Trendnet TEW-812DRU

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Goto page Previous  1, 2, 3, 4
Author Message
DatPratt
DD-WRT Novice


Joined: 18 Jul 2015
Posts: 21
Location: Ohio

PostPosted: Tue Mar 22, 2016 18:05    Post subject: Reply with quote
So I have ran Wireshark Legacy over the wired connection. The only unique packets I see when turning it on while holding reset are of the types:

IGMPv3 - Membership Report
NBNS - Name Query
ARP broadcast
MDNS - Standard Query
NBNS - Registration
SSDP - M-SEARCH

And as always, no packets received, only packets sent, and in Wireshark, for almost all packets the source is my laptop (192.168.10.2), not the router.

_________________
I'm not a professional at all, I've just been reading a lot about things
Sponsor
MrPete
DD-WRT User


Joined: 09 Jul 2013
Posts: 73

PostPosted: Tue Mar 22, 2016 19:43    Post subject: Reply with quote
Ahh... I had not seen the DDWRT "disable reset" option. I'm searching for the source code for this, but the one note I found DOES suggest this is a very dangerous option. I'll recommend they double-warn on this.

If it does work as suggested (that this changes a very low level monitor and possibly does impact the factory reset function) you may well have at least come close to bricking your router.

Before we make that assumption, here's a next test, with a bit more detail on the step you took. Perhaps I'm just misreading your report:

* WHILE you have the reset button held down after turning on power, I do not expect you to see any packets flow

* It is after you let go of the reset that things should begin happening...
DatPratt
DD-WRT Novice


Joined: 18 Jul 2015
Posts: 21
Location: Ohio

PostPosted: Tue Mar 22, 2016 22:21    Post subject: Reply with quote
MrPete wrote:
Before we make that assumption, here's a next test, with a bit more detail on the step you took. Perhaps I'm just misreading your report:

* WHILE you have the reset button held down after turning on power, I do not expect you to see any packets flow

* It is after you let go of the reset that things should begin happening...


I'll try it again...but I started seeing packets sent right when power cycle starts...

Now that I think about it, most of those packets are probably because of me using a USB adapter in this process...I can get a handle on a different PC with native Ethernet but I don't see the point of it...

Remind me again what is the point of this? or what I should be seeing? Examples of bad or good signs? or are we just trying to get ANY packets recieved FROM the router because I can just see that in Connection Status...

_________________
I'm not a professional at all, I've just been reading a lot about things
MrPete
DD-WRT User


Joined: 09 Jul 2013
Posts: 73

PostPosted: Wed Mar 23, 2016 19:16    Post subject: Reply with quote
Wait a sec. Are you using a Mac for this?

That can be trouble. Last time I checked (I have Macs as well), OSx is VERY poor for network diagnostics, because it essentially unconfigures the interface when there's a disconnect or power cycle at the far end. Sad

Anyway... the goal is to discover:
a) Is the router talking when you do a reset
b) What IP address(es) is it presenting and/or recognizing at the far end.
c) Given the right IP address, ensure you gain the best shot possible at connecting to the emergency web server to load the firmware you want.

My basic assumption is that with the right configuration, it IS possible to connect to the emergency web server.

If this does not work at all, then you possibly have done the equivalent of bricking by disabling the ddwrt reset button function... even if it isn't truly dead on the ethernet.
DatPratt
DD-WRT Novice


Joined: 18 Jul 2015
Posts: 21
Location: Ohio

PostPosted: Wed Mar 23, 2016 19:46    Post subject: Reply with quote
Nope, no Mac. Just an Asus Zenbook without ethernet port. However like I said, I am using an adapter. So, the fact that I was using a USB adapter for ethernet is probably causing the same problem that you say Macs have.

I dont think that the problem is even related to the whole reset button disabled thing. I'm convinced that, somehow, it has retained hardware issues ever since I get the "Decompressing...error 1" result from a serial connection. This apparently means the CFE is corrupted, which I dont think anyone can fix without exchanging hardware components...or maybe pin shorts but I dont think I am going to try that.

Anyway, The router doesnt talk at all...ever...I have checked Connection status many times (where they have Properties/Disable/Diagnose and the number of sent and received packets) and the number of received is always 0 no matter how long I keep it plugged and what type of power cycle or reset I try.

I cant imagine that anything I have done software-wise can cause CFE to die, whether it is a good flash or a bad flash or whatever settings I have done...and even power loss at any time no matter what the router is doing, unless I am wrong. Let's say I was in the middle of a flash or a power cycle after a flash. Would power loss completely break it? serial recovery is supposed to be possible after any such incident, right?

_________________
I'm not a professional at all, I've just been reading a lot about things


Last edited by DatPratt on Fri Mar 25, 2016 21:00; edited 1 time in total
DatPratt
DD-WRT Novice


Joined: 18 Jul 2015
Posts: 21
Location: Ohio

PostPosted: Fri Mar 25, 2016 6:18    Post subject: Reply with quote
I found this a few days ago. Talked about it on my original forum post. No response yet, so I am trying here.

Anyone think that something like this is possible to recover CFE without JTAG?

https://github.com/Chadster766/McWRT/wiki/WRT1900AC-corrupt-bootloader-recovery

_________________
I'm not a professional at all, I've just been reading a lot about things
Malachi
DD-WRT Guru


Joined: 17 Jul 2012
Posts: 7160
Location: Columbus, Ohio

PostPosted: Fri Mar 25, 2016 9:37    Post subject: Reply with quote
DatPratt wrote:
I found this a few days ago. Talked about it on my original forum post. No response yet, so I am trying here.

Anyone think that something like this is possible to recover CFE without JTAG?

https://github.com/Chadster766/McWRT/wiki/WRT1900AC-corrupt-bootloader-recovery


That's Marvell you have Broadcom. The wrt1900ac doesn't have a cfe.

_________________
I am far from a guru, I'm barely a novice.
DatPratt
DD-WRT Novice


Joined: 18 Jul 2015
Posts: 21
Location: Ohio

PostPosted: Fri Mar 25, 2016 20:19    Post subject: Reply with quote
But is it possible to use this process or some similar process with CFE instead of U-boot? Maybe if I were to get my hands on the correct CFE version from someone else? Is Marvell CPUs really designed with this kind of recovery in mind or is this actually some workaround that can also be done on other chipsets??

Originally I thought maybe it would even be possible to just use U-boot to replace the currently broken bootloader...but now I understand I would need much more information about the hardware and I would likely have to modify the bootloader myself.

Also I was wondering about JTAG. Even though there is no clear array of pinouts for JTAG on this board, I see on JTAG pinout images that it can sometimes still be on the board with the pins being part of the circuit in different locations among small chips and through-holes, etc...
Prime example here:
https://www.dd-wrt.com/wiki/index.php/JTAG_pinouts#Linksys_WRT300n_v2

Is it possible for Trendnet routers to be like this as well? If so, how were the ones for the WRT300n even found?

_________________
I'm not a professional at all, I've just been reading a lot about things
segin
DD-WRT Novice


Joined: 11 Dec 2016
Posts: 2

PostPosted: Sun Jan 08, 2017 15:45    Post subject: Reply with quote
MrPete wrote:
You are certain that you correctly attempted to connect to the default emergency webserver?

That unit is VERY hard to brick.

I would use WireShark to monitor the ethernet while connecting to it. And be sure you do a full reset-button reset.


I've got one of these routers that's bootlooping due to the Wi-Fi interface dropping during a firmware flash (laptop's Ethernet port is very shoddy.)

As far as I can tell, there's no emergency web server on this model, v2.2RB. Watching traffic from Wireshark shows that the router itself stays absolutely mum - Windows is spamming it with traffic, but that's about it.

I've tried using static IPs of 192.168.0.2 and 192.168.10.2 with my laptop after I found something to hold the Ethernet cable in place.

I'm not able to search up any further information on any possible recovery procedures than this thread, seems the Internet's thrown the rest into a memory hole.
lukhan42
DD-WRT Novice


Joined: 01 Nov 2015
Posts: 12

PostPosted: Tue Jan 10, 2017 3:02    Post subject: Reply with quote
segin wrote:
I've got one of these routers that's bootlooping due to the Wi-Fi interface dropping during a firmware flash (laptop's Ethernet port is very shoddy.)

As far as I can tell, there's no emergency web server on this model, v2.2RB. Watching traffic from Wireshark shows that the router itself stays absolutely mum - Windows is spamming it with traffic, but that's about it.

I've tried using static IPs of 192.168.0.2 and 192.168.10.2 with my laptop after I found something to hold the Ethernet cable in place.

I'm not able to search up any further information on any possible recovery procedures than this thread, seems the Internet's thrown the rest into a memory hole.


I had a similar issue when mine went into a boot loop after an update. I eventually fixed it by piecing together all of the info I found.

First thing is that this model's emergency web server is located at 192.168.10.1. You will want to set your computer's IP to 192.168.10.2. Make sure you are connected to the router by ethernet and unplug the power to your router. Assuming you use Windows, open up the command prompt and type in:

ping -t 192.168.10.1

That command will continuously ping your router's emergency web server and will let you know when you can access the emergency recovery. Plug your router in. You will start to get replies almost immediately if your computer can communicate with the emergency webserver. TTL will equal 100 if I'm not mistaken until the router begins the boot process. You need to try to access the web server while the replies are returning TTL=100.

The window is very short before the router goes into it's boot process so you need to be ready with the web browser right away. I personally keep a browser window open with the ip address typed in and will hit enter once I see the replies. Then you have to be quick to either browse for the stock firmware file or have the path ready to paste in.

If you cannot communicate then you may want to try to get ahold of a computer with a good ethernet port. Otherwise your only recourse is to use serial recovery. It is possible as I had to do it once when I couldn't connect to the recovery but can be a little tedious. You will either need to solder pins to the router's board or find a way to rig it so that the serial cable's pins can stay connected to the correct contact points.
janlugt
DD-WRT Novice


Joined: 01 Apr 2017
Posts: 1

PostPosted: Sat Apr 01, 2017 19:47    Post subject: Trendnet 812DRU v1.0R for donation Reply with quote
I have a Trendnet 812DRU v1.0R available to donate to a dev. The stock firmware is not useful to me, so I would prefer to support the community with this. Please send me a PM if you're interested in working with this device, and I'll ship it to you.
segin
DD-WRT Novice


Joined: 11 Dec 2016
Posts: 2

PostPosted: Sat May 06, 2017 23:14    Post subject: Reply with quote
So I finally unbricked my router!

If a flash is interrupted far enough along that the kernel is fully intact, but the filesystem is not, serial recovery will be necessary. The CFE will boot the kernel, which will kernel panic and reboot, and this process will repeat endlessly until the serial console is used to break into the CFE shell (spam ^C as soon as the CFE starts sending output.)

Because the kernel is bootable, the CFE won't respond to any network traffic at all - arp, ping, or web.

However, once you interrupt the boot sequence with ^C (Ctrl+C) and have the "CFE>" prompt, the emergency web flash UI will also be available at 192.168.10.1
Goto page Previous  1, 2, 3, 4 Display posts from previous:    Page 4 of 4
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum