OpenWrt or Bust

The low cost of budget electronic devices — even if they are of somewhat questionable quality — can be very tempting. Henning Paul was recently in need of a Wi-Fi 6 router and came across the WAVLINK WL-WN586X3. It may not be the best hardware out there, but for around $40 it seemed like a bargain. And since it should get the job done for casual use, he purchased one. He knew that he could replace the potentially very janky stock firmware with OpenWrt to make the most of the available hardware and turn it into a respectable router in any case.

Or at least that was the plan. But on closer inspection (after receiving the shipment, naturally), it turned out that the router was of a hardware revision that was not supported by OpenWrt. Paul was not about to take that as a final answer, so he downloaded the latest firmware package for the router and poked around. It turned out that the router was already running OpenWrt — albeit a very outdated and heavily modified version of it.

That gave Paul some hope that it might actually be possible to install a newer, unmodified version of the software on the router, so he got busy hacking. First, he unpacked the firmware tarball and found that the startup script could be modified to enable root access via telnet. He made the necessary changes, repacked the firmware, and applied it through the router's web interface. After a reboot, Paul had root access. However, he quickly discovered that adapting the router to a stock OpenWrt installation would not be straightforward. Differences in hardware between revisions required more investigation.

Next, Paul compared the device tree binaries from firmware packages of both hardware revisions. The main distinction was that Rev A used SPI NOR flash, while Rev B used SPI NAND flash. With this knowledge, Paul modified the OpenWrt device tree source and build files to account for the hardware differences, generating a custom firmware image. To test his creation without risking the router’s functionality, he soldered a pin header to the board, connected a USB serial converter, and used TFTP to boot the custom firmware.

This workaround allowed Paul to boot OpenWrt temporarily, but a big mistake was made when attempting to make the installation persistent. While flashing the new firmware, he inadvertently overwrote critical bootloader partitions, bricking the device. Looking for a solution, he probed the board for JTAG signals. Finding none, he ultimately decided to desolder the SPI NAND flash. Using a Raspberry Pi and custom device tree overlays, he wrote a new bootloader to the chip, restoring the router's ability to boot.

Things were looking up, but Paul encountered one final hurdle: Wi-Fi functionality was broken because the "Factory" partition containing the EEPROM configuration had been overwritten. Fortunately, OpenWrt provides a tool to regenerate this missing data, which Paul restored to the router to bring the Wi-Fi back to life. In the end, Paul transformed a bargain-bin router into a capable, fully operational device. That only leaves the question of whether or not spending all those hours working on the router was worth saving the extra $30 or so that could have gone into buying a better router in the first place.