Messing with hardware hacks – Tenda n300 v6 router UART [draft]

Few days ago in my local supermarket I have stumbled upon a line of cheap networking devices from Tenda. I have never heard about it before and was curious what’s inside so I grabbed the cheapest router from this manufacturer – N300 – and went home to crack it open and fool around.

Look around

After opening (there is not even one screw in this router, just need to pry it open with a flat screwdriver) and desoldering antennas you can simply pull out the board. First thing I wanted to look for was some kind of ICSP or UART header – unfortunately none was available but I have noticed 10 test points on the bottom side of the board in close proximity from the main chip.
(quick note – I have taken most of the pictures after I have hacked into it as I didn’t think about writing this post)

To make testing easier I have soldered wires to testpads and numbered them.

Next thing i needed to know is to what is that main chip and which pin had hardware UART available. The chip is Realtek RTL8196E and datasheets are easy to find in google. After brief search through this datasheet I knew there are two hardware UARTs – I only needed Rx, Tx and GND.

My first guess was to use pins 1 and 127 (U1_TX and U1_RX) so I started checking testpoints and pins on the chip with continuity mode of my multimeter. After finding the testpoint – pin pairs I wanted I started probing with my cheap usb oscilloscope