D-Link DAP-2020 unbrick guide

Around 2018 a purchased a WiFi access point for my mother. After some years the software was lost. Some guy restored the firmware. I don't know how. I imagine by the cool web emergency page of DAP-2020. The second time I was unable to restore the firmware via the webpage of DAP-2020. I contacted D-Link they stated: bricked.

I opened the DAP-2020 and I found RX/TX lines. Cool. Since I am familiar with FTDI via arduino I tried to unbrick it. I am very bad at soldering, but I made it (quick tips: 1. use gravity, 2. use flux, 3. use small tip 4. use small solder tin). It's funny, but if you have two people around you and three jumper wires, they can hold the jumper wires to the pins on the board if you don't want to solder. I amazed, but I really tortured the board to ssolder the jumper cables, but it survived.

I connected the FTDI to Winbond 25Q32 (I think). GND to GND, RX to TX and TX to RX.

FTDI to usb device is /dev/ttyUSB0 on my Linux system. With minicom -D /dev/ttyUSB0 -b 115200 I failed to TX (transmit) characters. So I used picocom -b 115200 -f n -c /dev/ttyUSB0

Now I had access to the DAP-2020! Great. Even in recovery mode, DAP-2020 had the ethernet up with ip 192.168.1.1. You can upload via ethernet a firmware.

My bricked DAP-2020 had this via serial console to say. Booting... TBS bootloader V1.0 (Dec 28 2016 - 14:30:44) DRAM: 32 MB Flash: 4 MB Can't get system configuration.Use default vlaue. init ehternet... IP: 192.168.1.1 MAC: 00:02:03:04:05:06 IN: eth_init... Hit Space or Enter key to stop autoboot: 0 out : abortboot Can't found system configuration! Please use "bootm addr" command. IN: eth_init... RTL8196#

Now back to the unbrick. On server (computer) connected via ethernet to DAP-2020 I executed: in.tftpd -s -l -L -v ./dap/ (dap folder containes DAP-2020 firmwares).

RTL8196# flinfo Bank # 1: Spi flash ID: 0xef4016 Size: 4 MB in 64 Sectors Sector Start Addresses: BFC00000 BFC10000 BFC20000 BFC30000 BFC40000 BFC50000 BFC60000 BFC70000 BFC80000 BFC90000 BFCA0000 BFCB0000 BFCC0000 BFCD0000 BFCE0000 BFCF0000 BFD00000 BFD10000 BFD20000 BFD30000 BFD40000 BFD50000 BFD60000 BFD70000 BFD80000 BFD90000 BFDA0000 BFDB0000 BFDC0000 BFDD0000 BFDE0000 BFDF0000 BFE00000 BFE10000 BFE20000 BFE30000 BFE40000 BFE50000 BFE60000 BFE70000 BFE80000 BFE90000 BFEA0000 BFEB0000 BFEC0000 BFED0000 BFEE0000 BFEF0000 BFF00000 BFF10000 BFF20000 BFF30000 BFF40000 BFF50000 BFF60000 BFF70000 BFF80000 BFF90000 BFFA0000 BFFB0000 BFFC0000 BFFD0000 BFFE0000 BFFF0000

By the way. This device has a mips CPU. Some info here and here.

RTL8196# bootm addr (yes as a noob, I executed wrong command. Probably the right was bootm BFC00000 ##failed! RTL8196# base Base Address: 0x00000000 RTL8196# flitem Dump part 0: Item HW_TX_POWER_CCK_A locate at 0xbfc10002, length=0x2e, flag=11, CRC=OK Item HW_TX_POWER_CCK_B locate at 0xbfc10036, length=0x2e, flag=11, CRC=OK Item HW_DIFF_HT20_A locate at 0xbfc1006a, length=0x2b, flag=11, CRC=OK Item HW_TX_POWER_HT40_1S_ locate at 0xbfc1009a, length=0x32, flag=11, CRC=OK Item HW_TX_POWER_HT40_1S_ locate at 0xbfc100d2, length=0x32, flag=11, CRC=OK Item �W_11N_THER locate at 0xbfc1010a, length=0xe, flag=00, CRC=BAD Item HW_11N_XCAP locate at 0xbfc1011e, length=0xe, flag=11, CRC=OK Item tbs_wps_pincode locate at 0xbfc10132, length=0x18, flag=11, CRC=OK Item tbs_app_cfg_bak locate at 0xbfc10150, length=0x30, flag=11, CRC=OK Item reset_flag locate at 0xbfc10186, length=0xd, flag=11, CRC=OK Item llconfig locate at 0xbfc10198, length=0xf1, flag=00, CRC=BAD Item boot_times locate at 0xbfc1028e, length=0xd, flag=11, CRC=OK Item tbs_app_cfg locate at 0xbfc102a0, length=0x36aa, flag=00, CRC=OK Item tbs_app_cfg locate at 0xbfc13950, length=0x36aa, flag=00, CRC=BAD Item tbs_app_cfg locate at 0xbfc17000, length=0x36aa, flag=00, CRC=OK Item tbs_app_cfg locate at 0xbfc1a6b0, length=0x36aa, flag=11, CRC=OK Item �������������������� locate at 0xbfc1dd60, length=0xffff, flag=ff, CRC=BAD (oops?) Dump part 1: Item HW_TX_POWER_CCK_A locate at 0xbfc20002, length=0x2e, flag=11, CRC=OK Item HW_TX_POWER_CCK_B locate at 0xbfc20036, length=0x2e, flag=11, CRC=OK Item HW_DIFF_HT20_A locate at 0xbfc2006a, length=0x2b, flag=11, CRC=OK Item HW_TX_POWER_HT40_1S_ locate at 0xbfc2009a, length=0x32, flag=11, CRC=OK Item HW_TX_POWER_HT40_1S_ locate at 0xbfc200d2, length=0x32, flag=11, CRC=OK Item �W_11N_THER locate at 0xbfc2010a, length=0xe, flag=11, CRC=BAD Item HW_11N_XCAP locate at 0xbfc2011e, length=0xe, flag=11, CRC=OK Item tbs_wps_pincode locate at 0xbfc20132, length=0x18, flag=11, CRC=OK Item tbs_app_cfg_bak locate at 0xbfc20150, length=0x30, flag=11, CRC=OK Item reset_flag locate at 0xbfc20186, length=0xd, flag=11, CRC=OK Item llconfig locate at 0xbfc20198, length=0xf1, flag=11, CRC=BAD Item boot_times locate at 0xbfc2028e, length=0xd, flag=11, CRC=OK Item tbs_app_cfg locate at 0xbfc202a0, length=0x36aa, flag=11, CRC=OK Item �������������������� locate at 0xbfc23950, length=0xffff, flag=ff, CRC=BAD (oops? #2) RTL8196# saveb 192.168.1.61 beta.bin TFTP from server 192.168.1.61; our IP address is 192.168.1.1 Filename 'beta.bin'. Load address: 0x80001000 Loading: ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################### done Bytes transferred = 3835048 (3a84a8 hex) Update failure ! System is RTL8196E_DLINK2020 ,but you translate a image! Please translate a RTL8196E_DLINK2020 BIN file!

Wait I minute there is another command savet Use this and the firmware will be uploaded!

savet 192.168.1.61 beta.bin (can't login. Needs user/pass) savet 192.168.1.61 DAP-v1.01.bin (After login I was able to ifconfig eth0)

After the installation of firmware, the device was still unoperable. Probably because I don't have a DHCP server. I used ifconfig to give the static IP's and I was able to user the device as consumer.

Some basic help with commands with `help command' help tftp tftp [loadAddress] tftpServerIP bootfilename

Too much hassle for little gain

Yes this device is very cheap. I unbricked because it was fun and for the ecology. Thank you D-Link, your electrical and software engineers for the great recovery methods / tools. I would like an easier method to compile the source for this device to keep it updated. Now it's abandonware.

You can see the serial log here. It's the beta firmware log. I don't know the credentials, so I abandoned it. In reality I use v1.01.

Bad soldering

You can see how bad I am at soldering here. Two cables are soldered from the back. I did'nt have proper jumper wires. In future I will add pins for easier connection to FTDI. You don't need to solder VCC. The only benefit is that you can power the device (!) from there. I don't know if the 5V/0.5A of USB is enough for proper operation with WiFi e.t.c.
The bogomips of this CPU is around 380. Ten times less power than my 2008 double core laptop. Not bad. With memory and storage is a capable CPU!

ChangeLog

Written at: 13 December 2022.

Made in Linux :)

Hits: 366

Φόρτος CPU: 0.01 | 0.02 | 0