If you backup cfe with this command:
dd if=/dev/mtd/0 of=/tmp/cfe.bin
Open the file with hex editor, you can find this from it:
boot_wait=off wait_time=3, would it be possible change it to this: boot_wait=on and wait_time=10 for easyer recovery?
like with Linksys WRT54GL.
My cfe: http://dl.dropbox.com/u/2880566/cfe.rar
Links about CFE:
http://www.dd-wrt.com/wiki/index.php/CFE_backup#Restoring_the_CFE
http://oldwiki.openwrt.org/OpenWrtDocs%282f%29Customizing%282f%29Firmware%282f%29CFE.html
Someone who has JTAG cable could maybe try this and if it works make some guide, i have no jtag cable or ttl header so if i crash the CFE even shortcuting those two pins on router to enable tftpd won't work.
Well i have tryed that, not working. It won't either change it to cfe.
I enabled it like this:
nvram set boot_wait=on
nvram set boot_time=10
nvram commit
so its only on linux firmware nvram not on the cfe bootloader, i have no jtag so i don't know how i would enable it to there.
How i can get to CFE prompt without jtag cable?
If you mean this: http://www.myopenrouter.com/article/13859/How-To-Debrick-Your-NETGEAR-WN...
i have no TTL header where to connect it and soldering one would be hard and if i would have ttl header and that cable it would be kinda useless to enable tftp boot_wait :)
It is useless to enable boot_wait because the WNR3500L does NOT act like a Linksys WRT54G with starting a tftp server and waiting for a firmware. The WNR3500L tries to connect to a tftp server on 192.168.1.2 and requests an image called vmlinuz.
This looks to me like booting from network but not like grabbing a firmware and writing to the flash.
If you want to write a flash image to the device from CFE prompt you really need a serial cable. There's no way around this from my point of view.
Ok did you try enable boot_wait to cfe? not just only nvram? Well this is not anything very important since there is that shortcut pins method to get tftpd started and accept new firmware.
I enabled boot_wait like you in nvram.
Then the router acted like i described above...
Ok, well i talked about CFE(bootloader) it has option for boot_wait already but it's off. I think it has no support for reading it from nvram but if you get it enabled to CFE(bootloader) it would work and wait. Open it with hex editor and find boot_wait. http://dl.dropbox.com/u/2880566/cfe.rar
I suppose the boot_wait that you see in the CFE partition is only a default value if the one in nvram is missing. The CFE bootloader is nvram capable and reads the boot_wait variable from nvram.
So changing the boot_wait flag in CFE will not change the behavior of the bootloader until the nvram partition is corrupted or empty.
See http://oldwiki.openwrt.org/OpenWrtDocs%282f%29Customizing%282f%29Firmwar... under "Checking it"