Connor McMillan

connor@mcmillan.website – http://github.com/mibs510

Rewriting an MT7628AN Bootloader

This article will provide an easy DIY guide on rewriting the bootloader on many cheap eBay wireless routers sold under the names of “WAVLINK” or for those who buy wholesale quantities they’re sold by “WINSTARS”.

Any how the said devices should be running an MT7628 processor and its original firmware. As you may have already read or seen these devices run an unsecured linux firmware, some even run a tainted version of OpenWrt. For the most part these devices won’t have the necessary utilities needed to upload anything onto the firmware (lacks curl, wget, scp, etc) or if they do the current kernel prohibits anyone from writing to certain mtd partitions especially the “Bootloader” partition (usually seen on those already running OpenWrt) So for the sake of simplicity I’m assuming you have a device which is similar to this one and you can’t seem to get anything running on that device after multiple attempts of following the “TFTP” steps on this page.

What You’ll Need

  • The device, I’m using a WL-WN575A3, running the original firmware that it came with
  • An Ethernet cable, you could use a wireless connection
  • This bootloader found here.
  • PuTTY or your favorite telnet terminal
  • Some familiarity with linux commands

First Step

  • Get connected to the device via Ethernet or a wireless connection.
  • Go to http://192.168.10.1/ and sign in with username as admin and password as admin.

Second Step

  • Connect the device via telnet using 192.168.10.1 as the IP address on port 21. I’m using telnet(1) on Linux

 

  • Upon connecting login using admin as the user and admin as the password.

Backup Your Original Bootloader

  • Change your current directory to
    /etc_ro/lighttpd/www

  • Copy a bit-per-bit copy of your original bootloader by executing the following:
cat /dev/mtd1 > original_bootloader.bin

Rewriting The Bootloader

  • We’ll need to create a simple html upload page to upload the bootloader onto our device
vi upload.html
  • Hit ‘i’ in your keyboard

  • And copy everything from below into vi
<form method="post" action="cgi-bin/upload_bootloader.cgi" name="submit" enctype="multipart/form-data">
<input type="file" name="fileField"><br /><br />
<input type="submit" name="submit" value="Submit">
</form>
  • Like so

  • Select the ‘Bootloader.bin’ file that you downloaded initially & ‘Submit’

  • If you are redirected to the login page then you’ve timed out like me this is why I instructed you to login at the beginning.

  • After rebooting you should be able to successfully flash any image as long as you follow the steps outlined at the bottom of this page under “TFTP”.

Flashing with OpenWrt

Once you have OpenWrt on the device you are free to flash with mtd.

8 Comments

  1. Saad Ali

    Hello,

    I Have a Wavlink AC1200 WL-WN529B3.

    When I start the router, port 2323 keeps open for some time. When I try to telnet into it, it doesn’t accept admin/admin as username and password. The router is running a tainted version of openwrt. Since I can’t get it via telnet, I am unable to change its bootloader. Any advice you may provide may be useful`.

    Reply
  2. John

    Hello,

    i have problem, please help me!!!.I have WavLink WL-WN575A3 (EBAY).I got to the point where I should upload BOOTLOADER via WEB.I got to the step where I should upload the BOOTLOADER via WEB. When BOOTLOADER will give SUMBIT, he writes that the path does not exist (cgi-bin/upload_bootloader.cgi).PLEASE HELP ME

    Reply
    1. Connor

      This only works if cgi-bin/upload_bootloader.cgi already exists on the firmware. It’s usually located in /etc_ro/lighttpd/www. You can test if it exist by “visiting” the following page: http://192.168.1.1/cgi-bin/upload_bootloader.cgi

      If the response is a blank page then you should be good to go assuming your following correctly. If not then this won’t work for you and you’ll need to seek another method.

      Reply
  3. wavlinkuser01

    Will this also work for WL-WN530A3???? It has decent spec’d with 64mb/512mb flash/ram combo and mt7628an after I searched online the IC’s to confirm.

    Reply
    1. Connor

      Sorry foe the late response.

      I’m afraid I can’t answer your questions regarding the WL-WN530A3 as I do not own one or have access to one.

      Reply
      1. Wavlinkuser01

        Oh, ok thanks! So its up to me to take the risk, but since many of Wavlink’s products almost have identical spec’s, so I was hoping they should atleast have the same way of flashing custom bootloader inorder to flash OpenWrt.

        It seems Wavlink no longer provides firmware updates for this(been sending emails but no reply), but ofcourse gotta have another Router as alternative before going thru the procedure just incase something goes wrong.

        The router have the SoC, MT7628AN with 64/512mb ROM/RAM, MT7612EN 1200AC, 100mbps LAN, with USB Slot that sadly is useless as it cannot be used for Cloud/Network Storage and only useable via Wavlinks Smart App.

        If only there’s an easy way to customize this pretty good spec’d Wavlink Device.

        Reply

DROP A COMMENT

Your email address will not be published. Required fields are marked *