Disclaimer: Founder/operator of hackspace.io (Matt Virus) works for Cisco, which acquired Meraki several years ago. Claims/methods/details of this post are personal thoughts. This lab activity has no engagement or sponsorship from Cisco and is entirely independent.
Firmware flashing video and guide is here:
https://youtu.be/5HHWQ6nIM6c
Meraki makes great hardware that is tied to a cloud-based administration and licensing model. When the license expires, the hardware stops working. This is slightly unfortunate and wasteful. Several Meraki AP’s and appliances can be flashed to run OpenWRT and bring life back to “bricked” devices with no valid license.
The MR16, MR18, and several other models of AP can be flashed to OpenWRT if they are running an old bootloader. Cisco/Meraki pushed a bootloader/UBoot update somewhere along the line that disabled the ability to do a re-flash without a hardware programmer.
Here in the HHV, at Kernelcon, we won’t bother checking UBoot versions – we will just crack the boxes open and use a JTAG programmer and USBJtag software to write a modified image to the internal memory chip.
An already modified image is available in the Kernelcon folder on the desktop, inside the “Meraki” folder. This image has a modified uboot/bootloader partition and a current OpenWRT image written in-place of Meraki firmware. After we flash this image, the AP will boot to OpenWRT and be ready to use.
Notes:
Every AP coming out of the HHV will have the same MAC address, and it wont’ match the sticker on the bottom of the AP. To return the MAC to the factory data, use this guide:
https://forum.openwrt.org/t/changing-mac-address-presented-to-network/94215
The notes for flashing an MR16 over-the-air are available here:
https://openwrt.org/toh/meraki/mr16
To configure WLAN/wireless in OpenWRT, see here – by default WLAN is disabled, so you must enable it for wireless to come online and broadcast:
https://openwrt.org/docs/guide-user/network/wifi/dumbap
If there is sufficient interest in this, i can record a video flashing an MR16 without using a jtag programmer.