Beeline SmartBox

Overview
"AHG00B-1.6", "EET-4", "E246995" and "1404" (01/2014)
 * is silkscreened on the board in the photos.

See also Beeline SmartBox One..

Reviews

 * Beeline SmartBox Pro on Beeline
 * Beeline SmartBox N300 Wireless Router
 * CPU: Realtek RTL8197D @660MHz
 * Flash: Macronix MX25L12845EMI-10G 16MB
 * RAM: EtronTech EM6AB160TSD-5G 64MB
 * WLAN: Realtek RTL8192CE 802.11bgn 2T2R

Forum threads

 * On iXBT forums
 * On 4PDA forums
 * Teardown on InGodweTrust (images PCB)

Custom firmware

 * OpenWRT on InGodweTrust
 * OpenWRT N300 1.2 (by V.Kredov)
 * OpenWRT build (by PukinDukun)

Serial Pinouts
Serial speed 38400 (38400,8,N,1) < J22 1 - GND 2 - Tx 3 - Vcc 4 - Rx

Pictures
User Images 

Superuser account
Superuser account gives you access to some additional settings and
 * allows to change network settings (initially locked by Beeline)

To use it login to web admin panel with this account:
 * Old firmware versions (under 2.0.25):


 * Login: SuperUser
 * Password:Beeline$martB0x
 * Newer firmware versions (after 2.0.25):


 * Login: SuperUser
 * Password: SFXXXXXXXXXX (serial number on the back of the device)

Boot log
{{SCollapse|boot log Booting...

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ @ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize @ 0000000h 0c22018h 00000c2h 0000020h 0000018h 0000000h 0000018h 1000000h @ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName @ 0010000h 0000100h 0001000h 0001000h 0000100h 0000010h 0000027h MX25L12805D @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

---RealTek(RTL8196D)at 2012.10.24-13:27+0800 v0.5 [16bit](659MHz) Scanning Flash Section 0... Scanning Flash Section 1... Flash Sector Number : 256.

Sercomm Boot Version 0.1.0.5

To Sercomm Dual image pid_addr 0x00dbd002 dbSign Addr: 0xc09bd00a imgNum: 2 crc32_head_src result: 0x5bfe7676 img 0: start addr: 0x003d0100, length: 0x0017c412 crc32 result: 0x788d1c3e checksum: 0x788d1c3e check sum OK img 1: start addr: 0x0054fff0, length: 0x0086d012 crc32 result: 0x668c2b2a checksum: 0x668c2b2a check sum OK Entering Firmware : Everything is OK.

---053D0100 Jump to image start=0x80500000... decompressing kernel: Uncompressing Linux... done, booting the kernel. done decompressing kernel. start address: 0x80003470 CPU revision is: 0000dc02 Determined physical RAM map: memory: 04000000 @ 00000000 (usable) Zone PFN ranges: Normal 0x00000000 -> 0x00004000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00004000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 Kernel command line: console=ttyS0,38400 root=/dev/mtdblock5 icache: 64kB/32B, dcache: 32kB/32B, scache: 0kB/0B NR_IRQS:48 PID hash table entries: 256 (order: 8, 1024 bytes) console handover: boot [early0] -> real [ttyS0] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 54568k/65536k available (3355k kernel code, 10900k reserved, 1205k data, 112k init, 0k highmem) Calibrating delay loop... 657.40 BogoMIPS (lpj=328704) Mount-cache hash table entries: 512 net_namespace: 528 bytes NET: Registered protocol family 16 bio: create slab  at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered NET: Registered protocol family 1 squashfs: version 4.0 (2009/01/31) Phillip Lougher NTFS driver 2.1.29 [Flags: R/W]. fuse init (API version 7.11) msgmni has been set to 106 Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254) io scheduler noop registered io scheduler cfq registered (default) Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x18002000 (irq = 8) is a 16550A Driver 'sd' needs updating - please use bus_type methods PPP generic driver version 2.4.2 MPPE/MPPC encryption/compression module registered NET: Registered protocol family 24 Realtek WLAN driver - version 1.6 (2012-12-24)

>>INSIDE rtl8192cd_init_one <<
PCIE reset (0) Do MDIO_RESET 98 - 40MHz Clock Source Find Port=0 Device:Vender ID=819110ec vendor_deivce_id=819110ec

>>EXIT rtl8192cd_init_one <<
Probing RTL8186 10/100 NIC-kenel stack size order[3]... chip name: 8196C, chip revid: 0 NOT YET eth0 added. vid=9 Member port 0x1... eth1 added. vid=8 Member port 0x10... eth2 added. vid=9 Member port 0x2... eth3 added. vid=9 Member port 0x4... eth4 added. vid=9 Member port 0x8... eth5 added. vid=9 Member port 0x0... Init priv skb. [peth0] added, mapping to [eth1]... SPI INIT - Force into Single IO Mode SPI flash(MX25L12805D/45E) was found at CS0, size 0x1000000 Creating 11 MTD partitions on "flash_bank_1": 0x000000000000-0x000000020000 : "bootloader" 0x000000020000-0x000000150000 : "kernel_recovery" 0x000000150000-0x0000003a0000 : "fs_recovery" 0x0000003a0000-0x0000003d0000 : "reserved" 0x0000003d0000-0x000000550000 : "kernel" 0x000000550000-0x000000f90000 : "rootfs" 0x000000f90000-0x000000fa0000 : "mac_ip" 0x000000fa0000-0x000000fb0000 : "critical_log" 0x000000fb0000-0x000000fc0000 : "critical_log_backup" 0x000000fc0000-0x000000fe0000 : "xml_config" 0x000000fe0000-0x000001000000 : "xml_config_backup" usbmon: debugfs is not available ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver b8021000=10000001 b8021054=200000 reg e0=99 reg e1=ac reg e2=98 reg e3=c1 reg e4=1 reg e5=89 reg e6=98 reg e7=1d reg f0=fc reg f1=8c reg f2=0 reg f3=11 reg f4=fb reg f5=d2 reg f6=0 rtl8652-ehci rtl8652-ehci.0: RTL8652 On-Chip EHCI Host Controller rtl8652-ehci rtl8652-ehci.0: new USB bus registered, assigned bus number 1 read synopsys=0 read synopsys2=0 rtl8652-ehci rtl8652-ehci.0: irq 10, io base 0x18021000 rtl8652-ehci rtl8652-ehci.0: USB 0.0 started, EHCI 1.00 [USB] Device 'RTL8652 On-Chip EHCI Host Controller rtl8652-ehci.0'is plugged into port 1. usb usb1: New USB device found, idVendor=1d6b, idProduct=0002 usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 usb usb1: Product: RTL8652 On-Chip EHCI Host Controller usb usb1: Manufacturer: Linux 2.6.30.9 ehci_hcd usb usb1: SerialNumber: rtl8652-ehci.0 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver rtl8652-ohci rtl8652-ohci.0: RTL8652 OHCI rtl8652-ohci rtl8652-ohci.0: new USB bus registered, assigned bus number 2 rtl8652-ohci rtl8652-ohci.0: irq 10, io mem 0x18020000 [USB] Device 'RTL8652 OHCI rtl8652'is plugged into port 2. usb usb2: New USB device found, idVendor=1d6b, idProduct=0001 usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 usb usb2: Product: RTL8652 OHCI usb usb2: Manufacturer: Linux 2.6.30.9 ohci_hcd usb usb2: SerialNumber: rtl8652 usb usb2: configuration #1 chosen from 1 choice hub 2-0:1.0: USB hub found hub 2-0:1.0: 1 port detected usbcore: registered new interface driver usblp Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. ---8196D OTG init reg e0=99 reg e1=ac reg e2=98 reg e3=c1 reg e4=1 reg e5=89 reg e6=b8 reg e7=1d dwc_otg: version 2.60a 22-NOV-2006 [S0] lmdev=83b60b80 device_register :register pass =>probe [S2] otg_dev=83b6a580 init hcd- [S3] hcd==83b55000 DWC_otg: Using DMA mode dwc_otg logicmodule: DWC OTG Controller dwc_otg logicmodule: new USB bus registered, assigned bus number 3 dwc_otg logicmodule: irq 15, io mem 0xb8030000 set OTG host to high speed ! DWC_otg: Init: Port Power? op_state=1 DWC_otg: Init: Power Port (0) [USB] Device 'DWC OTG Controller logicmodule'is plugged into port 3. usb usb3: New USB device found, idVendor=1d6b, idProduct=0002 usb usb3: New USB device strings: Mfr=3, Product=2, SerialNumber=1 usb usb3: Product: DWC OTG Controller usb usb3: Manufacturer: Linux 2.6.30.9 dwc_otg_hcd usb usb3: SerialNumber: logicmodule usb usb3: configuration #1 chosen from 1 choice hub 3-0:1.0: USB hub found hub 3-0:1.0: 1 port detected enable irq- [S1] dwc_otg_driver, lmdriver=8046be90 nf_conntrack version 0.5.0 (1024 buckets, 4096 max) CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or sysctl net.netfilter.nf_conntrack_acct=1 to enable it. nf_conntrack_rtsp v0.6.21 loading nf_nat_rtsp v0.6.21 loading ip_tables: (C) 2000-2006 Netfilter Core Team TCP cubic registered NET: Registered protocol family 17 Bridge firewalling registered Ebtables v2.0 registered RPC: Registered udp transport module. RPC: Registered tcp transport module. 802.1Q VLAN Support v1.8 Ben Greear  All bugs added by David S. Miller  VFS: Mounted root (squashfs filesystem) readonly on device 31:5. Freeing unused kernel memory: 112k freed init started: BusyBox v1.15.3 starting pid 776, tty '': '/etc.ro/rcS' sc_drv: module license 'Sercomm' taints kernel. Disabling lock debugging due to kernel taint starting pid 812, tty '/dev/console': '/bin/sh'
 * No chipID Sft chipSize blkSize secSize pageSize sdCk opCk chipName |
 * 0 c22018h 0h 1000000h 10000h 1000h 100h 50 0 MX25L12805D/45E|

BusyBox v1.15.3 built-in shell (ash) Enter 'help' for a list of built-in commands.

/ # 2019,1,1,1 2019,0,0,1 [main]read config /etc/default.xml success [CM_XML2RAM]xml file to RAM ret=0 ap_name=syslogd, action=start ap_name=coredump, action=start ap_name=switch, action=start Chain 'FORWARD_WIFI' doesn't exist. ft_tool uses obsolete (PF_INET,SOCK_PACKET) ap_name=dnrd, action=start ap_name=phy, action=start ap_name=iptv_bridge, action=start device eth0 entered promiscuous mode extra wan port mask 4, lan port mask 10b, wan port mask 14 ap_name=igmp_snoop, action=create ap_name=lanip, action=start br0: port 1(eth0) entering learning state info, udhcp server (v0.9.7) started Error, magic number is different. ap_name=telnetd, action=start ap_name=sshd, action=start ap_name=httpd, action=start ap_name=redirect, action=start ap_name=dnrd, action=start redirect ap_name=bftpd, action=start socket: Address family not supported by protocol ap_name=networkmap, action=start br0: port 1(eth0) entering forwarding state ap_name=firewall, action=start ap_name=srt, action=restart ap_name=rp, action=start ap_name=mediaserver, action=restart killall: minidlna: no process killed ap_name=ntp, action=start ap_name=hwim, action=start sh: /tmp/0/0/hwim_0: not found ap_name=cpm, action=start ap_name=wanip, action=stop 2 ap_name=dnrd, action=stop wid 2 ap_name=wanip, action=stop 3 ap_name=igmp_proxy, action=stop 3 ap_name=dnrd, action=stop wid 3 ap_name=web_notifier, action=start start_web_notifier: web notifier disable ap_name=igd_upnp, action=start ap_name=wlan, action=start device wlan0 entered promiscuous mode [PHY_ConfigMACWithParaFile][MACPHY_REG_92C] ===> Load_92C_Firmware <=== Load_92C_Firmware [PHY_ConfigTXLmtWithParaFile][TXPWR_LMT] br0: port 2(wlan0) entering learning state br0: port 2(wlan0) entering forwarding state Register to wlan0 iwcontrol RegisterPID to (wlan0) ap_name=wlan_guest_portal, action=start ap_name=qtbl, action=start sh: can't create /proc/fast_nat: nonexistent directory sc_is_l2tp_device:c1c43000 sc_event_ppp_dev_down:c1c432b8 sc_l2tp_tx_id:c1c43370 sc_fast_l2tp_rx:c1c43ba4 get_fast_l2tp_lastxmit:c1c43040 sc_check_for_fast_l2tp_to_wan:c1c43060 sc_fast_l2tp_to_wan:c1c43898 MyQtL2tpCtrl:c1c436c8 Insert quick routing module ... skb_dev_in_qtl:c1c578ac CheckSumModify:c1c57000 update_conntrack_time:c1c57bd8 matchFromLan:c1c57c64 matchFromWan:c1c57f0c doMatch:c1c58198 MyCheckSum:c1c570bc CheckSumDlt:c1c5710c checkEntry:c1c57748 delEntry:c1c57348 addEntry:c1c573c4 checkValidQTEntry:c1c572b0 updateQtlWhenPktXmit:c1c57928 qtbl_read_proc:c1c58264 qtbl_write_proc:c1c58214 ap_name=cron, action=start ap_name=wlan_wsc, action=restart Register to wlan0 iwcontrol RegisterPID to (wlan0) }}
 * 1) DUMP MODULE FUNCTION ADDR########
 * 1) DUMP QUICK TABLE FUNC ADDR#######
 * 1) DUMP QUICK TABLE FUNC ADDR END#######

Partition layout (on stock firmware)
0x000000000000-0x000000020000 : "bootloader" 0x000000020000-0x000000150000 : "kernel_recovery" 0x000000150000-0x0000003a0000 : "fs_recovery" 0x0000003a0000-0x0000003d0000 : "reserved" 0x0000003d0000-0x000000550000 : "kernel" 0x000000550000-0x000000f90000 : "rootfs" 0x000000f90000-0x000000fa0000 : "mac_ip" 0x000000fa0000-0x000000fb0000 : "critical_log" 0x000000fb0000-0x000000fc0000 : "critical_log_backup" 0x000000fc0000-0x000000fe0000 : "xml_config" 0x000000fe0000-0x000001000000 : "xml_config_backup"