IpTIME N8004R

"04176C" is silkscreened on the board. It is presumed this device is a Zioncom IP04176 (though it could potentially be a IP04173).

Speed comparison with the N5004 on http://koreatechblog.com
 * ipTime N8004R using RealTek RTL8198 chip introduced December 2011 W94,000
 * is an enhanced version of N8004 using RaLink RT3662 chip introduced July 2011

Q+A on the ipTIME site showing SoCs used by various ipTIME routers, including this one

It is assumed this device uses RTL8192DR (/ RTL8192DE .. any difference? ) and RTL8192CE. Per the ipTIME website, this device has 4MB Flash and 64MB RAM.
 * Per the below serial dump, the PCI IDs for the radios are 10ec:8193 (default 92DE ID) and 10ec:8191 (88CE ID per the pci-id repo).

Additional internal images (KR)

Review on funfunhan.com (KR)
 * The power adapter shown is a Shen Zhen City Hong Ben ELectronic Co., Ltd HB12B-050250SPA (5V, 2.5A).

The same parent Zioncom product may also be sold as the TOTOLINK N500RDG.

Pinout
Obviously, the UART pins are located @ the header clearly labeled UART.

Pinout seems to be... (3.3) (TxD) (RxD) (GND)

|  | ---> to SPI Flash |  v to JTAG / ICE

Info derived from
{{SCollapse|boot log

Booting...

=
SPI ============= SDRAM CLOCK:168MHZ

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ @ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize @      0h  c22016h      c2h      20h      16h       0h      16h  400000h @ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName @  10000h      40h    1000h     400h     100h      10h      54h MX25L3205D @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

---RealTek(RTL8198)at 2011.04.08-10:22+0900 version v1.1g [16bit](500MHz) Delay 1 second till reset button Magic Number: DEFAUL 00000000 Check Firmware(05020000) : product_id:, size: 0x001fdfc8 >[ OK ] Jump to image start=0x80500000... decompressing kernel: Uncompressing Linux... done, booting the kernel. done decompressing kernel. start address: 0x80003640 CPU revision is: 0000dc02 Determined physical RAM map: memory: 04000000 @ 00000000 (usable) Zone PFN ranges: Normal  0x00000000 -> 0x00004000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00004000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 Kernel command line: console=ttyS0,38400 root=/dev/mtdblock1 icache: 16kB/32B, dcache: 8kB/32B, scache: 0kB/0B NR_IRQS:48 PID hash table entries: 256 (order: 8, 1024 bytes) console handover: boot [early0] -> real [ttyS0] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 56128k/65536k available (2220k kernel code, 9340k reserved, 608k data, 104k init, 0k highmem) Calibrating delay loop... 498.07 BogoMIPS (lpj=2490368) Mount-cache hash table entries: 512 net_namespace: 524 bytes NET: Registered protocol family 16 bio: create slab  at 0 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered NET: Registered protocol family 1 squashfs: version 4.0 (2009/01/31) Phillip Lougher io scheduler noop registered io scheduler cfq registered (default) Realtek GPIO Driver for Flash Reload Default Init IPTIME GPIO: Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x18002000 (irq = 8) is a 16550A PPP generic driver version 2.4.2 MPPE/MPPC encryption/compression module registered NET: Registered protocol family 24 RTL8192C/RTL8188C driver version 1.6 (2011-07-18)

>>INSIDE rtl8192cd_init_one <<
PCIE reset (0) Do MDIO_RESET 98 - 40MHz Clock Source Find Port=1 Device:Vender ID=819310ec vendor_deivce_id=819310ec

>>INSIDE rtl8192cd_init_one <<
PCIE reset (0) Do MDIO_RESET 98 - 40MHz Clock Source Find Port=0 Device:Vender ID=819110ec vendor_deivce_id=819110ec

>>EXIT rtl8192cd_init_one <<
Probing RTL8186 10/100 NIC-kenel stack size order[3]... chip name: 8196C, chip revid: 0 ==Set GPHY Parameter OK NOT YET Set threshould idx 0 eth0 added. vid=9 Member port 0x11e... eth1 added. vid=8 Member port 0x1... eth2 added. vid=9 Member port 0x2... eth3 added. vid=9 Member port 0x4... eth4 added. vid=9 Member port 0x8... [peth0] added, mapping to [eth1]... SPI INIT - Force into Single IO Mode SPI flash(MX25L3205D/E) was found at CS0, size 0x400000 Creating 2 MTD partitions on "flash_bank_1": 0x000000000000-0x000000400000 : "boot+cfg+linux+rootfs" 0x000000100000-0x000000400000 : "root fs" nf_conntrack version 0.5.0 (1024 buckets, 4096 max) NETDETECT target register ip_nat_bnet: Trying to register for port 6112 ip_tables: (C) 2000-2006 Netfilter Core Team TCP cubic registered ==> create_proc_ipclone form DEV.c NET: Registered protocol family 17 Netlink[Kernel] create socket for igmp ok. VFS: Mounted root (squashfs filesystem) readonly on device 31:1. Freeing unused kernel memory: 104k freed mount /proc file system ok! mount /tmp file system ok! alias:n8004r version:8.02 Default Configuration
 * No chipID Sft chipSize blkSize secSize pageSize sdCk opCk      chipName    |
 * 0 c22016h 0h  400000h  10000h   1000h     100h   86    0      MX25L3205D/E|

=
==================================================== press magic key to change default setting ... LAN MAC : 00:26:66:C4:D5:58 WAN MAC : 00:26:66:C4:D5:59 Bridge Init device wlan1-wds0 is not a slave of br0 device wlan1-wds1 is not a slave of br0 device wlan1-wds2 is not a slave of br0 device wlan1-wds3 is not a slave of br0 device wlan1-vxd is not a slave of br0 device wlan0-wds0 is not a slave of br0 device wlan0-wds1 is not a slave of br0 device wlan0-wds2 is not a slave of br0 device wlan0-wds3 is not a slave of br0 device wlan0-vxd is not a slave of br0 Jan 1 00:00:16 miniupnpd[194]: Reloading rules from lease file Jan 1 00:00:16 miniupnpd[194]: could not open lease file: /var/run/upnp_pmlist Jan 1 00:00:16 miniupnpd[194]: HTTP listening on port 43041 PPTP Server Start!! sh: insmod: not found killall: iapp: no process killed killall: wscd: no process killed killall: iwcontrol: no process killed

WiFi Simple Config v1.19 (2011.07.28-00:28+0000).

Reaped 192 Reaped 193 Reaped 212 Reaped 224 Reaped 228 Reaped 232 Invalid Save : DEFAULT SIGNAL -> Config Update signal progress Check DHCP PID Elapsed Time: 0 SIGNAL -> WAN ip changed Reaped 236 iwcontrol RegisterPID to (wlan0) iwcontrol RegisterPID to (wlan1) sh: can't create /proc/gpio: nonexistent directory sh: can't create /proc/gpio: nonexistent directory }}

cat /proc/version
Linux version 2.6.30.9 (rtl98wl2@localhost.localdomain) (gcc version 3.4.6-1.3.6) #164 Mon Nov 7 14:26:08 KST 2011
 * 1) cat /proc/version

cat /proc/cpuinfo
system type            : RTL8198 processor              : 0 cpu model              : 56322 BogoMIPS               : 498.07 tlb_entries            : 32 mips16 implemented     : yes
 * 1) cat cpuinfo

cat /proc/mtd
dev:   size   erasesize  name mtd0: 00400000 00001000 "boot+cfg+linux+rootfs" mtd1: 00300000 00001000 "root fs"
 * 1) cat mtd

cat /proc/cmdline
console=ttyS0,38400 root=/dev/mtdblock1
 * 1) cat /proc/cmdline

ps aux
PID USER      VSZ STAT COMMAND 1 root     2720 S    /sbin/init 2 root        0 SW<  [kthreadd] 3 root        0 SW<  [ksoftirqd/0] 4 root        0 SW<  [events/0] 5 root        0 SW<  [khelper] 6 root        0 SW<  [async/mgr] 7 root        0 SW<  [kblockd/0] 8 root        0 SW   [pdflush] 9 root        0 SW<  [kswapd0] 10 root        0 SW<  [mtdblockd] 194 root     2644 S    upnpd 208 root     2668 S    httpd 210 root     3372 S    /sbin/dhcpd 215 root     2700 S    apcpd 217 root     2700 S    /sbin/iptables-q 225 root     2576 S    /sbin/pptpd -b br0 229 root     1096 S    /bin/iapp wlan0 wlan1 233 root     1376 S    /bin/wscd -start -both_band_ap -c /var/wsc.conf -w wl  237 root      1120 S    /bin/iwcontrol wlan0 wlan1 241 root     2604 S    /sbin/dhclient -i eth1 -p dhclient.eth1 254 root     1344 S    /bin/sh 267 root     1336 R    ps aux
 * 1) ps aux

cat /etc/passwd
root::0:0:root::/bin/sh nobody::99:0:nobody:/:/bin/sh bin::99:0:efm-sw:/bin:/bin/sh admin:$1$9Sideh27$eAiGI2LbLrtHkY6lAsoou0:0:0:root::/bin/sh
 * 1) cat /etc/passwd

cat /proc/meminfo
MemTotal:         56300 kB MemFree:           42424 kB Buffers:             904 kB Cached:             2788 kB SwapCached:            0 kB Active:             3124 kB Inactive:           2364 kB Active(anon):       1796 kB Inactive(anon):        0 kB Active(file):       1328 kB Inactive(file):     2364 kB SwapTotal:             0 kB SwapFree:              0 kB Dirty:                 0 kB Writeback:             0 kB AnonPages:          1812 kB Mapped:             1028 kB Slab:               7784 kB SReclaimable:        268 kB SUnreclaim:         7516 kB PageTables:          188 kB NFS_Unstable:          0 kB Bounce:                0 kB WritebackTmp:          0 kB CommitLimit:       28148 kB Committed_AS:       3764 kB VmallocTotal:    1048404 kB VmallocUsed:         292 kB VmallocChunk:    1044744 kB
 * 1) cat meminfo