At the risk of turning this into even more of a generic "what can we do with EnGenius hardware?" thread, here's last night's fun: turning an ENS620EXT into an ECW160.
Why do this? Well, the ENS620EXT is old enough that it only works with the EZMaster controller and not the newer Fit Controller (local or cloud). But I've migrated my other gear to a local FIT controller and I want everything there (this ENS620EXT is intended to go under the eaves and cover my backyard). Plus, you know, I just love tinkering.
Working theory: the ENS620EXT and ENH1350EXT are basically the same hardware (same specs, same CPU, same WiFi chips, etc). The main difference is that the ENS620EXT has two Ethernet ports, and uses EnGenius's proprietary 24v PoE implementation instead of standard 802.3at PoE, so in theory cross-flashing the ENS620EXT to the ENH1350EXT firmware should, in theory, work. On top of that, the ENH1350EXT and the ECW160 are the same hardware (same FCC ID), so cross-flashing between ENH1350EXT and ECW160 FW is easy. So by the transitive property of cross-flashing, it should be possible to run the ECW160 firmware on the ENS620EXT
And, in practice, that is sort of true - it was fairly easy to flash my ENS620EXT with the ECW160 firmware. At least, with the Linux Kernel and root filesystem. But the flash layout on those two models differs by a little bit. (And the flash partitioning scheme appears to be embedded in bootloader itself, not in the u-boot environment variables like a lot of OpenWRT devices). The main difference is that the ENS620EXT doesn't have a cert
flash partition, which is where the certificates used to communicate with FIT controllers/EnGenius cloud are stored. So while I was able to flash the ECW160 firmware onto the ENS620EXT, I couldn't get it to register with my local FIT controller.
However, if you have serial console (UART) access to the ENS620EXT (which requires opening it up and soldering onto some pads), you can get into the stock u-Boot, and reflash it from there with the u-Boot from an ECW160. At that point you have a brick, since the kernel location on flash is different and you have a flash with the kernel at the ENS620EXT address and a bootloader trying to load it from the ECW160 address. But you can use TFTP from the new u-Boot to transfer and write the kernel image and the root filesystem. Voila! Your ENS620EXT is now an ECW160.
(It may be possible to do all the flashing from inside Linux - that's how I did uBoot itself - but I didn't go down that route.)
One of these days I'll write up exactly what I did on this and put it somewhere online...