R6400 (v1) Flashing problem

14 posts / 0 new
Last post
JamesAD
JamesAD's picture
R6400 (v1) Flashing problem

My R6400 v1 had been running Shiiby Tomato 138 happily for a while, but after a few odd problems recently I thought it would be a good time to try out Advanced Tomato while upgrading to the 140 release.  Following the instructions on here, I flashed back to stock without any issues, but now the stock firmware won't let me flash any initial .chk file, complaining they are incorrect files.  I have tried several with the same result:  

tomato-R6400-1.28.AT-ARM-3.5-140-initial-128K.chk
tomato-R6400-initial.chk
dd-wrt.K3_R6400.chk
etc.

The only thing I haven't yet tried is a newer version of the stock firmware, but I thought I might see if anyone has any advice first - I don't want to make things worse..

A search of the forum turned up someone with the same problem a while ago, but no solutions or even suggestions.

Any ideas appreciated.

 

TXUSA
TXUSA's picture
The "incorrect file" message

The "incorrect file" message usually points to a mismatch between the firmware file and the motherboard ID inside the router. But for the v1 version there's usually not any issues. That is strange indeed.

JamesAD
JamesAD's picture
Thanks for looking. I am no

Thanks for looking. I am no expert, but that was the impression I got from reading these forums.  Is it known how the ID is stored on the motherboard, whether it could be corrupt and how you might check it? As a sometime Arduino tinkerer I think I have the bits and hopefully the knowledge to hook up a serial connection - would flashing this way be worth a try, or would it also object to a mismatch?

TXUSA
TXUSA's picture
The board ID could only be

The board ID could only be changed by using a serial connection and using a command line... it can't be changed by a firmware update on the router. I suspect that there could be leftover code somewhere in the RAM that causes the problem.

JamesAD
JamesAD's picture
I see. I have opened it up,

I see. I have opened it up, connected the serial line and got a comand prompt without too much trouble. It all seems to be working fine, it just won't allow any software update.  Even the OTA update from the Genie web interface, after finding a file and downloading it, fails with an "incompatible" error.  I tried erasing nvram for the sake of it, but no difference. I think I will try a tftp flash next, although I would like to check the board ID - now I.ve got the serial connection, would this be difficult and do you know what it should be?  All suggestions gratefully received. 

Incidentally, some information that may be of use to someone: I use WIndows 10 and I initially tried a CH340 based usb-ttl adapter, which hung the boot-up sequence immediately with all the router lights on. Tried leaving the ground connection until after the initial light flash, but no go.  Tried again with a CP201x based adapter and the same thing happened at first, but connecting the ground wire after the initial light flash worked a treat. Go figure. 

TXUSA
TXUSA's picture
The baord ID should show up

The baord ID should show up when you establish the serial connection to the router... should look similar to this:

Start TFTP server
Reading :: Done. 7258170 bytes read
Board ID : �
Image ID : U12H181T00_NETGEAR (<---- would say something else depening on the specific router model)
Reading ::

JamesAD
JamesAD's picture
Thanks. Unfortunately though,

Thanks. Unfortunately though, things are getting worse, not better. I can't establiblish the serial connectiuon again for some reason, and I've also noticed that the router's mac address seems to be garbage - 00 ff ff ff ff ff.  Looks like something critical has been overwritten, somehow.  The frustrating thing, it's all working perfectly, albeit on old stock firmware! I'll keep trying.

 

 

JamesAD
JamesAD's picture
Update:  Managed to get the

Update:  Managed to get the terminal up again, and did an "nvram show". The board ID is very corrupt (characters comes out as green blocks on my terminal program)  and the mac's are all mostly ff's.  Everything else looks vaguely sensible, but who knows?  it's a lot of data.  I'd like to try and restore the board id and the mac address - this discussion https://bitbucket.org/pl_shibby/tomato-arm/issues/149/wrong-router-model... seems highly relevant, but it assumes a level of knowledge that's above mine. Could anyone confirm the commands I need?

TXUSA
TXUSA's picture
Ouch !!! I heard that you can

Ouch !!! I heard that you can write the ID back but the mac address... hmm... not sure about that...

JamesAD
JamesAD's picture
Well, having nothing much to

Well, having nothing much to lose, a bit of reading produced:

burnboardid U12H332T00_NETGEAR
nvram set et0macaddr= xx:xx:xx:xx:xx:xx
nvram commit

Which all went well, but doesn't seem to have survived the reboot. I'll have another look tomorrow.

JamesAD
JamesAD's picture
Getting somewhere.  After

Getting somewhere.  After redoing the burnboardid, I am now able to flash firmware again. I must have made a typo last night.  Ok, so now I have flashed Genie, then the initial.chk file and finally tomato 140, all without problems and now have a working router again. Well, I had one before technically, but at least now it's running Tomato again and I can just telnet in.

It's not over yet, though. The mac address, the country id and probably some other nvram special variables are still screwed. Going by the link above, I think maybe I should have left the stock firmware on and tried to fix some of these with "burn" commands. I am wondering what problems will occur if I leave things as they are. Any thoughts, anyone?

 

TXUSA
TXUSA's picture
Well, this is territory that

Well, this is territory that I haven't been in... I have bricked routers before and revived them but I never had any erased info like that.

JamesAD
JamesAD's picture
Seems to be surprisingly

Seems to be surprisingly straightforward once you've got console access. You need to be running Genie because it has built-in commands for writing these special variables. You can list then by doing ls /sbin/burn*, which shows a dozen or so commands like burnboardid , burnethermac and so on.  Most are self explanatory - you just set them to match the info on the sticker on the bottom of the unit. I am stuck with the following though:

burn_hw_rev ... "1", maybe?
burnpin  ... Haven't a cluie what pin this is.
burnrf ... Something to do with wireless parameters, but no idea what this should be.
burnsku ... Don't know.

Anyone got sensible suggestions for these values? I also note that none of these appears to have anything to do with a Country ID

 .

nathanb
nathanb's picture
Hi does anyone know the

Hi does anyone know the DEFAULT user/password for the TOMATO R6400 (2017) flash ??