Thursday, 23 January 2014

Mini USB Portable 3G/4G router - rt5350f - 32M version

Short description how to upgrade router with 32 MB on board.



PCB is exactly the same, only resistor to set mem size to 32m has been added.


Default u-boot bootloader is not fully functional, and it seems that it is protected against starting other firmware than oryginal one.
Do not try to upgrade this bootloader from bootloader menu - you will brick your device  !

To load openwrt firmware new bootloader is needed - I am using - uboot256.img taken from JiapengLi

Openwrt firmware

Default firmware cannot accept openwrt images so at the beggining (after u-boot upgrade) we will load minimal openwrt firmware mini.bin .
Upgrade procedure

Check twice if it is router we are talking about:

  • Take a look on photos of PCB
  • Check MDT structure by call "cat /proc/mtd", has to be like below:
cat /proc/mtd
dev: size erasesize name
mtd0: 00400000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 003b0000 00010000 "Kernel"
          Think twice :)

First step

  • Reset router to default settings
  • Connect to router via telnet and login with default user name (admin) and password (admin)
  • Now  you can upgrade router via FTP or USB

Upgrade via FTP 

  • Cceck free memory

  • Verify free memory by calling free, check if you have more than  3500 free memory 
# free     total   used   free  shared buffersMem: 28584  17128  11456     0      0Swap: 0 0 0Total: 28584 17128 11456
  •  Resize TMP, and start proftp server
mount -o remount,size=4M tmpfs /tmp server 21 10
  • Connect to router via ftp and copy uboot256.img and mini.bin to /tmp directory on router
  • ! Upgrade uboot - be careful, do not reset router during and after this operation !
mtd_write write  /tmp/uboot256.img Bootloader
  • You should see on console 
#Unlocking Bootloader ...
#Writing from /tmp/uboot
256.img to Bootloader ...  [w]
  • ! Upgrade firmware - do not reset router during this operation!
mtd_write write /tmp/firmware.img Kernel
  • You should see on console  
#Unlocking Kernel ...
#Writing from /tmp/mini.bin to Kernel ...  [w]
  • Reboot router :), enjoy new u-boot with working ethernet and openwrt firmware. Now you can use standard openwrt upgrade procedure. 
  • Router will set IP address to , you can login via telnet

Upgrade via USB

  • Prepare usb stick, format it with fat filesystem, and copy  uboot256.img and firmware.img 
  • Conect usb stick to router and mount it by:
mount /dev/sda1 /mnt
  • Wait a few seconds and verify  if you see files
ls /mnt 
  • You should see content, do not go further if you do not see files ! 
uboot256.img mini.bin
  • ! Upgrade uboot - be careful, do not reset router during and after this operation !
mtd_write write  /mnt/uboot256.img Bootloader
  • You should see on console 
#Unlocking Bootloader ...
#Writing from /mnt/uboot256.img to Bootloader ...  [w]
  • ! Upgrade firmware - do not reset router during this operation!
mtd_write write /mnt/mini.bin Kernel
  • You should see on console  
#Unlocking Kernel ...
#Writing from /mnt/mini.bin to Kernel ...  [w]
  • Reboot router :), enjoy new u-boot with working ethernet and openwrt firmware. Now you can use standard openwrt upgrade procedure. 
  • Router will set IP address to , you can login via telnet 

Many Thanks for martin4android for support and materials.


  1. I have same router with 32Mb of RAM. But it has reduced busybox with only 10 commands: clean, ping, traceroute, ipmac, quit, show, restart_httpd, restore_defaults, ated. So I can't flash it using this manual. The only way to flash is to do it from web-interface or using bootloader menu.

    1. I flashed it successfully using UART cable from u-boot menu and tftp connection (I did not change u-boot, only firmware).

  2. Good afternoon.

    Take a picture of your Mini USB Portable
    I wanted to see how the resistors installed
    I want to change the memory from 16mb to 32mb
    I want to remove my chip em639165ts-6g
    I want to put a chip em63a165ts-6g.
    in my Mini USB Portable
    I want to put Openwrt in my Mini USB Portable

    thank you

    1. Here you can find pictures of my router:

    2. SMD components are not marked, what resistor do you want me to measure?

  3. Hi. I buy a 16MB variant. Flash new uboot128 and openwrt. Everything work good, but 16MB ram is not good for work with wifi.

    I buy 32MB chips and solder it to the router. I solder 3,3K resistor for detection 32MB ram..... but only 16MB is detected on uboot and kernel. How can I flash uboot256 to the device? MTD partitions have other names, but adresses are same as factory... but if i try write to MTD, i have this error

    root@OpenWrt:/tmp# mtd write /tmp/uboot256.img u-boot
    Could not open mtd device: u-boot
    Can't open device for writing!

    Please help me.. I spend lot time with desoldering and soldering ram chip, and I was sad when I see only 16MB ram and wifi make reboots and out of ram.

  4. Hi, have you try images mentioned here ?

    provide output of : cat /proc/mtd

  5. Доброе время суток! Ребята у меня накрылся роутер после неудачной прошивки. Все время горит красная лампочка и не как не могу вернуть его к жизни. Пытался через telnet, устанавливает, загораеться синяя лампочка. Но не реагирует.. После выключения питания заново загораеться красная.

  6. Have you setup IP on PC to for example and connect to router ip ? I am asking because some forget that router after restart have fixed ip and no dhcp.

  7. This comment has been removed by the author.

  8. Я выставлял на сетевой карте 192,168,100,2 и пробовал прошить прошивками указанами выше. Только после прошивки роутера, загорелась синяя лампочка. Жду 5 минут, перегружаю и снова красная.... Сейчас попробую изменить ip.

  9. У когото есть официальная прошивка?


    2. Спасибо. К сожалению не совместимо..=(

  10. This comment has been removed by the author.

  11. Hi, I also bought a 16MB one(precisely equal to the pictures shown here) and followed your instructions by downloading uboot128.img and firmware.img from and putting it on a USB stick. All seemed to go as described. However, despite being able to telnet:
    1 - There's nothing listening on port 80 (so, no web interface)
    2 - ls /dev doesn't show any sda1 device (so, no access to USB stick)
    3 - doesn't seem to exist (so, no FTP)

    There doesn't seem to be an easy way to flash a different firmware. I already placed an order on a UART cable, but I'll have to wait a couple of weeks for it to get here. Is there anything I can do while I wait? What have I done wrong, and how can I recover from it?
    Thanks in advance.

  12. Hi, after some trial and error I managed to get the firmware into the router with wget from a tiny web server on my PC. However, everyone seems to agree that 16MB is too short for using lan+wifi. I wish I could flash it with Hame A15 firmware... :(

  13. Hi Pablo,

    in mini.bin only telnet is included. If you would like more services, download appropriate image from

    But with 16 MB web interface is not stable, until you will not enable swap on USB stick or upgrade RAM to 32MB, the same issue is with WIFI.

  14. Hi,

    I've got 4x very similar devices (but not quite) and wondered if you could give me some pointers!

    Initially they had the limited shell "BoC Router", but these devices have more holes than swiss cheese so happily have a full busybox instance now :)

    RAM = em63a165ts-7g (32mb) (143mhz vs 166mhz of the -6)
    Flash = pm25lq032 (4mb)

    # cat /proc/mtd
    dev: size erasesize name
    mtd0: 00030000 00010000 "Bootloader"
    mtd1: 00010000 00010000 "Config"
    mtd2: 00010000 00010000 "Factory"
    mtd3: 003b0000 00010000 "Kernel"
    mtd4: 003b0000 00010000 "Romfs"
    mtd5: 003b0000 00010000 "Firmware"

    Warning: un-recognized chip ID, please update SPI driver!
    AT25DF321(1f 47000000) (4096 Kbytes)
    mtd .name = raspi, .size = 0x00400000 (4M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
    Creating 6 MTD partitions on "raspi":
    0x00000000-0x00030000 : "Bootloader"
    0x00030000-0x00040000 : "Config"
    0x00040000-0x00050000 : "Factory"
    0x00050000-0x00400000 : "Kernel"
    0x00050000-0x00400000 : "Romfs"
    0x00050000-0x00400000 : "Firmware"

    So different flash and a weird looking MTD layout.

    I've never really dabbled with OpenWRT so any pointers you could give me in mapping these (presumably to a modified mpr-a1 dts?) and building an image - it would be much appreciated!

    Thanks again.

    1. This comment has been removed by the author.

  15. Hi,

    hard to help, you have to start lstuddy openwrt build system, setup development environment and start to play.

  16. A couple of weeks of studying, playing and reverse engineering parts of the original firmware - and my patch has now been accepted into trunk.

    Just flash from the GUI :)

    1. Please, it is possible upload somewhere this your firmware? Thank you.

  17. I have a 32M clone with bad uboot - cyclic network drops with illegal image, so i cant update uboot or data via tftp.
    TIMEOUT_COUNT=10,Load address: 0x80100000
    Loading: *
    T T T T T T T T T T
    Retry count exceeded; starting again
    Trying Eth0 (10/100-M)


    any clues?

  18. Self response: if anyone flash wrong bootloader (via uart-tftp) and catch network loop-down and impossible to flash anything, u may dont desolder flash and have a sex with spi. just use kermit and uart:
    on uboot side select 7 (flash uboot via kermit)
    on linux host side run and configure c-kermit:
    set port /dev/ttyUSB0 (or your tty-uart node)
    set speed 57600
    set carrier-watch off
    set flow-control none
    set prefixing all
    send /path_to_correct_uboot_image

    wait some minutes and viola!

    any thoughts about this pcb... cheers

  20. Have anyone measure the power consumption for this device.
    I'm planning to use a 3G dongle Huawei E173, and power it from a solar/battery station.

  21. This comment has been removed by the author.

  22. Добрый день!
    Прошил роутер по инструкции выше, зашел через telnet, поставил пароль root по команде passwd root и теперь не могу подключиться по ssh.
    Кто-то может подскажет куда копать?
    Заранее спасибо.

  23. This comment has been removed by the author.

    1. Hi
      all worked but after change of passwd no ssh was possible.

      plz check


  24. This comment has been removed by the author.

  25. Hello, I've got a problem concerning the IP address: you say that the IP is 192 .168. 100.1 after reboot, however when I try to manually set my IP to the router cannot be found. DHCP on ethernet does not work either.

    Any help ?

  26. Actually it does work, it was just a question of netmask and gateway.

  27. Mine did not have ftp but samba. So I did put the file setting up samba : hostname WORkGROUP
    smbpasswd admin admin tmp /tmp admin

    then access \\\tmp with login admin admin

  28. Hi, the img and bin files are no longer available (404). Can you please upload them somewhere?

  29. proftpd does not exist on the board

  30. none of the image files mentioned still exist on the web.

  31. I used images from contains all.Also check OpenWrt page

  32. My device stopped booting during a when i insert a USB-Serial adapter.No blinking of LED when power up.Is it bricked or damaged?


  33. BoC Router> mtd_write write /mnt/uboot_usb_256_03.img Bootloader
    mtd_write: not found

    help me

  34. This comment has been removed by the author.

  35. I think the mtd-utils are absend. Can someone provide the mdt_write bin with needed libs?

  36. thanks for sharing such an informative post with us.
    Asus Router Customer Service

  37. If you phase any problem regarding router then you can follow our sites of if you want to fix any router device error then contact our asus router customer support number, for more information visit. asus router customer support