Project:OccupyWireless

Black 'Something' Boxes

Specification: Freescale MPC8241

• On board power regulation circuit allow 12V DC input, suitable to directly connect to automotive cigarette lighter power source.

Processors Freescale MPC8241 @ 200Mhz

• RAM 32MB
• Flash 8MB
• Standard Interface - Ethernet RJ-45 x 1 ( Optional Dual Ports )
• Dual 32-bit 33MHz Mini-PCI Slots
  • WiFi Module
  • Various CeedTec development boards
• DC 12V Power Set
• Reset Switch
• Indicators LED indicators for Power, LAN, WAN and other module specific status indications.
• OS Linux 2.4.26
• Applications - HSDPA / HSUPA / 3G / EDGE / GPRS WiFi Router
  • Wireless LAN Access Point
  • Routers / Switches- Embedded Remote DAQ System

- Network Access Storage Lead Time Typical delivery lead time is 2 weeks.

Table of Boxes

Box:	Default SSID	Default Gateway	eth0 MAC	wlan0 MAC!	Firmware Version	Type	Condition	Test Result	ToDo
	Super CT3	192.168.100.1
	Super CT3	192.168.100.1
	Super CT	192.168.100.1
	Hotspot	192.168.3.252
	Super CT 2	192.168.100.1
	Super CT 2	192.168.100.1

Power

5v DC, centre positive

Flashing Guide

Notes

Programmer

• Attached are the Bdi configuration files and Hotspot firmware for our M3 platforms. 
• Please follow the Bdi3000 user manual to set up the Bdi3000 IP, TFTP server (either Windows or Linux), and download/upload folder.
• Follow the user manual to configure your BDI3000 programmer.

Specifications

• Power Supply Voltage Limiting 5 VDC ± 0.25 V
• Power Supply Current max. 1 A
• Baud Rates (RS232) max. 115 Kbaud
• Network Interface 10/100 BASE-T
• Target Interface BDM and JTAG
• BDM/JTAG clock up to 32 MHz
• Supported Target I/O Voltages 1.2 – 5 V
• Operating Temperature + 5 °C ... + 60 °C
• Storage Temperature – 20 °C ... + 65 °C
• Relative Humidity (non-condensing) < 90% rF
• Size (without cables) 160 x 85 x 35 mm
• Electromagnetic Compatibility CE compliant
• Restriction of Hazardous Substances RoHS 2002/95/EC compliant

Official Method

1. Create a "bdi" folder/directory in the TFTP folder and save attached files under the "bdi" folder. 
2. Open /ceedtec_ppc26.cfg with a text editor.
3. Go to line 70 and modify the [HOST] IP to your TFTP server IP:

  [HOST] 
  IP          192.168.0.200 
  FILE        /umbra/ppcboot 
  FORMAT      BIN 
  LOAD        MANUAL      ;load code MANUAL or AUTO after reset 
  DEBUGPORT   2001 

1. Save it and restart/re-power your BDI.
2. Connect Bdi to M3 J4 connector.
3. To verify, Telnet to the BDI and try to perform some simple memory/flash reads at addresses 0xFFF00000, 0xFF810000, 0xFF940000, etc.

The range of the flash is 0xFF800000 ~ 0xFFFFFFFF (8MB).  The memory is from 0x0 to 0x02000000 (32MB).

1. Create a new folder in TFTP root and save the attached "ppcboot", "ramdisk", and "zImage".

ppcboot -> Bootloader @ flash address 0xFFF0 0000 zImage -> Kernel Image @ flash address 0xFF81 0000 ramdisk -> Root filesystem @ flash address 0xFF94 000

1. Program and flash the images.  Please use the attached /Bdi-flash-program-M3-readme.txt as a reference to program/flash the images.
2. Once you're done flashing, remove BDI cable and power cycle the PCBA.  You can connect to the unit via either an RJ45 cross over cable or wireless (default SSID is "Hotspot"). 
3. By default, the firmware was designed to use 3G/HSDPA as WAN.  But it can easily be configured to use DHCP (either Dynamic or Static IP) through the built-in Web Management GUI.  The username and password are admin/admin.

Notes / Observations

• 5v, centre positive
• Connected Via Ethernet
• DHCP will give an address x.x.x.x
• IP Address of router should be x.x.x.1 or x.x.x.254

Silk Screen

Ceedtek UMBRA721-MAIN REV4B

Headers

• serial port
• usb
• JTAG (might be able to use buspirate)

Notes

• MIPS or ARM (not an atom)
• NXP ISP 1564HL

Link Dump

• http://www.ceedtec.com/ct-730-wimax-wifi-wireless-router.html
• http://www.ceedtec.com/upload_files/21/ct730wiwiGen1.5.pdf
• Similar Product (probably same tech tree / family) http://www.ceedtec.com/upload_files/15/dukungbrochurev0.4.pdf
• http://commtechasia.net/comm-mainmenu-28/news/605-mimos-wiwi-technology-platform-expected-to-drive-broadband-penetration.html
• http://wiki.openwrt.org/doc/techref/bootloader/redboot
• http://code.google.com/p/the-bus-pirate/wiki/BusModeJTAG
• http://sourceware.org/redboot/

Text Dumps

Ct-730 Wimax-Wifi Wireless Router CEEDTec's CT-730 is a true WiMAX-WiFi (WiWi) wireless access router. It supports both the wireless WiFi 802.11b/g and Ethernet 10/100Mbps interfaces. Our CT-730 offers instantaneous multi-user Internet access over a WiFi connection. Being a true wireless solution, fixed telephone line or DSL cable connection is NOT needed. It is designed with ease of use in mind. As a true plug and play wireless network solution - users only need to power it up (*authentication mode dependent) to create an instant internet hotspot or home wireless network. Our CT-730 also offers a simple and intuitive web based configuration interface.

• Source: http://www.rf-china.com/n11/ML.pdf

 CEED Tec  mPCI-mPCIe-M1-EB 
 miniPCI to miniPCIexpress interface board with 
 SIM for UMTS-modules 
 CEED Tec  USB-mPCIe-M1-EB 
 USB to miniPCIexpress cradle with SIM for 
 UMTS modules 
 CEED *Source: Tec  USB-mPCIe-M2-EB 
 USB to miniPCIexpress cradle with SIM for 
 UMTS modules - model 2

• Nmap Fingerprint, source: https://svn.nmap.org/nmap-exp/colin/updater/project_root/nmap-os-db

 # Linux 2.6.23.17 #28 Thu May 14 12:28:51 MYT 2009 ppc unknown, CT-730 WiMAX-WiFi Wireless Router
 Fingerprint Ceedtec CD-730 WiMAX WAP (Linux 2.6.23)
 Class Ceedtec | Linux | 2.6.X | WAP
 SEQ(SP=C2-CC%GCD=1-6%ISR=C5-CF%TI=Z%CI=Z%TS=7|9)
 OPS(O1=M5B4NNT11%O2=M5B4NNT11%O3=M5B4NNT11%O4=M5B4NNT11%O5=M5B4NNT11%O6=M5B4NNT11)
 WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
 ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4%CC=N%Q=)
 T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
 T2(R=N)
 T3(R=Y%DF=Y%T=3B-45%TG=40%W=16A0%S=O%A=S+%F=AS%O=M5B4NNT11%RD=0%Q=)
 T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
 T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
 T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
 T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
 U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
 IE(DFI=N%T=3B-45%TG=40%CD=S)