Cudy AP3000 Indoor AKA Jupiter 2 and OpenWRT

Installing OpenWRT on a Cudy AP3000 (Indoor, AKA the Jupiter 2)

Overview

How about following the instructions on the OpenWRT.org website for a similar device (with the EXACT same CPU, WiFi, etc.): https://openwrt.org/toh/cudy/tr3000

Nope. Sadly Cudy doesn't make an InitRAMFS BIN file for the AP3000 (Indoor), even though the file for the AP3000 would work it weren't for their gosh darned 'security feature' of having a signed file. Side note: Is there really an instance where this has helped an end user, or is it about manufacturer control?

Anyway, that's out, so what about a TTY / Serial session via Ethernet? Not a chance. Why? Well: ethernet@15100000 Waiting for PHY auto negotiation to complete......... TIMEOUT ! It appears that the u-boot image is busted in that the Ethernet Interface does NOT work. It shows as 'active', but no link light on a switch and it just doesn't work. Blame this guy: U-Boot 2022.07-rc3 (Sep 01 2023 - 07:34:59 +0000), Build: jenkins-AP3000-19 (well, either he did it, didn't know what he did, or was told to do it by his corporate overlords, in any instance, is doesn't help the end owner of the device that wants OpenWRT installed)

But there is a solution: TTY / Serial Communication via a Serial Port and a good 'ole fashion TTL UART Serial Console Port.

No details here on what is needed for disassembly of the unit that as there is plenty of information out there. This website has some pictures: https://eko.one.pl/forum/viewtopic.php?id=24096

You'll probably notice the great spot for the vias to solder in some pins, directly under the heat sink (on most models), right? Well good news is that there is lots of space if one solders the pins on the backside of the PCB.

Oh, and the default IP Address for the device, with "Cudy Software" installed is 192.168.10.254. Just FYI. And that's as of 2025. Who knows if it'll change in the future.

Pins / Holes for Serial / TTY

As noted, the Pin Headers for the TTY / Serial communication are covered by a heat sink (on the top of the PCB) and a base plate (on the bottom of the PCB). It has been noticed that there is a minor design difference on some models where the Header Pin Holes on some models are visible because of a smaller base plate. Others have a base plate that covers the holes.

The Header Pin Holes from the left, labeled from the edge of the PCB closest to the holes (which is to the right of the picture) or just look at the picture of the top of the PCB (at the bottom of the page) with the Header Pin Holes labeled with a screen printing.

 
Cudy AP3000 (Indoor Jupiter 2) TTY Serial Headers Bottom with Header Clips


  • VCC / 3.3 Volts +
  • GND / Negative
  • RX
  • TX (the square solder pad, you know the one covered by the Blue Inserted Pin, far left in picture)

Oh, and notice the little "PCB Test Clips" / "Test Points" / "Through Hole Loops" (various names they're referred to as). No solder needed, works great. Why not just solder in some pins? Remember, if you've got a model that has the bigger base plate, they'll need to be unsoldered too. Clip Leads? In the middle of the board. Difficult if not impossible. Some spring "grabber" style might work if there's something on the other side to grab onto.

Stuff Ya Need (sorry, Windows just doesn't have the tools, well Subsystem for Linux)

  • Target Device: Cudy AP3000 (MediaTek MT7981 SoC)
  • Access: Serial console via FTDI or CH340 USB-UART adapter
  • Host OS: Rocky Linux 9
  • Software "Tools" used: `sx`, `loadx`, `iminfo`, `bootm`, `LuCI`

U-Boot Setup and Memory Layout (just FYI)

From `bdinfo` output:

Item Value
DRAM Start 0x40000000
DRAM Size 0x20000000 (512 MiB)
U-Boot Relocated Addr ~0x5ff38000
Reserved Region 0x5f7fb170 – 0x5fffffff

Safe RAM Load Addresses

Label Address Offset (from 0x40000000) Status
Known Good 0x42000000 32 MB ✅ SAFE
Default (`loadaddr`) 0x46000000 96 MB ✅ OK (tight)
High (bad) 0x48000000 128 MB ❌ Caused crash on decompression

Uploading OpenWRT initramfs FIT image

First, start at "Power Off", while holding down the Reset Button plug the device in (network cable), it will stop at the 'network challenged' U-Boot prompt.

Use Putty or any other SSH software to connect to the device and U-Boot (if using a USB "TTY" Device, look for ttyUSBx in /dev for the right device to connect to)

In U-Boot (via serial)

The first three items are just a 'safety precaution', as it was observed in some circumstances when trying to use a different load command that the system would just boot in the middle of the file transfer.

setenv bootcmd
setenv bootdelay -1
saveenv

loadx 0x42000000
 
Putty Command Prompt for Cudy AP3000 upgrade

And it will wait, slowly printing out CCCC

On Host PC (on Linux)

Sorry guys, there is no equivalent command in Windows, unless you're running a Linux sub-system.

Assuming `/dev/ttyUSB0` is your serial device, 115200 is the speed, and the usual "8 none 1"; 

sx -vv WhatEverNameOfFile.bin < /dev/ttyUSB0 > /dev/ttyUSB0

...but first download the "InitRAMFS" File from OpenWRT: https://downloads.openwrt.org/releases/24.10.0/targets/mediatek/filogic/ (look for Cudy AP3000, without the 'outdoor' reference, but notice it is the same size file, so probably the same file with a different name)

 
Command Prompt Showing Transfer of File for Cudy AP 3000

Now wait. And wait, and wait. Yes, the file is under 9 MB, but look up a couple of sentences and notice the speed things are transferring at. The SX Command will show "Progress". There will be no indication on the Serial / TTL session that anything is happening at all (but if your Serial USB device has LEDs, then they'll be blinking really fast or almost on solid showing a high transfer rate).

Image Inspection in U-Boot

iminfo 0x42000000

Result (partial):

  • FIT image detected
  • Kernel: LZMA compressed, load/entry address: 0x48000000
  • initrd and FDT present and hash-verified

Booting the Image

bootm 0x42000000

OpenWRT should be available soon (watch it boot up via the Serial Console) at 192.168.1.1. Make sure the load address is the 0x42..., not something higher like `0x48000000`. Not done! This is only the InitRAMFS version of OpenWRT running. Nothing is written to NVRAM (yet).

Permanent Installation

After booting into OpenWRT RAM (initramfs):

  1. Connect to LuCI via web browser (default IP: 192.168.1.1)
  2. Navigate to System → Backup / Flash Firmware
  3. Upload the permanent OpenWRT SquashFS image (`*-squashfs-sysupgrade.bin`) (see above link, and get the SquashFS File)
  4. Choose "Do not keep settings"
  5. Flash the image and reboot

Final Result

OpenWRT should be permanently installed.

Notes

  • Always verify the image format (`iminfo`) before booting.
  • Do not load images to `0x48000000` if that is also the decompress target.
  • To make this repeatable, avoid saving `bootcmd` unless a custom autoboot is configured.

Pin Hole Headers (top of PCB with edge closest to the holes at the top)

 
Cudy AP3000 (Indoor Jupiter 2) TTY Serial Headers

References (minor as they might be)

https://eko.one.pl/forum/viewtopic.php?id=24096 (some parts are in Polish, so use your web browser's translate capability)

Retrieved from "https://wiki.terrabase.info/index.php?title=Cudy_AP3000_Indoor_AKA_Jupiter_2_and_OpenWRT&oldid=2150"