The Fonera Simpl is based on Ralink RT3050 SoC. The device is faster and more stable than previous Fonera 2100 series. But it is not easy to do hacking and to replace custom firmware for this new model. I found to access to the SoC at last and I managed to replace this original firmware to my custom firmware.
Architecture MIPS32 Release 1
Wireless IEEE 802.11g / IEEE 802.11b / IEEE 802.11n(2.4GHz only)
Security WiFi Protected Access (WPA) / WEP / WPA2 / WPS
Power Supply DC 5V 1A
Antenna Terminal Reverse SMA（RP-SMA）
Antenna Gain 2dBi
CPU RT3050 320MHz
Lan 10/100Base-T AutoMDI RJ-45*2
2. Access to the case
Remove four rubber feet. The screws are special, but some precision minus screwdriver may use to them.
3. Serial cable installation
4, Access to SoC via serial
Prepare a proper cable and a module for TTL(CMOS). FTDI FT232RL module works well, some serial modules have a problem for Simpl.
Run terminal application on host PC (e.g. putty). And connect at 57600/8N1.
5. Setup tftp server
i. Setup tftp server (tftpd-hpa) on host PC and start daemon:
# apt install tfpd-hpa openbsd-inetd
tftp dgram udp wait root /usr/sbin/in.tftpd /usr/sbin/in.tftpd -s /var/lib/tftpboot
Run inetd daemon
# /etc/init.d/inetd start
ii. Copy firmware to tftproot directory:
iii. Connect ethernet cable to fonera (computer side port)
iv. Setup static IP addess of host PC: 10.10.10.3/24
6. Access u-boot menu
The way to access to u-boot is the following:
i. Put AC power plug to Simpl while pressing the reset button.manage
ii. Wait about four seconds, u-boot menu will be displayed.
iii. If installing a firmware to flash memory, press 2 and release the reset button,
If loading to RAM memory for testing, pess 3.
7. Load a firmware into ram for testing
i. Select '3' on u-boot menu
ii. Enter commands like this:
Note: Ralink firmware only.
8. Backup the original firmware
i. Run telnet to Simpl:
ii. Extract firmware
Note: The address of copied data is from 0x20000 to 0x3f0000, but the actual range of kernel + rootfs of fon firmware is from 0x20000 to 0x1f0000.
Original fon firmware's log:
iii. Transfer the copy to host PC
iv. Adjust proper file size
If having a problem while restoring orginal firmware, try this:
This firmware is 64kb bigger than previous one, and it erases "uci_overlay".
9. Firmware installation into flash memory
A telnetd enabled orignal firmware. To access to Simpl:
i. Run dhcpclient
ii. Run telnet
$ telnet 192.168.10.1
This firmware cannot do many things, only for using research purpose.
i. Three operation mode: Bridge, Gateway, and AP Client: Bridge and AP Client work well
ii. Qos (not tested)
iii. Channel BandWidth 20/40 (Not tested):
Theoretically twice faster than original fon firmware.
iv: WPS (not tested)
v. Mesh metwork (not tested)
vi. a little advanced firewall settings: MAC/IP/Port filtering etc.
This firmware is built by ralink SDK. A few bugs exist:
i. Click Wireless Settings > Station List on GoAhead does not work and goes down.
ii. AP Client mode requires addtional setting.
10. Access control panel
Default IP addess is 10.10.10.254. Access the control panel via browser.
11. Basic Setting
a. Bridge (AP mode)
LAN: static IP addess (private network, require for AP Client)
LAN2: arbitrary IP addess
Wireless: AP mode
b. Gateway (router mode)
WAN: DSL modem
LAN: static IP addess(private network)
Wireless: AP mode
c. AP Client (Client bridge mode)
It needs a little tweak.
i. Basic setting:
- NAT: disable
- WAN: arbitrary IP addess (e.g. 10.10.10.254/24)
- LAN: static IP address
- LAN2: disable
- DHCP: disable
- Wireless SSID: arbitrary setting, hidden mode
- Wireless security: WPA2-PSK (strongest security)
- AP Client: SSID, Security mode, Encryption Type and Pass Phrase of AP
ii. Access to system via telnet:
# brctl addif br0 apcli0
If apcli0 interface does not exist, AP Client does not work.
WAN ==DSL == Simpl 1(GW, Fon firmware) == Simpl 2 (AP,bridge mode customized firmware) ---Simpl 3 (AP Client, customized firmware)==hub==PCs
Simpl 1: 192.168.211.30/27
Simpl 2: 192.168.211.29/27
Simpl 3: 192.168.211.28/27
# ping -c 3 192.168.211.28
# brctl addif br0 apcli0
Add New custom firmware (22 SEP 2016)
This is Fon-ng based firmaware which is removed fon modules and some customized.