FON 2100ABC "aquiring network address"

[Gator8]

I picked up a used 2100ABC. With no internet plugged in the WAN port, I'm trying to bring up the FON setup page at 192.168.10.1 over the wireless side. My notebook finds the WPA security enabled network called myfon. I entered the s/n from the bottom of the fon for the encryption key. It's just sitting there "acquiring network address" while the fon blinks. I've reset the fon using the pushbutton at the bottom. I'm not able to get passed this point. Are there any other default key's for the fon that I should try?

[digininja]

if it is acquiring an IP then it has associated so you've got the key right, maybe the dhcp server is off, set yourself a static IP in the 192.168.1.X range and see what happens. If that doesn't work try other ranges .0.X and .10.X are common ones.

[Gator8]

if it is acquiring an IP then it has associated so you've got the key right, maybe the dhcp server is off, set yourself a static IP in the 192.168.1.X range and see what happens. If that doesn't work try other ranges .0.X and .10.X are common ones.

Thanks for the reply. I should have said "not acquiring" in my title. It was stuck in the "acquiring network" mode instead of connecting. The problem is the router was configured to an ssid of myfon and looking for a different WAP key than the s/n. It wasn't accepting the decal s/n as the WAP key to gain access. And it wasn't resetting with one cycle of the restart button. I guess I should also have explained the seller had subscribed this unit on FON service for a while before selling it on eBay. I finally got in this evening. I found a reset procedure at

reset process

I had to run this reset several times, but my FN2100 finally submitted. The id changed back to MyPLace and I finally get the Router Status screen and it shows Firmware Version: 0.7.0 r2. What happens if I don't "downgrade" it to an older rev?

When I go through step by step Jasager unlocking / install explained at the top of project/Jasager, does that overwrite the FON2100 software, or does it just add modules? If I make a mistake, will the reset procedure bring it back to default condition?

[digininja]

Once you remove the original fon software during the flashing process Fon is gone. No reset, the button is dead unless you go for the reset button hack to turn Jasager on and off by l0rdnic0 and 01706 elsewhere in the forums.

[Gator8]

Once you remove the original fon software during the flashing process Fon is gone. No reset, the button is dead unless you go for the reset button hack to turn Jasager on and off by l0rdnic0 and 01706 elsewhere in the forums.

That's what I thought. Why does it matter what version of FON is on the system then? In the user guide it says to make sure FON is at firmware version 0..7.1 r1 or below. Why would this matter? I have 0.7.1 r2.

Are there any applications I can try first that simply put the FON into promiscuous mode so I can tinker with wireshark?

[digininja]

That's what I thought. Why does it matter what version of FON is on the system then? In the user guide it says to make sure FON is at firmware version 0..7.1 r1 or below. Why would this matter? I have 0.7.1 r2.

Because they fixed the vulnerability that allowed you to gain redboot in later versions so the only way to get it was/is to downgrade then exploit.

Are there any applications I can try first that simply put the FON into promiscuous mode so I can tinker with wireshark?

Short answer, no, long answer, sort of, you can put the card into monitor mode and run tcpdump or possibly tshark but as wireshark is a GUI app then you wouldn't run it on a Fon.

[Gator8]

Because they fixed the vulnerability that allowed you to gain redboot in later versions so the only way to get it was/is to downgrade then exploit.

Short answer, no, long answer, sort of, you can put the card into monitor mode and run tcpdump or possibly tshark but as wireshark is a GUI app then you wouldn't run it on a Fon.

Well, I've turned this FON into an expensive green nightlight. I got through the login, renamed dropbear and transferred openwrt-ar531x-2.4-vmlinux-CAMICA.lmz and out.hex. WinSCP stopped at 90-something percent during the transfer, but the file showed in the tmp directory. I sent the command

mtd -e vmlinux.bin.l7 write openwrt-ar531x-2.4-vmlinux-CAMICIA.lzma vmlinux.bin.l7

reboot

Fon winked and flickered, but didn't seem to reboot. It was 2:30AM, so I called it a night. I recycled power this morning and connected using WinSCP. The two files were missing from the tmp directory. I guess they never wrote from ram to flash. I transferred them again. this morning. This time I got a little further. I was successful in getting the "writing from openwrt-ar531x-2.4=-vmlinux-CAMICIA.lzma .... [w] " I proceeded to the step to write redboot config. That's when the unit bricked.

I can ping the ethernet side at 192.168.1.2. The Wifi side doesn't try to connect.

I have a serial adapter on order. What are the steps to restore/install via the serial connection? Is there anything I can try through the ethernet port while I'm waiting for the usb to ttl converter to arrive?

[Gator8]

I think there's enough left living inside my FON to recover through the serial pin. She's blinking out SOS messages on the TX line.

[Gator8]

I hooked up a 2N7000 inverter and read the serial stream with Putty.

Can anyone explain what the failure message means after the Redboot> prompt?

[digininja]

As you can get that far just follow my steps for installing the firmware again from scratch. This is for the Interceptor so stop once you've done the firmware bit.

http://www.digininja.org/interceptor/install_walkthrough.php

If you use the Jasager firmware then you should have a working device by the end of the first boot.

[DELETE ME]

I got the same problem when flashing my fon the first time. My guess to why it failed, was while the fon was flashing it self with the new firmware,the batty pack went dead, but the leds where still on making it look like it just froze. After messing around I made myself a USB power cable and then flashed the fon using veyron guild here it took about 15 minutes to do and worked first time.

[Gator8]

Thanks for all the help! I was successful installing Jasager using the flash application with digininja's firmware. The serial interface was very helpful to get going again.

I think the issue some people report of needing to disconnect the ground or disconnect the interface before plugging in the fon is from the active serial adapters injecting power into the fon before the power is up. This can cause digital chips to latch. I used the 3.3 volts from inside the fon to run the interface. I did not have to disconnect anything during power up. Here's the interface I built. I rigged it on a ten pin header out of a scrapped PC case.

It was very helpful to watch the chatter coming from the serial port (using putty) while the package was installing.

[digininja]

I haven't put the new photos up but I now add a push to break switch on my ground cables. You can connect it all up the hold down the button and power on then release as soon as you see the first + in the console.