Page Type: Article
Edit this page (last editedJuly 24, 2008)
Bookmarks1: Bitsum | Wiki | Frontpage | RecentChanges | TitleIndex | CategoryIndex | UserPreferences | FindPage | HelpPage | SandBox
Welcome WL-530G

  1. Quick downloads
    1. Liberated Libertas Firmware
      1. Liberated Libertas Downloads
      2. Using the Liberated Libertas Firmware (User Guide)
      3. Project hosting
      4. Following svn repository commit logs
      5. Other editions
  2. Project goals
  3. Supporting this project
  4. WL-530G Overview
  5. Pictures
  6. Hardware
    1. Opening the unit
    2. Board: Marvell Libertas AP22V2
    3. System-on-a-chip: Marvell 88W8510
    4. Ethernet switch
    5. Power: 5V ~2A - can be powered over USB 2
    6. ROM: 4MB
    7. RAM: 16MB
    8. Serial and JTAG
    9. LEDs
  7. Creating custom firmwares
    1. Caveats of an MMU-less system
    2. Compiling for this board
      1. Building the kernel
      2. Building applications/packages or adding new ones
    3. Modifying vendor firmware images (extract, change, rebuild)
    4. [UTIL] asustrx: update to add -b parameter
    5. Firmware image format
  8. Changing any NVRAM variable via HTTP management console
  9. Boot loader: ARMBOOT
    1. Rescue mode (debricking and alternate firmware flash)
  10. ASUS firmware technical details
    1. Operational details
      1. Telnetd: Now you see it, now you don't...
    2. Technical details
      1. Kernel: uClinux 2.4.22
      2. Boot messages
      3. File systems: CRAMFS, RAMFS, JFFS2
      4. Persistent configuration storage: NVRAM
      5. Shell: Sash
      6. Busybox utilities
      7. HTTP management console
  11. External Links
  12. Contacts
  13. Appendix

Quick downloads

Liberated Libertas Firmware

If you like this project, or would like to help in development, I'd love to hear from you. Please visit the forum at [Custom Firmwares Forum].

Changes from stock firmware

  • telnetd enabled and password protected - user: root password: <your_http_password>
  • JFFS2 (writable flash ROM) partition for persistant storage on the router.
  • newer and more complete BusyBox? applet set (1.2.1 vs 0.60) - this is a collection of common linux utilities. A swiss army knife of embedded linux.
  • a much better shell - msh (busybox). Supports most shell scripting, command history, tab file/dir completion, and more.
  • startup script support (/etc/init.d and /jffs/etc/init.d).
  • support for mounting NFS shares.
  • crond/crontabs support.
  • wireless-tools v29 pre10: iwconfig, iwlist, iwpriv.
  • much more control over the configuration.
  • pre-set with optimized network settings for p2p.
  • adjustable maximum connections.
  • much more ... impossible to list it all here. It's a whole different world.

Liberated Libertas Downloads

'Please understand that this is a beta test. Builds marked FINAL are considered to be stable and ready for use by the general end user population. By downloading beta firmwares you understand that you are part of a beta test, meaning that you may encounter bugs and should report those bugs so that they can be fixed by the next non-beta release. ''

'USE AT YOUR OWN RISK.' These builds are just my daily snapshots, some of which may have bugs. In a unlikely worst case scenario, you will simply need to use rescue mode to flash a new firmware. So, your device should be completely safe from permanent harm, but for legal reasons I can not make any warranties to that effect. You use at your own risk.

By downloading these firmwares you acknowledge and agree that you are using this firmware at your own risk and will not hold any other parties, including the author(s) and distributor(s) of this firmware liable for damages, tangible or intanglible, resulting from the use or misue of this firmware. No warranties are made of any kind.

IMPORANT NOTICE ABOUT A PROBLEM: People have reported that in the later builds often times dhcpd fails to load due to a lack of contiguous free memory. This will result in the router not automatically assigning IP addersses. Try the 9/24 or 9/22 build, they may do better. I will update the latest build eventually.

LATEST: [Download firmware] (always points to newest build)
09/26/06: [Download firmware] -
09/24/06: [Download firmware] - Milestone 1 - FINAL
09/23/06: [Download firmware] - Milestone 1 Release Candidate 2
09/22/06: [Download firmware] - Milestone 1 Release Candidate 1
09/20/06: [Download firmware]
09/19/06: [Download firmware]
09/17/06: [Download firmware]
09/16/06: [Download firmware]
09/15/06: [Download firmware]
09/13/06: [Download firmware]
09/12/06: [Download firmware]
09/10/06: [Download firmware]
09/08/06: [Download firmware]
09/06/06: [Download firmware]
09/03/06: [Download firmware]
09/01/06: [Download firmware]
- Older downloads removed -

Using the Liberated Libertas Firmware (User Guide)

See Liberated Libertas User Guide.

Project hosting

The buildroot is a mess right now and there is SO much left to do.. so,so much. Join the effort. The project is hosted here:

Following svn repository commit logs

You can see what we have been up to lately by checking the list at:

You can sign up, or just watch the archives.

Other editions

Stock vendor firmware with telnetd enabled (no other changes): [Download]

Project goals

Goal Status
Document firmware image format Done
Document procedure and write any utilities necessary to manipulate them. Done
Document how to extend vendor firmware Done
Document how to build vendor sources Done
Make my [Firmware Modification Kit] compatible. Done
Port OpenWrt. Planning stage

WL-530G Overview

This pocket router is an excellent device for hacking. It's capable, small, efficient, and has vendor supplied GPL linux sources.

As you read through this wiki, you will notice other than the hardware differences, it's not at all an unfamaliar set up. It uses a tuple based pseudo-NVRAM configuration system with many variables named exactly like those common on BCM947xx devices. This is good for easily portability of management consoles (i.e. HTTP based) for for BCM947xx devices.

The biggest limitation of this device is that it doesn't have an MMU. This means that not everything will run ok without modifications, and what does run may run sub-optimally.

The community should thank Dan Flett for sending me a WL530-G to work on and soliciting this project. Were it not for him whatever progress this project makes would not have been made. As always, it's a community working cooperatively together that makes progress. For every accomplishment that is made there are countless unseen individuals who contribute to it.


These are from the FCC submission, so are a development unit and may have very minor differences from the production unit:




Opening the unit

First things first ;). Let's pop this sucker open. It's not as hard as it might appear at first. Unfortunately, it takes much more time to put back together ;p.

To take apart:

  1. Pop off the metallic bar by using a screw driver to pry it off (starting at the end closest to the "L". It's simply got some adhesive gunk underneath it and comes off easily.
  2. You'll see little tabs on each side of the case. On the side where the LAN ports are use a small screw driver to pry the halves of the case apart (easily), possibly while pushing in that little tab closest to it. Then go around the case and press in each tab as you encounter it.
  3. Pull the bottom piece of the case off. Be careful because each of the two halves of the PCB are attached via a connector and if you pried too hard and got it too askew you might break it.
  4. Be careful not to loose the supporting metal rod and spring, as these are necessary to support the side of the PCB sandwidch that would otherwise be inclined to 'float'. This little pain in the butt is what took me a while to get in.

Board: Marvell Libertas AP22V2

Board: AP22V2
System-on-a-chip: Marvell 88W8510-BAN (Access Point/Gateway? SoC?) [Product brochure]
Ethernet switch: Marvell 88E6060 [Product borchure]

System-on-a-chip: Marvell 88W8510

System-on-a-chip: Marvell Libertas SOHO AP/Gateway? (8W8510-BAN) [Product brochure]

CPU (in the 888510): ARM Arm946id(wb) rev 1 (v4l) at 160mhz (~88 BogoMips?)

/> cat /proc/cpuinfo
Processor       : ARM Arm946id(wb) rev 1 (v4l)
BogoMIPS        : 87.85
Hardware        : MV88W85x0

Ethernet switch

Ethernet switch: Marvell Link Street (88E6060) SOHO Switch [Product borchure]

Power: 5V ~2A - can be powered over USB 2

The power adaptor supplies 5V @2A. I have seen reports that it can successfully be powered over USB 2 with an appropriate adaptor. [] looks like it but this adapter is untested.


Total size: 4MB (32Mbit)
Chip(s): MX 29LV320*-TC90
Data sheet: To link..


Total size: 16MB (128Mbit)
Chip(s): SAMSUNG K4S641632H-TC60 x 2
Data sheet:

Serial and JTAG

Special thanks Johan Ronkainen (jr) for a lot of assistance in this matter. He bought a WL-530g and was able to positively determine the serial ports. Once he let me know for sure where they were, I was able to get my serial console working.

The serial (TTL) and JTAG connectors are on small little test points beside the CPU. They are very hard to get to while the unit is running. Be careful when installing a serial port. Very careful.


NOTE: This is a snippet of the FCC photo, not my unit. Hence, you see the soldering 'burns' on the development unit and the PCB differes slightly from the final pruduction design.

You of course also need +3.3v and a GND to get the serial ports working. There's an excellent connector for these on the edge of the switch/LAN part of the PCB:

Of course, you'll need to use an RS232<->TTL chip/cable (typical in cell phone serial cables, and used on almost all embedded devices). This is because the serial port on the router is running at 3.3v, but the serial port on your PC is running at a higher voltage. Not using this chip may fry your router.

TIP: To test your RS232<->TTL cable simply hook the RX to TX and type something (make sure flow control is off). If you see what you typed, then it's working. If not, then it's not. Thanks Johan Ronkainen (jr).

Here's an example of how I implemented an external D-SUB 9-pin connector:


The board supports two sets of 3 LEDs (one on each side of the 'top'). However, only one set is implemented (actually has LEDs), and since the case doesn't have a window for the other 3 LEDs, you couldn't see them anyway.

And the LEDs implemented are ...

Power : On when powered on. Flashing with in recovery mode or critical error
WLAN : On when the WLAN interface is enabled. Flashing when radio is enabled but disconnected.
ETH : On when the ethernet interface is connected.

Creating custom firmwares

Caveats of an MMU-less system

First, you should famalarize with the rules of an MMU-less system. Every instance of an application requires the entire application be loaded again into RAM, so shared libraries or multi-binary (combined) executables like Busybox have to be used with care. XIP can avoid this, but obviously uses ROM space.

Applications can not use fork. There is a vfork substitution, but due to the reasons above, it's not nearly as efficient as a true fork on a system with an MMU.

The uClinux patches must be applied to the Linux kernel, as it is designed to run on an MMU-less system.

Compiling for this board

The uClinux-dist build root is used to build user applications and the system kernel. It makes this process very easy, and the Firmware Modification Kit makes building firmware images even easier.

Building the kernel

  1. You have a few options here.
    • Download the ASUS GPL sources. OR
    • Download the uClinux-dist buildroot release 08-03-2006. The newer buildroot uses kernel version 2.4.32 instead of 2.4.22 in the ASUS GPL sources.If you download the new uClinux-dist buildroot, you should follow the instructions [here] to apply necessary kernel patches. Note that the newer uClinux-dist buildroot does not have the all the appropriate vendor user packages, but that's not what this section is about. Thanks to Johan Ronkainen for creating the kernel patches for uClinux 2.4.32.
  2. Install ARM toolchains (included in ASUS GPL sources in the Tools/ folder).
  3. Run 'make menuconfig'. To configure the kernel, select "[X] Change kernel configuration".
  4. If you are using the vendor default settings, you must make two changes:
    • include cramfs driver ([X] compressed ROM file system)
    • change boot string to indicate cramfs instead of romfs
  5. make clean && make dep && make
  6. Move the resulting zImage to the image_parts/segment1 file that was extracted from the latest vendor firmware image with the Firmware Modification Kit.

Building applications/packages or adding new ones

  1. Download the latest uClinux-dist buildroot or use the older one in the ASUS GPL sources. The advantage of using the latest one is that it has a lot more applications in the source tree and is more up to date.
  2. Install ARM toolchains (included in ASUS GPL sources in the Tools/ folder).
  3. Add the linux-2.4.xx/arch/mach-libertas directory contents from the ASUS GPL sources and also the vendors/Marvell/Libertas? directory contents. There may need to be other things moved over as well if you want to build the kernel correctly using the new uClinux-dist buildroot.
  4. Run 'make menuconfig'. Don't worry with configuring the kernel exactly right, we're using this buildroot just for building user applications. It should, however, build. To configure user applications/packages, select "[X] Change user configuration".
  5. Move the applications you want to install to the firmware image from the romfs/ folder to the vendor firmware file system you extracted with the Firmware Modification Kit.

Modifying vendor firmware images (extract, change, rebuild)

To add or remove packages or make configuration changes to the firmware is simple. It involves simply extracting the firmware image, making changes, then building a new firmware image.

I've now made my [Firmware Modification Kit] compatible with WL530g images (presumably also WL520g and WL550g as well).

Follow the instructions in the kit to extract a vendor firmware image, update it with your own files, then rebuild it. It's only one step to extract and one step to rebuild.

[UTIL] asustrx: update to add -b parameter

This is an update to the open source asustrx utility that adds the '-b' parameter to start segments at a specific offset, padding up until that point. This is done by ASUS. I believe it may be necessary due to the lack of an MMU.

[ASUSTRX v0.90] - Update to asustrx utility that adds the "-b" switch to force segment offets.

Firmware image format

The firmware images are a standard ASUS style TRX with an 'addver' style header appended. They expect to have two segments with the file system image starting at 0xA0000 (hence the -b addition to the asustrx utility).

0x00000 ^^ TRX Header
0x00020 ^^ Segment1: Kernel
0xA0000 ^^ Segment2: cramfs file system
0x????? ^^ addver style header to indicate version of the firmware

Changing any NVRAM variable via HTTP management console

This is really unnecessary since using the techniques I've shown you can re-enable telnetd on vendor supplied firmware images and thus use the nvram console mode utility. Or, you can just download the telnet enabled images I've already created ;).

You can change any NVRAM variable you wish by using the configuration backup/restore functionality. Simply perform a backup, then use a hex editor to modify the variables you wish. Note that this is a NULL terminated array of ASCIIZ strings. Do not edit it if you don't understand how this works (basically, a NULL terminates a string and two NULLs terminate the array). If anyone wants, maybe I'll write a simple conversion tool to translate it to plain text and back.

If you get the idea of changing telnet_enabled, it won't work to re-enable telnet on ASUS firmwares where it's been disabled.

Boot loader: ARMBOOT

The full source code to the boot loader is included in the ASUS GPL sources. The release notes label it as "ARMboot for "AP22V2 Ver 1.42".

Curiously, the boot loader looks like it is made to be buildable under CYGWIN. This is surely a refreshing sight for all you Windows users (which include me). I may work with it under CYGWIN just because the Windows users are so often neglected in the OSS world.

However, since a JTAG interface hasn't been documented yet on this device it's a risky move to flash a new boot loader.

Rescue mode (debricking and alternate firmware flash)

Rescue mode allows you to flash a new firmware image regardless of whatever state your current firmware image (kernel) is in. It is facilitated by the boot loader, which runs a TFTP server. It should allow you to easily downgrade to an older firmware without having to edit the addver header at the end of the firmware image.

To enter rescue mode:

  1. plug wired ethernet cable into a LAN port on the router.
  2. set static IP on your network adaptor (i.e. , subnet mask, gateway
  3. unplug power from router.
  4. hold down reset button and plug in router power. Release button after a couple seconds.
  5. the power LED should be blinking now, if it isn't, repeat steps 3 and 4.
  6. run the asus firmware restoration tool for the wl-530g (get it in wl-530g support downloads).
  7. select firmware you want to upload, and hit Go. give it a few seconds to find the right device (you may see error messages until then as it scans other subnets).
  8. after a few minutes the progress bar should reach 100%. The router will then automaticall reboot itself.

Facts about rescue mode:

  • The device will NOT respond to pings.
  • The ASUS device discovery utility will NOT work.
  • 'Normal' TFTP clients might work if you rename the firmware to ASUSSPACELINK. Otherwise, I know they won't work.
  • It probably (almost surely) allows you to revert to an older firmware, but I haven't tested this fact.
  • You may need to disable other network interfaces to get the ASUS Firmware Restoration utility to work properly.

ASUS firmware technical details

The vendor firmware is pretty functional, but its HTTP management console has perhaps the ugliest color scheme ever invented.

The same firmware sources are used for the WL-520/530/550/600 so you'll see things like webcam management and USB printer support scattered throughout.

Operational details

Telnetd: Now you see it, now you don't...

Firmware versions 1.8.x.x have telnetd enabled. Newer builds (like 1.9.x.x) have disabled telnetd. To re-enable it using the above procedure, simply extract the firmware, uncomment out the telnet line in etc/inetd.conf, then rebuild the firmware image.

Technical details

Kernel: uClinux 2.4.22

kernel: linux 2.4
Linux version 2.4.22-uc0 (root@localhost.localdomain)
(gcc version 2.95.3 20010315 (release)
(ColdFire patches - 20010318 from
 uClinux XIP and shared lib patches from 
 #1369 Wed Aug 18 21:32:58 CDT 2004

Boot messages

See appendix.

File systems: CRAMFS, RAMFS, JFFS2

As typical, it has a large RO file system and uses a ramdisk for one-session writable storage. A JFFS2 filesystem driver is incldued in the kernel and an area is reserved for it in the flash ROM mapping. HOWEVER, this area is instead used for nvram storage by default, not utilizing the JFFS2 driver at all. The custom firmware I've written changes this, so that the nvram storage actually uses the JFFS2 file system.

/> cat /proc/mounts
rootfs / rootfs rw 0 0
/dev/root / cramfs ro 0 0
proc /proc proc rw 0 0
ramfs /tmp ramfs rw 0 0

Persistent configuration storage: NVRAM

This device uses a standard tuple (name=value) based emulated NVRAM area on the flash ROM chip. The NVRAM can be accessed by the user in the with an nvram tool that works the same as what we've seen before on the BCM947xx.

Some interesting things you may notice is:

  1. Many of the NVRAM variables correspond to those on BCM974xx devices.
  2. There are a lot of variables, like the *usb* and *webcam* ones, that aren't pertainent to the wl-530g.

See Appendix A for a dump of NVRAM.

Shell: Sash

Sash command shell (version 1.1.1). Sucks, at least in the state they have it.

Busybox utilities

The vendor firmware uses Busybox v0.60.4 with only the most minimal of shell utilities linked in.

/> busybox
BusyBox v0.60.4 (2004.06.01-23:28+0000) multi-call binary

Usage: busybox [function] [arguments]...
   or: [function] [arguments]...

        BusyBox is a multi-call binary that combines many common Unix
        utilities into a single executable.  Most people will create a
        link to busybox for each function they wish to use, and BusyBox
        will act like whatever it was invoked as.

Currently defined functions:
        busybox, cat, cp, du, echo, env, false, hostname, ifconfig, insmod,
        kill, killall, klogd, logread, ls, lsmod, mkdir, mount, nslookup,
        ping, ps, reboot, rm, rmmod, route, sleep, syslogd, traceroute,
        true, umount, which

HTTP management console

This console seems pretty capable, but damn it's got to be the ugliest color scheme I've ever seen in my life. The author was clearly either color blind or otherwise not inclined towards visual design (I empathize, I'm not good with aesthetics either..).

QOS isn't available on the router with the vendor firmware, but they've at least started to add it with a series of nvram variables and the following web page, which you can browse to manually:

Advanced_QOS_Content.asp (i.e.

External Links

[ FCC external images] - FCC pictures of the outside of the submitted unit.
[FCC internal images] - FCC pictures of the inside of the submitted unit.

Pictures of similar units:

[Similar unit 1] [Similar unit 2] [Similar unit 3] [Similar unit 4]


If you have further information or want to contribute to this project, please email . Feel free to edit this wiki when appropriate.


WL-530g Boot Messages, Filesystem Dumps, and More

Summary : WL-530g: Research and Development
Bookmarks1: Bitsum | Wiki | Frontpage | RecentChanges | TitleIndex | CategoryIndex | UserPreferences | FindPage | HelpPage | SandBox
Edit this page | Rename this page | View other revisions | Attachments (0) | Print this page | View XML | Page views: 88416
Find page by browsing, searching or an index | Page Revisions: 2
Last Edited July 24, 2008 by Jc | (diff)

Valid XHTML 1.0!Valid CSS!