Last year I’ve applied for a ripe.net Atlas probe that it’s supposed to monitor the health of the internet.
With your help, the RIPE NCC is building the largest Internet measurement network ever made. RIPE Atlas employs a global network of probes that measure Internet connectivity and reachability, providing an unprecedented understanding of the state of the Internet in real time.
After keeping it plugged in for more than half an year, I decided to try and do something interesting with it, like dumping the partition info and data for further inspecting and restore it as a router. If you didn’t know, an Atlas probe is actually a TP Link TL-MR3020 router with a custom firmware (and a separate boot/data partition loaded from a USB drive). All internal ports are closed, there is no web interface, so you have no other way to communicate with it except via the on-board serial interface.
Pulling out the flash USB from the probe, we can see it’s a Sandisk Cruzer Fit (low profile) 4Gb variant; I popped it into a Linux notebook and used dd to get an image file out of it and save it for further inspecting. Opening the actual device is kinda tricky, some glue is involved (I guess the router wasn’t opened and the custom firmware was uploaded from the original TP Link router web interface.), but you can check some video tutorials on how to do it; you should be careful though, it’s very easy to destroy the mainboard with a sharp tool. I had a Sparkfun FTDI Basic 3.3V board laying around, that I used to connect to my netbook and, via a 4-pin header (pin 1 is TX, 2 is RX, 3 is GND, 4 is VCC), to the router mainboard.
Fire up Putty on the laptop, configure a connection to the adapter’s COM port (use device manager to find that), 115200 bits per second, 8 data bits, 1 stop bits, parity none and flow control none. When you power up the device, you will pick up the u-boot log and when you see the message Autobooting in 1 seconds type tpl really fast. You will get the u-boot prompt next, so we need to setup a TFTP server to serve the router the new OpenWrt image. On the laptop, install TFTP server, download OpenWrt for the MR3020 router and copy it in the folder where you unzipped/installed TFTP. Also, configure the laptop’s static IP to be 192.168.1.100 so that it’s on the same internal network as the router. Then, at the router’s u-boot prompt, type those commands:
hornet> setenv ipaddr 192.168.1.111
hornet> setenv serverip 192.168.1.100
hornet> tftpboot 0x80000000 openwrt-15.05-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin
eth1 link down
dup 1 speed 100
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.111
Filename 'openwrt-15.05-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin'.
Load address: 0x80000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
######################################################
done
Bytes transferred = 3932160 (3c0000 hex)
hornet> erase 0x9f020000 +0x3c0000
First 0x2 last 0x3d sector size 0x10000 61
Erased 60 sectors
hornet> cp.b 0x80000000 0x9f020000 0x3c0000
Copy to Flash... write addr: 9f020000
done
hornet> bootm 9f020000
That’s it, your ripe.net Atlas probe is no longer … a probe but a full-featured OpenWrt router that you can configure to your heart’s desire.