├── 301w_Specs.md ├── AQR_ethphyfw_5.6.7.mbn ├── Marvel-AQR-10GPHY-FW ├── AQR-G4_v5.4.B-AQR_CIG_WIFI_ID44715_VER1673.cld ├── AQR-G4_v5.4.C-AQR_CIG_WF-1945_0x0_ID44778_VER1630.cld ├── AQR-G4_v5.4.C-AQR_CIG_WF-1945_0x8_ID44776_VER1630.cld ├── AQR-G4_v5.5.6-AQR_CIG_WIFI_ID44858_VER1745.cld ├── AQR-G4_v5.6.7-AQR_Netgear_Orbi-prov2_ID45586_VER1990.cld ├── AQR-G4_v5.6.7-AQR_Netgear_Orbi_ID45480_VER1958.cld ├── README.md └── mkheader.py ├── README.md ├── pic ├── 301w.jpg ├── IPQ8072A.jpg ├── flash_qsdk.jpg ├── putty.jpg └── ttl_pins.jpg ├── recovery_oem.md └── uboot.md /301w_Specs.md: -------------------------------------------------------------------------------- 1 | # QNAP QHora-301W 产品介绍 2 | 3 | ## [官方介绍](https://www.qnap.com/zh-cn/product/qhora-301w) 4 | 5 | ## 硬件参数 6 | - SOC: 高通 Networking Pro 1200 平台 [IPQ8072A](pic/IPQ8072A.jpg) 四核 Cortex-A53 2.2GHz 7 | - 内存: 1024MB of DDR3 8 | - 存储: 9 | - 8MB SPI NOR FLASH (包含art mibib cdt uboot等启动引导分区) 10 | - 4GB eMMC NAND FLASH (包含固件操作系统分区kernel和rootfs等) 11 | - 有线网络: 12 | - 4个 RJ45接口 (10Mbps/100Mbps/1Gbps自适应)（PHY芯片：QCA8075） 13 | - 2个 RJ45接口 (10Mbps/100Mbps/1Gbps/2.5Gbps/5Gbps/10Gbps自适应)（PHY芯片：Aquantia AQR113C） 14 | - 无线网络: 15 | - 2.4GHz: 4x4 最大速率1182Mbps 支持4x4(40MHz)模式 (RF:Qualcomm QCN5024 / FEM:SKY85347-11) 16 | - 5GHz: 4x4 最大速率2475Mbps 支持4x4(80MHz)和2x2(160MHz)模式 (RF:Qualcomm QCN5054 / FEM:SKY85755-11) 17 | - 无线天线: 18 | - 2.4G: 4根内置 4.5dBi增益 PCB天线 19 | - 5G: 4根内置 5.2dBi增益 PCB天线 20 | - USB接口: 21 | - 2个 USB3.2 Gen1 TYPE-A接口 22 | - LED灯: 23 | - 7个 GPIO 可编程黄/绿色LED指示灯 24 | - 2个 GPIO 可编程单色LED指示灯 25 | - 按键: 1个 reset键、1个 WPS按键、1个电源开关键 26 | - 电源: 12V DC接口 最大功耗24W 27 | - 尺寸: 250 x 180 x 48 mm 28 | - 重量: 1.9 Kg 29 | 30 | ![接口图](pic/301w.jpg) 31 | ![acwifi拆解图](pic/acwifi_301w.jpg) 32 | 33 | ## 闪存分区表 34 | 35 | ### MTD 36 | 37 | ``` 38 | dev: size erasesize name 39 | mtd0: 00050000 00010000 "0:SBL1" 40 | mtd1: 00010000 00010000 "0:MIBIB" 41 | mtd2: 00180000 00010000 "0:QSEE" 42 | mtd3: 00010000 00010000 "0:DEVCFG" 43 | mtd4: 00010000 00010000 "0:APDP" 44 | mtd5: 00040000 00010000 "0:RPM" 45 | mtd6: 00010000 00010000 "0:CDT" 46 | mtd7: 00020000 00010000 "0:APPSBLENV" 47 | mtd8: 00100000 00010000 "0:APPSBL" 48 | mtd9: 00040000 00010000 "0:ART" 49 | mtd10: 00080000 00010000 "0:ETHPHYFW" 50 | mtd11: 003d0000 00010000 "reserved" 51 | ``` 52 | 53 | ### MMC 54 | 55 | ``` 56 | Partition Map for MMC device 0 -- Partition Type: EFI 57 | 58 | Part Start LBA End LBA Name 59 | Attributes 60 | Type GUID 61 | Partition GUID 62 | 1 0x00000022 0x00008021 "0:HLOS" attrs: 0x0000000000000000 type: b51f2982-3ebe-46de-8721-ee641e1f9997 guid: 1a373c3c-588e-eff4-5182-68ad83e0e62e 63 | 2 0x00008022 0x00010021 "0:HLOS_1" attrs: 0x0000000000000000 type: a71da577-7f81-4626-b4a2-e377f9174525 guid: 7d35f31d-0980-2220-edfd-6228595b79d2 64 | 3 0x00010022 0x00018021 "0:HLOS_2" attrs: 0x0000000000000000 type: 3e972198-336f-11ea-baa1-52540063a6b7 guid: 964e7e67-6666-7303-312a-291b757640e8 65 | 4 0x00018022 0x00118021 "rootfs" attrs: 0x0000000000000000 type: 98d2248d-7140-449f-a954-39d67bd6c3b4 guid: 2a213133-47f8-80a1-5d66-1d565a2ec756 66 | 5 0x00118022 0x00218021 "rootfs_1" attrs: 0x0000000000000000 type: 5647b280-dc2a-485d-9913-cf53ac40fa32 guid: 77f91baf-6750-e138-dbe5-434eaeded6dd 67 | 6 0x00218022 0x00318021 "rootfs_2" attrs: 0x0000000000000000 type: cd26dc90-3370-11ea-baa1-52540063a6b7 guid: 8530d17c-21e3-f82b-12ec-87fd429a600e 68 | 7 0x00318022 0x0031a021 "0:WIFIFW" attrs: 0x0000000000000000 type: 5911fd72-35be-424e-975d-69c957ad3a43 guid: 9420c4b0-ba83-2b38-6ba6-2839be048c92 69 | 8 0x0031a022 0x00322021 "reserved" attrs: 0x0000000000000000 type: 8da63339-0007-60c0-c436-083ac8230908 guid: e590e607-3410-795e-afbc-888e9b2ea17b 70 | 9 0x00322022 0x0073d821 "rootfs_data" attrs: 0x0000000000000000 type: ab1760da-a8bb-4d6f-98d2-9ad3ab9009cd guid: d1402149-3e8e-0709-99d9-170bfab2f66c 71 | ``` 72 | 73 | ## TTL接线图 74 | 75 | 接中间3根，从左到右分别是TX-GND-RX，参数设置115200, 8N1, 3.3 V 76 | 77 | ![TTL接线图](pic/ttl_pins.jpg) 78 | 79 | -------------------------------------------------------------------------------- /AQR_ethphyfw_5.6.7.mbn: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/0x5826/QNAP-QHora-301w-Guide/d9910ce85148b6e2842cadec18446dd0a3692991/AQR_ethphyfw_5.6.7.mbn -------------------------------------------------------------------------------- /Marvel-AQR-10GPHY-FW/AQR-G4_v5.4.B-AQR_CIG_WIFI_ID44715_VER1673.cld: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/0x5826/QNAP-QHora-301w-Guide/d9910ce85148b6e2842cadec18446dd0a3692991/Marvel-AQR-10GPHY-FW/AQR-G4_v5.4.B-AQR_CIG_WIFI_ID44715_VER1673.cld -------------------------------------------------------------------------------- /Marvel-AQR-10GPHY-FW/AQR-G4_v5.4.C-AQR_CIG_WF-1945_0x0_ID44778_VER1630.cld: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/0x5826/QNAP-QHora-301w-Guide/d9910ce85148b6e2842cadec18446dd0a3692991/Marvel-AQR-10GPHY-FW/AQR-G4_v5.4.C-AQR_CIG_WF-1945_0x0_ID44778_VER1630.cld -------------------------------------------------------------------------------- /Marvel-AQR-10GPHY-FW/AQR-G4_v5.4.C-AQR_CIG_WF-1945_0x8_ID44776_VER1630.cld: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/0x5826/QNAP-QHora-301w-Guide/d9910ce85148b6e2842cadec18446dd0a3692991/Marvel-AQR-10GPHY-FW/AQR-G4_v5.4.C-AQR_CIG_WF-1945_0x8_ID44776_VER1630.cld -------------------------------------------------------------------------------- /Marvel-AQR-10GPHY-FW/AQR-G4_v5.5.6-AQR_CIG_WIFI_ID44858_VER1745.cld: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/0x5826/QNAP-QHora-301w-Guide/d9910ce85148b6e2842cadec18446dd0a3692991/Marvel-AQR-10GPHY-FW/AQR-G4_v5.5.6-AQR_CIG_WIFI_ID44858_VER1745.cld -------------------------------------------------------------------------------- /Marvel-AQR-10GPHY-FW/AQR-G4_v5.6.7-AQR_Netgear_Orbi-prov2_ID45586_VER1990.cld: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/0x5826/QNAP-QHora-301w-Guide/d9910ce85148b6e2842cadec18446dd0a3692991/Marvel-AQR-10GPHY-FW/AQR-G4_v5.6.7-AQR_Netgear_Orbi-prov2_ID45586_VER1990.cld -------------------------------------------------------------------------------- /Marvel-AQR-10GPHY-FW/AQR-G4_v5.6.7-AQR_Netgear_Orbi_ID45480_VER1958.cld: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/0x5826/QNAP-QHora-301w-Guide/d9910ce85148b6e2842cadec18446dd0a3692991/Marvel-AQR-10GPHY-FW/AQR-G4_v5.6.7-AQR_Netgear_Orbi_ID45480_VER1958.cld -------------------------------------------------------------------------------- /Marvel-AQR-10GPHY-FW/README.md: -------------------------------------------------------------------------------- 1 | # FW-AQR-GEN4 2 | 3 | ## 一、将 cld 转换成 mbn 格式 4 | 5 | ```bash 6 | python3 mkheader.py 0x44000000 0x13 AQR-G4_v5.5.6-AQR_CIG_WIFI_ID44858_VER1745.cld aqr_5.6.mbn 7 | ``` 8 | 9 | ## 二、将10G fw刷入分区（以301w的mtd10为例） 10 | 11 | ```bash 12 | mtd erase /dev/mtd10 13 | mtd -n write /tmp/AQR_ethphyfw_5.6.7.mbn /dev/mtd10 14 | fw_setenv bootcmd "aq_load_fw 0; aq_load_fw 8; bootipq" 15 | ``` 16 | -------------------------------------------------------------------------------- /Marvel-AQR-10GPHY-FW/mkheader.py: -------------------------------------------------------------------------------- 1 | # 2 | # Copyright (c) 2014-2016 The Linux Foundation. All rights reserved. 3 | # 4 | # This program is free software; you can redistribute it and/or modify 5 | # it under the terms of the GNU General Public License version 2 and 6 | # only version 2 as published by the Free Software Foundation. 7 | # 8 | # This program is distributed in the hope that it will be useful, 9 | # but WITHOUT ANY WARRANTY; without even the implied warranty of 10 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 11 | # GNU General Public License for more details. 12 | # 13 | 14 | import sys 15 | import struct 16 | 17 | def create_header(base, size, img_type): 18 | """Returns a packed MBN header image with the specified base and size. 19 | 20 | @arg base: integer, specifies the image load address in RAM 21 | @arg size: integer, specifies the size of the image 22 | @arg img_type: integer, specifies the image type 23 | @returns: string, the MBN header 24 | """ 25 | 26 | header = [ 27 | img_type, # Type: APPSBL 28 | 0x3, # Version: 3 29 | 0x0, # Image source pointer 30 | base, # Image destination pointer 31 | size, # Code Size + Cert Size + Signature Size 32 | size, # Code Size 33 | base + size, # Destination + Code Size 34 | 0x0, # Signature Size 35 | base + size, # Destination + Code Size + Signature Size 36 | 0x0, # Cert Size 37 | ] 38 | 39 | header_packed = struct.pack('<10I', *header) 40 | return header_packed 41 | 42 | def mkheader(base_addr, img_type, infname, outfname): 43 | """Prepends the image with the MBN header. 44 | 45 | @arg base_addr: integer, specifies the image load address in RAM 46 | @arg img_type: integer, specifies the image type 47 | @arg infname: string, image filename 48 | @arg outfname: string, output image with header prepended 49 | @raises IOError: if reading/writing input/output file fails 50 | """ 51 | with open(infname, "rb") as infp: 52 | image = infp.read() 53 | insize = len(image) 54 | 55 | if base_addr > 0xFFFFFFFF: 56 | raise ValueError("invalid base address") 57 | 58 | if base_addr + insize > 0xFFFFFFFF: 59 | raise ValueError("invalid destination range") 60 | 61 | header = create_header(base_addr, insize, img_type) 62 | with open(outfname, "wb") as outfp: 63 | outfp.write(header) 64 | outfp.write(image) 65 | 66 | def usage(msg=None): 67 | """Print command usage. 68 | 69 | @arg msg: string, error message if any (default: None) 70 | """ 71 | if msg != None: 72 | sys.stderr.write("mkheader: %s\n" % msg) 73 | 74 | print("Usage: mkheader.py ") 75 | 76 | if msg != None: 77 | exit(1) 78 | 79 | def main(): 80 | """Main entry function""" 81 | 82 | if len(sys.argv) != 5: 83 | usage("incorrect no. of arguments") 84 | 85 | try: 86 | base_addr = int(sys.argv[1], 0) 87 | img_type = int(sys.argv[2], 0) 88 | infname = sys.argv[3] 89 | outfname = sys.argv[4] 90 | except ValueError as e: 91 | sys.stderr.write("mkheader: invalid base address '%s'\n" % sys.argv[1]) 92 | exit(1) 93 | 94 | try: 95 | mkheader(base_addr, img_type, infname, outfname) 96 | except IOError as e: 97 | sys.stderr.write("mkheader: %s\n" % e) 98 | exit(1) 99 | except ValueError as e: 100 | sys.stderr.write("mkheader: %s\n" % e) 101 | exit(1) 102 | 103 | if __name__ == "__main__": 104 | main() 105 | 106 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # QNAP 301w 免拆刷机方法 2 | 3 | #### 特别感谢 [@coolsnowwolf](https://github.com/coolsnowwolf) [@asushugo](https://github.com/asushugo) 等一众牛B的开发者适配301w路由器！ 4 | 5 | #### 本教程仅限在lean的qsdk闭源固件和[lede开源固件](https://github.com/coolsnowwolf/lede)测试通过，衍生固件刷机请自行测试。 6 | 7 | #### [QNAP QHora-301W 产品介绍](./301w_Specs.md) 8 | #### [QNAP QHora-301W OpenWRT官网介绍](https://openwrt.org/inbox/toh/qnap/301w) 9 | #### [QNAP QHora-301W 第三方带Web操作&支持原厂双分区Uboot](./uboot.md) 10 | 11 | ### 一. 开启SSH服务 12 | 13 | 在开启路由器可以正常进系统的状态下，长按路由器后的 WPS 键，直到听到**第二声**“嘟”松开（大约 12 秒）就 OK。 14 | 15 | --- 16 | 17 | ### 二. SSH连接路由器后台 18 | 19 | 这里需要注意一点 20 | 21 | - 路由器默认开启的SSH的端口号是 **22200** 22 | 23 | - 用户名是`admin`，密码是路由器网页登录密码 24 | 25 | ssh命令就是 `ssh admin@192.168.100.1 -p 22200`（ 如果端口没开重复步骤1 ） 26 | 27 | 或者使用putty连接 28 | 29 | ![putty](pic/putty.jpg) 30 | 31 | --- 32 | 33 | ### 三. 将启动分区切换到第二分区 34 | 35 | `sudo fw_setenv current_entry 1` **提示要输入的密码就是刚刚你登录 ssh 的密码，以下不再赘述** 36 | 37 | `sudo reboot` 重启 38 | 39 | --- 40 | 41 | ### 四. 检查路由器当前启动分区 42 | 43 | *按照上述步骤二操作重新打开ssh* 44 | 45 | `sudo fw_printenv -n current_entry` 46 | 47 | 查看分区，确保这里会输出 1，如果不是，重复步骤 三。 48 | 49 | --- 50 | 51 | ### 五. 使用 Winscp 上传QSDK的 kernel.bin 和 rootfs.bin 到 /tmp 52 | kernel文件和rootfs文件可以从sysupgrade格式的固件解压获得 53 | 54 | --- 55 | 56 | ### 六. 将QSDK到dd刷入第一分区 57 | 58 | *注意：强烈建议使用dd命令（方法自行搜索引擎）备份一些重要的分区例如mtd闪存分区以及mmc闪存分区，以便以后可以[恢复官方固件](./recovery_oem.md)* 59 | 60 | ```sh 61 | sudo dd if=/tmp/kernel.bin of=/dev/mmcblk0p1 62 | sudo dd if=/tmp/rootfs.bin of=/dev/mmcblk0p4 63 | sudo fw_setenv current_entry 0 64 | sudo fw_setenv boot_0 good 65 | sudo reboot 66 | ``` 67 | 截图参考： 68 | 69 | ![putty](pic/flash_qsdk.jpg) 70 | 71 | 执行完上述命令之后即可刷入QSDK并从第一分区启动QSDK，注意由于目前还没有刷10G PHY的firmware，需刷入firmware。 72 | 73 | --- 74 | 75 | ### 七. 刷入 10G PHY 的 firmware 76 | 77 | 1. 将AQR_ethphyfw_5.6.7.mbn用scp命令或者winscp工具传输到QSDK的/tmp目录下 78 | 2. 使用putty或其他ssh工具进路由器后台，抹除原ethfw分区 mtd10的数据：`mtd erase /dev/mtd10` 79 | 3. 刷入fw文件：`mtd -n write /tmp/AQR_ethphyfw_5.6.7.mbn /dev/mtd10` 80 | 4. 修改bootcmd环境变量：`fw_setenv bootcmd "aq_load_fw 0; aq_load_fw 8; bootipq"` 81 | 5. `fw_printenv` 看下是否有这条记录 bootcmd=aq_load_fw 0; aq_load_fw 8; bootipq ，如果有就没问题。 82 | 6. 重启 83 | 84 | -------------------------------------------------------------------------------- /pic/301w.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/0x5826/QNAP-QHora-301w-Guide/d9910ce85148b6e2842cadec18446dd0a3692991/pic/301w.jpg -------------------------------------------------------------------------------- /pic/IPQ8072A.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/0x5826/QNAP-QHora-301w-Guide/d9910ce85148b6e2842cadec18446dd0a3692991/pic/IPQ8072A.jpg -------------------------------------------------------------------------------- /pic/flash_qsdk.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/0x5826/QNAP-QHora-301w-Guide/d9910ce85148b6e2842cadec18446dd0a3692991/pic/flash_qsdk.jpg -------------------------------------------------------------------------------- /pic/putty.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/0x5826/QNAP-QHora-301w-Guide/d9910ce85148b6e2842cadec18446dd0a3692991/pic/putty.jpg -------------------------------------------------------------------------------- /pic/ttl_pins.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/0x5826/QNAP-QHora-301w-Guide/d9910ce85148b6e2842cadec18446dd0a3692991/pic/ttl_pins.jpg -------------------------------------------------------------------------------- /recovery_oem.md: -------------------------------------------------------------------------------- 1 | # 刷回官方固件 2 | 3 | 这里要说明一下301w的固件系统分区结构，由于301w是双存储模式，emmc中保存了路由器操作系统，9分区结构如下: 4 | 5 | ```bash 6 | /dev/mmcblk0p1 --- "0:HLOS" --- 16MB --- 系统1 kernel 分区 7 | /dev/mmcblk0p2 --- "0:HLOS_1" --- 16MB --- 系统2 kernel 分区 8 | /dev/mmcblk0p3 --- "0:HLOS_2" --- 16MB --- 系统3 kernel 分区（空的，官方未刷入固件，也无法引导到该分区，忽视） 9 | /dev/mmcblk0p4 --- "rootfs" --- 512MB --- 系统1 rootfs 分区 10 | /dev/mmcblk0p5 --- "rootfs_1" --- 512MB --- 系统2 rootfs 分区 11 | /dev/mmcblk0p6 --- "rootfs_2" --- 512MB --- 系统3 rootfs 分区（空的，官方未刷入固件，也无法引导到该分区，忽视） 12 | /dev/mmcblk0p7 --- "0:WIFIFW" --- 4MB --- 无线的firmware分区 13 | /dev/mmcblk0p8 --- "reserved" --- 16MB --- 保留分区（没用的） 14 | /dev/mmcblk0p9 --- "rootfs_data" --- 2.1GB --- rootfs的数据分区，多个官方系统共用的数据分区，目前openwrt固件没有使用该分区 15 | ``` 16 | 系统1和系统2的分区（kernel+rootfs）是互为备份的，理论上是一毛一样的。 17 | 18 | 前面提到的`sudo fw_setenv current_entry 1`即是切换到系统2，同理`sudo fw_setenv current_entry 0`即使切换到系统1 19 | 20 | 恢复官方固件可以在前面刷机教程提到的把备份的/dev/mmcblk0p1和/dev/mmcblk0p4 dd命令刷回301w的这个分区即可，如果之前没备份但是系统2还在也可以刷回去 21 | 例如`dd if=/dev/mmcblk0p2 of=/dev/mmcblk0p1`这样就把系统2的kernel分区复制一份到系统1的kernel分区中了，同理rootfs`dd if=/dev/mmcblk0p5 of if=/dev/mmcblk0p4` 22 | 23 | **但是注意一点，你刷系统1分区一定要切换到系统2下操作** 24 | -------------------------------------------------------------------------------- /uboot.md: -------------------------------------------------------------------------------- 1 | # 威联通 QNAP 301W Uboot 不死 2 | 3 | [Uboot购买&下载地址](https://mbd.pub/o/bread/mbd-ZZWVlZ1v) 4 | 5 | 兼容原厂双分区 6 | 7 | 1. 通过 Openwrt luci web 界面的 “文件传输” -> "上传" ， 把解压后的2个文件上传到路由器的 /tmp/upload/ 目录下 8 | 2. 通过 putty 的 ssh 登录路由器，输入以下命令成功后，等 10s 9 | 10 | ``` 11 | cd /tmp/upload 12 | 13 | mtd write uboot.bin /dev/mtd8 14 | ``` 15 | 16 | ------------------------------------------------------- 17 | PS: 切换分区命令（ OpenWrt 固件中） 18 | 19 | 切换到原厂 20 | 21 | ``` 22 | fw_setenv current_entry 1 23 | 24 | fw_setenv boot_1 good 25 | 26 | reboot 27 | ``` 28 | ------------------------------------------ 29 | 30 | 原厂切换到 OpenWrt（ QNAP 原厂固件中） 31 | 32 | ``` 33 | sudo fw_setenv current_entry 0 34 | 35 | sudo fw_setenv boot_0 good 36 | 37 | sudo reboot 38 | ``` 39 | --------------------------------------------------------------------------------