OrayBox X1 解锁SSH & 刷入 OpenWrt 系统

X1 分两个版本:X1-2111 和 X1-3111。3111 版本升级成为 Type-C 供电,内存大小从 64M 升级到 128M,其他地方大致相同。

Specifications

SoC: MediaTek MT7628N (580MHz)
RAM: 64 MiB
Flash: 16 MiB NOR (Winbond W25Q128JVSIQ)
Wireless: 802.11b/g/n 2x2 2.4GHz (Built In)
Ethernet: 1x 100Mbps only
USB: 1x USB Type-A 2.0 Host Port
Button: 1x “Reset” button
LED: 1x Blue LED + 1x Red LED + 1x White LED
Power: 5V Micro-USB input

折腾

我用了烧录器 + sop8 夹子把官方固件读了出来。

Flash Layout

0x000000000000-0x000000030000 : “u-boot”
0x000000030000-0x000000040000 : “u-boot-env”
0x000000040000-0x000000050000 : “factory”
0x000000050000-0x000000f50000 : “firmware”
0x000000fe0000-0x000000ff0000 : “bdinfo”
0x000000ff0000-0x000001000000 : “reserve”

oraybox-lua-api

有个叫做 oraybox-lua-api 的包,里面有所有此路由器可以调用的 API 文件。

1
2
3
4
5
6
7
8
9
Package: oraybox-lua-api
Version: 2.0.7-1
Depends: libc, lua, luci-lib-json, wget, oraybox-base, luac, lua-cjson, oraybox-check-auth
Source: /ext/blue/jenkins/workspace/pgy-box/openwrt/oray_packages/lua_api
Section: net
Maintainer: blue<kbkman@hotmail.com>
Architecture: mtkmips_24kec
Installed-Size: 121182
Description: oraybox lua api

大概能用得到的

1
2
3
4
5
6
7
/usr/lib/lua/oraybox/api/oray_custom_set.lua
/usr/lib/lua/oraybox/api/log_read.lua
/usr/lib/lua/oraybox/api/ssh_set.lua
/usr/lib/lua/oraybox/api/privilege_config_get.lua
/usr/lib/lua/oraybox/api/download.lua
/usr/lib/lua/oraybox/api/sys_upgrade_ex.lua
/usr/lib/lua/oraybox/api/set_upgrade.lua

读启动日志

1
ip/cgi-bin/oraybox?_api=log_read

其他有趣的文件

/etc/ssh_switch.sh
1
2
3
4
5
6
7
8
9
10
11
#!/bin/sh

ENABLED=$(uci get system.ssh.enabled 2>/dev/null)

if [ -z "$ENABLED" -o "$ENABLED" == "0" ]; then
killall dropbear
sleep 5
/etc/init.d/dropbear stop
else
/etc/init.d/dropbear restart
fi

解锁 SSH权限

2111 版本

  1. 使用 WiFi 或者网线连接到路由器,然后查看路由器的 IP 地址(默认是 10.168.1.1)
  2. 浏览器登录到路由器后台(http://10.168.1.1),默认密码是 admin
  3. 浏览器访问此地址:http://10.168.1.1/cgi-bin/oraybox?_api=ssh_set&enabled=1 ,响应应为 {“code”:0}。此时 SSH 服务已开启。
  4. 使用 putty 或其他 ssh 工具连接即可,用户名:root,密码就是自己的后台密码(默认为admin)。
    2111版本 SSH 开启效果

3111 版本

  1. 使用 WiFi 或者网线连接到路由器,然后查看路由器的 IP 地址(默认是 10.168.1.1)
  2. 浏览器访问此地址:http://10.168.1.1/cgi-bin/oraybox?_api=ping&hostname=localhost%27%20%26%20sed%20-i%20%27s/osh/ash/g%27%20/etc/passwd%20%26%20/etc/init.d/dropbear%20restart%20%27 ,此时 SSH 服务已开启。
  3. 使用 putty 或其他 ssh 工具连接即可,用户名:oray,密码就是自己的后台密码(默认为admin)。
    3111版本 SSH 开启效果

刷入 OpenWrt

官方系统有 mtd 软件包,使用 mtd 命令或 dd 命令刷写即可。
我编译了官方固件 适配了 LED 灯以及 Reset 按钮等,也可以刷入其他类似 MT7628N 路由器固件:
https://download.web1n.com/router/OpenWrt/

若想刷 breed,可以使用此版本:breed-mt7628-hiwifi-hc5661a.bin

固件

原厂固件下载

我将所有向日葵路由器的原厂固件链接做了整合, 可以到这里下载: https://github.com/web1n/oraybox-firmwares

关于适配

target/linux/ramips/image/mt76x8.mk

add

1
2
3
4
5
6
7
define Device/oraybox_x1
IMAGE_SIZE := 15360k
DEVICE_VENDOR := OrayBox
DEVICE_MODEL := X1
DEVICE_PACKAGES:= kmod-usb2 kmod-usb-ohci
endef
TARGET_DEVICES += oraybox_x1
target/linux/ramips/dts/mt7628an_oraybox_x1.dts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
// SPDX-License-Identifier: GPL-2.0-or-later

#include "mt7628an.dtsi"

#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>

/ {
compatible = "oraybox,x1", "mediatek,mt7628an-soc";
model = "OrayBox X1";

aliases {
led-boot = &led_status_white;
led-failsafe = &led_status_red;
led-running = &led_status_white;
led-upgrade = &led_status_red;
};

chosen {
bootargs = "console=ttyS0,115200";
};

leds {
compatible = "gpio-leds";

led_status_blue: status-blue {
label = "blue:status";
gpios = <&gpio 37 GPIO_ACTIVE_HIGH>;
};

led_status_red: status-red {
label = "red:status";
gpios = <&gpio 1 GPIO_ACTIVE_HIGH>;
};

led_status_white: status-white {
label = "white:status";
gpios = <&gpio 44 GPIO_ACTIVE_HIGH>;
};
};

keys {
compatible = "gpio-keys";

reset {
label = "reset";
gpios = <&gpio 38 GPIO_ACTIVE_LOW>;
linux,code = <KEY_RESTART>;
};
};
};

&spi0 {
status = "okay";

flash@0 {
compatible = "jedec,spi-nor";
reg = <0>;
spi-max-frequency = <40000000>;

partitions {
compatible = "fixed-partitions";
#address-cells = <1>;
#size-cells = <1>;

partition@0 {
label = "u-boot";
reg = <0x0 0x30000>;
read-only;
};

partition@30000 {
label = "u-boot-env";
reg = <0x30000 0x10000>;
read-only;
};

partition@40000 {
label = "factory";
reg = <0x40000 0x10000>;
read-only;
};

partition@50000 {
compatible = "denx,uimage";
label = "firmware";
reg = <0x50000 0xf00000>;
};

bdinfo: partition@fe0000 {
label = "bdinfo";
reg = <0xfe0000 0x10000>;
read-only;
};

partition@ff0000 {
label = "reserve";
reg = <0xff0000 0x10000>;
read-only;
};
};
};
};

&state_default {
gpio {
groups = "jtag", "wdt";
function = "gpio";
};
};

&ethernet {
nvmem-cells = <&macaddr_bdinfo_9>;
nvmem-cell-names = "mac-address";
};

&wmac {
status = "okay";
};

&bdinfo {
compatible = "nvmem-cells";
#address-cells = <1>;
#size-cells = <1>;

macaddr_bdinfo_9: macaddr@9 {
reg = <0x9 0x6>;
};
};
target/linux/ramips/mt76x8/base-files/etc/board.d/02_network

add

1
2
3
4
oraybox,x1)
ucidef_add_switch "switch0" \
"3:lan" "6@eth0"
;;

OrayBox X1 解锁SSH & 刷入 OpenWrt 系统
https://https.gs/archives/359/
作者
web1n
发布于
2022年9月20日
许可协议