This is the mtd partition map:

# cat /proc/mtd

dev:    size   erasesize  name

mtd0: 00800000 00010000 “whole flash”

mtd1: 00040000 00010000 “uboot”

mtd2: 00130000 00010000 “kernel0″

mtd3: 00130000 00010000 “kernel1″

mtd4: 00010000 00010000 “others”

mtd5: 00010000 00010000 “parameter tags”

mtd6: 00060000 00010000 “usercfg”

mtd7: 00270000 00010000 “rootfs0″

mtd8: 00270000 00010000 “rootfs1″

Some hardware information:

/ # cat /proc/cpuinfo
Processor : ARMv7 Processor rev 1 (v7l)
BogoMIPS : 1196.03
Features : swp half fastmult edsp
CPU implementer : 0×41
CPU architecture: 7
CPU variant : 0×4
CPU part : 0xc09
CPU revision : 1

Hardware : ZX279125
Revision : 0020
Serial : 0000000000000000

/ # cat /proc/meminfo
MemTotal: 21420 kB

Now I finally managed to get rid of the ZTE F601 by using a SFP with integrated ONU/ONT. The SFP I bought is DFP-34X-2C2 but DFP-34G-2C2 model should work as well.

DFP-34G-2C2 SFP ONU/ONT

This is an ARM v7 (ZX279125) running at 600Mhz and nearly 1200 bogomips, 32Mb integrated RAM and 16Mb of external (SPI?) flash (source) running linux ZTE flavour 2.6.32 in a SFP form factor. PDF

To be able to configure it there has to be some link in the optical connection, otherwise the SFP interface in your switch/router might not linkup and the SFP internal IP might not be reachable.

The default connection info is as follows:

• IP: 192.168.1.1
• VLAN: 1
• URL: http://192.168.1.1
• User: admin
• Pass: admin

In its web page you can configure PON settings and even routing mode. By default, there is no WAN connection (this means there’s no routing mode, only bridge with all vlans through the SFP interface port). You can make the SFP a router to route you house/office traffic by making a WAN connection but I prefer to keep it as bridge.

Once in the web configuration page we can configure LOID, SN and their passwords as per our ISP requirements:

DFP-34G-2C2 LOID web

DFP-34G-2C2 SN web

There is also telnet access with the following credentials:

• User: root
• Pass: Pon521

Telnet access is for linux advanced users and is not recomended to tamper with.

I bougth mine here: https://es.aliexpress.com/item/4000296796422.html

I have this SFP directly plugged to my C2960G switch and my router is a Debian virtual machine inside a synology DS218+ NAS which receivec VLAN20 traffic from the ONU/ONT through the switch and then the VM routers the traffic to VLAN1.

This is a simple-one-afternoot project that I made to be able to open the office door.

Our office door is locked by a presence control (with fingerprint reader, keypad and NFC cards) which is connected to a cloud server and API service. So, to open the door with just a button I need two curl calls to the API service in that server (one for login and another for opening the door).

I love using Omega2 over other projects because has 3 mainly things: has easy built-in wifi, is linux and is cheaper than other things like arduino. Also it’s footprint is quite small.

For the button, I searched over some sites looking for a big button with small footprint but was a futile search. I ended for a chinese repurposed button. This one had a speaker and said ‘Yes’ when pushed’.

I tore it down to fit inside the Omega2 main board, a small DC-DC step down 5v to 3.3v and a micro-usb connector for power. Also I put a small red led to show opening status. I reused the momentary switch soldering a pull-down resistors. Switch is on GPIO 17 and LED on GPIO 11.

Once everything is fit together comes time for a small code. I have 2 scripts. This one is a loop to read the gpio button:

#!/bin/sh

# Boton (Input)
fast-gpio set-input 17 > /dev/null 2>&1

# LED (Output)
fast-gpio set-output 11 > /dev/null 2>&1
fast-gpio set 11 0 > /dev/null 2>&1

# Bogus GPIO?
gpioctl dirout-low 16 > /dev/null 2>&1

while [ 1 ]; do

        # Get button status
        STATUS=`fast-gpio read 17|awk '{print $4}'`

        if [ $STATUS -eq 1 ]; then
                fast-gpio set 11 1  > /dev/null 2>&1
                # LED is light meanwhile the script 'open.sh' is being executed
                /root/open.sh
                fast-gpio set 11 0 > /dev/null 2>&1
        fi

        # Some sleep
        sleep 0.05
done

The other one has the 2 curl sentences:

#!/bin/sh
# Do login and save the cookie
curl -i -c cookie_door \
-H "Accept: application/json" \
-H "Content-Type:application/json" \
-X POST --data '{"name": "someUser","password": "somePassword","user_id": "700"}' \
"https://api.biostar2.com/v1/login" > /dev/null 2>&1

# Use the cookie to open the door (index 1)
curl -i -b cookie_door \
-H "Accept: application/json" \
-H "Content-Type:application/json" \
-X POST --data '{"door_id": "1"}' \
"https://api.biostar2.com/v1/doors/1/open" > /dev/null 2>&1

As a side comment about the ‘bogus GPIO’, I don’t get quite how works the GPIO in Omega2. Seems that GPIO 17 and 16 are somehow linked? I had to put 16 on dirout-low so 17 could work great.

Also I had to install GNU/sleep that accepts times <1s. This way doesn’t use too much CPU without having to sleep 1s that could cause missing push to the push button.

In the end the project is highly usable for almost everything as is a simple network enabled IoT button. Changing the ‘open.sh‘ script can make this project to use in a infinity uses.

1. Using any windows, format any pen-drive in NTFS.
2. Using any linux, mount the NTFS formated pen-drive, change directory to the mounted path and do the following symlink:
   

   ln -s /var/samba/lib/smb.conf .

3. Plug the pen-drive in the router. Ensure Samba Service is enabled.
4. Connect to \\192.168.1.1. This is a tricky part because the router only has SMBv1 which has been disabled since the WannaCry mess. I used my mac to connect to smb://samba@192.168.1.1/samba.
5. If ecerything is going fine you will see the smb.conf file in the connected shared. This part is tricky too because in windows you can only edit it with notepad++. In mac textedit and vi failed both to properly edit the file so I ended doing the following:
   

   echo "[global]
     guest account = root
     deadtime = 5
     log level = 0
     server string = Samba Server
     security = share
     load printers = no
     workgroup = workgroup
     short preserve case = yes
     preserve case = yes
     netbios name = smbshare
   [samba]
     comment = samba share dir
     read only = no
     guest ok = yes
     guest only = yes
     short preserve case = yes
     preserve case = yes
     max connections = 3
     path = /mnt
   [root]
     exec = sendcmd 1 DB set TelnetCfg 0 UserTypeFlag 0; sendcmd 1 DB save
     comment = samba share root
     read only = no
     guest ok = yes
     guest only = yes
     short preserve case = yes
     preserve case = yes
     max connections = 3
     path = /" > /Volumes/samba/usb1_1/smb.conf

   This router version only has one USB so the path ‘usb1_1′ should be fine. The differences between the original file and this version are the guest account = root and the root share, which includes a exec to change telnet behaviour. Actually the root share is just to mess with root file system but not really needed.

6. Without disconnecting the actual share or rebooting the router (changes will be lost!) open a new connection to the router (shares samba or root will be fine).
7. Now the telnet should be in admin mode. Try connecting to 192.168.1.1:23 with username root and password Zte521. Congratulation! you should now have an unlimited telnet inside the router.
8. To be able to connect as admin in the web interface do a sendcmd 1 DB p DevAuthInfo in the telnet session and search for the admin password. The admin password is a pre-router generated password so is unique to your router.

I also wanted to do a full unencrypted dump of the configuration so in the telnet terminal do the following:

for i in `sendcmd 1 DB p | awk ‘{print $2}’`; do echo $i; sendcmd 1 DB p $i; done

Prepare for a extensive dump of data.

Also you can download a precompiled busybox-mips and win some commands as vi, uname and netstat.

cp initrd.img initrd.gz
gunzip < initrd.img | cpio -i –make-directories

y para comprimir:

find ./ | cpio -H newc -o > initrd.cpio
gzip initrd.cpio
mv initrd.cpio.gz initrd.img

Así de sencillo!