Sonos Bridge Hack

This all began when I came across a FREE Sonos Bridge. Ready to be thrown away I swiped it up and figured I could make use of it somehow. Well after googling what the device actually does, I realized how useless its intended function really way. Its really just a glorified Wifi extender. Should you have a Sonos speaker(which I may never own as they are very $$$), they can connect to the Wifi, so you dont need to add a bridge in-between. The box also rattled, so I knew something was broken.

So I immediately open it up and discover both antennas had broke off, would be an easy fix. But I'm not here to fix it, I dove further in, discovered there was a 4 pin header on the PCB. Hooked up a usb to ttl converter and tried every single pin combo at 9600 baud.... 

Diagnostics setup

Wala I saw some output! Very little output, but there was hope I could do something with this thing. Next I tried holding the button down and power cycling, what do you know, there was console output from something called redboot. Which I now know is the bootloader they are using to launch linux. The output said something like press Ctrl+c to halt the boot process. Once you hit that step, you now have free reign to the bootloader tools(I think). 

Redboot output

From this point I started looking into redboot commands, if there was a possibility to load a new kernel, other ways to access the linux environment. Things I found out:

• Redboot has a load command to pull images from a tftp server
• The processor is a: Atheros AR2315A-001 D4Q089C 1328
• OpenWrt distro came in a flavor for this chip. May be a possibility to load that .img
• https://downloads.openwrt.org/snapshots/targets/ath25/generic/

This all sounded very promising that I could turn this into a linux box. I just couldnt ever figure out how to get this device to connect to my network. Which may have worked originally, but I "accidentally" erased the original/sonos linux filesystem image. Originally I had though I would need to erase the original files to make room, well that flash chip on the board is 64gb I believe, should have been plenty of room to add an extra linux image. That may or may not have impacted the ability for the board to connect to my router. I would think redboot running would have been enough for me to be able to ping the device, but I had no success. My theory is the IP175C ethernet switch chip might be being controlled by the Atheros processor(the linux code that WAS running on it), but I have no idea how to prove or disprove that.

Well I gave it a try, might just pull the rj45 connector off the board and trash the rest.