{"id":1853,"date":"2021-12-30T15:12:20","date_gmt":"2021-12-30T05:12:20","guid":{"rendered":"https:\/\/blog.hegars.com\/?p=1853"},"modified":"2022-03-17T21:06:30","modified_gmt":"2022-03-17T11:06:30","slug":"dlink-dl514-remote-access-server","status":"publish","type":"post","link":"https:\/\/blog.hegars.com\/?p=1853","title":{"rendered":"D-Link DI-524 Remote Access Server"},"content":{"rendered":"\n

I got this device on ebay for $10, it was sold as not tested. It was non functional. Dlink has since resued the DI-524 model number so finding information about it is a challenge. Date codes on most of the parts are all in the mid 1998’s this would have been a pricey device in its day.<\/p>\n\n\n\n

I think it was desigend by “Argus Technologies Co Ltd” Taiwan judging by the bios dump and the FCC listing for its sister product and the styling of the user manual. The board is labled PN:AGS9884, on the rear of the board “M4954-B 9847”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Lets talk about the different areas on the PCB<\/h2>\n\n\n\n

A – Power Control<\/h3>\n\n\n\n

4 Layer board?<\/p>\n\n\n\n

B – AMD N80C188-25 16bit Microprocessor<\/h3>\n\n\n\n

External Logic – Address Translation<\/p>\n\n\n\n

External Ram – TC551001BPL-10L (32pin SOP 100ns Static RAM)<\/p>\n\n\n\n

External ROM – AM29F002T 265Kb (32pin PLCC)<\/p>\n\n\n\n

B1 – Epic Hi16c550 FIFO UARTS<\/h3>\n\n\n\n

HIN238CB Transceivers<\/p>\n\n\n\n

C – Davicom DM9008 ISA Plug and Play Super Ethernet Controller<\/h3>\n\n\n\n

AT93c46 Serial EEPROM<\/p>\n\n\n\n

D – Davicom DM9081 10BAST-T Hub Controller<\/h3>\n\n\n\n

YCL 20F001N Magnetics<\/p>\n\n\n\n

D2 – BNC MAU<\/h3>\n\n\n\n

URLS<\/p>\n\n\n\n

https:\/\/web.archive.org\/web\/20010106193900\/http:\/\/www.dlink.com.au\/products\/routers\/di5xx\/<\/a><\/p>\n\n\n\n

https:\/\/web.archive.org\/web\/20010210205153\/http:\/\/www.dlink.com.au\/tech\/resources\/files\/routers\/di5xx.htm<\/a><\/p>\n\n\n\n

https:\/\/fccid.io\/NYTAGS-CA3XX<\/a><\/p>\n\n\n\n

Unhacking it?<\/h2>\n\n\n\n

Was it a factory bodge or is it a user hack? This came with a 014 50Mhz clock can hastely soldered underneith, it looked a bit weird<\/p>\n\n\n\n

The 186\/188 CPU is a 25Mhz part so it can run up to that speed so you would need to provide 50Mhz to run the CPU at 25MHz.<\/p>\n\n\n\n

I’m not sure you get small crystals that go that fast?…. plus it might not need to go that fast either, the memory parts are only 100ns so thats 10MHz, ie 20Mhz crystal.<\/p>\n\n\n\n

……and the pcb layout dosent look quite right to me with a resistor bridge across the crystal pins so it could have been a factory bodge allbeith poor installation <\/p>\n\n\n\n

\"\"
X1 was removed and poor soldering<\/figcaption><\/figure>\n\n\n\n

Flipping the board over we find a 50MHz crystal can powered by the +5v side of an LED, clock out through the X! via and ground to a random graound via.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

looking more closley at it, the poor soldering job to the gound VIA <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Relocating the Clock<\/h3>\n\n\n\n

Removing the bodge works and cleaning up everything.<\/p>\n\n\n\n

\"\"
Cleaning up the pads<\/figcaption><\/figure>\n\n\n\n
\"\"
Kapton Tape cause i couldnt be bother heating up the hot snot gun<\/figcaption><\/figure>\n\n\n\n

Xo carrier should anyone want one <\/p>\n\n\n\n

https:\/\/github.com\/hegars\/14DIPxSMA<\/a><\/p>\n\n\n\n

Remounted the clock onto a carrier board for easy soldering and connecting it to all the pads<\/p>\n\n\n\n

\"\"
Powering from the +5V rail as from the previous bodge job<\/figcaption><\/figure>\n\n\n\n

Testing Clock out<\/h3>\n\n\n\n

The CPU was now getting warm and the clock drive is 50Mhz to PIN 59 (X1) it is divided by 2 by the CPU and then ouput on PIN 56 (CLKOUT) giving 25MHz<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"
The clock generation circuit includes a crystal oscillator, a divide-by-two counter, power-save, powerdown, idle, and reset circuitry.<\/figcaption><\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

EEPROM<\/h2>\n\n\n\n
BIOS Dump – BIN file, remove the .pdf extension.<\/a>Download<\/a><\/div>\n\n\n\n

Removing the eeprom, reading it and putting a socket on <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Socketing the NIC Serial eeprom <\/h3>\n\n\n\n

Socketing the serial EEPROM from the network card for science.<\/p>\n\n\n\n

Also this is a 20MHz clock<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Replacing the Magnetics to the Network card <\/h3>\n\n\n\n

The Magnetics from the CPU’s network card off the the HUB looked a bit melted, could have been from a soldering iron but it was work replacing the 1998 part with the newer 2016 part 20F991N -> 20F001NG (G for RoHS i think)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Memory Part<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Serial Outputs<\/h3>\n\n\n\n

Serial clock marked 737AT3Z which is a 7.3728 MHz clock for BAUD generation<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

What is the highest baud rate produced by an internal clock? The highest baud rate is an X1 clock input divided by 16. For xample: At 3.6864Mhz, the highest baud rate is 3.6864M\/16 = 230.4K baud. At 8Mhz, the highest baud rate is 8M\/16 = 500K baud. What is the maximum baud rate in timer mode with a crystal of 3.6864Mhz? The maximum baud rate is a C\/T clock input divided by 64. For example, at 3.6864Mhz, the maximum baud rate is 3.6864M\/(216<\/em>2) = 57.6K baud. If the crystal of 3.6864Mhz is doubled, will the baud rates in each column in the baud rate selection table be doubled? Yes. For example, if a crystal of 7.3728Mhz (2*3.6864Mhz) is used, the baud rates will be doubled as follows: The 57.6K and 115.2K in one column will become 115.2K and 230.4K<\/p>\n","protected":false},"excerpt":{"rendered":"

I got this device on ebay for $10, it was sold as not tested. It was non functional. Dlink has since resued the DI-524 model number so finding information about it is a challenge. Date codes on most of the parts are all in the mid 1998’s this would have been a pricey device in […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.hegars.com\/index.php?rest_route=\/wp\/v2\/posts\/1853"}],"collection":[{"href":"https:\/\/blog.hegars.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.hegars.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.hegars.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.hegars.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1853"}],"version-history":[{"count":60,"href":"https:\/\/blog.hegars.com\/index.php?rest_route=\/wp\/v2\/posts\/1853\/revisions"}],"predecessor-version":[{"id":1972,"href":"https:\/\/blog.hegars.com\/index.php?rest_route=\/wp\/v2\/posts\/1853\/revisions\/1972"}],"wp:attachment":[{"href":"https:\/\/blog.hegars.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1853"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.hegars.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1853"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.hegars.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1853"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}