Skip to content

Instantly share code, notes, and snippets.

Last active October 27, 2023 00:46
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
Star You must be signed in to star a gist
Save cyyself/6f3544348e27aff2df647ba60cc6cc1c to your computer and use it in GitHub Desktop.

RAISECOM DR5364 Hack Note

Get Root Telnet

Backup configuration file in

You will found an entry <TelnetEntry Active="No" telnet_username="CMCCAdmin" telnet_passwd="aDm8H%MdA" telnet_port="23" />

replace "No" with "Yes" and write it back to get telnet root shell.

U-Boot Console

directly use of U-boot from factory firmware requires password.

We can get the password from mtd0 dump files. The file can be sent to host by tftp which is included in factory firmware.

➜  dr5364 strings mtd0.bin | grep username
➜  dr5364 strings mtd0.bin | grep password

Then, restart your router, connect 3.3V TTL UART on the board, and the serial port is 115200,8n1.

The U-Boot also has ethernet driver avialable, you can connect tftp server to any of the LAN ports.


Flash dump:

dts dump:


OpenWrt Forum Thread:

squashfs dump(including npu driver .ko for analyze):

Kernel dump and converted to elf:

RISC-V NPU Firmware npu_rv32.bin:

Factory MTD Partition

part name offset size
mtd0 bootloader 0x0 0x80000
mtd1 romfile 0x80000 0x40000
mtd2 kernel 0xC0000 0x31CDC9
mtd3 rootfs 0x3DCEC4 0x15D0000
mtd4 tclinux 0xC0000 0x1E00000
mtd5 kernel_slave 0x1EC0000 0x31CDC9
mtd6 rootfs_slave 0x21DCEC4 0x15D0000
mtd7 tclinux_slave 0x1EC0000 0x1E00000
mtd8 data 0x3CC0000 0x400000
mtd9 config 0x40C0000 0x200000
mtd10 yaffs 0x42C0000 0x500000
mtd11 reservearea 0xDDC0000 0x240000
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment