Rbr50v2 Conversion

[gssjshark]

Hello,

I tried searching the forums but couldn’t find anything. Has anyone successfully converted a rbr50v2 to a satellite. I have successfully converted a rbr50v1 to a satellite but I keep bricking my rbr50v2 when trying to convert it using the v1 method. Would love to hear anyone’s thoughts.

thanks!

 

[CaptainReboot]

Hello,

I tried searching the forums but couldn’t find anything. Has anyone successfully converted a rbr50v2 to a satellite. I have successfully converted a rbr50v1 to a satellite but I keep bricking my rbr50v2 when trying to convert it using the v1 method. Would love to hear anyone’s thoughts.

thanks!

Hey,

Old thread, but did you ever figure this out? I just bricked mine, not realizing the steps wouldn't work on a V2 until after I did it.

 

[caseybhouse]

Same here...seems like this would be easy for these folks to figure out!

 

[kvr]

I've experimented and bricked the v2 multiple times and had to restore it via the JTAG. Unfortunately no luck.

Feels like

Wisdom of the Ancients

xkcd.com

 

[kvr]

I'm now trying a different path. It seems the router firmware has all the elements on board of the satellite and that during boot is determined whether it should act as router or satellite.

This idea is support by the existence of the document /tmp/orbi_type and the subsequent checking of its content by rc.d and init.d scripts.
Several contain:

    if [ "$(cat /tmp/orbi_type)" = "Satellite" ]; then

I'm experimenting with writing "Satellite" to /tmp/orbi_type as early in the boot process as possible and then restarting several boot scripts. I've got some success. The second satellite is the RBR50v2 I'm messing around with. It says "Config Sync", but it's actually working!

Now the question becomes how to make this persistent. Because I could only make it happen via:

 

[HELLO_wORLD]

I'm now trying a different path. It seems the router firmware has all the elements on board of the satellite and that during boot is determined whether it should act as router or satellite.

This idea is support by the existence of the document /tmp/orbi_type and the subsequent checking of it's content by rc.d and init.d scripts.
Several contain:

    if [ "$(cat /tmp/orbi_type)" = "Satellite" ]; then

I'm experimenting with writing "Satellite" to /tmp/orbi_type as early in the boot process as possible and then restarting several boot scripts. I've got some success. The second satellite is the RBR50v2 I'm messing around with. It says "Config Sync", but it's actually working
(…)
Now the question becomes how to make this persistent. Because I could only make it happen via:
(…)

1) What writes into /tmp/orbi_type in the first place in a normal use?
2) Could you alter the init script (PID=1) to do what you want? (granted that /tmp/orbi_type is created before)

 

[kvr]

1) What writes into /tmp/orbi_type in the first place in a normal use?

I have not figured that out yet

2) Could you alter the init script (PID=1) to do what you want? (granted that /tmp/orbi_type is created before)

The problem is persistence (and my limited knowledge of Linux). (Almost) the whole system is written at boot. I know of one way to change/add something and that's by abusing bitdefender. It's explained on this forum thread Hack Netgear Orbi to make it release Pi-hole IP as DNS. So now, I break in via the console ASAP and enter: while true; do echo "Satellite" > /tmp/orbi_type; done . I've also tried injecting it via the bitdefender[/ICODE method, but that seems to be too late in the process.

 

[HELLO_wORLD]

I have not figured that out yet

The problem is persistence (and my limited knowledge of Linux). (Almost) the whole system is written at boot. I know of one way to change/add something and that's by abusing bitdefender. It's explained on this forum thread Hack Netgear Orbi to make it release Pi-hole IP as DNS. So now, I break in via the console ASAP and enter: while true; do echo "Satellite" > /tmp/orbi_type; done . I've also tried injecting it via the bitdefender[/ICODE method, but that seems to be too late in the process.

You would need to be able to change what writes the filesystem. I know Orbi are weird about that…

 

[R. Gerrits]

looking at the gpl sources:

./dni_home/package/dni-platform/files/lib/dni_platform/project/dni_project.sh:    #Create /tmp/orbi_type to indicate that It is Orbi Base or Satellites.
./dni_home/package/dni-platform/files/lib/dni_platform/project/dni_project.sh:    [ "$model_prefix" = "R" ] && echo "Base" > /tmp/orbi_type
./dni_home/package/dni-platform/files/lib/dni_platform/project/dni_project.sh:    [ "$model_prefix" = "S" ] && echo "Satellite" > /tmp/orbi_type

dni_project.sh is dot-sourced from dni_platform.sh, which in turn is dot-sourced from /etc/init.d/boot

I think if you'd have a v1, then you could have used an overlay partition on USB and changed those files. (although I'm not sure if the overlay fs is already activated when /etc/init.d/boot is executed).
But because you have a v2, that option is not possible.

You'd almost have to build your own version of the firmware, because then you can change some of the files.

another potential solution, which might be a very DANGEROUS one:

orbi_type is written based on the info that is fetched from board_model_id:

/sbin/artmtd -r board_model_id | cut -f 2 -d ":" > /tmp/board_model_id

Potentially using /sbin/artmtd -w you could change board_model_id value into RBS50.
Next time during boot, orbi_type should then be written as Satellite because of the S in board_model_id

But again, I have NO idea what stuff might break when doing this change. It might not even boot anymore.
And if it doesn't boot, I have no clue on how to fix it again.
(I.e. whether tftp recovery restores this values back to the original, or whether it is somehow possible via jtag).

 

[kvr]

looking at the gpl sources:

./dni_home/package/dni-platform/files/lib/dni_platform/project/dni_project.sh:    #Create /tmp/orbi_type to indicate that It is Orbi Base or Satellites.
./dni_home/package/dni-platform/files/lib/dni_platform/project/dni_project.sh:    [ "$model_prefix" = "R" ] && echo "Base" > /tmp/orbi_type
./dni_home/package/dni-platform/files/lib/dni_platform/project/dni_project.sh:    [ "$model_prefix" = "S" ] && echo "Satellite" > /tmp/orbi_type

dni_project.sh is dot-sourced from dni_platform.sh, which in turn is dot-sourced from /etc/init.d/boot

[..]

You'd almost have to build your own version of the firmware, because then you can change some of the files.

Yes! I've found that as well. I also found Voxel's Github which has the source for his custom firmware. I haven't been able to compile that successfully yet.

Makefile:39: toolchain/Makefile: No such file or directory
make[3]: *** No rule to make target 'toolchain/Makefile'.  Stop.
Collecting package info: done
Makefile:39: toolchain/Makefile: No such file or directory
make[3]: *** No rule to make target 'toolchain/Makefile'.  Stop.
Collecting target info: done
make[2]: Entering directory '/Volumes/OpenWrt/ORBI-RBK50/scripts/config'
.
.
.
1 warning generated.
make[2]: Leaving directory '/Volumes/OpenWrt/ORBI-RBK50/scripts/config'
Makefile:39: toolchain/Makefile: No such file or directory
make[2]: *** No rule to make target 'toolchain/Makefile'.  Stop.
make[1]: *** [/Volumes/OpenWrt/ORBI-RBK50/include/toplevel.mk:172: prereq] Error 2
make: *** [/Volumes/OpenWrt/ORBI-RBK50/include/toplevel.mk:186: world] Error 2

I keep ending up with the error above. The toolchain folder does not exist. It does exist in the OpenWRT Github. I managed to build OpenWRT firmware. But not the GPL or Voxel's one. I'm under the expression both are incomplete. I may need to resort to Frankenstein options. @Voxel any suggestions?

another potential solution, which might be a very DANGEROUS one:

orbi_type is written based on the info that is fetched from board_model_id:

/sbin/artmtd -r board_model_id | cut -f 2 -d ":" > /tmp/board_model_id

Potentially using /sbin/artmtd -w you could change board_model_id value into RBS50.
Next time during boot, orbi_type should then be written as Satellite because of the S in board_model_id

But again, I have NO idea what stuff might break when doing this change. It might not even boot anymore.
And if it doesn't boot, I have no clue on how to fix it again.
(I.e. whether tftp recovery restores this values back to the original, or whether it is somehow possible via jtag).

Yes, that's dangerous. Those values are read before the Linux kernel is loaded. The whole process crashes. And Indeed had to restore via JTAG.

 

[kvr]

Done! Successfully created a near stock firmware that converts a RBR50v2 into an RBS50v2.

Basic steps
- Download firmware-mod-kit
- Extract RBS firmware
- Modify dni_project.sh to overwrite (almost) all code blocks like below with corresponding RBS values
- Make sure that the partition part is excluded from these mods
- Rebuild firmware
- Use dni-header-util to set device to RBR50 and recalculate header checksum.
- Flash firmware

/sbin/artmtd -r board_model_id | cut -f 2 -d ":" > /tmp/board_model_id

 

[gssjshark]

Could you share the firmware? Will we have to do this to all future firmwares we are flashing?

 

[kvr]

I’m hesitant to share it as I have not tested it thoroughly. If you’re comfortable with tftp or jtag and willing to experiment sent me a DM

 

[Hallex]

Hello kvr !

U're doing a good job ! I just receveid 2 packs (189$ for both) orbi rbk50 but v2 version . I'll use two satellites with one routeur but i'll be interested to flash second routeur later if you make a tutorial with which tool for flash

Thks !

 

[pantigon]

Done! Successfully created a near stock firmware that converts a RBR50v2 into an RBS50v2.

Basic steps
- Download firmware-mod-kit
- Extract RBS firmware
- Modify dni_project.sh to overwrite (almost) all code blocks like below with corresponding RBS values
- Make sure that the partition part is excluded from these mods
- Rebuild firmware
- Use dni-header-util to set device to RBR50 and recalculate header checksum.
- Flash firmware

/sbin/artmtd -r board_model_id | cut -f 2 -d ":" > /tmp/board_model_id

Thank you for sharing the solution and the motivation for me to try "MOD" myself. I have done it successfully.

 

[schmellic]

Done! Successfully created a near stock firmware that converts a RBR50v2 into an RBS50v2.

Basic steps
- Download firmware-mod-kit
- Extract RBS firmware
- Modify dni_project.sh to overwrite (almost) all code blocks like below with corresponding RBS values
- Make sure that the partition part is excluded from these mods
- Rebuild firmware
- Use dni-header-util to set device to RBR50 and recalculate header checksum.
- Flash firmware

/sbin/artmtd -r board_model_id | cut -f 2 -d ":" > /tmp/board_model_id

OMG you are a genius! Just successfully converted mine, thanks for sharing the solution

 

[indoortraveler]

OMG you are a genius! Just successfully converted mine, thanks for sharing the solution

This is huge. Proof that RBR50 v2 is able to be converted to RBS50 v2! I also bought a new RBK50 kit recently that was v2. Is it possible to post the firmware (or a step by step tutorial) for some of us technically unenlightened?

 

[schmellic]

This is huge. Proof that RBR50 v2 is able to be converted to RBS50 v2! I also bought a new RBK50 kit recently that was v2. Is it possible to post the firmware (or a step by step tutorial) for some of us technically unenlightened?

I can post the firmware, but I'm not sure what would happen if the orbi ever updated itself. It might go back to being a router or might be totally unusable, so I would not advise running this unless you are comfortable with tftp

You can always reflash with proper RBR50 firmware via tftp and recovery mode to restore it back into a router, in fact I've only ever flashed this firmware via tftp, I'm not even sure if it would load via the web interface?

 

[indoortraveler]

I can post the firmware, but I'm not sure what would happen if the orbi ever updated itself. It might go back to being a router or might be totally unusable, so I would not advise running this unless you are comfortable with tftp

You can always reflash with proper RBR50 firmware via tftp and recovery mode to restore it back into a router, in fact I've only ever flashed this firmware via tftp, I'm not even sure if it would load via the web interface?

It will be great if you can post the firmware or DM me. My RBK50 system is run in AP mode. And I have a setup on the gateway that blocks netgear from auto updating any orbis with a DNS configuration. (I can share more if interested.) and I am comfortable to do tftp. Thank you so much!

 

[schmellic]

Cool, well here's the link! https://drive.google.com/file/d/1BITNgWNralEcBh6oRXDeQIq7pPpbQvQx/view?usp=sharing let me know if it works for you, and I am no way responsible for bricked devices

Yes please, I'd be interested in the config to block future updates

props to @kvr, I'm only following his steps above, nothing clever from me!

*edit - Link to google drive containing various modified firmware versions https://drive.google.com/drive/folders/1OIY-LzWgfw7jH8lb1kx0M-oVRuiTIKOn?usp=sharing