Category: Boneyard

During my Christmas holiday I came across a couple of discarded NetGear WN602v2 boxes. They are clearly marked with NetGear, but also seem to self-identify as a ViasatOnDemand wireless device. From what I can gather, they are used as a wireless network bridge, wirelessly connecting a satellite receiver to a wired Ethernet network. Viasat is a Scandinavian television distributor.

Research

I was curious as to how the device was configured, so I set out on a quest searching for answers. NMAP confirmed my suspicions that the IP was set to 192.168.1.1. I tried connecting to the device both with a browser and a console application with no success. After wading through some misses I came across this forum post revealing that the WN602v2 was in fact a special edition of the WNR612 B: https://dd-wrt.com/phpBB2/viewtopic.php?p=871408. Further research brought me to the OpenWrt page for the WNR612 v2: http://wiki.openwrt.org/toh/netgear/wnr612v2. Here I found a pinout for a serial port jumper that should be located on the board. I pulled out my trusty screwdriver kit and located the T9 screws underneath the rubber feet. Update: Did another one today, and it had T8 screws. Either the factory changed the screws at some point, or they are all T9¾ with really bad tolerances.

T9 is a bit of an odd Torx size, as Torx bit sets usually go from T10 and upward. Thus, you either have a boatload of these laying around or you have never heard about them. They can usually be found in comprehensive mobile repair toolkits or in “specialty bit sets” at your local low cost hardware monstrosity. The same goes for T8.

Once into the box, the jumper was easy to locate. The leftmost pin appears to be labeled 4, but I suspect this is really part of CA114. Anyways, it will henceforth be known as pin four as that corresponds with the data from OpenWrt.

I connected my BusPirate, making sure to not connect the 3.3V line to decrease the risk of releasing the magic blue smoke. After putting the BusPirate in UART pass-through and rebooting the board I was greeted with a OpenWrt console. Version 7.09 Kamikaze to be exact.

I was still unable to log in though, but the bootloader supports overwriting the firmware using TFTP. First I tried loading the latest OpenWrt, v15 at the time of writing. That failed miserably. No matter what I did, the upload would fail after a few seconds. I tried multiple TFTP clients, different cables and whatnot, but to no avail. A Wireshark capture revealed that the TFTP did not receive any ACK-messages as soon as the transfer started. After some time I tried changing the network connection to half duplex 100MB on the client side. That did the trick and the firmware upload completed successfully. Or so I thought until the board restarted…

[ 7.280000] Kernel panic – not syncing: VFS: Unable to mount root fs on unknown-block(31,4)

[ 7.280000] —[ end Kernel panic – not syncing: VFS: Unable to mount root fs on unknown-block(31,4)

[ 82.490000] random: nonblocking pool is initialized

Not really what I call a success… But I persevered and decided to try the latest NetGear fw image for the WNR612v2. To my astonishment it worked perfectly, no problems at all. Some digging around in forums indicated that the load screen messages was probably caused by the firmware image being too big for the flash memory on the board. It was indicated that it was possible to reduce the size of the OpenWrt image by building your own custom image, but that was a bit far from my end goal. All I wanted was access to the box, and possibly to make it usable as a backup router. I knew it was able to run OpenWrt 7, so I decided to just try versions until I found one that worked, starting with v 14, the previous one. And it worked like a charm, ten minutes later I was greeted with the OpenWrt Barrier Breaker console.

I sourced a fitting ethernet RJ45 jack from the usual suspects in Hong Kong and soldered it to the board (shown fitted on the image above). From what I can figure out it should have been blue, but who cares? The next chapter details the process from start to finish without all the dead ends.

Flashing new firmware using TFTP and BusPirate

Just a side note: If you do not possess a BusPirate, do not get one for the sole purpose of flashing this router. The FTDI Friend + from AdaFruit is a lot cheaper and easier to work with. You may also need some jumper wires.

This procedure requires a basic understanding of electronics, ESD shielding and working with exposed circuit boards.

Equipment list

• Windows computer acting as a TFTP client and terminal. You can probably use apples or penguins as an alternative in a pinch.
• BusPirate to interface with the console. (FTDI Friend+ from AdaFruit also works, and probably other FTDI/UART adapters as well.)
• Software: RealTerm and TFTPD64.
• Optional: USB Ethernet adapter.
• Optional: RJ45 PCB connector, 20 x 15,5 x 14 mm, EAN 4894462487914 or similar.

Procedure

• Dismantle the WN602v2. Four torx T9 or T8 screws are located under the rubber feet.
• Remove the board from the case.
• Wire the BusPirate to the console jumper. I did not connect the 3.3V line.

• Black wire to pin 2
• Gray wire to pin 3
• Brown wire to pin 4

• Serial bus interface pinout, pin 4 closest to the heatsink:

• 1: 3.3 V (Not connected to BusPirate)
• 2: TX
• 3: RX
• 4: GND

• BusPirate probe color codes:

• If you use an FTDI Friend, refer to its manual for pinout. Remember to connect RX to TX and vice versa.
• Connect to one of the yellow ethernet ports from the TFTP client computer. Use a USB ethernet dongle to reduce the risk of destroying your computer if something fails.
• Power on the board.
• Check for magic blue smoke. If you see it, abort.
• Set the Ethernet connection to 100mbps, half duplex. If you forget this, you get timeout error messages as the router is in half duplex mode and unable to transmit ACK-messages.
• Set the IP for the connection to 192.168.1.2/24 or anything other than 192.168.1.1 (the router IP).
• Connect to the BusPirate terminal, use Ansi mode in RealTerm.
• Enter UART mode
• Connect to the router console at 115200 baud, default settings for the other parameters.
• Start UART pass-through, macro (1).
• (If you use a FTDI Friend, just connect it at 115200 baud)
• Press a key when requested to interrupt the boot process and enter the bootloader
• Execute “protect off all” to remove any write protection on the firmware memory.
• Execute “fsload” to enter firmware recovery mode.
• Send the firmware image using TFTP client mode on the computer.

• Wait for the update process to complete. The router boots automatically once the process has finished.

• Look at the boot messages to make sure the flash was successful.
• Solder in a plug for the WAN ethernet port if you want to use it. I could only find a shielded version of a connector in the correct size, but the shielding was easily removed. The PCB does not support shielded connectors.

• Dremel out a hole in the backplate for the new connector
• Log in to OpenWrt and configure your new router.
•  

This small SOHO-type switch was subject to an overvoltage on the network cable coming from an ADSL-modem. The modem survived, the switch and one of the attached computers did not. Apologies for the poor image quality, I did not bring my camera gear for this.

In the close-up of the middle part we se that both R22, R24 and C75 are gone.R26 and R28 looks suspicious but may be OK. The Ethernet chips on the reverse side looks fine, and the self test (blinking lights) completed on four of the ports. There is a total of four resistor and capacitor sets, each connected to two ports. As shown in the close-up below, C76, R25 and R27 have also been relieved of their magic blue smoke. As the capacitor is shared between the ports in the set, none of them are working even if only two of the four ports have their resistors blown. It is likely that this is fixable with new resistors and capacitors, as their function is probably to shield the fancy Ethernet control chips from nasty voltages. But, as I do not carry the necessary parts and equipment it was easier to just replace the entire unit for the extortionist price of 30USD at the local brick and mortar store.

Background

I was spending Christmas with relatives on the western coast of Norway. A part of Norway where foul weather is no stranger and heavy rain is the norm. Where the Vikings learned to handle the waves of the Atlantic ocean next door.  Thus we are no strangers to voltage spikes. Power outages due to Thor’s angry electrons are quite common. It can be pretty, but such evening skies are usually a harbinger of bad weather.

And surely it was. The next morning we were hammered by gale force winds. I would rate it as a medium storm, but the meteorologists gave it an official name (Urd, and old Viking female name) and called it extreme weather. The second night of the storm I was awaken by a loud crack from the direction of the intake breaker box located in the guest room, followed by thunder. The howling from the UPS in the server closet revealed a power outage. I waited for about 10 minutes, but all I could hear was the storm. The reason for waiting is this: If there is one place in the house you do not want to be during a lightning-strike, it is with your nose in the breaker box trying to get the power back on.

After a while the lack of electrical heating won over my concerns for further strikes, and I went to look at the main breaker box. I was expecting one of the breakers reduced to a pile of rubble, but everything looked OK.  If you wonder how I found my way through the darkness, let us just say that you do not grow up in this part of Norway without learning how to find one of your many flashlights in the dark. As all seemed OK in the intake box, on I went to investigate the distribution box in the next room. This is where the main distribution breaker, residual current device and surge protectors are located. Both the surge protectors and the residual current device were triggered, along with several circuit breakers. I primed the residual current device and switched it back on. Then I reset the circuit breakers, verified that the electric heater in my room was working and went back to sleep.

I was raised from my slumber by the users (i.e. my relatives) a couple of hours later. They complained about missing internet service and beseeched me to investigate. And investigate I did. For a normal residential house they have quite the advanced setup (I might be to blame for this), but it is made such to be resilient. After the installment of extra surge protectors some years back, the culprit is usually the ADSL modem. There are sadly no phone line surge protectors available that are powerful enough to resist the onslaught, so when the angry electrons enter the house through the phone lines they usually end up killing the modem. The ISDN phone connected to the same line has survived for more than a decade, but that is a German made ancient Siemens device unlike the chinesium crap the ISP calls an ADSL modem that is usually replaced twice per year.

A quick look at the modem revealed not a hint of status LEDs. Hoping for a quick fix in form of a power supply replacement I took it down from its mounting bracket, only to discover the unmistakable rattle of destroyed components from within. The VPN box was also dead.

I called the ISP and convinced them to send over a new modem. Due to this still being Christmas, it would take two days. Which isn’t bad, but usually we could get one the same day.

A quick summary of the components: The Wireless AP is there to provide a consistent WLAN. The modem has one built in, but each time it is replaced, the settings change. The VPN box is placed there by me to facilitate remote support. The DSL splitter is connected to the outside line and sends one signal to the ISDN NT1 and another signal to the modem. The NT1 is located in another room. The box on the lower right is supplied by the satellite TV supplier, and its function is unclear. It has some kind of wireless function, and I suspect it is a dedicated WLAN for the satellite decoder to call home.

Zyxel P8702N

But back to the modem. When you remove the top dark-out cover it looks like this:

It identifies itself as a ZyXEL P8702N, which as far as I can tell is an ISP special, that is, only sold to ISPs. The hardware supports both an internal DSL modem and an external modem/adapter.

I was curious as to which components produced the rattle, so I removed the top cover. No screws, only fidgety plastic clips. Does not look like it is designed to be serviced. First glance revealed three separate confirmed problems.

1 – MNC G4804DG

This chip is a dual port gigabit ethernet line transformer. There are two of them, which correlates to the four LAN ports. There is also a WAN port connected to the G1806DG on the left. There are clear signs of carbon on the board, evident of a blue smoke leak. And as we all know, if the magic blue smoke gets out of the chip it stops working. This should have prompted me to investigate further at the other end of port 3, but more on that later.

2 – DSL line “protection”

The designers have tried to protect the modem from angry electrons by connecting the DSL line to a gas discharge tube and two in-line capacitors. As the picture clearly tells, this was not enough. As far as I could find out the capacitors are low quality chinesium, and I guess that goes for most of this box.

A close-up reveals further damage, even carbon on the connector itself. I would guess that the two capacitors were the source of the loud noise.

3 – Unknown chip

This could be the “modem” part, but it was to small and damaged to identify with the equipment I had available. The board shows a trail of destruction from the DSL-port down to this chip.

VPN Power

All I could find is a broken 3-pin part, probably some kind of transistor. The power was luckily all that was broken, and a retrofit universal model from the local supplier brought it back to life. Local as in 50 clicks away, but I digress.

Network meltdown

I promised to return to case 1 from the modem. The one about carbon on the network interface transformer. After replacing the modem I quickly discovered that the server was no longer accessible. This is your typical small-business setup with one box running file, print, AD and accounting software connected to a couple of clients. There was sadly no time for pictures, but to sum it up, the angry electrons killed a HP Procurve switch and a network adapter in one of the computers.

Summary

All this from a single lightning strike far away. The angry electrons of Thor are not to be scoffed at.

Western Digital Scorpio Blue.

Also known as Ericsson P504

Problem

Gunk and green death on the speaker/mic connector, leading to poor sound performance.

Solution

Disassemble, apply some magical cleaning compound and reassemble. You will need a ball-ended allen key to remove the bolts inside the battery connector. The rest are standard flat and Phillips bolts/screws. There are some really tiny screws holding the display assembly to the main board that are easy to miss. Also, look out for the five springs. Three blade springs on the battery latch, one tiny coil spring on the speaker/mic locking mechanism and another longer coil spring holding a latch on the rear case assembly. I do not know what the latch is for, but I guess it is for some kind of radio dock.

To take the case apart, the rear case assembly goes out and then down. It is pivoting at the antenna connector. The lower part of the front and rear case need to be about 15mm apart before you can pull down on the rear case.

Problem

When you try to power on the PopCorn Hour C-200 mediaplayer, the power led is flashing white and orange, that is alternating white – orange – white – orange… Other than that, the device is dead. No info in the display, no drives spin up and the dvd/blueray tray won’t open.

Analysis

Searching the support forums revealed that this code translates to power supply issues. I removed the power and opened it to examine it closer, and unsurprisingly, the main capacitors were cooked.

The ones outlined in yellow are OK, the ones outlined in red are not. You can see the top of the capacitors mushrooming up, and on one you can se the electrolyte fluid leaking out on the top (lower right, the brown stain). This problem is competing with lightning/overvoltage damage as the most prevalent problem when modern switch mode power supplies like this one fails.

Temporary fix

As this is an ATX compatible power supply, I found an old computer and scavenged it’s power. It’s way oversized, but the C-200 worked without a hitch, thus proving that the rest of the unit wasn’t damaged by the power supply failure.

It isn’t a pretty fix, but it will let you use the unit while waiting for parts.

Continue reading “Popcorn Hour C-200 White/Orange flash”