Belkin F5D8233-4 v1



Again, this router would seem to be running SuperTask! with its stock FW.

The default SSID is Belkin_N_Wireless_XXXXXX.. where XXXXXX
 * is the last three octets of the WLAN MAC address (upper case letters).

The device appears to assumed the SSID RT2860AP temporarily when booting.

Pinout
Arcadyan Type1 pinout ^
 * to AMAZON-SE

[ • ] ( • ) ( • ) ( • ) (3.3) ( • ) (RxD) (TxD) ( • ) (GND)

J2

Info derived from
{{SCollapse|boot log ROM VER: 1.0.3 CFG 01 Read ROM VER: 1.0.3 CFG 01 Read EEPROMX X

=
========================================================== Wireless Gateway WG7005B-LF-AK Loader V0.09 build Apr 26 2007 16:55:35 Arcadyan Technology Corporation

=
========================================================== MX29LV160B bottom boot 16-bit mode found

Copying boot params.....DONE

Press Space Bar 3 times to enter command mode ... Flash Checking Passed.

Unzipping firmware at 0x80002000 ... [ZIP 3] [ZIP 1] done In c_entry function ... install_exception Co config = 80008483 [INIT]@Interrupt ... CLC = 0x00000100 CON = 0x00008200 PISEL = 0x00000000 FDV = 0x000001a3 BG = 0x00000024 end of uart_init-- [GPIO FLOW] SetGpio port 0 value =0x9158 [GPIO FLOW] SetGpio port 1 value =0x3401 gptu: totally 6 16-bit timers/counters Init timer = 0 [INIT] System Log Pool startup ... [INIT] MTinitialize .. [INIT] usrclk CPU Clock 333333334 Hz mips_counter_frequency:166666667 r4k_offset: 00028b0a(166666) init_US_counter : time1 = 260428, time2 = 40260478, diff 40000050 US_counter = 48 cnt1 40984883 cnt2 40986142, diff 1259 Runtime code version: 1.00.10 System startup... [INIT] Memory COLOR 0, 800000 bytes .. [INIT] Memory COLOR 1, 600000 bytes .. [INIT] Memory COLOR 2, 607200 bytes .. MX29LV160B bottom boot 16-bit mode found Set flash memory layout to BRN-BOOT Boot Parameters found !!! Bootcode version: V0.09 Serial number: 12733823304858 Hardware version: 01A MX29LV160B bottom boot 16-bit mode found
 * DANUBE_FPIS_BCU_CON = 4009FFFFh @ 0xbc200410
 * DANUBE_FPIS_BCU_ECON = 00000000h @ 0xbc200420
 * DANUBE_FPIS_BCU_EADD = 00000000h @ 0xbc200424
 * DANUBE_FPIS_BCU_EDAT = 00000000h @ 0xbc200428
 * 1) _ftext      = 0x80002000
 * 2) _fdata      = 0x80359AB0
 * 3) __bss_start = 0x803CE6D4
 * 4) end         = 0x80E114EC
 * 5) Backup Data from 0x80359AB0 to 0x80E194EC~0x80E8E110 len 478244
 * 6) Backup Data completed
 * 7) Backup Data verified

sizeof(struct III_Config_t) is 80884, nLen:80884, Magic:0xffffffff !![E-CFG-VER] Configuration data version mismatch!! !![E-CFG-VER] Adapting factory defaults!! !![E-CFG-VER] Reconfiguration required!! !!No configuration file present!! !!Cleanup configuration in flash memory!! MX29LV160B bottom boot 16-bit mode found !!! Invalid wireless channel range 0 ~ 0 !!! Use default value 1 ~ 13 default route: 0.0.0.0 BufferInit: BUF_HDR_SZ=160 BUF_ALIGN_SZ=28 BUFFER_OFFSET=384 BUF_BUFSZ0=544 BUF_BUFSZ1=4320 NUM_OF_B0=0 NUM_OF_B1=900 BUF_POOL0_SZ=0 BUF_POOL1_SZ=4032000 sizeof(BUFFER0)=704,sizeof(BUFFER1)=4480 Altgn *BUF0=0x80af9960 *BUF1=0x80721340 End at BUF0:0x80af9960, BUF1:0x80af9940
 * BUF0=0x80af9958 *BUF1=0x80721338

BUF0[0]=0x80af9960 BUF1[0]=0x80721340

buffer0 pointer init OK! buffer1 pointer init OK! ifno= 0, Link_Type= 4 time = 08/01/2003, 00:00:00 Interface 0 ip = 127.0.0.1

ifno= 1, Link_Type= 1 DMA g_desc_list=0x8066D1A0 Register=0x4012FFFF init GPIO#19 (as0:0,as1:0,dir:1) ctrl GPIO#19 (val:1) ctrl GPIO#19 (val:0) ctrl GPIO#19 (val:1) MAC Address: 00:17:3f:c2:84:47 mac_0_init: init MIB counter. time = 08/01/2003, 00:00:00 Interface 1 ip = 192.168.2.1

ifno= 2, Link_Type= 1 PCI: Probing PCI hardware on host bus 0. danube pci startup... PCI clock 33.3MHz DANUBE_GPIO_P1_ALTSEL0=81c6 DANUBE_GPIO_P1_ALTSEL1=0 DANUBE_GPIO_P1_DIR=b5ef Autoconfig PCI channel 0x803B9BCC Scanning bus 00, I/O 0xbae00000:0xbb000001, Mem 0x18000000:0x1a000001 Ralink vendor id: 0x1814 (bus:dev:fun)= 00:0e.0 Class 0280: VenID 1814: DevID 0601 Mem at 0x18000000 [size=0x10000] Scanning bus 00: Found 00:70 [1814/0601] 000280 00 Fixups for bus 00 Bus scan for 00 returning with max=00 6011814 4100007  2800000     8000 18000000        0        0        0       0        0     8001 28601814        0       40        0  4020100

[HWLAN] ifno=2 irno=7 port=0x00000000 RTMP_ADAPTER_mem : 8048bf78, sizeof(RTMP_ADAPTER) 332176 rt2860_probe : should call pci_set_master ??? should call pci_set_drvdata ??? RUNTASK id=1 hwlan_light_isr... time = 08/01/2003, 00:00:00 Interface 2 ip = 192.168.2.1

ifno= 3, Link_Type= 1 WAN MAC Address: 00:17:3f:c2:84:48 MAC Address: 00:17:3f:c2:84:48 mac_0_init: init MIB counter. time = 08/01/2003, 00:00:00 iput_IpLinkUp(ifno=3)> ifp->add_default_route:1 Re-Init NAT data structure Init NAT data structure Interface 3 ip = 0.0.0.0

ifno= 4, Link_Type= 0 ifno= 5, Link_Type= 0 ifno= 6, Link_Type= 0 ifno= 7, Link_Type= 0 ifno= 8, Link_Type= 0 ifno= 9, Link_Type= 0 ifno= 10, Link_Type= 0 ifno= 11, Link_Type= 0 ifno= 12, Link_Type= 0 ifno= 13, Link_Type= 0 ifno= 14, Link_Type= 0 ifno= 15, Link_Type= 0 ifno= 16, Link_Type= 0 ruleCheck> Group: 0, Error: Useless rule index will be truncated ruleCheck> Group: 1, Error: Useless rule index will be truncated ruleCheck> Group: 2, Error: Useless rule index will be truncated CBAC rule format check succeed !! reqCBACBuf> init match pool, Have: 1000 Memory Address: 0x80dc0790 ~ 0x80dc750c reqCBACBuf> init timeGap pool, Have: 10000 Memory Address: 0x80dc750c ~ 0x80df8260 reqCBACBuf> init sameHost pool, Have: 2000 Memory Address: 0x80df8260 ~ 0x80e07c80 CBAC rule pool initialized !! Init NAT data structure No default route, no need to reinit the NAT data structure RUNTASK id=2 if_task if0... RUNTASK id=3 if_task if1... RUNTASK id=4 if_task if2... RUNTASK id=5 if_task if3... RUNTASK id=6 timer_task... RUNTASK id=7 conn_mgr... RUNTASK id=8 main_8021x... RUNTASK id=9 main_lltd... RUNTASK id=10 period_task... RUNTASK id=11 belkin_goodie_task... RUNTASK id=12 dhcp_daemon... RUNTASK id=13 dhcp_clt...on interface 3 RUNTASK id=14 pptp_callmgr... RUNTASK id=15 L2tpd... found signature: 78h 56h 34h 12h ulImgLens=900046, LENGTH[3]-12=1769460 length checking OK [0] find End at 0xB011B800 len=900046 ---[ LZMA head start in 0xB011BC00 ]--- found signature: 78h 56h 34h 12h ulImgLens=99449, LENGTH[3]-12=1769460 length checking OK [1] find End at 0xB0134000 len=99449 Image[1] at 0xB0040000, len = 900046 Image[2] at 0xB011BC00, len = 99449 Unzipping from B011BC00 to 80EC2000 ... [ZIP 1] done Uncompressed size = 944563 drive start addr[0]=80ec2000, [1]=80fa89c0 [HTTPD] flash_init: failed!! httpd: listen at 192.168.2.1:80 RUNTASK httpd... RUNTASK id=18 dnsproxy... RUNTASK id=19 rip... RUNTASK id=20 ripout... RUNTASK id=21 dhcpd_mgmt_task... UPnP is enabled UPNP Device initialize success! slot=22

>>> belkin_wan_cfg task runs successfully, task_id = 23 gConfig.WSC_Mode:1 RUNTASK id=24 wscmain... RUNTASK id=25 wsc_Send_eap_packet... RUNTASK id=26 wsc_Send_UPNP_packet... RUNTASK id=27 WSC_WaitUserAction_Task... gConfig.WSC_Mode:1 UART RX Input Starting Multitask... run_project_task RUNTASK id=28 apAppInit... ifno2dot1x_if[2]=0 dot1x_wireless_if_mask=0x4 init psock cnt=1975247578 rt2860_open : should call request_irq ???????????????????????? rt2860_open 1 rt2860_open 2 rt2860_init 1 rt2860_init 2 rt2860_init 3 rt2860_init 6 rt2860_init 7 rt2860_init 8 rt2860_init 9 rt2860_init 10 sizeof(RT2860AP_DAT) : 1314 sould check E2PROM MAC ????????????????? rt2860_open 3 should Set up the Mac address ????????? rt2860_open 4 rt2860_open 5 rt2860_open 6 netif_carrier_on called ??? [dhcp_clt] enable dhcp client in interface WAN[3] Wi-Fi Simple Config Application - Intel Corp. Version: Build 1.02, Jul 25 2007 11:41:56 Initializing stack... -in wsc init-- --sizeof(uint32)=4 --sizeof(uint-long)=4 --sizeof(uint32)=2 @#*@#*@#*EAP-WSC: Entered eap_wsc_init *#@*#@*#@ wsc_Send_eap_packet:udpFdupnp_wcn:28;;udpFdupnp:2a WSC_WaitUserAction:wait user action:0 [HWLAN] [30] rapi_tmr_task running [24]pthread_cond_init: 0 [24]pthread_mutex_init: resource No. 34 [24]pthread_mutex_init: resource No. 35 [PORTABLITY]:WscCreateThread Entered udp_read WscCmd:ActualCBThreadProc: Started [htf_dbg]    - OnlineActiveWirless 858 should check capable(CAP_NET_ADMIN) ??? should check capable(CAP_NET_ADMIN) ??? should check capable(CAP_NET_ADMIN) ??? should check capable(CAP_NET_ADMIN) ??? should check capable(CAP_NET_ADMIN) ??? should check capable(CAP_NET_ADMIN) ??? should check capable(CAP_NET_ADMIN) ??? should check capable(CAP_NET_ADMIN) ??? should check capable(CAP_NET_ADMIN) ??? should check capable(CAP_NET_ADMIN) ??? should check capable(CAP_NET_ADMIN) ??? [24]pthread_cond_init: 1 [24]pthread_mutex_init: resource No. 36 [24]pthread_mutex_init: resource No. 37 [PORTABLITY]:WscCreateThread WscCmd:ActualUIThreadProc: Started. ActualUIThreadProc: wait q MasterControl constructor WscCmd::MC instantiated ok [24]pthread_cond_init: 2 [24]pthread_mutex_init: resource No. 38 [24]pthread_mutex_init: resource No. 39 [PORTABLITY]:WscCreateThread [24]pthread_mutex_init: resource No. 40 [PORTABLITY]:pthread_mutex_init CTransport Construction [24]pthread_cond_init: 3 [24]pthread_mutex_init: resource No. 41 [24]pthread_mutex_init: resource No. 42 [PORTABLITY]:WscCreateThread In CTransport::ActualCBThreadProc ActualCBThreadProc: Calling Dequeue MC::Init: Init complete ok WscCmd::MC intialized ok WscCmd::Init ok, starting stack... Info::ReadConfigFile: Called Info::ReadConfigFile:▒4▒H Info::ReadConfigFile:File open ok mp_deviceInfo->uuid[i]: 0-0-0-0-0-0-0-1-10-0-0-17-3f-c2-84-47- mp_deviceInfo->macAddr:00:17:3F:C2:84:47 gSetting.dot1x.if_entry[0].enableWEP:0 authTypeFlags is 1 ,encrTypeFlags is 1 ,m_nwKey is, key len is 0 ssid is Belkin_N_Wireless_C28447 S, c93 E, ee3 RegistrarSM constructor [24]pthread_cond_init: 4 [24]pthread_mutex_init: resource No. 43 [24]pthread_mutex_init: resource No. 44 [PORTABLITY]:WscCreateThread [24]pthread_mutex_init: resource No. 45 [PORTABLITY]:pthread_mutex_init RegistrarSM constructor [24]pthread_cond_init: 5 [24]pthread_mutex_init: resource No. 46 [24]pthread_mutex_init: resource No. 47 [PORTABLITY]:WscCreateThread c_devPwd:org:79614429 Generated devPwd: ▒b▒0 in startMonitor.... CInbEap Construction Sizeof(WSC_NOTIFY_DATA) = -2141004712 ---test--sizeof(WSC_NOTIFY_DATA) = 36 [24]pthread_cond_init: 6 [PORTABLITY]:WscCreateEvent Entered udp_open Socket open successful, sd: -2141004728 Entered udp_open Socket open successful, sd: -2141004728 Entered udp_bind Binding successful for socket [-2141004744] [PORTABLITY]:WscCreateThread In CInbEap::StaticRecvThread CInbEap::ActualRecvThread Started Entered udp_read in startMonitor.... CInbUPnPDev Construction Entered udp_open Socket open successful, sd: -2141004728 Entered udp_open Socket open successful, sd: -2141004728 Entered udp_bind Binding successful for socket [-2141004744] CInbUPnPDev StartMonitor [PORTABLITY]:WscCreateThread MC::SwitchModeOn: Exit In CInbUPnPDev::StaticUPnPThread end UPnPCreateMicroStack Entered udp_read MC::StartStack: Informing app of mode -WscCmd::CallbackProc Enqueue done MC::SwitchModeOn: Done callback exit wscmain @@[31]pthread_mutex_unlock: the res is free 34-- -2142138992 WscCmd:ActualCBThreadProc: CB_MAIN_PUSH_MODE recd
 * uuid_p:0x0000000000000001100000173fc28447*****
 * mcp_devPwd:79614429;;

-@@[28]pthread_mutex_unlock: the res is free 36-- -2142139112
 * MODE: Access Point *******
 * p_header->eType:1

Options: 0. Quit 1. Get configured 2. Get configured via push-button 3. Get configured using IEs Enter selection: ***gp_mc->mp_info->GetSwitchMode:1 mp_info->GetSwitchMode:1:e_currMode:1,,e_targetMode:3 mp_deviceInfo->authTypeFlags:1 mp_deviceInfo->encrTypeFlags:1 mp_deviceInfo->authTypeFlags:1 mp_deviceInfo->encrTypeFlags:1 MC::SetBeaconIE: call to trans->SetBeaconIE ok MC::SetProbeRespIE: call to trans->SetProbeRespIE ok Waiting for Registrar to connect... WscCmd::unconfig initiated ActualUIThreadProc: wait q [reset_802dot1x] wireless module ready [init_wpa] dot1x_ready[0]=1 [reset_802dot1x] 802.1Xv2 ready upnp_Init: flag=0 SSDP Initialization completed... GenaInit : event_hook is NULL!! }}
 * g_pin:79614429*****
 * cp_devPwd:79614429*****

{{SCollapse|.. and a boot log from the same unit bricked (whoops) ROM VER: 1.0.3 CFG 01 Read▒ ROM VER: 1.0.3 CFG 01 Read EEPROMX X

=
========================================================== Wireless Gateway WG7005B-LF-AK Loader V0.09 build Apr 26 2007 16:55:35 Arcadyan Technology Corporation

=
========================================================== MX29LV160B bottom boot 16-bit mode found

Copying boot params.....DONE

Press Space Bar 3 times to enter command mode ... Flash Checking Passed.

Unzipping firmware at 0x80002000 ... failed : 4 !! Unzipping firmware at 0x80002000 ... failed : 4 !! Unzipping firmware at 0x80002000 ... failed : 4 !! Unzipping firmware at 0x80002000 ... failed : 4 !! Unzipping firmware at 0x80002000 ... failed : 4 !! Unzipping Tiny Kernel at 0x80002000 ... [ZIP 1] done Tiny ETCPIP running ...

In c_entry function ... install_exception Co config = 80008483 sys_irq_init ... Tiny Kernel System startup... Unzipping from B001E000 to 80720000 ... done Uncompressed size = 10142 CPU Clock 333333334 Hz tcpip_startup... MX29LV160B bottom boot 16-bit mode found Set flash memory layout to BPARAMS+RECOVER_KERNEL Bootcode version: V0.09 Serial number  : 12733823304858 Hardware version: 01A !!No configuration file present!! default route: 0.0.0.0 default route: 0.0.0.0 BufferInit: BUF_HDR_SZ=32 BUF_ALIGN_SZ=16 BUFFER_OFFSET=96 BUF_BUFSZ0=384 BUF_BUFSZ1=1632 NUM_OF_B0=24 NUM_OF_B1=800 BUF_POOL0_SZ=9984 BUF_POOL1_SZ=1331200 Buf0_Block 80265df8 Buf1_Block 80120dd8 BUF0[0]=0x80265e00 BUF1[0]=0x80120de0

buffer0 pointer init OK! buffer1 pointer init OK! init_if ; gConfig.Interface[0].Link_Type is [4] Interface 0 ip = 127.0.0.1

init_if ; gConfig.Interface[1].Link_Type is [1] DMA g_desc_list=0x8011B7A0 Register=0x4012FFFF MAC Address: 00:17:3f:c2:84:47

***** Manufactory ID=5988 *****---

***** Chip ID=200 *****--- Interface 1 ip = 192.168.2.1

init_if ; gConfig.Interface[2].Link_Type is [0] RUNTASK id=1 if_task if0... RUNTASK id=2 if_task if1... RUNTASK id=3 timer_task... RUNTASK id=4 period_task... RUNTASK id=5 dhcp_daemon... RUNTASK httpd... Starting Multitask... period_task running!!! httpd: listen at 192.168.2.1:80 }}