See 'WikiDevi' @ the Internet Archive (MW XML, Files, Images)
upgraded MW to 1.30 - maybe things are slightly less broken
TRENDnet TEW-432BRP D2.0R / D2.1R
This revision isn't listed by TRENDnet! trendnet.ru had some info and firmware before 2014.
"ZC-IP04135.C" is imprinted under the solder mask.
It has antenna connector on the left of Reset button, 16 MiB of RAM, but an older 8305 switch chip.
Also in white plastic for a local ISP. Mine is unfortunately standard blue, I bought it through retail.
Local ISP is probably the only source of firmware left now. I've dumped V1.2.06_B100813 from the retail version of mine and compared those. There's no ISP branding whatsoever in 101101 provided, so feel free to upgrade/unbrick your device. The kernel is almost identical though, with maybe only some minor driver updates.
Realtek bootloader accepts CSYS firmware images through TFTP server on 192.168.1.6. RTL8186 with 2 MiB flash chip makes Wive-NG the only 3rd party firmware supported.
[ 3.3V ] ( TX ) ( RX ) ( GND )
Pinout from the rear / LAN side (reversed), see J1 on silkscreen and square pin on the back of the PCB! TX are logs from router to PC (-> RX on PC side), RX commands back (<- TX).
Trendnet TEW-432BRP on OpenWrt wiki features D2 revision too (16 MiB RAM, same pinout). "Auto-Discovery (ver 1.01)" in the boot log is a sort of backdoor. It also phones home to zioncom.gnway.net on port 1981 with WAN MAC and external IP (/bin/productclient.sh).
root login is "password" protected (literally!).
Full flash backup
Set up PC for fixed IP 192.168.1.254, wired connection to LAN port is required. Start terminal at 38400 baud, power on with Reset button pressed until
---Escape booting by user <RealTek>
is displayed (~5 sec from power on), release Reset then issue
FLR 80300000 0 200000 y
Wait for "Flash Read Successed!", then start TFTP client "get" mode with a file name of your liking. Courtesy of Evgeny Manachkin (sfstudio)
- starts with bootloader (gzip-packed), MAC OUI with a tail (CRC?) at 0x5FF5
- 0x6000 - Hardware Settings, most important part to back up! Signature HS02 01 88 00 (size 0x188), then WAN MAC address (6 bytes), LAN MAC, WAN MAC again, wireless calibration?, CRC?
- 0x8000 - Default Settings (signature DS05W)
- 0x10000 - Current Settings, signature CS05W. These can be backed up from Web as (0xc7 - each byte ciphered) config.dat. Stock firmware operates on this through wholeflash /dev/mtd, scary stuff!
- 0x20000 - CSYS firmware, kernel and ext2 rootfs packed together (LZMA 5D 00 00 80 00), several zeroes, CRC-16, 0xFF padding
Looks like super / super login / password pair might also work (another backdoor).
All electrolytic caps were replaced on this one since at least one 470uF failed (glowing hot). Probably due to 1000uF in wall brick not soldered in from the factory - and polarity reversed too. I've replaced it as is and blown a fine brand new Jamicon WL...