I bought one of these cheap 'wireless drives' from Amazon: https://www.amazon.de/I-ONIK-70752-i-onik-WIFI-Cloud/dp/B00I16C1K2/
Currently (early 2017) selling for 15E, I think I paid 12E including shipping. This post will focus on basic features and some early data. Later posts will go into some reverse-engineering, featuring a great YouTuber, LiveOverFlow. If you like reverse-engineering you will surely enjoy his tutorials. By the time you read this he will have probably published his first video showing you how to get into the device.
He also discovered that a very similar device is being sold under the Strontium Mobile Wifi Cloud (Sri-CUBa-3KW) moniker in US and India. However that one is advertised as having a 3000mAh battery while this one only has a 1900mAh one.
The main gadget has a single-channel 2.4GHz connection, a USB port and an SD card reader. It also features a 1900 mAh (7.03Wh) battery, a micro USB port that doubles as data and charging.
The user has access to reset and power buttons and some top LEDs: bright blue for power, brighter blue for WiFi connected, yellow for charging, red for custom feedback.
Getting sidetracked here, but red LEDs have a higher working voltage than blue ones. The end effect is that, without a dedicated driver, blue LEDs will be much brighter than red. This is compounded by the fact that blue ones require less current for the same amount of output lumens.
In the picture above you can see the sandwich construction:
The board is centered around a Ralink RT5350F system-on-a-chip, running at around 350MHz. Firmware is stored in an cFeon Q64-104H - 8 MBytes NAND flash chip (ENQ64-104HIP). Working memory is handled by 2x32MBytes SDRAM chips.
The unit has an internal antenna but also a micro-UFL (?) connector for an external antenna.
Spoiler: serial port is on the test pads below the flash chip in the picture below.
The unit has pretty bad reviews on amazon, not helped by the fact that the manual covers only the basics.
As a disclaimer, I am running a custom firmware on it, so the paragraphs below are from memory or short notes taken some time ago. Your unit might behave differently.
On the initial startup the gadget creates an open WiFi hotspot. If you have any USB or SD cards attached they will be accessible by anyone, so either plug in the storage devices later or change immediately the default admin/admin password. The address for that is http://10.10.10.254/
The drives are shared on Samba, so they could be accessed from a Windows computer (Network neighbourhood) or any other device that understand the protocol. On Android this can be achieved through most file managers (Root Explorer, ES File Explorer, ...). I haven't tested any iOS/MacOS functionality.
The purpose of the unit is to provide wireless access to the attached storage devices, while at the same time relaying wireless traffic. So you connect from your phone/tablet to it, it connects to another WiFi hotspot to provide internet access. All traffic from your phone/tablet then goes through the device. You can examine photos, music and videos from the attached storage on the wireless clients (phone, tablet, computer).
Samba transfer speed is around 3-5MB/s.
If you want to copy files from USB to SD (for example) that transfer rate gets halved, as everything has to go through your device first. So, assuming you want to back up 1000 JPEG photos (at 4MB each) from your SD card to a USB stick, it would take 44 minutes. On a normal laptop this would take under a minute.
Internet access rate is also around 20-30Mbps (3-5MB/s), in line with the local bandwidth. Certainly a far cry from the 150Mbps the chip claims.
With both the stock and custom firmware I get dropouts, sometimes requiring a device reset to get it back online. This is in line with the other reviews, so it doesn't win any reliability points.
The DLNA media server function is performed by RedSonic. I don't have any further details on this, it seems to work "ok". The server is accessible under http://10.10.10.254::49152/ but there is not much to configure there.
A slightly more interesting web server is found at http://10.10.10.254:8000/. This is basically the Ralink default implementation, the web server at port 80 is the 'skin' provided by I.Onik. Still not sure whether I.Onik (i-onik, ionik, ?) and CnMemory are the same company.
If the micro USB port is connected to a computer and the unit is powered on, the port is only proving power and battery charging. As soon as the unit is turned off (big power button on top) the gadget is detected/enumerated as two storage devices on the host computer. The first drive maps the USB port while the second one the SD card. As soon as you power up the device again, the devices disappear and are essentially 'unsafely' unmounted. This can lead to data corruption.
The device keeps a telnet port open (port 23) but the root password is unknown and the admin account is disabled. If someone can decode the password from the hash please contact me, I've tried most default passwords. However, there is another way to get into the device, but more on that later.
If somehow you manage to 'brick' your unit, there is a recovery method. You need a serial-USB converter at 3.3V (most of them offer this capability. You need to power off the unit, keep the reset button pressed (toothpick) and power on the unit. The only access now is through the hardware serial port on the top PCB (it has an ESMT chip). So you would need to take the unit apart (two screws on the bottom, under the rubber feet) and connect the GND, RX and TX wires to some test pads.
The serial protocol is 57600 baud 8N1.
Assuming you made it this far, there is a way to unbrick the unit in recovery mode by flashing the mtd5 partition with a backup.
In recovery mode you are root on the serial terminal.
The measurements were taken with a USB power monitor, so don't expect any precision. Since they were taken on the 5V voltage, you need to convert everything to the battery voltage or use Watts for a precise power estimation. The unit does some kind of trickle charging that can vary/increase the 5V current by 100mA during certain periods.
Example: 340mA @ 5V is about 531mA @ 4V (on battery, assuming 80% converter efficiency). Or 1.7W, easier to work with.
Idle, bridge mode: 340mA. Estimated battery time 4h8m.
As above, but with a USB stick plugged in: 400mA. This means that just plugging in a USB stick reduces the battery time by 1h18m to 3h30m.
Copy 8GB of data from HFS+ USB stick (Apple-formatted) via Samba (network): 540-640mA.
Cpu at full load seems to take ~70mA of current, so only a 20% increase.
With all network interface disabled, at idle: 260mA.
Unit off: 10mA or 100mA. The 10mA is likely from the blue LED, the 100mA is the trickle current as noted above, it does not draw this at all times.
Unit off, USB and SD inserted: 170mA. It seems that just the USB interface by itself is drawing 70mA at all times.
With the above data I can derive the consumption of various components:
Currently (early 2017) selling for 15E, I think I paid 12E including shipping. This post will focus on basic features and some early data. Later posts will go into some reverse-engineering, featuring a great YouTuber, LiveOverFlow. If you like reverse-engineering you will surely enjoy his tutorials. By the time you read this he will have probably published his first video showing you how to get into the device.
He also discovered that a very similar device is being sold under the Strontium Mobile Wifi Cloud (Sri-CUBa-3KW) moniker in US and India. However that one is advertised as having a 3000mAh battery while this one only has a 1900mAh one.
Edit
The excelent video from LiveOverFlow is up: https://www.youtube.com/watch?v=FxE2ITDWsNEHardware
The main gadget has a single-channel 2.4GHz connection, a USB port and an SD card reader. It also features a 1900 mAh (7.03Wh) battery, a micro USB port that doubles as data and charging.
The user has access to reset and power buttons and some top LEDs: bright blue for power, brighter blue for WiFi connected, yellow for charging, red for custom feedback.
Getting sidetracked here, but red LEDs have a higher working voltage than blue ones. The end effect is that, without a dedicated driver, blue LEDs will be much brighter than red. This is compounded by the fact that blue ones require less current for the same amount of output lumens.
To get inside the unit you need to remove the two rubber stops on the bottom of the unit and the screws beneath them.
In the picture above you can see the sandwich construction:
- the top cover of the unit houses the power button, LED ring and the external antenna
- the bottom half houses the processor board, extension board and battery
The board is centered around a Ralink RT5350F system-on-a-chip, running at around 350MHz. Firmware is stored in an cFeon Q64-104H - 8 MBytes NAND flash chip (ENQ64-104HIP). Working memory is handled by 2x32MBytes SDRAM chips.
The unit has an internal antenna but also a micro-UFL (?) connector for an external antenna.
Spoiler: serial port is on the test pads below the flash chip in the picture below.
Function and performance
The unit has pretty bad reviews on amazon, not helped by the fact that the manual covers only the basics.
As a disclaimer, I am running a custom firmware on it, so the paragraphs below are from memory or short notes taken some time ago. Your unit might behave differently.
On the initial startup the gadget creates an open WiFi hotspot. If you have any USB or SD cards attached they will be accessible by anyone, so either plug in the storage devices later or change immediately the default admin/admin password. The address for that is http://10.10.10.254/
The drives are shared on Samba, so they could be accessed from a Windows computer (Network neighbourhood) or any other device that understand the protocol. On Android this can be achieved through most file managers (Root Explorer, ES File Explorer, ...). I haven't tested any iOS/MacOS functionality.
The purpose of the unit is to provide wireless access to the attached storage devices, while at the same time relaying wireless traffic. So you connect from your phone/tablet to it, it connects to another WiFi hotspot to provide internet access. All traffic from your phone/tablet then goes through the device. You can examine photos, music and videos from the attached storage on the wireless clients (phone, tablet, computer).
Samba transfer speed is around 3-5MB/s.
If you want to copy files from USB to SD (for example) that transfer rate gets halved, as everything has to go through your device first. So, assuming you want to back up 1000 JPEG photos (at 4MB each) from your SD card to a USB stick, it would take 44 minutes. On a normal laptop this would take under a minute.
Internet access rate is also around 20-30Mbps (3-5MB/s), in line with the local bandwidth. Certainly a far cry from the 150Mbps the chip claims.
With both the stock and custom firmware I get dropouts, sometimes requiring a device reset to get it back online. This is in line with the other reviews, so it doesn't win any reliability points.
The DLNA media server function is performed by RedSonic. I don't have any further details on this, it seems to work "ok". The server is accessible under http://10.10.10.254::49152/ but there is not much to configure there.
A slightly more interesting web server is found at http://10.10.10.254:8000/. This is basically the Ralink default implementation, the web server at port 80 is the 'skin' provided by I.Onik. Still not sure whether I.Onik (i-onik, ionik, ?) and CnMemory are the same company.
If the micro USB port is connected to a computer and the unit is powered on, the port is only proving power and battery charging. As soon as the unit is turned off (big power button on top) the gadget is detected/enumerated as two storage devices on the host computer. The first drive maps the USB port while the second one the SD card. As soon as you power up the device again, the devices disappear and are essentially 'unsafely' unmounted. This can lead to data corruption.
The device keeps a telnet port open (port 23) but the root password is unknown and the admin account is disabled. If someone can decode the password from the hash please contact me, I've tried most default passwords. However, there is another way to get into the device, but more on that later.
Recovery
If somehow you manage to 'brick' your unit, there is a recovery method. You need a serial-USB converter at 3.3V (most of them offer this capability. You need to power off the unit, keep the reset button pressed (toothpick) and power on the unit. The only access now is through the hardware serial port on the top PCB (it has an ESMT chip). So you would need to take the unit apart (two screws on the bottom, under the rubber feet) and connect the GND, RX and TX wires to some test pads.
The serial protocol is 57600 baud 8N1.
Assuming you made it this far, there is a way to unbrick the unit in recovery mode by flashing the mtd5 partition with a backup.
In recovery mode you are root on the serial terminal.
Power consumption
The measurements were taken with a USB power monitor, so don't expect any precision. Since they were taken on the 5V voltage, you need to convert everything to the battery voltage or use Watts for a precise power estimation. The unit does some kind of trickle charging that can vary/increase the 5V current by 100mA during certain periods.
Example: 340mA @ 5V is about 531mA @ 4V (on battery, assuming 80% converter efficiency). Or 1.7W, easier to work with.
Idle, bridge mode: 340mA. Estimated battery time 4h8m.
As above, but with a USB stick plugged in: 400mA. This means that just plugging in a USB stick reduces the battery time by 1h18m to 3h30m.
Copy 8GB of data from HFS+ USB stick (Apple-formatted) via Samba (network): 540-640mA.
Cpu at full load seems to take ~70mA of current, so only a 20% increase.
With all network interface disabled, at idle: 260mA.
Unit off: 10mA or 100mA. The 10mA is likely from the blue LED, the 100mA is the trickle current as noted above, it does not draw this at all times.
Unit off, USB and SD inserted: 170mA. It seems that just the USB interface by itself is drawing 70mA at all times.
With the above data I can derive the consumption of various components:
- baseline: 1.3W
- USB inserted: 0.35W
- CPU max TDP: 0.35W
- WiFi: 0.4-1.2W
telnet 10.10.10.254
ReplyDelete# root/91657853