Wednesday, July 26, 2023

DWR-921 C1/C3 OpenWRT Ordeal

Recently I've got my hands on a few DWR-921 routers with, those routers are nothing special

but they do have a 4G modem built-in so you can use them as a regular router or 4G one.
















Checked the OpenWRT site and it is supported on the C1 and C3 revisions of the routers,
I had 4 C1 revision and 2 C3 revision.

after trying to put OpenWRT for a week this is what I've discovered,

There are 2 Flash layouts to these devices,

Older layout (Versions 1 - 3.0.0)
0x000000000000-0x000000010000 : "Bootloader" - JBOOT
0x000000010000-0x000000150000 : "Kernel"
0x000000180000-0x000000f10000 : "RootFS"
0x000000f10010-0x000000ff0000 : "UI"
0x000000ff0000-0x000001000000 : "Config"

Newer layout (Versions 3.0.X+)
mtd1: 00030000 00010000 "Bootloader" - UBOOT
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 00150000 00010000 "Kernel"
mtd5: 00e60000 00010000 "RootFS"
mtd6: 00fb0000 00010000 "Linux"

Also each layout is supported by a different Bootloader (seems strange for D-Link to switch bootloaders on the same hardware)

OpenWRT only supports the older layout, so if you have update to a newer version of the Firmware
it will be much more difficult to downgrade and install OpenWRT.

UBOOT does not support OpenWRT in any shape or form, so lets see how to downgrade 
and what does JBOOT expects.


The JBOOT bootloader when loading looking for the Config memory space and it must be unmodified 
the CRC checks must be passed, without this partition the bootloader will not update to any version.

So if your Config partition is intact, you can hold reset on the device and turn it on, connect a computer with DHCP enabled and wait for the router to boot for a bit, navigate to any site and you will be redirected to firmware upload page, select the correct version of OpenWRT (C1/C3 with a -factory.bin ending)  and upload it you are done.

But you have a later version of the Firmware already installed, you will need a way to dump/flash the flash chip directly, something like CH341 device with the clip and the NeoProgrammer 2.X software 

First thing you do is backup your flash and save it in some place you remember.

Here is the firmware that you need to upload to your device using the programmer (unzip it first)
this firmware is for the C1 revision of hardware only, it will not work (for some reason on the C3)
The problem is there is no way that I've found to change the MAC address in the firmware since each update requires re calculating the CRC and editing it, after many tries I could not find how to correctly do it.

After flashing the firmware you can update to the OpenWRT version by holding Reset button and waiting for the process to start as written above.