AirPort Express 2G

Front of an AX2G

Back on an AX2G

Introduction

Currently it appears the root password for the AX2G is set to the same password as the base station wireless password, i.e. WPA key.

Application Processor

Atheros AR9344 operates with Big Endian address spacing, a K31

DAC

AK4430

Specifications

Size
Weight
I/O
Storage Capacity

• 64 MB RAM Hynix H5PS5162GFR
• Atheros AR9344 (Datasheet: http://cykey.me/~cykey/airport/AR9344.pdf)
• Atheros AR9582 <= 5GHz radio

Flash Partitions

• 0x0020 0000 - 0x0090 0000 Primary firmware
• 0x0090 0000 - 0x0100 0000 Secondary firmware
• 0x000c 0000 - 0x0020 0000 Dynamic Config (dcfg)
• 0x0008 0000 - 0x000c 0000 Static Config (scfg)
• 0x0000 0000 - 0x0008 0000 bootloder (CFE)

Similar Hardware

http://wiki.openwrt.org/toh/tp-link/tl-wdr4310

http://wiki.openwrt.org/toh/tp-link/tl-wdr3500

http://www.smallnetbuilder.com/wireless/wireless-reviews/31952-tp-link-tl-wdr3500-n600-wireless-dual-band-router-reviewed

Useful Links

• disassembly
• boot process
• http://www.akm.com/akm/en/file/datasheet/AK4430ET.pdf
• https://www.winbond.com/NR/rdonlyres/1C7E7EF8-ACBF-47EC-BE16-D668A7933A21/0/W25Q128BV.pdf