RouterBOARD 133

From Noisebridge
Revision as of 21:25, 30 August 2016 by (talk)
Jump to: navigation, search

See also: Sparky


BusyBox v1.8.2 (2008-05-30 09:59:52 EEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r11293) -------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!

Teh SECRET sauce

sudo dnsmasq -i eth0 --dhcp-range=, --dhcp-boot=openwrt-adm5120-2.6-vmlinux.elf --enable-tftp --tftp-root=/srv/tftp/ -d -u dnsmasq -p0 -K --log-dhcp --bootp-dynamic



Meraki Flashed Versions


Note: The following references boards that have a meraki flashed NAND.


The board has a non-standard PoE option, there is also a barrel connector that supports 9-28V DC tip positive supply


Connecting the first ethernet port (has PoE sticker) to a DHCP enabled network will allow access to some meraki web pages. Browse to the IP to see these pages.

  • index.cgi
  • advanced.html
  • configure/index.cgi

Some pages are password protected. The username is 'admin' and the password is the serial number. The serial number can be obtained via the serial terminal using 'cat /MERAKI_SERIAL'

serial boot output

CuteCom was used to get the following via Serial Console

BusyBox v1.1.0 (2007.09.21-01:28+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

Welcome to your Meraki device.  Please look for developer information at  We would like to encourage you to play with this
platform and add your own features to it.  However, our lawyers
require us to tell you that much of the software on this device is
protected by copyrights, and may not be redistributed or sold.

Like hacking on wireless stuff?  Come work with us!

Happy Hacking!
00:18:0A:00:F0:DC:/# help

Built-in commands:
\0x09. : alias bg break cd chdir command continue eval exec exit export
\0x09false fg getopts hash help jobs kill let local pwd read readonly
\0x09return set shift times trap true type ulimit umask unalias unset

reboot command, followed by any key to enter setup

00:18:0A:00:F0:DC:/# reboot
00:18:0A:00:F0:DC:/# adm5120_wdt_release: release

The system is going down NOW !!

Sending SIGTERM to all processes.

Sending SIGKILL to all processes.

Please stand by while rebooting the system.
Restarting s\0xf9

RouterBOOT booter 2.7

RouterBoard 133

CPU frequency: 175 MHz
  Memory size:  32 MB

Press any key within 2 seconds to enter setup.

What do you want to configure?
   d - boot delay
   k - boot key
   s - serial console
   o - boot device
   u - cpu mode
   r - reset configuration
   e - format nand
   g - upgrade firmware
   i - board info
   p - boot protocol
   t - do memory testing
   x - exit setup
your choice: 

more console out

RouterBOOT booter 2.7

RouterBoard 133

CPU frequency: 175 MHz
  Memory size:  32 MB

Press any key within 2 seconds to enter setup..
loading kernel from nand... OK
setting up elf image... OK
jumping to kernel code
mem_detect: disable buffers for both banks
mem_detect: checking for 64MB chip in 1st bank
mem_detect: write 0xAAAAAAAA to 0xA0000000
mem_detect: delay 10000 ns
mem_detect: pattern at 0xA1000000 is 0x55555555
mem_detect: write 0xAAAAAAAA to 0xA0000000
mem_detect: delay 10000 ns
mem_detect: pattern at 0xA2000000 is 0x55555555
mem_detect: chip size in 1st bank is 64MB
mem_detect: enable buffers for both banks
mem_detect: 1x64MB memory found
<6>ADM5120 revision 8, running at 175MHz
<6>Boot loader is: RouterBOOT
<6>Booted from   : NAND flash
<6>Board is      : RouterBOARD 133
<6>Memory size   : 32MB
done meminit
Linux version (xyu@xyu-dev) (gcc version 3.4.6 (OpenWrt-2.0)) #14 Wed Sep 26 18:49:21 PDT 2007
ADM5120 board setup
CPU revision is: 0001800b
Determined physical RAM map:
 memory: 013d1000 @ 00c2f000 (usable)
Built 1 zonelists
Kernel command line: console=ttyS0,115200 rootfstype=squashfs,yaffs2,jffs2 init=/etc/preinit
Primary instruction cache 8kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 8kB, 2-way, linesize 16 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 256 (order: 8, 4096 bytes)
Using 87.500 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 19960k/20292k available (2336k kernel code, 316k reserved, 447k data, 9544k init, 0k highmem)
Mount-cache hash table entries: 512
Checking for 'wait' instruction...  available.
unpacking initramfs....done
NET: Registered protocol family 16
adm5120: system has PCI BIOS
usbcore: registered new driver usbfs
usbcore: registered new driver hub
Algorithmics/MIPS FPU Emulator v1.5
PCI: slot number 0 is not supported
PCI: mapping irq for 0000:00:02.0 pin:1, irq:15
yaffs Sep 20 2007 18:44:25 Installing. 
Initializing Cryptographic API
io scheduler noop registered
io scheduler anticipatory registered (default)
io scheduler deadline registered
io scheduler cfq registered
watchdog hb: 90  WDOG0: 0xa32806dd  WDOG1: 0x7fff06de
adm5120_wdt_init using heartbeat 90 s cycles 9000
watchdog hb: 90  WDOG0: 0xa3280000  WDOG1: 0x7fff0000
ttyS0 at I/O 0x12600000 (irq = 9) is a ADM5120
ttyS1 at I/O 0x12800000 (irq = 10) is a ADM5120
eth0: ADM5120 switch port0
eth1: ADM5120 switch port1
eth2: ADM5120 switch port2
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <>
RB1xx nand
NAND device: Manufacturer ID: 0xad, Chip ID: 0x76 (Hynix NAND 64MiB 3,3V 8-bit)
Scanning device for bad blocks
Creating 4 MTD partitions on "NAND 64MiB 3,3V 8-bit":
0x00000000-0x00400000 : "/bootpart"
0x00400000-0x00800000 : "/storage"
0x00800000-0x00810000 : "paniclog"
0x00810000-0x04000000 : "extra"
usbmon: debugfs is not available
mice: PS/2 mouse device common for all mice
NET: Registered protocol family 2
IP route cache hash table entries: 512 (order: -1, 2048 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
ip_conntrack version 2.4 (256 buckets, 2048 max) - 232 bytes per conntrack
ip_conntrack_pptp version 3.1 loaded
ip_nat_pptp version 3.0 loaded
ip_tables: (C) 2000-2006 Netfilter Core Team
ClusterIP Version 0.8 loaded successfully
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Bridge firewalling registered
802.1Q VLAN Support v1.8 Ben Greear <>
All bugs added by David S. Miller <>
Freeing unused kernel memory: 9544k freed
init started:  BusyBox v1.1.0 (2007.09.21-01:28+0000) multi-call binary

Please press Enter to activate this console. yaffs: dev is 32505856 name is "mtdblock0"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.0, "mtdblock0"
yaffs: auto selecting yaffs1
yaffs: dev is 32505857 name is "mtdblock1"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.1, "mtdblock1"
yaffs: auto selecting yaffs1
adm5120_wdt: starting watchdog w/timeout 90 seconds
watchdog hb: 90  WDOG0: 0xa328028c  WDOG1: 0x7fff028c
ath_hal: module license 'Proprietary' taints kernel.
ath_hal: (AR5210, AR5211, AR5212, RF5111, RF5112, RF2413, RF5413, REGOPS_FUNC)
wlan: (svn 10828)
ath_rate_sample: 1.2 (svn 10828)
ath_pci: (svn 10828)
PCI: Enabling device 0000:00:02.0 (0000 -> 0002)
wifi0: 11a rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
wifi0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps
wifi0: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
wifi0: H/W encryption support: WEP AES AES_CCM TKIP
wifi0: mac 10.4 phy 6.1 radio 6.3
wifi0: Use hw queue 1 for WME_AC_BE traffic
wifi0: Use hw queue 0 for WME_AC_BK traffic
wifi0: Use hw queue 2 for WME_AC_VI traffic
wifi0: Use hw queue 3 for WME_AC_VO traffic
wifi0: Use hw queue 8 for CAB traffic
wifi0: Use hw queue 9 for beacons
couldn't load module 'wlan_scan_sta' (-89)
unable to load wlan_scan_sta
wifi0: Atheros 5212: mem=0x11400000, irq=15
click: starting router thread pid 478 (818d3480)
wlan: mac acl policy registered

!!!!! reading /tmp/mtunnel_state failed: No such file or directory
couldn't load module 'wlan_scan_monitor' (-89)
unable to load wlan_scan_monitor

BusyBox v1.1.0 (2007.09.21-01:28+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

Welcome to your Meraki device.  Please look for developer information at  We would like to encourage you to play with this
platform and add your own features to it.  However, our lawyers
require us to tell you that much of the software on this device is
protected by copyrights, and may not be redistributed or sold.

Like hacking on wireless stuff?  Come work with us!

Happy Hacking!

Wiki page for RB133

Diane moaned with ecstasy as Terry and Kevin worked her long, firm nipples like levers, sliding her boulder-like boobs up and down the unbelievable length of Mahmout's shaft. The work was made harder by the fact that Mahmout's cock had begun to brush up against he ceiling, forcing them to work at an angle, rather than straight up and down. Mahmout's cock continued to expand, massive veins bulged across the surface like snakes, winding their way up the gleaming tower of flesh. "Holy shit! How much bigger is that thing gonna get?" asked Kevin, his jaw slack at the sight of the towering cock. "Fuck if I know," grunted Terry, sweating with the effort of pumping Diane's gigantic tit. Mahmout didn't seem to mind the massive new developments in his cock, he seemed to have finally lost himself in the pleasure of the world's biggest titfuck. Diane, meanwhile, was more than enjoying herself. The combined thrill of Terry and Kevin stroking her colossal nipples and the growing warmth in her crotch was driving her insane with pleasure. "Yes! Oh yessss!" she moaned, fondling the growing bulge in her own pants. She'd never gotten around to wiping the cream off her gloves, by now her clit had received a double dose of the supercharged cream. The once tiny nubbin of flesh had expanded into a full blown sausage, and it was only a matter of time before she gave into the temptation to just whip it out and start jerking off like a dude. Her pussy, too, had puffed up to nearly twice its size and her swollen labia were putting a pleasurable pressure on her throbbing clit-on. Mahmout began to groan and his yoga-ball sized nuts began to contract, hugging his shaft like a pair of bears snuggling up against an oak tree. "I think he's getting close," panted Terry, watching Mahmout's eyes as they rolled back in his head. Kevin nodded and the pair began to stroke faster, driving Mahmout inexorably toward climax. Diane purred hungrily as she felt Mahmout's shaft grow hot and bulge in anticipation of orgasm. She reached up and grasped the trunk of his shaft, pulling it down with all her weight and inching backwards until the gargantuan cockhead was right in her face. "What the hell are you doing?" grunted Kevin. "This angle is really difficult." "Just keep it up a little longer," Diane instructed. "He's close, I can feel it..." She gazed into Mahmout's gaping cumslit. It was like looking down the barrel of an artillery piece. Mahmout moaned again and his balls tightened further. "Oh yeah, cum for me, baby," Diane licked her lips, gripping Mahmout's cockhead firmly behind the flared edges of the broad mushroom and opening her mouth wide. "Don't tell me you're gonna try and swallow that load?" asked Kevin, his eyes bugging in disbelief. "There's no way you could take it all!" "I dunno, man," said Terry, "she did chug like, two gallons of protein shake without taking a breath. I think she might be able to handle this." "There's no way I'm gonna pussy out on taking the world's largest cumshot," said Diane. Mahmout grunted and his abs tightened as a visible bulge began to climb the twelve and a half foot pillar of his cock. "Here we go!" Diane grinned and plunged her face into Mahmout's cockhead. His cumslit was actually larger than her mouth, so she stuck her whole face in and opened wide...

This is the part where Diane almost died.

Mahmout let out a terrific howl of pleasure and let loose with a blast of jizz that, for a moment, looked like an explosion of white. Cum flooded into Diane's mouth, filling her cheeks and spraying out her nose. Her years of experience in sucking cock were the only thing that saved her; if she'd hesitated to swallow for only a split second, three gallons of spunk would have flooded into her lungs instead of her stomach. The pressure was enough to knock her off her feet, she hit the wall behind her with enough force to crack the drywall, held momentarily in midair by a stream of jizz that would have shamed a fire hose. Terry and Kevin, still gripping Diane's now eighteen inch nipples, were yanked off balance and flung to the ground as the wet splatter of semen cascaded off the wall and pattered all over them in heavy globs. Trapped beneath the incredible weight of her tits, Diane flailed helplessly in a lake of cum, her entire body frosted in white goo. She still couldn't breathe and her efforts to call for help only produced sticky bubbles in the inch lick layer of jizz that covered her head. Terry was the first to realize what was happening and rushed to help, scraping the jizz off Diane's face in wet handfuls and flicking it to the ground. He was coated in semen up to his knees and he could feel it squishing in his socks as he sloshed around to help Diane to a sitting position. Diane drew a gasping breath and lifted her hand to her nose, clamping down on one nostril and blowing a thick rope of jizz out the other. "Holy. Living. Fuck!" exclaimed Kevin, lifting himself off the ground and stepping away from the expanding puddle of jizz. "That was-" "The most awesome thing I've ever experienced!" shouted Diane, raising her fists over her head in triumph. Mahmout lay on his back twelve feet away, moaning softly in his own private world as his still-firm cock pumped out the dregs of his orgasm in footlong ropes. "Dudes, help me up!" Diane ordered, "There's jizz going to waste!" Terry and Kevin hesitated for a moment, then shrugged and hoisted Diane up by her armpits, rolling her forward on her gargantuan tits until she could latch onto Mahmout's still-pulsing cockhead. Now that the flow of Mahmout's cum was more like a garden hose than a firehose, Diane drank from it easily, guzzling down the hot liquid with enthusiasm. "Where does she put it all?" asked Kevin. "Isn't it obvious?" Terry nudged one of Diane's boobs with his foot. Diane's stomach didn't remain bloated for long. Her tits were still growing and their overcharged metabolism made swift use of Mahmout's load. For several minutes, it seemed like Mahmout were pumping directly into Diane's hefty gazongas. With every gulp, her boobs swelled a little larger and her nipples puffed out a little further. Before long, her erect teats were the size of traffic cones, jutting from a pair of breasts that were each as large as she was. "Oh man!" sighed Diane, scooping the last of Mahmout's cum out of his slit with her finger and licking it off like cake frosting. "So, did this thing get any smaller?" asked Terry, looking over the fleshy yards of Mahmout's monster dick. "It looks smaller, but that might just be because it's starting to get soft," observed Kevin. Diane nodded. "We'll give him time to built up another load, then go again," she said. Kevin raised a hand. "Can we like, give him an hour or something? I'm fucking exhausted." "Yeah, and I'd kind of like to take a shower," added Terry, gesturing to the slick coat of cum that covered most of his lower body. "Whatever," Diane shrugged, sending a small cascade of spunk rolling off her soulders where it merged with the goopy puddle that covered most of the floor. "Just remember we've gotta do this like, five more times before he'll be small enough to walk. If you take long breaks in between, we'll be at this all day." "Yeah, I'm sure you'd hate that," Terry rolled his eyes. Diane made a kissy face at him and leaned forward on her boobs, luxuriating in their bouncy softness. She felt another stir in her loins and remembered she had plenty to keep herself occupied while she waited for Mahmout's gargantuan balls to churn up a new load of hot cum. Her boobs weren't the only thing that had taken advantage of Mahmout's load to fuel their growth. Her sausage-like clit was swiftly expanding into a full blown bratwurst. She wondered it Terry would be jealous if she got bigger than him. With that thought in mind, she waited for Terry and Kevin to leave before snagging the bottle of cream. She had to scoop it off the bed with Mahmout's lacrosse stick, as she couldn't reach that far. A couple of pumps filled her gloved hand with a satisfying mound of the precious growth cream and she began to massage it vigorously into her hungry clit...