Browsed by
Category: Computer Projects

Computer projects I’m working on Module Tips and Tricks Module Tips and Tricks

Some basic instructions/ramblings to get started (as the documentation for the Domino module isn’t currently complete)

To connect your Domino to a WiFi network using a GUI:

Plug in your Domino Pi/Qi/base module and use your phone or laptop to connect to the “Domino-***” Wifi. The default password is “goodlife”. Navigate to to access the web interface. Change your device’s hostname and password on the web interface and click “Okay, Reset”. Reconnect using your new password, navigate again to and log in using your new password, and you will have access to the web interface.

The basic interface (“Domino Web Panel”) is mobile-friendly; the “LUCI” tab, however, is still formatted for larger screens.

To connect to your local wireless network, choose “LUCI”, then “Network”, “WiFi”. Click “Scan” beside “Generic Wireless” and click “Join Network” next to your WiFi. Enter your password and hit “Submit”. Scroll to the bottom of the page and select “Save and Apply”. You can now access http://domino.local/ from your network.

To connect your Domino to a WiFi network using the command line:

Connect your domino by USB and open a terminal to it (/dev/ttyUSB0 on Linux or whichever COM port Windows assigns) at 115,200 bps. You will have root access just like any OpenWRT implementations. You will want to change the wifi-iface block in /etc/config/wireless to look something like the following (modify to suit your needs):

config wifi-iface
option network ‘wwan’
option ssid ‘yourwifinamehere’
option encryption ‘psk2’
option device ‘radio0’
option mode ‘sta’
option bssid ‘ma:ca:dd:re:ss:he:re’
option key ‘yourpasswordhere’

Mount points / Storage:

With the 3x USB + MicroSD expansion:
/mnt/sda1 is your microSD card
/mnt/sdb1 is your USB,
/mnt/sdc1 is your internal Flash storage

Getting a terminal on the Domino Qi (Arduino Yun Clone):

  1. Upload the YunSerialTerminal sketch over USB
  2. Connect to the Qi at 115200 8N1 and send ~2 to set it to 115200 (Otherwise you’ll just get garbage)

More goes here as I play around with it…

WiiMu A01 (Work in Progress)

WiiMu A01 (Work in Progress)

This is an information dump of the WiiMu A01 in hopes of instituting audio control with the OpenWRT firmware.

PCB Silkscreen:

MVSILICON& WiiMu A01 V2.0 2013.03

Default firmware:


Busybox Linux 2.6.21, built from the Ralink SDK


printk, 8250, rt_rdm, rt2860v2_ap, block2mtd, ohci_hcd, snd_timer, snd_seq_oss, snd_soc_core, nf_nat_ftp, rcupdate, rd, ppp_async, scsi_mod, usbcore, usb_storage, snd_pcm, snd_seq, nf_conntrack, iptable_filter, n_hdlc, loop, pppopptp, sg, ehci_hcd, snd, snd_pcm_oss, snd_seq_dummy, nf_conntrack_ftp, tcp_cubic


  • 2.6.21/kernel/drivers/net/wireless/rt2860v2_sta/rt2860v2_sta.ko
  • 2.6.21/kernel/drivers/char/hw_random/rng-core.ko

Unpacking the root_uImage upgrade:

Using binwalk, specifically

binwalk -Me root_uImage

I was able to extract the root_uImage

Audio DAC

My unit had the DAC markings sanded off, but from /proc/asound/cards, DAC appears to be an Everest Semiconductor ES8155. According to their product sheet, it is a 2-channel DAC in QFN-28 package.

  • SNR: 96 dB
  • THD+N: -85 dB
  • Headphone Amp: Yes
  • Line Driver: Yes
  • PLL: Yes
  • Additional Function: 3-band PEQ
  • Supply Voltage: 1.5 to 3.6 V
  • Low Power: 7 mW
OpenWRT on the DIR-615 Rev. A1 (Marvell 88F5181L) [Work In Progress]

OpenWRT on the DIR-615 Rev. A1 (Marvell 88F5181L) [Work In Progress]

This article will document the process of making OpenWRT work on the DIR-615 rev. A1.

In its dmesg, the stock firmware reports this board as “Marvell Development Board (LSP Version 0.0.102)– RD-88F5181L-VOIP-FE”.

In the GPL’d source code available from D-Link [FTP], in DIR-615A1-GPL.tgz (inside the downloaded file), in Noahsark/platform/MVL5181/linux/arch/arm/mach-mv88fxx81/Board/boardEnv/DB_88FXX81/mvBoardEnvSpec.h, a search for “RD-88F5181L-VOIP-FE” reveals a list of constants that pertain to the board. (See attached .XLS file)

I created Board ID# 4262 at the ARM Linux website to describe this board.(This document from explains why this needs to be done, and goes into detail about how to get support for your particular Orion board type in the mainline Linux kernel. This only ever needs to be done once for each type of board defined on the ARM Linux site, so consider it “already done” for the D-Link DIR-615 and/or the Marvell RD-88F5181L-VOIP-FE reference board.)

Update (25-Jul-2012): I just received my Dangerous Prototypes Bus Blaster to allow me to use JTAG with either OpenOCD or urjtag, among others. It seems that the resistor and capacitor footprints beside the JTAG header need to be populated to allow JTAG access. Proper SMD resistors and caps are part of my next DigiKey order.

Unbricking a D-Link DIR-615 Rev A1

Unbricking a D-Link DIR-615 Rev A1

I have managed to unbrick a D-Link DIR-615 Rev A1 back to D-Link firmware (1.00) from firmware 1.10. Allow me to describe the situation:

  • Given a direct connection to my laptop, the router does not respond to HTTP requests on either WAN or LAN, does not assign DHCP IP addresses, cannot ping or respond to pings, but does show up on the laptop in the ARP tables (arp -an). (This same setup has worked for numerous non-bricked routers, so it seems that some busybox functionality is corrupt.)
  • Over serial, the uBoot bootloader cannot connect to a TFTP server (and does not have the ability to flash over serial).

Attached to this article is a log of one of these so-called “failboots”. It can be easily identified as it only one block of text following the BusyBox ash shell:

BusyBox v1.1.0 (2007.07.26-06:29+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
/ # pc : [<40146968>] lr : [<400ca0b8>] Not tainted
sp : befaf8a0 ip : 00000002 fp : 40079bf8
r10: 00000003 r9 : 40079bb8 r8 : 00050500
r7 : befb5c75 r6 : 00026740 r5 : befb5c74 r4 : 0002674a
r3 : 00000065 r2 : 0000000a r1 : 00026741 r0 : 400ca0b7
Flags: nzCv IRQs on FIQs on Mode USER_32 Segment user
Control: A005317F Table: 01DF0000 DAC: 00000015

A successful bootup (log also attached) is followed by much more serial chatter, such as bringing up interfaces, mounting flash, etc.

BusyBox v1.1.0 (2007.01.24-07:26+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
/ # cp -f /etc/nvram.default /var/etc
mount -t jffs2 /dev/mtdblock2 /flash
cp -f /flash/nvram.conf /var/etc
brctl addbr br0
brctl stp br0 off
brctl setfd br0 0
brctl addif br0 eth1
device eth1 entered promiscuous mode
[... etc ...]

To recover your device:
(Warning: This might damage your device; however, if you are in need of these instructions, I don’t think it’s possible to damage it any more.)

1) Solder on serial headers to CON5 (on the side opposite of the mini-PCI slot)

2) With an Ethernet cable, connect the DIR-615’s WAN port to one of the LAN ports of another router, as it doesn’t play well otherwise. (It seems to need an intermediary to handle ARP tables for it while bricked like this)

3) Power it on, let it boot up, and over the serial connection to the router, run “ipconfig eth0” or some other memorable IP address that’s in the same subnet as your computer

4) Again, over serial connection to the router, run “tftpd”

5) On your computer, download the firmware from DLink:

6) And with a tftp client (See Installing OpenWRT via TFTP (Bootloader contains TFTP Server)), upload the .bin file to the router.

The router will flash itself, then reboot, and erase the (dirty) NVRAM. It will set itself to the default

The key, I believe, lies in installing a version of firmware that is not currently installed, so as to erase all NVRAM settings. If you try to reinstall the same firmware, it will not clear the device’s (faulty) settings. In other words, there may be a much easier way to debrick the device, however with the limited (and possibly corrupt) BusyBox commands, I took the first viable option I could get.

I hope this works for you as it did for me, but as usual, ‘no promises’.

How to convert .RMT to .BIN for OpenRG Bootloader (RGLoader)

How to convert .RMT to .BIN for OpenRG Bootloader (RGLoader)

I recently encountered a situation while loading firmware into an Actiontec MI424-WR router, when I found myself without a bootable firmware, and the OpenRG bootloader would vehemently refuse to load .rmt files.

The MI424-WR has two sections in its Flash for firmware. The stock firmware available from Actiontec is, of course, a RMT. (I did in fact have the .bin dump of the entire flash chip, but I wasn’t about to attempt to make the bootloader overwrite itself.)

After comparing hex dumps, I came to the conclusion that .rmt files are .bin files with a 148-byte header. All you have to do to create a .bin that is ready to be downloaded by the router is to use the following command:

dd if=firmware.rmt of=firmware.bin bs=1 skip=147

Such that the resulting “firmware.bin” file begins with 0xE2 0x8F 0xA0 like other .img files built for this router. I’m not sure if the “magic” will be the same for other machines, but that’s what it seems to be for the MI424-WR running on the stock bootloader (OpenRG).

I hope this saves someone some hassle. As usual, no guarantees of accuracy or completeness 😉

WIP: DIR-615 rev C1 Hacking

WIP: DIR-615 rev C1 Hacking

In my most recent thrift store trips, I found (among other things) a large quantity of D-Link DIR-615 Rev C1.

Some relevant linkage:

Things on my TODO List:

  • Add a USB port and/or hub, and supporting components
  • Add a third antenna (requires a lot of supporting components)
  • Install Kismet and gpsd for a mobile wardriving box?
  • Add I2C Bus over GPIO
  • Add SD Card Support over GPIO?
USB Host on HP Touchpad: Progress…

USB Host on HP Touchpad: Progress…

To access USB Host mode on the Touchpad (to plug in a Keyboard/USB Drive/etc), you need:

  1. A microUSB to USB Female cable (USB-OTG cable), available on ebay for ~$3, shipped [search ‘USB-OTG cable’]
  2. A powered USB Hub (a USB Hub with a spot to plug in an external power supply), available on ebay for under $10, shipped, with power supply  [Search ‘powered usb hub’]

All you need to do is plug the USB Hub into the OTG adapter, and the OTG Adapter into the Touchpad. Power it with a wall adapter, and you’ll have USB devices showing up in dmesg in no time!

For example:

[16075.755719] usb 1-1.1: new high speed USB device using msm_hsusb_host and address 3
[16075.775744] get_port_status port=1,portstatus=1503, portchange=10
[16075.868006] usb 1-1.1: New USB device found, idVendor=13fe, idProduct=3323
[16075.868111] usb 1-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[16075.883769] usb 1-1.1: Product: STORE N GO
[16075.883821] usb 1-1.1: Manufacturer: Verbatim
[16075.894000] usb 1-1.1: SerialNumber: 070007A315074099E8C5
[16075.922270] scsi1 : usb-storage 1-1.1:1.0
[16075.944010] get_port_status port=1,portstatus=1503, portchange=0
[16076.953338] scsi 1:0:0:0: Direct-Access     Verbatim STORE N GO       5.00 PQ: 0 ANSI: 0 CCS
[16076.993863] sd 1:0:0:0: Attached scsi generic sg0 type 0
[16077.204050] sd 1:0:0:0: [sda] 7802880 512-byte logical blocks: (3.99 GB/3.72 GiB)
[16077.204665] sd 1:0:0:0: [sda] Write Protect is off
[16077.216317] sd 1:0:0:0: [sda] Mode Sense: 23 00 00 00
[16077.216329] sd 1:0:0:0: [sda] Assuming drive cache: write through
[16077.219671] sd 1:0:0:0: [sda] Assuming drive cache: write through
[16077.227274]  sda: sda1
[16077.237134] sd 1:0:0:0: [sda] Assuming drive cache: write through
[16077.237234] sd 1:0:0:0: [sda] Attached SCSI removable disk

To be fair, there is most likely a way to enable the Touchpad to power USB OTG devices itself, which would remove the need for the powered hub.

See also: and, which suggest using a USB Y-cable to inject power, and from which I blatantly stole the idea of using a powered USB hub 😉

So far I have tried a USB thumbdrive and a wireless mouse dongle; the thumbdrive was detected flawlessly, while the mouse’s dongle was not.

HP Touchpad Hardware [Preliminary]

HP Touchpad Hardware [Preliminary]

Although this is an article on hardware, I’m going to be using software to probe it. This is from a 32GB HP Touchpad, though the 16GB should be the same, barring the difference in storage.


Processor       : ARMv7 Processor rev 2 (v7l)
processor       : 0
BogoMIPS        : 13.52

Features        : swp half thumb fastmult vfp edsp neon vfpv3
CPU implementer : 0x51
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0x02d
CPU revision    : 2

Hardware        : TENDERLOIN
Revision        : 0000
Serial          : 0000000000000000

The touchpad runs on a Qualcomm Snapdragon dual-core CPU, so I would take this output with a grain of salt: It’s only showing one core, and my touchpad is in powersave mode, so the bogomips, as usual, is way off.

Now for the more interesting stuff, like i2c devices.

cat /sys/bus/i2c/devices/*/name: (with annotations)

mt9m113– Aptina Webcam SoC

  • /sys/devices/i2c-1/1-0078

a6_0 – Battery monitor – Battery?

  • /sys/devices/i2c-3/3-0031
  • This one seems to have information on voltage, charge percentage, etc.
  • Seems to be the battery monitor
  • Here are the values/categories for the Veer (for comparison and info)
  • A6 Version: HW: 255, FW (M.m.B): 2.13.25, ManID: 28769, ProdTyp: 1281

a6_1 – Battery monitor – Charger?

  • /sys/devices/i2c-3/3-0032
  • This one has info in acc_data_*, but not voltage
  • Seems to be the battery charging circuit
  • A6 Version: HW: 255, FW (M.m.B): 2.7.23, ManID: 28769, ProdTyp: 1793

LM8502– National Semiconductor “Smart Lighting” IC

  • /sys/devices/i2c-3/3-0033
  • Fun: The LM8502 driver brings out the vibrator, LEDs (home button LEDs?), flash (for camera? I dont’ think the TP has one),

wm8958– Wolfson Microelectronics Audio Hub w/ 3 Digital Audio interfaces & DSP

  • /sys/devices/i2c-4/4-001a
  • Fun: Driver brings out some GPIO pins

maXTouch– Atmel’s family of “Unlimited-Touch” Touchscreen controllers

pm8058-core – Qualcomm Power Management IC

  • /sys/devices/i2c-6/6-0055
  • The datasheet for this one is kept under wraps?
  • From what the driver brings out, we can see that it controls power to the charger, GPIO, MPP (Multi-Purpose Pins), PWM, Power button, RTC, TM (IC Temperature Monitor), UPL(?), and the vibrator

pm8901-core – Qualcomm Power Management IC (No datasheet?)

  • /sys/devices/i2c-7/7-0055
  • The datasheet for this one is kept under wraps?
  • The driver brings out MPP (Multi-Purpose Pins), regulators, and a Temperature Monitor.
  • (Maybe this one is used for large loads, whereas the pm8058 is for smaller loads?)

QUP I2C adapter – (Six) – Qualcomm Universal Peripheral [cite]

  • /sys/devices/i2c-0 all the way through i2c-5

MSM SSBI adapter – (Three) – Qualcomm MSM-series “Single-Wire Serial Bus Interface” [cite]

  • /sys/devices/i2c-6 through i2c-8

cat /etc/fstab:

  • # <filesystem>  <mount point>   <type>  <options>       <dump>  <pass>
  • rootfs  /       ext3    ro,suid,dev,exec,auto,nouser,async,noatime      1       1
  • /dev/mapper/store-var   /var    ext3    noatime,data=writeback  0       0
  • /dev/mapper/store-cryptodb      /var/db ext3    noauto,noatime,data=ordered     0       0
  • /dev/mapper/store-cryptofilecache       /var/file-cache ext3    noauto,noatime,user_xattr       0       0
  • /dev/mapper/store-log   /var/log        ext3    noatime 0       0
  • /dev/mapper/store-update        /var/lib/update ext3    noauto,noatime  0       0
  • proc    /proc   proc    defaults        0       0
  • devpts  /dev/pts        devpts  mode=0620,gid=5 0       0
  • tmpfs   /tmp    tmpfs   size=40M,mode=1777      0       0
  • tmpfs   /var/run        tmpfs   size=16M,mode=1777      0       0
  • tmpfs   /var/tmp        tmpfs   size=32M,mode=1777      0       0
  • tmpfs   /media/ram      tmpfs   defaults        0       0
  • /dev/mapper/store-media /media/internal vfat    utf8,shortname=mixed,umask=0000 0       0

/dev/input/event0 is the home button and volume button device
/dev/input/event1 is the power button device
/dev/bt_uart is the Bluetooth serial stream

/proc/tty/drivers: (showing some promising signs of USB-Host ability)

/dev/tty             /dev/tty        5       0 system:/dev/tty
/dev/console         /dev/console    5       1 system:console
/dev/ptmx            /dev/ptmx       5       2 system
/dev/vc/0            /dev/vc/0       4       0 system:vtmaster
usbserial            /dev/ttyUSB   188 0-253 serial
acm                  /dev/ttyACM   166 0-31 serial
msm_serial_hsl       /dev/ttyS     243 0-3 serial
pty_slave            /dev/pts      136 0-1048575 pty:slave
pty_master           /dev/ptm      128 0-1048575 pty:master
pty_slave            /dev/ttyp       3 0-255 pty:slave
pty_master           /dev/pty        2 0-255 pty:master
smd_tty_driver       /dev/smd      253 0-36 serial
unknown              /dev/tty        4 1-63 console

More to come.

How to make a 5-Bay NAS Box for under $400

How to make a 5-Bay NAS Box for under $400

What you will need:


  • Case: If space and/or looks are an issue, get a Lian Li PC-Q08, otherwise just get any generic case that will accept a Mini-ITX board and 5 (or 6, like the PC-Q08) hard drives. I chose the PC-Q08 because it was the only reasonably small, well-ventilated case for Mini-ITX and six 3.5″ drives. (It can also hold a 2.5″ hard drive in a space underneath the 5.25″ bay, as I’ll discuss later)
  • Power Supply: I went with the SeaSonic 350W SS-350ET as it was one of the lowest-powered models available (except for the 300W version, which seems to be hard to find), and was from a reputable power supply manufacturer. It supports ATX2.31 and has received the 80 Plus Bronze rating for efficiency. Although it is still overkill for what will be going into this machine, it will allow for adding a graphics card for HTPC use if you decide to go that route either now or in the future.
  • Motherboard/CPU: ASUS E35M1-I — If you are going to use your NAS as an HTPC as well, get the Deluxe version. If you’re going all-out for storage capacity, get the regular, non-deluxe one (The regular has 6 SATA ports, Deluxe only has 5)
  • RAM: This is a bit of a tricky one, as the motherboard tops out at PC3-8500 (DDR3-1066), single channel. That speed of memory is pretty scarce compared to its faster sibling, PC3-10666, and if nothing else, the PC3-10666 will give you more stability. I’d recommend the Mushkin 996992 Silverline PC3-10666 8GB (2x4GB Kit) as it fills the motherboard up to its maximum for memory without breaking the bank.

    I couldn’t get my hands on the Mushkin 996992 memory, and the Mushkin 997667
    Blackline PC3-12800 8GB (2x4GB Kit)
    was actually cheaper than buying two no-name, bottom-of-the-barrel 4GB sticks of PC3-10666 memory.

    My reasoning for maxing out the memory is that we can use this later on to set up RAM drives (tmpfs) to speed up generic tasks and keep our drives spun down longer to save power. If this isn’t your cup of tea, feel free to grab whatever memory best suits your needs.

  • Hard Disk (OS): For power savings, I opted to use a 2.5″ drive for my system disk as it takes substantially less power to operate. I considered a Seagate Momentus XT for the added benefit of having a small amount of SSD storage, but the benchmarks for a server-type machine don’t support spending the extra money. I settled on a WD Scorpio Black 500GB drive (WD5000BEKT)

    As an added bonus, the Lian Li case that I discussed earlier has a special hiding spot for a 2.5″ drive so that it won’t take up any of the 3.5″ bays (leaving a whopping 6 3.5″ bays for possible RAID storage! Unfortunately, the motherboard only has 6 SATA ports, though if you really wanted to have a 6-bay RAID, you could always add a SATA board in the PCIe slot.)

  • Hard Disks (RAID): For this build, I will be making a RAID out of Western Digital Green 2TB SATA-II drives (WD20EARS).

    As of this writing, 2TB drives have the lowest Cost/GB of any 3.5″ drive. 3TB drives, while available, are disproportionately expensive as they are still solely in the realm of the early adopter.

    A RAID 5 setup requires (as a bare minimum) 3 drives. You can always add more in later; the RAID array will just expand to accommodate the extra space.

    Unfortunately, whereas most Western Digital drives used to have a feature known as TLER (Time-Limited Error Recovery) [Wikipedia] hidden in the firmware, this feature now seems to be only available on Enterprise-level drives. This isn’t a problem for Linux software RAID (mdadm) as it just waits for the drive to complete its recovery, but may be a problem if you plan on using a RAID controller card.