ADB PR.G EA4201N-G

OpenWRT

This is an experiment to load the latest OpenWRT on this device:

• Name: ADB P.RG EA4201N-G
• SoC: Broadcom 6362, BCM6362B0 400MHz, DDR: 333MHz, Bus: 166MHz
• CFE: version 1.0.38-114.170 for BCM96362
• CPU: broadcom 4350 V7.0 dual core MIPS big endian
• Board ID: 96362ADVNrtk
• RAM: 128MB
• Flash: NAND 64MB, ST NAND512W3A2CN6
• Switch: RTL8367R, 1000mbps (GbE), 4 LAN + 1 WAN
• DSL: yes
• VoIP: yes, 2 dect ports
• WLAN: Broadcom BCM435f 802.11 Wireless Controller 6.30.102.3.cpe4.12L07.0
• OEM kernel: 2.6.30
• OEM software: OpenWRT 10.03 based Epicentro
• OEM version: PRGEA4202N_TEO_3.0.1.0031

Default OEM credentials:

• User: tadmin
• Password: hqMV8Wps

OpenWRT forum topic

https://forum.openwrt.org/t/new-device-adb-p-rg-ea4201n-g/48220

Info

https://github.com/digiampietro/adbtools2

https://unlocka1.wordpress.com/2014/04/28/adb-full-root-access/

https://www.exploit-db.com/exploits/44983

root@localhost:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00004000 00004000 "CFE"
mtd1: 00200000 00004000 "bootfs_1"
mtd2: 01cd0000 00004000 "rootfs_1"
mtd3: 00200000 00004000 "bootfs_2"
mtd4: 01cd0000 00004000 "rootfs_2"
mtd5: 01ed0000 00004000 "upgrade"
mtd6: 00010000 00004000 "conf_old_main"
mtd7: 00020000 00004000 "conf_fs"
mtd8: 00010000 00004000 "conf_factory"
mtd9: 00100000 00004000 "bbt"
mtd10: 04000000 00004000 "flash"

root@localhost:/mnt/sda1# cat /proc/cpuinfo
system type             : 96362ADVNrtk
processor               : 0
cpu model               : Broadcom4350 V7.0
BogoMIPS                : 398.33
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
ASEs implemented        :
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

unaligned exceptions            : 12
processor               : 1
cpu model               : Broadcom4350 V7.0
BogoMIPS                : 402.43
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
ASEs implemented        :
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

unaligned exceptions            : 12

Rooting OEM firmware

1. For 2.1.1: Login as tadmin into limitted shell (config->user) and create an ftp user (). Then follow FTP symlink hack
2. For 3.0.1: Use Samba symlink hack