EXPIRED Meraki MR52 29,90€ (gone)

legopc

Active Member
Nov 2, 2014
220
37
28
26
The Netherlands
Owh damn thats an awesome deal, shame they do indeed need a license. No mention anywhere of MR52 and the word "mod", "hack" or "openwrt".
 

Dev_Mgr

Active Member
Sep 20, 2014
115
37
28
Texas
Besides the licensing (mainly paying for the cloud management and some for warranty I guess), if I remember correctly from a few years ago; Meraki equipment assigned to one account is next to impossible to assign to another account.

I was working for another company and we bought one of Meraki's AP units from a major reseller. The unit we received turned out to be a returned unit that was already assigned to someone else' account and trying to get it under our account was not an easy task. The reseller ended up sending us another unit to fix the issue.
 

hmartin

Active Member
Sep 20, 2017
270
189
43
35
Owh damn thats an awesome deal, shame they do indeed need a license. No mention anywhere of MR52 and the word "mod", "hack" or "openwrt".
I've had success in getting Cisco to cough up the GPL source code for Meraki products in the past. It is possible (though not easy or fun) to build your own firmware from their source. I'm currently slogging through this for an older product line of switches (blog).
 

legopc

Active Member
Nov 2, 2014
220
37
28
26
The Netherlands
I've had success in getting Cisco to cough up the GPL source code for Meraki products in the past. It is possible (though not easy or fun) to build your own firmware from their source. I'm currently slogging through this for an older product line of switches (blog).
Aaaah you are the guy behind that blog?! I've read it before, great work! I was about to make an offer of me buying you one to see if you could get it to run but I see they are sold out already :L.
 

hmartin

Active Member
Sep 20, 2017
270
189
43
35
Aaaah you are the guy behind that blog?! I've read it before, great work! I was about to make an offer of me buying you one to see if you could get it to run but I see they are sold out already :L.
I bought one before I posted it here, I know the STH effect ;)

Stay tuned...
 
  • Like
Reactions: usbTypeD and legopc

usbTypeD

New Member
Apr 2, 2020
26
12
3
Thanks for the link the Hardware is VERY exciting. Stying tuned :p
(If there is any benefit in having another device or access to the device remotely for your research let me know)
 

Navy_BOFH

Active Member
Aug 2, 2013
151
58
28
Aaaah you are the guy behind that blog?! I've read it before, great work! I was about to make an offer of me buying you one to see if you could get it to run but I see they are sold out already :L.
Fingers crossed! I have been watching your progress for some time because I have the MR33/MS220/MX64 combo that came from their webinars that are otherwise trash to me now.
 
  • Like
Reactions: usbTypeD

hmartin

Active Member
Sep 20, 2017
270
189
43
35
Thanks for the link the Hardware is VERY exciting. Stying tuned :p
(If there is any benefit in having another device or access to the device remotely for your research let me know)
Do you have access to one? If you know the UART port, having access to the serial boot log is going to be necessary to get Cisco to cough up the source code.

Mine was supposed to be delivered to a friend's today, but UPS decided instead to redirect it to an Access Point and didn't bother leaving a delivery notice... :mad:

Unfortunately due to travel restrictions in the EU, I won't be able to pick it up for some time (assuming we can sort out the situation with UPS). The MS220 firmware is my focus for the moment anyway.
 

e97

Active Member
Jun 3, 2015
247
117
43
Got OpenWRT running on MR24 and using it as my home AP.

Looking into ac Wave 2 models now.. MR52 is one of them and 4x4 !

Here's the FCC report: 60041010 802.11 a/b/g/n/ac Wireless Access Point Teardown Internal Photos UDX-60041010 Internal photo_rev1 Cisco Systems

Chips:


IPQ8068 - IPQ8068 is a quad-core network processor. It combines a powerful, dual-core Qualcomm® Krait™ CPU (1.4 GHz) for control plane and applications, with a dual-core 730 MHz Network Subsystem (NSS) to accelerate packet processing.

QCA9889 - Dual-band 1x1 802.11ac/agbn WLAN SoC

AR8033 - Integrated 10/100/1000 Mbps Ethernet Transceiver

QCA9994 - Wave-2 802.11ac Solution with MU-MIMO and 160MHz for Enterprise Networks
 
Last edited:

usbTypeD

New Member
Apr 2, 2020
26
12
3
I have not yet opened the device yet nor so i know the UART port location. But iam willing to grab a friends cable and see if i found a new hobby in poking around in such ports.
So what is the procedure? Once we get some output of the device we send cisco a notice and tell them "your device id xyz we request the source code for?".
 

RobstarUSA

Active Member
Sep 15, 2016
165
56
28
I've had success in getting Cisco to cough up the GPL source code for Meraki products in the past. It is possible (though not easy or fun) to build your own firmware from their source. I'm currently slogging through this for an older product line of switches (blog).
Is this published somewhere?
 

hmartin

Active Member
Sep 20, 2017
270
189
43
35
Is this published somewhere?
No, you have to email open-source@meraki.com and request it.

The boot log may not be necessary, in my case they tried to claim that since the device was discontinued more than 3 years ago, they weren't under any license obligation to release the source code. Having the boot logs with the kernel/boot loader build date within the last 3 years was enough proof that they were still distributing the code, and they provided the GPL archive.

I have not yet opened the device yet nor so i know the UART port location. But iam willing to grab a friends cable and see if i found a new hobby in poking around in such ports.
So what is the procedure? Once we get some output of the device we send cisco a notice and tell them "your device id xyz we request the source code for?".
If we are lucky, it may be labelled on the PCB silk screen. Even having higher resolution photos of the PCB than what is in the FCC report would be helpful.
 

hmartin

Active Member
Sep 20, 2017
270
189
43
35
You got a good chance its labeled conn18 on the right of the board. Should be 4pin UART. You could check power and gnd with a multimeter, should be on the outside iirc.
That indeed looks like it could be a UART port. Just want to throw out there that testing connections with a multi-meter in ohm mode risks destroying the UART Rx line. I did that with one of my Meraki switches and now UART Rx doesn't work :(

Now I just measure voltages, if it's below 3.3V, I throw a USB to UART adapter on it and see if there's any output.

U1000 looks like it's an unpopulated SOIC-16. I wonder what the SoC boot order is and if you soldered a NOR flash if it would take priority over NAND :thinking:
 
Last edited:

usbTypeD

New Member
Apr 2, 2020
26
12
3
Code:
    0.000000] Booting Linux on physical CPU 0
[    0.000000] Linux version 3.4.113 (jenkins@atx101.meraki.com) (gcc version 4.                                                                8.3 (GCC) ) #3 SMP Thu Apr 5 19:12:21 PDT 2018
[    0.000000] CPU: ARMv7 Processor [512f04d0] revision 0 (ARMv7), cr=10c5387d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[    0.000000] Machine: Qualcomm Atheros AP160 reference board, model: Meraki MR                                                                52 (Bigfoot)
[    0.000000] msm_reserve_memory: 0x44600000, 0x200000
[    0.000000] memory pool 3 (start 5fe00000 size 100000) initialized
[    0.000000] Memory policy: ECC disabled, Data cache writealloc
[    0.000000] smem_find(137, 80): wrong size 72
[    0.000000] socinfo_init: v6, id=204, ver=2.0, raw_id=2313, raw_ver=2313, hw_                                                                plat=0,  hw_plat_ver=65536
[    0.000000]  accessory_chip=0 hw_plat_subtype=0
[    0.000000] PERCPU: Embedded 8 pages/cpu @c0c3f000 s10240 r8192 d14336 u32768
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pag                                                                es: 123692
[    0.000000] Kernel command line: ubi.mtd=ubi ubi.mtd=art root=/dev/ram rw con                                                                sole=ttyHSL1,115200n8
[    0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Memory: 49MB 438MB = 487MB total
[    0.000000] Memory: 477300k/480372k available, 21388k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0xdf000000 - 0xff000000   ( 512 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xdea00000   ( 490 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .text : 0xc0008000 - 0xc0505648   (5110 kB)
[    0.000000]       .init : 0xc0600000 - 0xc0702800   (1034 kB)
[    0.000000]       .data : 0xc0704000 - 0xc0797540   ( 590 kB)
[    0.000000]        .bss : 0xc0797564 - 0xc08366f0   ( 637 kB)
[    0.000000] SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=2, N                                                                odes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:1689
[    0.000000] sched_clock: 32 bits at 32kHz, resolution 31240ns, wraps every 13                                                                4175798ms
[    0.000000] Console: colour dummy device 80x30
the complete boot ouput is available on request.
I will update the post later with a pin layout that worked for connecting to UART console.

Code:
<Meraki>
<Meraki> help
UNRECOGNIZED COMMAND LOGGED TO CLOUD SERVERS.
<Meraki>
Sadly the console is not very user friendly. To be expected by a cloud managed aka LOCKED device
 

okrasit

Member
Jun 28, 2019
40
26
18
There's a reset button between the ethernet ports. Hold the reset button down, during boot, until the led starts blinking white. At this stage clicking the button will toggle the led, blue or red. Once "selected", just wait and it'll continue booting. Blue is for the "recovery/diagnostic" firmware and red is the Meraki one.
Code:
BusyBox v1.19.4 (2016-02-18 09:57:12 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

     MM           NM                    MMMMMMM          M       M
   $MMMMM        MMMMM                MMMMMMMMMMM      MMM     MMM
  MMMMMMMM     MM MMMMM.              MMMMM:MMMMMM:   MMMM   MMMMM
MMMM= MMMMMM  MMM   MMMM       MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
MMMM=  MMMMM MMMM    MM       MMMMM    MMMM    MMMM   MMMMNMMMMM
MMMM=   MMMM  MMMMM          MMMMM     MMMM    MMMM   MMMMMMMM
MMMM=   MMMM   MMMMMM       MMMMM      MMMM    MMMM   MMMMMMMMM
MMMM=   MMMM     MMMMM,    NMMMMMMMM   MMMM    MMMM   MMMMMMMMMMM
MMMM=   MMMM      MMMMMM   MMMMMMMM    MMMM    MMMM   MMMM  MMMMMM
MMMM=   MMMM   MM    MMMM    MMMM      MMMM    MMMM   MMMM    MMMM
MMMM$ ,MMMMM  MMMMM  MMMM    MMM       MMMM   MMMMM   MMMM    MMMM
  MMMMMMM:      MMMMMMM     M         MMMMMMMMMMMM  MMMMMMM MMMMMMM
    MMMMMM       MMMMN     M           MMMMMMMMM      MMMM    MMMM
     MMMM          M                    MMMMMMM        M       M
       M
---------------------------------------------------------------
   For those about to rock... (IPQ806X.LN, r37758)
---------------------------------------------------------------
root@OpenWrt:/#
It doesn't seem very useful, though. :(
 
Last edited:

usbTypeD

New Member
Apr 2, 2020
26
12
3
wait. I just did the procedure as you described @okrasit and it does indeed give this exact output. How is there openwrt already on the machine?
I was always under the impression evil companys use the linux kernel for their devices but that there is already some openwrt on a cisco cloud managed device. Can someone explain that?