Hacking the WRT54GC Router

THIS ROUTER IS UNHACKABLE!

With only 1MB of Flash, you can't really do much with it. You sure can't get Linux on it. OK, *MAYBE* you can netboot it. But with 4MB of Ram, that's not too good.. and what's the point of netbooting such a small router? Its beauty is its size... but if you've got an ethernet cable running might as well go for a Netgear WGT634U refurbed for $40 or so. 8MB Flash, 32MB RAM, *USB 2.0 HOST* and 16x9cm. Not tiny, but you get SOO much more. I'll keep this page up for historical reference. THis is still a great router just to use, so if it's on sale for cheap (which it often is), get it just to have one. It's cool.



The WRT54GC is a very small router. Here's a pic, from Linksysinfo.org, to show you just how small it is.


The WRT54GC compared to an iPod (Thanks LinksysInfo!). Yeah, it's that small. I can literally put it in my pocket. This is a jeans pocket, mind you - few things can fit there with ease, but the router can. It's tiny! It's awesome!

Ok, now i've gotten over how small it really is, time to get to what it can (and can't) do. It is a wireless router, access point, and switch. Five ethernet ports (4 LAN + 1 WAN), integrated wireless antenna, external antenna connector, fold-out foot stand, 3.3v 2A power supply (very well designed btw...), and, well, that's pretty much it. But what more could you want? Oh, and the external antenna connector folds down when not in use.

That's the "consumer" info. Now for the REAL tech specs.

  • Marvell 88E6060 "6-Port Fast Ethernet Switch" (Source, No PDF)
  • EtronTech EM636165TS-6 "16Mb 1Mx16 Enduring SDRAM" (Source, PDF)
  • Macronix LV29800BTTC-70 8M-BIT CMOS 3V FLASH MEMORY (Source, PDF)
  • The processor is under a heat sink, and I have no intention of taking it off.
  • There's a shieled area that generates the RF signals; you can see for yourself from the FCC Internal Photos (PDF, Page 3) what that chip is; I can't tell, and I'm not taking mine apart! I still want it to work when I'm done. Perhaps I'm too ambitious... oh well, one can dream.

    Now, that's the chips. First, how I got it apart:




    A picture is worth a thousand words. Well, actually, if it's a VGA picture with 24bit color depth, then it's 640x480x24bits = 7,372,800 bits = 921,600 bytes. If each byte is one charachter, assuming an average word length of 8 (with a space after each word), we get about 115,200 words (lol, no coincidence intended). So our ancestors were off by two orders of magnitude. Maybe they were assuming 200x150 images? Whatever.

    In any case, (lol, what's with me and bad puns? case...) you can see how the case is held together. There's little tabs and indentations on the two halves. Allegedly, the Mac Mini is held together similarly. I hate snap-together cases, even if OEM's love 'em. Just push in the dark part of the case, then push up on the light part. Eventually one of the connections will snap. When it does, just put your thumb under it and go around.

    When I tried this, there were two parts that REFUSED to open. I was ready to cut them apart! Then I read a post by James Depew who mentioned that it had a screw. Well, thanks for telling me! It's under the bottom-left rubber foot, on the grey part of the case. It's towards the bottom of the foot. Philips head. Once that's out, then the back comes off. To take off the other half, there's two more things: 1) Using pliers, gently remove the nut holding the external antenna connector in place. Then it can be pushed through its hole. Also, there's a switch that tells the router whether to use the external antenna based on wheteher it's open or closed. This can be pulled from the board (gently!) and then the board is (almost) free. The last part is the sticker. This sticker covers the ethernet ports, and labels the WAN, LAN, and POWER connectors. Unfortunately, this sticker is securely stuck to both the board-mounted ethernet ports, and the plastic case. Gently peel this sticker off to free the motherboard. I didn't remove mine compeltely, so I could put it back. I like it. It looks nice. But i'm still an engineer, not a sissy - I don't care about how things look. The sticker just identifies the WAN port nicely. That's all. Don't think that I'm getting soft on you. Anyway, I must have ADD or something, 'cuz I get off topic really easily. This reminds me of my sophomore year chem teacher, who went to see a comedian. He said, "We went off on a tangent, so let's come back on a sine." My chem teacher chuckled lightly, but NOONE else got it. The comedian points to her and says, "THANK YOU for getting that!" A friend of mine, those of you who know him will instanly know who it is, upon hearing the story said, "Well, if you went off on a tangent, you'd have to come back on a secant, wouldn't you? Yea, a secant!" Anyway... back to the GC.

    Now you have your board separated. Woopy. yay. Be careful: the internal antennas are easy to bend. I think I may have bent mine. Woops. You'll notice, on the bottom is a solderpad area with 16 pins. I think the 14 label should be 16; that would make more sense. Anyway, all the even pins except 2 are ground. 2 is +3V. The other 8 pins: I dunno. Pin 11 MIGHT be serial. The piezo buzzer test reveals something here. I still have to find my MAX233's and figure out what it says. That might help ID .... something. Pin 15 is also pulled semi-high. The others appear to be constant low.

    ... That's all I've gotten so far. Here's some pictures to make you happy.





    The two rounded screws are the ones that hold the circuitboard in place. The wedge-shaped one is the external case-holding one.

    What am I gonna do once I get OpenWrt on this thing? Well, another Wifi Car, of course! :-D


    Page Created by Yasha Okshtein