Pheenet WAP-654G
bg (G54) | |
---|---|
802.11g 54Mbps High Power AP / Bridge | |
![]() | |
3rd Party Firmware | |
dd-wrt | |
OpenWrt |
Incompatible |
Tomato any flavor |
Incompatible |
Gargoyle |
Incompatible |
Platform | |
Brand • Model • Rev |
Pheenet WAP-654G |
FCC ID |
none specified |
Type |
access point, repeater |
CPU1 ![]() | |
CPU1 Type |
Lexra LX5280 |
CPU1 Speed |
180 MHz |
Flash1 Chip |
Macronix MX29LV160CBTC-70G |
Flash1 Size |
2 MiB2,097,152 B <br />16,384 Kib <br />2,048 KiB <br />16 Mib <br />0.00195 GiB <br /> |
RAM1 Size |
16 MiB16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br /> |
RAM1 Chip |
ISSI IS42S16800A-7TL |
ETH chip1 |
Realtek RTL8201CP |
Ethernet Port Count |
1-100MbE-LAN |
Wired Standard |
IEEE 802.3i/3u |
802dot11 OUI: 00:1A:50 | |
Stock bootloader |
btcode |
Stock FW OS |
Linux 2.4.18 MIPS-01.00 |
Expansion IF types |
none specified |
Power |
12 VDC, 1 A |
Connector type |
barrel |
Serial Port (UART) |
yes, 4-pin header, JPU1 |
JTAG Port |
yes, 12-pad header, J1 |
Flags: high power | |
Other | |
Default SSID: PheeNet | |
3rd Party Firmware Support | |
Retail | |
(Est.) release date | 2007 |
(Est.) initial retail price (in USD): | $50 |
Country of manuf | Taiwan |
Radio 1 | |
Chip1 | |
Wireless interface OUI |
00:1A:50 |
Antenna Connector Type |
RP-SMA |
Wireless Standard |
IEEE 802.11b/g |
802.11g |
up to 54 Mbps |
802.11b |
up to 11 Mbps |
WiFi Operating Frequency |
2.4 GHz |
For a list of all currently documented Realtek chipsets with specifications, see Realtek.
- • 54 Mbps - 2.4GHz 802.11g = G54 class
Overview
See also Pheenet WAP-654GP (int. splitter PoE)
- 2.2dBi detachable antenna (RP-SMA conn.)
Base Platform: RTL8186 + RL2560 (MIPS R3000 ISA-1) Spec.
Very simple access point with WIFI high output power (200mW)
- that allows several wifi modes:
- AP, WDS, AP + WDS, Client bridged, Ad-hoc
- AP + Client bridged (aka Universal Repeater)
The original firmware doesn't have Telnet or other remote CLI interface.
- It only can be configured via web interface.
It is worth mentioning the web interface doesn't allow to reboot the router,
- however there is a hidden page that allows to execute custom commands:
httр://192.168.1.254/syscmd.asp
Some useful commands:
- Change the MAC adresss
flash set HW_WLAN0_WLAN_ADDR 001122334455
flash set HW_NIC0_ADDR 001122334455
- Change the regulatory domain
flash set HW_WLAN0_REG_DOMAIN 6
Links of Interest
Flashing
![]() | NOTE: During configuration or flashing a device, the only things that should be hooked to the device is the computer and power. |
Tested firmwares
Third party firmwares like Wive-NG were successfully tested in this unit.
Version | Link | Notes |
---|---|---|
OEM 1.4c | WAP-654G(P)_v1.4c.zip | doesn't seem to flash via tftp |
OEM 1.4b | WAP-654G(P), F v1.4b 070228.rar | |
Wive-NG 0.3.18 | wive-ng-0.3.18.tar.7z | no web interface |
Dlink 1.41-1 | DAP1160A1-OEM_MOD-1.41.zip | modded firmware from Dlink DAP1160A1 GPL |
Flash backup
- Connect the serial UART Adapter. Also connect the ethernet cable.
- Set a static IP on your computer, use 192.168.1.35 (or any compatible)
- Press the reset button, don't release it yet
- Plug the power cord, and wait 5 seconds
- Release the reset button
- On the serial console execute the command:
flr 80300000 0 200000
- On your computer execute:
tftp 192.168.1.6 -m binary -c get flash-backup.bin
You should see something like this at the serial console
<RealTek>flr 80300000 0 200000 Flash read from 00000000 to 80300000 with 00200000 bytes ? (Y)es , (N)o ? --> y Flash Read Successed! <RealTek> File Start: 80300000,length=00200000 **TFTP GET File flbackup.bin,Size 00200000 Byte *TFTP Client Download Success! File Size = 00200000 Bytes .Success! <RealTek>
Recovery
If you bricked the router by flashing a bad firmware follow these steps:
- Connect the ethernet cable from your computer to the device.
- Set a static IP on your computer, use 192.168.1.35 (or any compatible)
- Press the reset button, don't release it yet
- Plug the power cord, and wait 5 seconds
- Release the reset button
- On your computer execute:
tftp 192.168.1.6 -m binary -c put valid-firmware.bin
valid-firmware.bin is supposed to be a known firmware working ok on this device
Serial
Boot log |
---|
UART1 output test ok Uart init mfid=000000c2 devid=00002249 Found 1 x 2M flash memory ---RealTek(RTL8186)at 2006.02.20-12:02+0800 version 1.4a [16bit](180MHz) no sys signature at 00010000! Jump to image start=0x80350000... decompressing kernel: Uncompressing Linux... done, booting the kernel. done decompressing kernel. early printk enabled Determined physical RAM map: memory: 00800000 @ 00000000 (usable) Initial ramdisk at: 0x80173000 (1843200 bytes) On node 0 totalpages: 2048 zone(0): 2048 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: root=/dev/ram console=0 ramdisk_start=0 single Calibrating delay loop... 178.99 BogoMIPS Memory: 4628k/8192k available (1292k kernel code, 3564k reserved, 1932k data, 44k init, 0k highmem) Dentry-cache hash table entries: 1024 (order: 1, 8192 bytes) Inode-cache hash table entries: 512 (order: 0, 4096 bytes) Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 2048 (order: 1, 8192 bytes) check_wait... unavailable. POSIX conformance testing by UNIFIX Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd Serial driver version 6.02 (2003-03-12) with no serial options enabled ttyS00 at 0x00c3 (irq = 3) is a rtl_uart1 state->flags=00000000 Realtek GPIO Driver for Flash Reload Default block: 64 slots per queue, batch=16 RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize RealTek E-Flash System Driver. (C) 2002 RealTek Corp. Found 1 x 2M Byte MXIC MX29LV160AB at 0xbe000000 RTL8185 driver version 1.11 (2006-08-01) 8186NIC Ethernet driver v0.0.5 (Mar 3, 2006) eth0: RTL8186-NIC at 0xbd200000, 00:01:02:03:04:05, IRQ 4 eth1: RTL8186-NIC at 0xbd300000, 04:05:06:07:08:09, IRQ 5 NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 512 bind 1024) NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. NET4: Ethernet Bridge 008 for NET4.0 RAMDISK: ext2 filesystem found at block 0 RAMDISK: Loading 1800 blocks [1 disk] into ram disk... done. Freeing initrd memory: 1800k freed VFS: Mounted root (ext2 filesystem). Freeing unused kernel memory: 44k freed mount /proc file system ok! serial console detected. Disabling virtual terminals. init started: BusyBox v1.00-pre8 (2005.09.16-02:17+0000) multi-call binary BusyBox v1.00-pre8 (2005.09.16-02:17+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. Initialize wlan0 interface killall: syslogd: no process killed killall: klogd: no process killed SIOCGIFFLAGS: No such device bridge br0 doesn't exist; can't delete it Setup bridge... device eth0 entered promiscuous mode eth0:phy is 8201 SIOCDELRT: No such process device wlan0 entered promiscuous mode SIOCDELRT: No such process br0: port 2(wlan0) entering listening state br0: port 1(eth0) entering listening state br0: port 2(wlan0) entering learning state br0: port 2(wlan0) entering forwarding state br0: topology change detected, propagating br0: port 1(eth0) entering learning state br0: port 1(eth0) entering forwarding state br0: topology change detected, propagating SIOCDELRT: No such process SIOCDELRT: No such process Auto-Discovery (ver 1.01) 342 343 # auth uses obsolete (PF_INET,SOCK_PACKET) IEEE 802.1x (WPA) daemon, version 1.7b |
# cat /proc/version Linux version 2.4.18-MIPS-01.00 (root@lnx103) (gcc version 3.3.3) #5 Thu Aug 10 13:14:01 CST 2006 # cat /proc/cpuinfo system type : Philips Nino processor : 0 cpu model : R3000 V0.0 BogoMIPS : 178.99 wait instruction : no microsecond timers : no tlb_entries : 64 extra interrupt vector : no hardware watchpoint : no VCED exceptions : not available VCEI exceptions : not available ll emulations : 0 sc emulations : 0
Pictures
Notes
Power regulators
- AnaChip AP1506-50 (U9 silkcreened): Main power regulator,12V input, 5V output
- BS33P (U38 silkcreened): Low dropout regulator, 5V input, 3.3V output
- BS17P (U10 silkcreened): Low dropout regulator (adjustable), 5V input, 3.1V output
- BS18P (U8 silkcreened): Low dropout regulator, 5V input, 1.8V output. It runs extremely hot, probably causing unstability problems. It's recommended to install the bigger heat sink as possible.