Thanks, thats a real reset :)
How To Debrick Your NETGEAR WNR3500L Using A USB-TTL Cable on Windows
Categories: Troubleshooting
September 10, 2012 1:20 PM
Hi, I am trying to debrick my 3500L as indicated in your tutorial but I'm finding a problem at the moment I start step 9, when powering on the router. I will put my findings after typing CTRL-C in here below and I hope you can give me instructions on how to proceed. Thanking you in advance, Roger
Decompressing..........done
Decompressing..........done
CFE for WNR3500L version: v1.0.36
Build Date: Tue Aug 11 15:09:14 CST 2009
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found a 8MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.28
CPU type 0x19740: 453MHz
Tot mem: 65536 KBytes
Device eth0: hwaddr 20-4E-7F-22-F2-A0, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Loader:raw Filesys:tftp Dev:eth0 File:192.168.1.2:vmlinuz Options:(null)
Loading: Failed.
Could not load 192.168.1.2:vmlinuz: Timeout occured
Checksum mismatch:
Image chksum: 0xE9950927
Calc chksum: 0x895989DB
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 5192 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
Linux version 2.6.22.19 (root@tomato) (gcc version 4.2.4) #7 Sun Mar 4 21:23:05 ICT 2012
CPU revision is: 00019740
Found a 8MB ST compatible serial flash
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
Normal 0 -> 16384
HighMem 16384 -> 16384
early_node_map[1] active PFN ranges
0: 0 -> 16384
Built 1 zonelists. Total pages: 16384
Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 512 (order: 9, 2048 bytes)
CPU: BCM4716 rev 1 pkg 10 at 453 MHz
Using 226.500 MHz high precision timer.
console [ttyS0] enabled
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 61360k/65536k available (33k kernel code, 4112k reserved, 2669k data, 124k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
PCI: Using membase 8000000
PCI: Disabled
PCI: Fixing up bus 0
PCI: Fixing up bus 1
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
squashfs: version 3.0 (2006/03/15) Phillip Lougher
io scheduler noop registered (default)
HDLC line discipline: version $Revision: 4.8 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0xb8000300 (irq = 8) is a 16550A
PPP generic driver version 2.4.2
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V0.17
PPTP driver version 0.8.5
pflash: found no supported devices
Creating 6 MTD partitions on "sflash":
0x00000000-0x00040000 : "pmon"
0x00040000-0x00790000 : "linux"
0x00124400-0x006f0000 : "rootfs"
0x006f0000-0x00780000 : "jffs2"
0x007f0000-0x00800000 : "nvram"
0x007e0000-0x007f0000 : "board_data"
u32 classifier
OLD policer on
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (512 buckets, 4096 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
ipt_account 0.1.21 : Piotr Gasidlo , http://www.barbara.eu.org/~quaker/ipt_account/
net/ipv4/netfilter/tomato_ct.c [Mar 4 2012 21:19:54]
NET: Registered protocol family 1
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear
All bugs added by David S. Miller
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 124k freed
Warning: unable to open an initial console.
September 16, 2012 2:51 PM
I'm out of ideas, been trying everything in this thread.. The only thing I can't do which would work is to shortcut those two pins but I've got a newer version apparently so there are no pins!.
I get a connection to the router but I can't CTRL+C in putty. The ping responds two times before going into request timed out.
Tried to use another CMD window with pint -t to slow down the boot process but no result.
What can I do when I've got no pins to shortcut! :)
September 17, 2012 3:37 AM
Hi, regarding the CTRL+C in putty I found out that you need to adjust a setting which enables this command within putty itself (maybe calles special commands?) As for the other part of your problem I'm not able to help you.
I'm waiting for some help myself as I was able to connect the pins, get the putty to work but unfortunately I can't get the commands to work which are mentioned in the tutorial above.
Good luck and hope someone will answer our questions.
September 17, 2012 7:13 AM
I managed to fix this, I had the wrong cable on PIN 2... Now I can break the bootloader and get into CFE. The router is restored finally.
I thought the router wouldn't give any life signs unless the cables were correctly in place, but apparently you can mix the cables and still looks like everything is ok.
So you can break and get into CFE but not TFTP?
September 17, 2012 8:51 AM
Nice to hear you have been able to resolve the problem, one gets crazy not finding the solution.
Yes I get into CFE (please see my earlier message with cfe console message) but I'm not able to get in tftpd and I don't know how to fix this
Any clue?
Thanks
gateway not set, nameserver not set
Loader:raw Filesys:tftp Dev:eth0 File:192.168.1.2:vmlinuz Options:(null)
Loading: Failed.
Could not load 192.168.1.2:vmlinuz: Timeout occured
Checksum mismatch:
Image chksum: 0xE9950927
September 24, 2012 4:47 AM
Hello all, just to close my previous threads I'd like to inform that I have been able to resolve the problem which at the end was connected to my firewall/virus scanners. Disabling all of them (disconnecting from the internet as well) I've been able to tfpd the firmware to the router and all works.
October 8, 2012 3:16 AM
For those who have a RaspberryPi it is also possible to use its serial port to unbrick the router, I tested this on a WNR3500Lv2 and it worked.
October 8, 2012 3:17 AM
For those who have a RaspberryPi it is also possible to use its serial port to unbrick the router, I tested this on a WNR3500Lv2 and it worked
October 28, 2012 11:32 PM
WOW! It worked!
Couple caveats...you can buy the ttyl cable on ebay from China for a lot less and then you don't have to worry about screwing it up. The one you get, you can pry the heads out of the plastic sleeve by lifting up the stoppers that hold the heads in with an exacto blade, then pull them out. I abandoned the plastic sleeve and stuck the leads onto the pins directly according to the picture.
Getting the CFE prompt up was a LOT more difficult than I thought it was going to be. I must have started and stopped the router a hundred times before getting the CFE. And I wasn't sure whether it was control + c or control + C (control + shift + c) so I alternated between them rapidly.
After a few hours, though, I had my router back! Thanks!
November 9, 2012 4:55 AM
I can't get my WNR3500Lv2 working. When my router boots, it says that it has a corrupted boot block. Yet, it will boot far enough to bring up the ethernet port and start listening on tftp. I can upload firmware after firmware, but nothing happens.
I've tried the 30-30-30 method, but that didn't work.
I've tried using the cable method (on Windows), and have even managed to get a CTRL-C to work and drop me into the CFE command prompt. But, when I try to type "nvram erase", my text is all garbled, and it won't work. I've tried a couple different cables, including the one recommended here, but always have the same result.
Also, as a point to note, I cannot connect the ground wire because that prevents my router from doing anything (just sits there with a very dim green light). To get to the CFE prompt, I have to disconnect the ground, boot, rapidly hit CTRL-C. And then when I get to the CFE prompt, I've tried in vain reconnecting the ground in the hopes that this will clear up the garbled communications enough to let me issue the "nvram erase" command.
I've also tried the pin-shorting method, but I'm not sure which pins to short
because my MoBo looks different from the ones in your photos; especially, I don't see the metal enclosed chip(?) next to the chip with the reset pins. Perhaps there is a slight revision to the 3500Lv2 that isn't be reflected in the model number? Anyhow, I've tried shorting all of the pins possible on the smaller chips on my board, but nothing resets the nvram.
I don't know what to do from here. After spending $30 on cables, I'm thinking that it would be easier and certainly much less frustrating just to pony up the rest of the dough needed to buy a new router. It just seems stupid to spend the money when my router seems to have some life in it yet....
Any help would be appreciated. TIA.
November 9, 2012 2:41 PM
Hey. I brought my router back to life. I was doing two things wrong.
1. I was hooking up the ground to the 3.3v pin because I didn't realize that the
v2 pin-out was opposite to the v1 router's pin-out. Now, no more garbage on the screen.
2. Problem two. This one is really stupid and would have saved me some $$ spent on usb2ttl cables. What was it? When I used Linux to tftp the files, I didn't force it into binary mode with the "-m binary" flag. Oy! No wonder none of my uploads had been working! Of course, I only realized this when I got the serial console working, and I saw that uploaded filename had junk prepended to it.
Hindsight is such a kick in the butt! :-)
Administrator
- member since: 01/02/2008
- rank: 2 of 30029
- 50 articles authored
- 5 blog entries posted
- 96 forum threads started
- 271 comments
November 9, 2012 2:59 PM
Hey tc, thanks for posting your experiences. Glad you got things working!
I do have a WNR3500Lv2 guide which shows the alternate pinouts, in case anyone needs that: http://www.myopenrouter.com/article/36609/How-to-Debrick-Your-WNR3500Lv2-Usin...
The -m flag is what you would use in Linux, correct? For the Windows guide, I have -i. Just want to make sure it's clear for anyone keeping an eye on this thread :)
January 8, 2013 12:55 PM
I haven't needed this yet, but am fascinated by your article. I know that one day I'm gonna need it. Thanks.
February 5, 2013 5:54 PM
I was thinking all would go fine, but putty stops at DRX 0x02 "Hit enter to begin"
any thoughts?
February 5, 2013 5:57 PM
I thought all was going swell, but after 4 times trying, each time Putty gets stuck on DRX 0x02 "Hit enter to continue"
any thoughts?
February 7, 2013 4:15 PM
Hi,
thanks for your perfect instruction. The wnr works again perfectly!
Krds from Austria!
RSS
