The Consolidated Hacking Guide For The Linksys WRT54GL

I recently acquired a Linksys WRT54GL wireless broadband router. The nice thing about this piece of networking gear is that it runs Linux. There is an abundance of information on the prior model (WRT54G) of this series on the Internet. In fact, there is so much information that I had over twenty tabs open in Firefox of various web sites to sort through just to get the information that I needed to hack on my new router. So I decided to write this guide to save others from information overload.

The “L” in the model number, WRT54GL, stands for Linux. The previous models of the WRT54G are also powered by Linux (version 1.0 to 4.0). The latest version of the Linksys WRT54G is version 5.0 and runs VxWorks. The move to VxWorks cut the memory footprint in half according to Mani Dhillon, senior manager of product marketing at Linksys. This claim appears to be based in fact because the Version 5.0 model only has 2MB of Flash and 8MB of SDRAM. “We still wanted to have a Linux SKU for the Linux audience,” said Dhillon, hence the WRT54GL.

Linksys WRT54GL Features

• Linux Kernel 2.4
• Based on the Broadcom BCM5352E SoC
  • (BCM95352E Hardware Reference Design)
• Hardware design is the WRT54G Version 4.0
• After market firmware upgrades
• All-in-one Internet-sharing Router, 4-port Switch, and 54Mbps Wireless-G (802.11g) Access Point
• Shares a single Internet connection and other resources with Ethernet wired and Wireless-G and -B devices
• Push button setup feature makes wireless configuration secure and simple
• High security: TKIP and AES encryption, wireless MAC address filtering, powerful SPI firewall

The Linksys Wireless-G Broadband Router is really three devices in one box. First, there's the Wireless Access Point, which lets you connect to both a Wireless-G (802.11g at 54Mbps) and Wireless-B (802.11b at 11Mbps) devices to the network. There's also a built-in 4-port full-duplex 10/100 Switch to connect your wired-Ethernet devices together. Connect four PCs directly, or attach more hubs and switches to create as big a network as you need. Finally, the Router function ties it all together and lets your whole network share a high-speed cable or DSL Internet connection.

The WRT54G has gained in popularity due to the fact that one can upgrade the unit with after market firmware. This is possible because the WRT54G runs Linux and uses other Open Source software in the box. As required by the GPL, Linksys has made available the source code and can be downloaded from the Internet. Hackers picked up this code and created new development branches that added features such as SSHD. I downloaded the WhiteRussian RC4 image from OpenWrt and two minutes later, I SSH'ed into my WRT54GL. After poking around for a few minutes in /proc I was left with a hunger for what all the BCM95352E was capable of.



My first reaction was to increase the memory size. More memory means more applications that the WRT54GL could run concurrently.

Update: A12 appears to be connected to the BCM5352E SoC. All that is left to do is to solder down the ram (HY5DU561622CT) and modify the source to tell the SDRAM controller what type of SDRAM is connected. Click on the image for a bigger picture.

To my dismay, there is no pin information or schematic available to the public for the WRT54GL. After some digging I found that I could swap UC10 for a 256Mb X 16 and double the ram to 32MB. The only catch is that address line A12 from the SDRAM controller (BCM5352E) has to be routed to pin 42 of UC10. At the time of this writing, I have not verified this route. I emailed Linksys technical support asking if A12 was routed to UC10. As you would have guessed, Linksys would not tell me. “We are sorry but information like these can't be disclosed to the public. The information is withheld by our Engineers,” stated Linksys support in their reply email. The only option left is to remove UC10 and look at the pads. Before I do that, I've decided to go ahead and buy a 256Mb X 16 SDRAM to replace the old ram just in case A12 is there. I will update once I've accomplished this task. Removing and replacing the part is not hard, the hard part is getting access to a surface mount workstation with a microscope.