981 with WAN MAC and external IP (/bin/productclient.sh).

another boot log

root login is "password" protected (literally!).

Full flash backup[edit]

Set up PC for fixed IP 192.168.1.254, wired connection to LAN port is required. Start terminal at 38400 baud, power on with Reset button pressed until

---Escape booting by user
<RealTek>

is displayed (~5 sec from power on), release Reset then issue

FLR 80300000 0 200000
y

Wait for "Flash Read Successed!", then start TFTP client "get" mode with a file name of your liking. Courtesy of Evgeny Manachkin (sfstudio)

  • starts with bootloader (gzip-packed), MAC OUI with a tail (CRC?) at 0x5FF5
  • 0x6000 - Hardware Settings, most important part to back up! Signature HS02 01 88 00 (size 0x188), then WAN MAC address (6 bytes), LAN MAC, WAN MAC again, wireless calibration?, CRC?
  • 0x8000 - Default Settings (signature DS05W)
  • 0x10000 - Current Settings, signature CS05W. These can be backed up from Web as (0xc7 - each byte ciphered) config.dat. Stock firmware operates on this through wholeflash /dev/mtd, scary stuff!
  • 0x20000 - CSYS firmware, kernel and ext2 rootfs packed together (LZMA 5D 00 00 80 00), several zeroes, CRC-16, 0xFF padding

Looks like super / super login / password pair might also work (another backdoor).

Images[edit]

All electrolytic caps were replaced on this one since at least one 470uF failed (glowing hot). Probably due to 1000uF in wall brick not soldered in from the factory - and polarity reversed too. I've replaced it as is and blown a fine brand new Jamicon WL...