Saturday, 21 December 2013

Mini USB Portable 3G/4G router - rt5350f


Mini USB Portable 3G/4G WiFi Hotspot IEEE 802.11b/g/n 150Mbps Wireless Router - search on ebay

This hardware seems to be exactly the same like (firmware is different ):
  • HAME A5 Mini
  • HAME A15
Upgrade with default firmware via WEB interface is not possible. Upgrade from u-boot (tftp) is not  working too  - because of broken ethernet configuration. Upgrade from u-boot via serial (kermit) will end with bricked router too ( verified).

Below you will find the way how to bring new working u-boot and openwrt firmware at once.

Basic device parameters:

  • SoC RT5350
  • Clock 360 MHz
  • 4 MByte Flash (GD25Q32) 
  • 16 MByte RAM (EM639165TS-6G)
  • USB Host 2.0
  • 10/100 Ethernet switch
  • 802.11n interface
  • I2C
  • Uart
  • Reset button
  • 2 LEDs
  • Micro usb as power source

GPIO description:

  • GPIO0 - Reset Button
  • GPIO1 - I2C_SD
  • GPIO2 - I2C_SCLK
  • GPIO7 - USB Power
  • GPIO12 - USB Root Hub Power
  • GPIO13 - Unknown, but seems to be used in bootloader
  • GPIO17 - Red Power LED
  • GPIO20 - Blue System LED


Default u-boot bootloader is broken - ethernet is not fully initialized, and it seems that it is protected against starting other firmware than oryginal one.
Do not try to upgrade this bootloader from bootloader menu - you will brick your device  !

To load openwrt firmware new bootloader is needed - I am using - uboot128.img taken from JiapengLi

Openwrt firmware

Default firmware cannot accept openwrt images so at the beggining (after u-boot upgrade) we will load minimal openwrt firmware firmware.img .

Upgrade procedure

Check twice if it is router we are talking about:

  • Take a look on photos of PCB
  • Check MDT structure by call "cat /proc/mtd", has to be like below:
cat /proc/mtd
dev:    size   erasesize  name

mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 00117a6d 00010000 "Kernel"
mtd5: 00298593 00010000 "RootFS"
mtd6: 003b0000 00010000 "Kernel_RootFS"
mtd0: 00400000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader" 
Think twice :)

First step

  • Reset router to default settings
  • Connect to router via telnet and login with default user name (admin) and password (admin)
  • Now  you can upgrade router via FTP or USB

Upgrade via FTP 

  • Release memory by commands:  
killall udhcpd
killall dnsmasq
killall nvram_daemon
rmmod ehci_hcd
rmmod ohci_hcd
ifconfig ra0 down
rmmod rt2860v2_ap

  • probably you will be disconnected after last command, so login via telnet again. 
  • Verify free memory by calling free, check if you have more than  3500 free memory 

# free              total         used         free       shared      buffers  Mem:        12884         9180         3704            0          532 Swap:            0            0            0Total:        12884         9180         3704
  •  Resize TMP, and start proftp server
mount -o remount,size=4M tmpfs /tmp server 21 10
  • Connect to router via ftp and copy uboot128.img and firmware.img to /tmp directory on router
  • ! Upgrade uboot - be careful, do not reset router during and after this operation !
mtd_write write  /tmp/uboot128.img Bootloader
  • You should see on console 
#Unlocking Bootloader ...
#Writing from /tmp/uboot128.img to Bootloader ...  [w]
  • ! Upgrade firmware - do not reset router during this operation!
mtd_write write /tmp/firmware.img Kernel_RootFS
  • You should see on console  
#Unlocking Kernel_RootFS ...
#Writing from /tmp/firmware.img to Kernel_RootFS ...  [w]
  • Reboot router :), enjoy new u-boot with working ethernet and openwrt firmware. Now you can use standard openwrt upgrade procedure. 
  • Router will set IP address to , you can login via telnet or ssh 

Upgrade via USB

  • Prepare usb stick, format it with fat filesystem, and copy  uboot128.img and firmware.img 
  • Conect usb stick to router and mount it by:
mount /dev/sda1 /mnt
  • Wait a few seconds and verify  if you see files
ls /mnt 
  • You should see content, do not go further if you do not see files ! 
uboot128.img firmware.img
  • ! Upgrade uboot - be careful, do not reset router during and after this operation !
mtd_write write  /mnt/uboot128.img Bootloader
  • You should see on console 
#Unlocking Bootloader ...
#Writing from /mnt/uboot128.img to Bootloader ...  [w]
  • ! Upgrade firmware - do not reset router during this operation!
mtd_write write /mnt/firmware.img Kernel_RootFS
  • You should see on console  
#Unlocking Kernel_RootFS ...
#Writing from /mnt/firmware.img to Kernel_RootFS ...  [w]
  • Reboot router :), enjoy new u-boot with working ethernet and openwrt firmware. Now you can use standard openwrt upgrade procedure. 
  • Router will set IP address to , you can login via telnet or ssh 
 Connect UART

In order to have access to bootloader (u-boot) menu and functions we have to connect serial port to the router board. Pads are quite large so soldering is relatively easy.

Serial port parameters:

  • Speed: 57600
  • Data Bits: 8
  • Parity: None
  • Stop Bits: 1
!   One problem has to be fixed - when you will connect adapter to RX in router and power on system will hangs. To fix it temporary you have first power on router and next quickly connect RX cable.  To fix this issue permamently you have connect  router RX and adapter TX by resistor (470 ohm - 1k ohm).

Solder three thin wires to the router GND, TX, RX and connect:
  • Router GND to adapter GND,
  • Router RX via 470 ohm resistor to adapter TX,
  • Router TX to adapter RX.

Router pads description

To test connection:

  1. Connect USB adapter to PC
  2. Start terminal and connect to port with proper parameters (putty or TeraTerm Pro )
  3. Power on router - you shoud see bootloader logs

USB to TTL UART converters

My recomendation is to use:
  • CP2102
  • FT232
  • CH340
CP2102 based adapter

and avoid if possible prolific PL2303 because of unstability ( maybe there are plenty of clones  and prolific is not guilty - hard to say).

Program SPI flash

When you failed with u-boot upgrade you can program SPI flash without desoldering it.
You need to connect thin wires to MISO, MOSI, CLK, CS, VCC and GND. I recomend to desolder VCC pin and lift it little bit, you will solder it again after programming. Disconnecting VCC prevent and distrubances from SoC or other components.

SPI flash pinout
Wires connected to SPI flash,
lifted VCC pin at the right corner soldered after programming.

I have used simple programmer made of

But you can use any SPI programmer which supports GigaDevice GD25Q32 or flash you currently have.

Upgrade RAM

You can upgrade RAM by desoldering SDRAM chip and soldering chip with  32 MB. It is required to have  4M x 16bit x 4 (otherwise you would need to recompile bootloader) taken from old laptop memory PC133 SO-DIMM. It can be by example:

  • Winbond W9825G6JH-6
  • Samsung K4S561632C-TC
  • Samsung K4S561632E
  • Micron  mT48LC16m16A2 
  • EtronTech EM63A165
  • ESMT M12L2561616A
According to Boot strapping description pins: 
  • EPHY_LED3_N 
are used to determine SDRAM size:
  • 0,0: 2 MB/8 MB (default) 
  • 0,1: 8 MB/16 MB 
  • 1,0: 16 MB/32 MB, 32 MB*2 
  • 1,1: 32 MB 
In order to set memory to 32MB you have to add 4.7k resistor (or just shorten)

Location of resistor pads to pull-up EPHY_LDE2_N



PCB top side

PCB bottom side

Opened case
How to open case

Router case

Desoldered CPU, vias visible, from anton.rad 


  1. Hello,
    I need a little help here …
    I purchased the same router and when it came I plugged it to the computer and tried to set it as a wireless client.
    The moment I hit submit button the router died and now the only signs of life are the two red and blue diodes that burn constantly and nothing.
    Do you have any ideas how to bring it back to life?

  2. Hi,

    you have oryginal firmware ?
    Could you try to connect to it via telnet, what is the result ?

  3. Hello,

    I found your address in openwrt forum. I hope you can help me a little.
    I also have one of these HAME MPR-A1 clones and want to run openwrt. I have a 32MB Version and I assume that I need to update u-boot.... fine. Which firmware should I use to ensure a proper working, because all currently available images only support 16MB. Yes I'm willing to compile a version by myself, but for this I would need additional help. I hope you can help.
    Did you compile provided version+patch from ?
    Anything else or a different approach?

    The description here says, that the image shall be written via "mtd_write write /mnt/firmware.img Kernel_RootFS". My router does not provide Kernel_RootFS. How can I solve this?

    Hope you can help.

    1. Hi Martin,

      1. Regarding u-boot, probably ( I do not hav 32M version) you should use

      2. Regarding firmware I will release today or tomorrow memory independent images, so you can use them.

      3. I have used path you mentioned + many little changes espetially fixes in packages. Some important for me was broken by default. I have additional scripts to generate many images at once.

      4. Regarding missing Kernel_RootFS, could you send me result of "cat /proc/mtd" ?

    2. Thanks,

      @1-3: please give me private message, when you release newer version. I can give repsonse when it works.

      @4: see below:
      # cat /proc/mtd
      dev: size erasesize name
      mtd0: 00400000 00010000 "ALL"
      mtd1: 00030000 00010000 "Bootloader"
      mtd2: 00010000 00010000 "Config"
      mtd3: 00010000 00010000 "Factory"
      mtd4: 003b0000 00010000 "Kernel"
      # free
      total used free shared buffers
      Mem: 28584 17128 11456 0 0
      Swap: 0 0 0
      Total: 28584 17128 11456
      # mount
      rootfs on / type rootfs (rw)
      proc on /proc type proc (rw)
      none on /var type ramfs (rw)
      none on /etc type ramfs (rw)
      none on /tmp type ramfs (rw)
      none on /media type ramfs (rw)
      none on /sys type sysfs (rw)
      none on /dev/pts type devpts (rw)
      none on /proc/bus/usb type usbfs (rw)

    3. Hi Martin images released. Working with 16 and 32m versions.

    4. Please give me a hint about writing to Kernel_RootFS. I assume "mtd_write write /mnt/firmware.img Kernel_RootFS" won' work. Any idea?

    5. Hi Martin,
      looking on you /proc/mtd
      and assuming that you have 4MB flash !

      I would try "mtd_write write /mnt/firmware.img Kernel"

      Remember to upgrade uboot first (256 version).

      Eventually you will have to say hello to USB2uart adapter and solder three wires.

      BTW. you have plenty of ram, so you do not have to kill processes by killall.

    6. ...I did it. I also assumed to overwrite just Kernel. Even when size does not fit. I flashed your mini.bin and after reboot the system led became red. Wifi seemed to be off. Connecting via cable to works like a charm. Here is the output:
      _______ ________ __
      | |.-----.-----.-----.| | | |.----.| |_
      | - || _ | -__| || | | || _|| _|
      |_______|| __|_____|__|__||________||__| |____|
      |__| W I R E L E S S F R E E D O M
      BARRIER BREAKER (Bleeding Edge, r35407) - RT5350F
      -- Cooked by pratanczuk --
      -- --
      -- --
      root@OpenWrt:/# cat /proc/mtd
      dev: size erasesize name
      mtd0: 00030000 00010000 "u-boot"
      mtd1: 00010000 00010000 "u-boot-env"
      mtd2: 00010000 00010000 "factory"
      mtd3: 000e0000 00010000 "kernel"
      mtd4: 002d0000 00010000 "rootfs"
      mtd5: 00220000 00010000 "rootfs_data"
      mtd6: 003b0000 00010000 "firmware"
      root@OpenWrt:/# free
      total used free shared buffers
      Mem: 13576 10120 3456 0 680
      -/+ buffers: 9440 4136
      Swap: 0 0

      So thanks for your help! According to "free" it only has access to 16MB RAM. I read somewhere that there is a mis-configuration, that can't be solved without soldering. Probably you must set a fixed size of RAM for image creation.

      Best regards,

    7. Hi Martin,

      great :).

      Regarding RAM you have flashed:




      Can you provide photos of box, and PCB ?

      I will update manual how to upgrade 32meg version.

      can you send me your email to pawel.ratanczuk at gmail ?

  4. I'm an idiot. I took the wrong file for 16MB version!!!

    Here is the correct welcome screen:
    _______ ________ __
    | |.-----.-----.-----.| | | |.----.| |_
    | - || _ | -__| || | | || _|| _|
    |_______|| __|_____|__|__||________||__| |____|
    |__| W I R E L E S S F R E E D O M
    BARRIER BREAKER (Bleeding Edge, r35407) - RT5350F
    -- Cooked by pratanczuk --
    -- --
    -- --
    root@OpenWrt:/# free
    total used free shared buffers
    Mem: 29820 10232 19588 0 612
    -/+ buffers: 9620 20200
    Swap: 0 0 0

  5. Hi,

    Thanks for the tutorial. I was able to flash my router to openwrt successfully. However, afterwards I attempted enable ssh via a passwd command, and now I'm not longer able to access the router.

    I'm still able to ping it at When attempting to telnet back in, I get the expected "login fail" since telnet is now disabled. However, I'm not able to SSH into it.

    I attempted to do a failsafe recovery, but that didn't work either. Not sure why.

    Any ideas what's going on? Thanks


    1. Hi,

      I do not include ssh in to images, in order to reduce size, so ... look for solder and usb to uart adapter.

    2. ouch...

      How about the failsafe recovery? Why isn't it working?

      Do you know if its recoverable via TFTP? Thanks

    3. I do not see other ways thn solder uart to usb adapter

  6. Hi
    I want to upgrade my A15 router to Openwrt.
    The problem is, there's no proftpd & on /bin or /sbin
    How do I upload uboot128.img firmware.img files to /tmp
    Also tried with USB Flash as well, but the router didn't recognize /dev/sda1
    Please advice :)

  7. I do not have access to A15.
    According to information there:

    Upgrade procedure should be the same like in mentioned mini router.
    One issue is still open - how to download image. I have read that A15 has no ftp server nor Mass Storage support. So maybe you can check if is there in any ftp, tftp server or client or meybe wget is available.

  8. Hi! I have the same device and before I try to hack the firmware I would like to address an other problem.
    The signal strength is pathetic. Do you think it would be possible to add an antenna extension to the board or enhance it in any way ? Please answer in layman's terms, as I'm quite a noob when it comes to hardware. :-)

  9. Is it still possible to use your instruction if mtd show a little bit different structure?

    # cat /proc/mtd
    dev: size erasesize name
    mtd0: 00400000 00010000 "ALL"
    mtd1: 00030000 00010000 "Bootloader"
    mtd2: 00010000 00010000 "Config"
    mtd3: 00010000 00010000 "Factory"
    mtd4: 000c61a0 00010000 "Kernel"
    mtd5: 002e9e60 00010000 "RootFS"
    mtd6: 003b0000 00010000 "Kernel_RootFS"

    1. # cat /proc/mtd
      dev: size erasesize name
      mtd0: 00400000 00010000 "ALL"
      mtd1: 00030000 00010000 "Bootloader"
      mtd2: 00010000 00010000 "Config"
      mtd3: 00010000 00010000 "Factory"
      mtd4: 00128876 00010000 "Kernel"
      mtd5: 0028778a 00010000 "RootFS"
      mtd6: 003b0000 00010000 "Kernel_RootFS"

      Did it work out OK to just install the image above?

  10. hi,

    seems to be OK, but no warranty as usual ;)

  11. Thanks! Can you make a simple description of your firmwares - what is inside of every one?

  12. How can I install packages? I need 3g dongle working? Can you post your patches to openwrt trunk? I want to compile by myself

  13. @Nop & Dimitar

    I have published imagebuilder and scripts used to generate images. So you can take alook what is in images, you can modify scripts and ad own packages. I have not include opkg to save space.

    There you have latest image builder:

    decompress it under ubuntu, run ./

    To change configuration modify ./ and content of "Files" directory.

  14. I compiled openwrt, but I don't like the results with just 16MB ram. Ordered a 32MB chip and will try the ram upgrade.

    Did you made a backup of you original firmware on the 16Mb Ram Device?
    If you did can you upload it somewhere?

  15. I have the same CPU / Flash on a Tenda A6 router. However, I cant seem to telnet into the device. (telnet results in an error : "Connection Refused") I can access the device using the web console
    Any advice on how I can connect via telnet ?

    1. Maybe there isn't telnet service on your device?

  16. Dimitar,

    Yes, that is what I am being led to believe.
    In a situation like this ( telnet ) do you have any recommendations on how I can flash it with an image of my choosing ?

  17. Heh, i have a version of this router. I can telnet in, but cannot run any commands. The busybox (msh) only has access to 5 or 6 commands. Not even cat or ls works. Any ideas ? ctrl -D just closes the telnet session. Does anyone have an "official" firmware, where Telnet works ?

    1. Hi,
      I have the same version of router with 10 commands. I soldered UART cable and flashed mini.bin using boot menu (with stock u-boot) for 32Mb version. Now I have OpenWRT :)

    2. In this post you can find my full log while booting, flashing and rebooting to OpenWRT:

    3. Hi, I tried with UART, there also I can see few commands only. And the prompt is like 'BoC Router>'. There is no root prompt. What should I do to upload u-boot?

  18. I have flashed my device and now its bricked. Is there any way to re-flash bricked device?

  19. Hi, I try to use yours ImageBuilder, but it not work. I try build mini image, and this is output from console... Plese help me, this is interesting device.

    echo "Package list missing or not up-to-date, generating it.";\
    make package_index; \
    else \
    mkdir -p /home/mili/openwrt2/OpenWrt-ImageBuilder-ramips_rt305x-for-linux-x86_64/build_dir/target-mipsel_r2_uClibc-; \
    IPKG_TMP="/home/mili/openwrt2/OpenWrt-ImageBuilder-ramips_rt305x-for-linux-x86_64/tmp/ipkgtmp" IPKG_INSTROOT="/home/mili/openwrt2/OpenWrt-ImageBuilder-ramips_rt305x-for-linux-x86_64/build_dir/target-mipsel_r2_uClibc-" IPKG_CONF_DIR="/home/mili/openwrt2/OpenWrt-ImageBuilder-ramips_rt305x-for-linux-x86_64/tmp" IPKG_OFFLINE_ROOT="/home/mili/openwrt2/OpenWrt-ImageBuilder-ramips_rt305x-for-linux-x86_64/build_dir/target-mipsel_r2_uClibc-" /home/mili/openwrt2/OpenWrt-ImageBuilder-ramips_rt305x-for-linux-x86_64/staging_dir/host/bin/opkg -f /home/mili/openwrt2/OpenWrt-ImageBuilder-ramips_rt305x-for-linux-x86_64/repositories.conf --force-depends --force-overwrite --force-postinstall --cache /home/mili/openwrt2/OpenWrt-ImageBuilder-ramips_rt305x-for-linux-x86_64/dl --offline-root /home/mili/openwrt2/OpenWrt-ImageBuilder-ramips_rt305x-for-linux-x86_64/build_dir/target-mipsel_r2_uClibc- --add-dest root:/ --add-arch all:100 --add-arch ramips:200 update; \
    Package list missing or not up-to-date, generating it.
    make[2]: Entering directory `/home/mili/openwrt2/OpenWrt-ImageBuilder-ramips_rt305x-for-linux-x86_64'

    Building package index...
    (cd /home/mili/openwrt2/OpenWrt-ImageBuilder-ramips_rt305x-for-linux-x86_64/packages; /home/mili/openwrt2/OpenWrt-ImageBuilder-ramips_rt305x-for-linux-x86_64/scripts/ . > Packages && \
    gzip -9c Packages > Packages.gz \
    ) >/dev/null 2>/dev/null
    make[2]: *** [package_index] Error 126
    make[2]: Leaving directory `/home/mili/openwrt2/OpenWrt-ImageBuilder-ramips_rt305x-for-linux-x86_64'
    make[1]: *** [_call_image] Error 2
    make[1]: Leaving directory `/home/mili/openwrt2/OpenWrt-ImageBuilder-ramips_rt305x-for-linux-x86_64'
    make: *** [image] Error 2
    mv: cannot stat ‘bin/ramips/openwrt-ramips-rt305x-mpr-a1-squashfs-sysupgrade.bin’: No such file or directory

  20. So. Now i have it flashed. I used usb-ttl/kermit to get the boot loader, and then i upgraded via tftp. Perfect. Then i started experimenting with the image builder, but it seem to me, that it creates images for the 16 mb version. Any hints on how to enable the image builder for the 32 mb version ?. Btw my reason for doing this, is a want to make a wireless serial server :-). Basicly combining two of the images in the create file. good work btw

  21. Are you sure that you have taken this image bulider: ?

    As far as I remember it was build with support for 32meg version.

    1. Just Tried it again, and no luck :-(.
      I added this to the image builder...
      , and then i added
      To files/browsem/usr/sbin.
      Seemed like a nice plan, but no cigar :-(

    2. What im trying to do, is flash an arduino mega, via wifi, and monitor/communicate with it, also over wifi. I have tried ser2net, and it resets every time i send a command to the arduino, and thats why i tried virtualhere, witch does the trick, but cannot flash the arduino mega( works with the regular arduino uno). So my plan is, to use avrdude to flash it, and the virtual here, to communicate with my application ( a lawn mover robot). I have tried compiling openwrt from source, but i seem to be lacking som magic, because the /overlay wont quite work. Then i tryed the image creator again, but got 16mb ram, with is too little. The pieces work seperatly, i just need to get the puzzle complete :-)

    3. Hi Browsem,
      did you succeed in your project? I trying something similiar... I managed to build and flash an image but am unable to set up the wifi correctly. Maybe you can publish your config?

  22. Man, this is perfect tutorial!!
    But why didn't you mentioned that ssh is not installed,
    Now I have to buy a that uart!!
    Please tell me if there is any way other than serial comm, (failsafe mode or else)

    Thanks for the tutorial, great work.

  23. Man, just connect using telnet or ssh to :), they are included.

    1. Actually I'v changed password and as stated there telnet is disabled now.
      When I try to connect by SSH, I get connection refused, which means either port is not open in firewall or SSH is not included in firmware (as you have mentioned in comments -> to reduce firmware size).

      So, only option is to use UART, right?

    2. :), now it is clear, with mini image only telnet is included, so if you had change password, look for solder and usb2uart adapter.

  24. Привет. Ребята у меня после прошивки горит красная лампочка и устройство не работает. Как реанимировать и с какой прошивкой?

  25. Hi all,

    For all those fighting to get the 16 to 32Mb to work...
    You need to move 2 resistor...

    Have fun...

  26. hello, i have an "Wireles Hard Disk" formerly known as "ALZXmate" that i have bought from aliexpress. This seems to be have very same hardware inside. I want to know if anyone could help-me to upgrade that firmware to OpenWRT. If i try and brick my device, could i unbrick via UART ? i really don't know where to start.