How To Debrick Your NETGEAR WNR3500L Using A USB-TTL Cable on Windows

So you've gone and done it... you've bricked your WNR3500L.  Nothing sinks the spirits like constantly flashing lights and endless reboot loops.  However, don't lose hope or get frustrated - there's a solution to your woes, and it's called a serial console.

Before you think that this is too complicated for you, read on.  It's actually quite simple, but there are several steps involved that require completion exactly as stated.  Remember, you perform these steps at your own risk, but rest assured that I have followed these exact steps to great success and that you should be able to duplicate them.  The instructions that follow are for use on Windows systems.

[Purchase a NETGEAR WNR3500L]

Materials Needed

  • 1x Bricked WNR3500L 
  • Ethernet cable
  • Windows PC/Laptop
  • Installed TFTP client (Windows XP, 2000, and 7 have this built in.  Otherwise, see step 10 for installation instructions/links)
  • Teeny tiny screwdriver or similar implement
  • Electrical tape (Optional, but recommended)
  • USB-TTL Cable from FTDI.  You can purchase one of these from Mouser ElectronicsEnsure that you have model TTL-232R-3V3 specifically, or you can fry your router! See photo above.
  • Torx T6 or T7 screwdriver
  • Thin flathead screwdriver (Optional, but recommended)
  • NETGEAR Original Firmware for the WNR3500L (Download from here and put into your C: drive).
  • Patience.  Some of these steps may take multiple attempts.

Step 1: Crack Open the Router

Well, don't literally crack it, unless you want a broken router!  It's pretty easy to open, but be careful.  Use the Torx screwdriver to remove the two screws on the bottom of the unit first.

Now, you will have to unsnap the case from the router.  In the photo, look closely at the router's casing.  You may be able to see the tabs on the left and right side.  The panel you need to remove is the "top" panel - look at the back of the router and turn it so the text is right side up.  The top panel, when the router is situated this way, is the one you should need to remove.  Gently put your screwdriver (preferably flathead) in the seam and disconnect these tabs.  Once you are able to slide the case off, put the router aside for now. 

Note: The first time removing it, I needed the screwdriver to pry it loose, but on subsequent tries I discovered that the case "slides" and snaps into place.  Try various methods to find what works best for you.  You may not need an implement to unsnap the tabs at all, if you're lucky!

Step 2: Download PuTTY Program and Install

PuTTY is the nifty, free little program that you will use to program the router, also known as a serial console.  Download it from here, and install it using the self-installing executable.

Step 3: Download Cable Drivers and Install

Now, you'll need to download the drivers for your USB-TTL cable.  In a nutshell, this cable "converts" the USB interface of your PC to a serial output that the board of the WNR3500L can understand, so you can communicate directly with the board (i.e., not over your network.)

Download the proper driver for Windows from here and install it.  A reboot is not required, but recommended.

Step 4: Give your PC a Static IP Address

This step is to ensure that you will be able to communicate with 192.168.1.1, the default address of the bricked router.

Head to Control Panel => Your Internet Connection => TCP/IP => Properties and change your IP address as shown above.  Make sure it does not end in .1, .x1, or .xx1.

Step 5: Plug in Ethernet from Router to PC

Note: Do NOT connect the power to the router just yet.  

Connect the Ethernet cable you have in your possession to an orange port on the WNR3500L to the Ethernet port on your PC.  Note that it must be an orange port, NOT the yellow port... it won't work otherwise.  At least, it didn't for me.

[[page]]

Step 6: Modify the USB-TTL Cable for Use with WNR3500L

Take a look at the photo above.  See how each of the leads is covered by a small plastic tab?  Bust out your tiny screwdriver or whatever it is that you have that's tiny, and pry off the tabs on the black, yellow, and orange leads only.  If you choose to remove all six, you will need to wrap up the unused leads in electrical tape to avoid shorting anything out.  I just left the unused leads inside the plastic harness as shown above.  Once you pry the tabs off, the leads that you will use slip out easily. Now, you can plug the cable in.

Step 7: Find Out What COM Port Your Cable is Using

You installed the cable driver in step 3, right?  If so, head on over to Control Panel => System => Hardware => Device Manager, and click on the "Ports" item as shown in the photo above.  Note the "USB Serial Port" item with a designation of "COM3."  You'll use this information in the next steps. If you don't see that, plug in the cable and the Device Manager should refresh.

Step 8: Connect the USB-TTL Cable to the WNR3500L

Note: Make sure the router is still powered off and unplugged from power when you do this.  Don't touch anything metal either, don't want to take any risks of shock or shorting anything out, which is always a potential concern when tinkering with open electronics.

This part is particularly important, as if you don't connect these cables properly it will be very frustrating for you!   Take a close look at the photo above.  On the pinout on the board, you will see six pins.  Next to one pin it will read "JP1."  That is actually Pin 6.  Pin 1 is labeled with a "1" next to it.  Connect the cables as follows and as shown in the photo:

Black => Pin 6 (next to JP1)

Yellow => Pin 5

Orange => Pin 2

Note: In this photo, the black and yellow leads are seated properly.  I wanted to show you what an improper cable seating looked like; the orange cable is NOT seated properly.  Make sure all the cables are firmly seated to the pins and that they are not touching each other.

Step 9: Configure and Launch PuTTY

Hanging in there?  Do you feel like a geek yet?  It should feel good :)

Fire up PuTTY and you'll see the screen above.  Select the exact options as shown above; click on the Serial radio button, the port to COM3 (or whatever port was revealed in Step 7) and the speed to 115200.

Then, click on the very last item in the menu and choose the options above.  They must be exact: serial line of COM3, speed of 115200, Data bits of 8, Stop bits of 1, and "None" for both parity and flow control.  Once you are confident these settings are correct, click "Open," and you will see a blank window with a green cursor.  Nothing is supposed to be happening in there yet, so don't fret.

Step 9: Power on the WNR3500L and Press Ctrl-C

Now, you can finally connect power to the router.  Press in the power button and immediately press Ctrl-C on your PC, with the PuTTY window active.  This will bring you to what is called the CFE console; essentially, you're interacting directly with the board.  If this does not happen, double and triple check all of the previous steps.

Then, type in "tftpd" (without quotes) to bring up what is called the TFTP interface.  This will ready the router for programming.  If this step performed properly, you'll be left with the screen above.  Almost there...

Step 10: "Put" The Firmware Into Your WNR3500L In The DOS Prompt

Note: If you are on Windows 2000, XP, or 7, you have a TFTP client built in.  However, if you're on Win95, 98, Me, NT, or Vista - you do not.  

Instructions for installing TFTP on Windows Vista can be found here.

Here is one open source TFTP client for Windows that you can try.

Assuming that you have TFTP installed in some form, zoom on over to your DOS prompt. You copied the original NETGEAR fimware to your C: drive, correct?  Good.  Type "cd.." without quotes as shown above to get to your root directory, then type this command:

tftp -i 192.168.1.1 put FIRMWARE_FILE.chk

When you do this, the TFTP command will send the firmware file you indicated to the router, and you will get a confirmation as shown above.  If this doesn't work, make sure your router is connected to your PC properly, you have a static IP that doesn't end in 1, and that you can ping the router.

If this command is successful, your PuTTY console will start to get some action, and it will re-program the router.  Allow this process to finish, it will take several minutes, and wait until it is COMPLETELY finished or you will get a bad flash.  And nobody wants a bad flash!  You'll get a lot more text than is displayed above, but when it's done, you can try accessing your router's GUI via http://192.168.1.1. You will need to enter the "standard" username and password, consult your user manual for this information. (At the time of this writing, "admin" and "password" were used.)

Step 11: Rejoice and Relax... or troubleshoot

Hopefully, not the latter, but unfortunately things don't always go as planned.  If you're struggling with this procedure, have an unsolvable problem with your WNR3500L, or are on another OS let us know.  We're continuing to work on recovery guides for Linux and Mac OS X, so stay tuned!

You can post your questions on the public forums or as a comment below!

Quick Links

marychristian
marychristian's picture
グッãÃ

グッチ、グッチ腕時計、グッチレプリカ時計、安いグッチ腕時計、グッチ時計を買うには、販売グッチ腕時計、グッチ時計店、ディスカウントグッチ腕時計

marychristian
marychristian's picture
Abercrombie & Fitch Bikini,

Abercrombie & Fitch Bikini, Badeanzug Abercrombie & Fitch, Abercrombie & Fitch Bademode, Bikini zum Verkauf

marychristian
marychristian's picture
watches on sale,Replica

watches on sale,Replica Wacthes,Replica IWC Wacthes,Replica Rolex Wacthes,Replica Omega Wacthes

Roger_
Roger_'s picture
Hi, I am trying to debrick my

Hi, I am trying to debrick my 3500L as indicated in your tutorial but I'm finding a problem at the moment I start step 9, when powering on the router. I will put my findings after typing CTRL-C in here below and I hope you can give me instructions on how to proceed. Thanking you in advance, Roger

Decompressing..........done
Decompressing..........done

CFE for WNR3500L version: v1.0.36
Build Date: Tue Aug 11 15:09:14 CST 2009
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found a 8MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.28
CPU type 0x19740: 453MHz
Tot mem: 65536 KBytes

Device eth0: hwaddr 20-4E-7F-22-F2-A0, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Loader:raw Filesys:tftp Dev:eth0 File:192.168.1.2:vmlinuz Options:(null)
Loading: Failed.
Could not load 192.168.1.2:vmlinuz: Timeout occured
Checksum mismatch:
Image chksum: 0xE9950927
Calc chksum: 0x895989DB
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 5192 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
Linux version 2.6.22.19 (root@tomato) (gcc version 4.2.4) #7 Sun Mar 4 21:23:05 ICT 2012
CPU revision is: 00019740
Found a 8MB ST compatible serial flash
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
Normal 0 -> 16384
HighMem 16384 -> 16384
early_node_map[1] active PFN ranges
0: 0 -> 16384
Built 1 zonelists. Total pages: 16384
Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 512 (order: 9, 2048 bytes)
CPU: BCM4716 rev 1 pkg 10 at 453 MHz
Using 226.500 MHz high precision timer.
console [ttyS0] enabled
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 61360k/65536k available (33k kernel code, 4112k reserved, 2669k data, 124k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
PCI: Using membase 8000000
PCI: Disabled
PCI: Fixing up bus 0
PCI: Fixing up bus 1
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
squashfs: version 3.0 (2006/03/15) Phillip Lougher
io scheduler noop registered (default)
HDLC line discipline: version $Revision: 4.8 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0xb8000300 (irq = 8) is a 16550A
PPP generic driver version 2.4.2
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V0.17
PPTP driver version 0.8.5
pflash: found no supported devices
Creating 6 MTD partitions on "sflash":
0x00000000-0x00040000 : "pmon"
0x00040000-0x00790000 : "linux"
0x00124400-0x006f0000 : "rootfs"
0x006f0000-0x00780000 : "jffs2"
0x007f0000-0x00800000 : "nvram"
0x007e0000-0x007f0000 : "board_data"
u32 classifier
OLD policer on
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (512 buckets, 4096 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
ipt_account 0.1.21 : Piotr Gasidlo , http://www.barbara.eu.org/~quaker/ipt_account/
net/ipv4/netfilter/tomato_ct.c [Mar 4 2012 21:19:54]
NET: Registered protocol family 1
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear
All bugs added by David S. Miller
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 124k freed
Warning: unable to open an initial console.

Whatshisface
Whatshisface's picture
I'm out of ideas, been trying

I'm out of ideas, been trying everything in this thread.. The only thing I can't do which would work is to shortcut those two pins but I've got a newer version apparently so there are no pins!.

I get a connection to the router but I can't CTRL+C in putty. The ping responds two times before going into request timed out.

Tried to use another CMD window with pint -t to slow down the boot process but no result.

What can I do when I've got no pins to shortcut! :)

Roger_
Roger_'s picture
Hi, regarding the CTRL+C in

Hi, regarding the CTRL+C in putty I found out that you need to adjust a setting which enables this command within putty itself (maybe calles special commands?) As for the other part of your problem I'm not able to help you.

I'm waiting for some help myself as I was able to connect the pins, get the putty to work but unfortunately I can't get the commands to work which are mentioned in the tutorial above.

Good luck and hope someone will answer our questions.

Whatshisface
Whatshisface's picture
I managed to fix this, I had

I managed to fix this, I had the wrong cable on PIN 2... Now I can break the bootloader and get into CFE. The router is restored finally.

I thought the router wouldn't give any life signs unless the cables were correctly in place, but apparently you can mix the cables and still looks like everything is ok.

So you can break and get into CFE but not TFTP?

Roger_
Roger_'s picture
Nice to hear you have been

Nice to hear you have been able to resolve the problem, one gets crazy not finding the solution.

Yes I get into CFE (please see my earlier message with cfe console message) but I'm not able to get in tftpd and I don't know how to fix this

Any clue?
Thanks

gateway not set, nameserver not set
Loader:raw Filesys:tftp Dev:eth0 File:192.168.1.2:vmlinuz Options:(null)
Loading: Failed.
Could not load 192.168.1.2:vmlinuz: Timeout occured
Checksum mismatch:
Image chksum: 0xE9950927

Roger_
Roger_'s picture
Hello all, just to close my

Hello all, just to close my previous threads I'd like to inform that I have been able to resolve the problem which at the end was connected to my firewall/virus scanners. Disabling all of them (disconnecting from the internet as well) I've been able to tfpd the firmware to the router and all works.

femmecanada
femmecanada's picture
Tiffany

Tiffany Bracelets


Bracelets


Cheap Tiffany Bracelets


Buy Tiffany Bracelets


Discount Tiffany Bracelets


.Look on the options supplied through from suppliers websites.Purchase directly belonging to the manufacturer.

Moreover, once you could have several labels and versions that you are anticipating, you will find excellent sales to be had on your chair additionally.You are capable of doing this, as expected, with the effective use of the net.

You could think like this may be a lot for work to order a seat.The simple truth is, though, anytime you produce good, solid purchase that fit this description, you will not likely need to change the chair all the time.

In its place, your people are at ease, you are at ease that experts claim they may not be complaining about back difficulties or a whole lot worse and you now have a chair that probably will last you a long time

femmecanada
femmecanada's picture
Tiffany

Tiffany Bracelets


Bracelets


Cheap Tiffany Bracelets


Buy Tiffany Bracelets


Discount Tiffany Bracelets


.Look on the options supplied through from suppliers websites.Purchase directly belonging to the manufacturer.

Moreover, once you could have several labels and versions that you are anticipating, you will find excellent sales to be had on your chair additionally.You are capable of doing this, as expected, with the effective use of the net.

You could think like this may be a lot for work to order a seat.The simple truth is, though, anytime you produce good, solid purchase that fit this description, you will not likely need to change the chair all the time.

In its place, your people are at ease, you are at ease that experts claim they may not be complaining about back difficulties or a whole lot worse and you now have a chair that probably will last you a long time

femmecanada
femmecanada's picture
A. Lange & Sohne
femmecanada
femmecanada's picture
A. Lange & Sohne
femmecanada
femmecanada's picture
Designer CushionsBedding
femmecanada
femmecanada's picture
Designer CushionsBedding
femmecanada
femmecanada's picture
[b][url=http://www.beginroom

[b][url=http://www.beginroom.com/it/]cheap kids bedding[/url][/b]
[b][url=http://www.beginroom.com/it/]discount bedding sets[/url][/b]
[b][url=http://www.beginroom.com/it/]Fashion Bedding[/url][/b]
[b][url=http://www.beginroom.com/it/]Bedding Sets[/url][/b][b][url=http://www.beginroom.com/it/]Teens Bedding[/url][/b]

femmecanada
femmecanada's picture
[b][url=http://www.beginroom

[b][url=http://www.beginroom.com/it/]cheap kids bedding[/url][/b]
[b][url=http://www.beginroom.com/it/]discount bedding sets[/url][/b]
[b][url=http://www.beginroom.com/it/]Fashion Bedding[/url][/b]
[b][url=http://www.beginroom.com/it/]Bedding Sets[/url][/b][b][url=http://www.beginroom.com/it/]Teens Bedding[/url][/b]

femmecanada
femmecanada's picture
[b][url=http://www
femmecanada
femmecanada's picture
[b][url=http://www
femmecanada
femmecanada's picture
[b][url=http://www
femmecanada
femmecanada's picture
[b][url=http://www
femmecanada
femmecanada's picture
[b][url=http://www
femmecanada
femmecanada's picture
[b][url=http://www
femmecanada
femmecanada's picture
[b][url=http://www.bigcosplay
femmecanada
femmecanada's picture
[b][url=http://www.bigcosplay
femmecanada
femmecanada's picture
Strand TrouwjurkenBeach
femmecanada
femmecanada's picture
Strand TrouwjurkenBeach
femmecanada
femmecanada's picture
2011 Dr Dre Studio Teams Logo
femmecanada
femmecanada's picture
2011 Dr Dre Studio Teams Logo
femmecanada
femmecanada's picture
[b][url=http://www

Pages