How to factory reset without reset switch

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Author Message
stivesstu
DD-WRT Novice


Joined: 11 Apr 2013
Posts: 6

PostPosted: Mon May 01, 2017 11:53    Post subject: How to factory reset without reset switch Reply with quote
I have a WNDR3700 V3 flashed with Kong 22000++ which works perfectly except for the factory reset button which has broken off.

The good: Wifi is working. I can ping it on the Lan and I can see the setup/status page in a browser. Essentially there's nothing wrong with it.

The Bad: It hasn't been used for a couple of years and I've forgotten the login password. I can't reset it, nor get into recovery mode to use TFTP because of the broken switch.

The ugly: I do know the wireless password but can't login to the router with it..only connect to it. So although I can see it from almost every angle I just can't get in to change the settings so I can use it.

I was thinking about shorting the missing reset switch but don't know what to short. I don't mind if I blow the thing up so any and all suggestions how I might get inside would be gratefully received. Cheers
Sponsor
jwh7
DD-WRT Guru


Joined: 25 Oct 2013
Posts: 2670
Location: Indy

PostPosted: Tue May 02, 2017 13:43    Post subject: Reply with quote
You could take it apart and short the pins where the reset switch used to be; or whatever remains of it. And/or solder a momentary switch to it...
_________________
# NAT/SFE/CTF: limited speed w/ DD # Repeater issues # DD-WRT info: FAQ, Builds, Types, Modes, Changes, Demo #
OPNsense x64 5050e ITX|DD: DIR-810L, 2*EA6900@1GHz, R6300v1, RT-N66U@663, WNDR4000@533, E1500@353,
WRT54G{Lv1.1,Sv6}@250
|FreshTomato: F7D8302@532|OpenWRT: F9K1119v1, RT-ACRH13, R6220, WNDR3700v4
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Tue May 02, 2017 14:29    Post subject: Reply with quote
The reset switch is behind a small hole on the bottom of the router (when laying flat) that needs a toothpick or paper clip inserted to activate / push the switch.

How can it be broken off / missing?

_________________
[Moderator Deleted] Shocked
stivesstu
DD-WRT Novice


Joined: 11 Apr 2013
Posts: 6

PostPosted: Thu May 04, 2017 5:11    Post subject: Reply with quote
It's definitely come right off.

I did it 5 or 6 years ago when I was young and heavy-handed...the feedback/give from clicking the Netgear reset switch is actually rather subtle (and prone to misinterpretation by this keen newbie). This combined with all the dire warnings about flashing properly.... of course I had to make sure Embarassed Idea Use wooden toothpicks, not metal paperclips

I threw it in the cupboard and only pulled it out last week to have a look. It works like new except where the reset switch used to be there are now six tiny solder points.

I can't remember the password to save my life and I'm not ready to throw the router away just yet.

jwh7 is quite right. I need to replicate or bypass the old reset switch. I've tried shorting across the various pins but which ones, how many, etc? Logically it's probably 3 pins vs 3pins - tricky enough in itself - and for 10s or more. I will play around with it but thought it worth a shot to see if anyone knew. Cheers
jwh7
DD-WRT Guru


Joined: 25 Oct 2013
Posts: 2670
Location: Indy

PostPosted: Thu May 04, 2017 15:22    Post subject: Reply with quote
The Wikidevi page for the (allegedly identical?) WNDR4000 only showed the circuit board top view, and I didn't look at mine when I had mine apart long ago...

The 6 pins are cuz you desoldered the switch? I would think there are 4 pins to mount the switch pad to the board, and two pins for the reset (one of which would be ground)...but I'm obviously guessing. Are the traces around the pad ok? Have you got a close-up pic?

Another thought; search for it's FCC ID (WNDR3700v3 Wikidevi says PY311200166) and maybe there are some bottom view pics (or schematic? ya right...) which might help figure out the circuit.

_________________
# NAT/SFE/CTF: limited speed w/ DD # Repeater issues # DD-WRT info: FAQ, Builds, Types, Modes, Changes, Demo #
OPNsense x64 5050e ITX|DD: DIR-810L, 2*EA6900@1GHz, R6300v1, RT-N66U@663, WNDR4000@533, E1500@353,
WRT54G{Lv1.1,Sv6}@250
|FreshTomato: F7D8302@532|OpenWRT: F9K1119v1, RT-ACRH13, R6220, WNDR3700v4
jwh7
DD-WRT Guru


Joined: 25 Oct 2013
Posts: 2670
Location: Indy

PostPosted: Thu May 04, 2017 15:34    Post subject: Reply with quote
jwh7 wrote:
maybe there are some bottom view pics (or schematic? ya right...) which might help figure out the circuit.
Or I'll look... are 4 of the 6 pins you mention the 4 corners of the pictured switch?


WNDR3700v3 reset.png
 Description:
from FCC internal photo pdf
 Filesize:  40.1 KB
 Viewed:  10378 Time(s)

WNDR3700v3 reset.png



_________________
# NAT/SFE/CTF: limited speed w/ DD # Repeater issues # DD-WRT info: FAQ, Builds, Types, Modes, Changes, Demo #
OPNsense x64 5050e ITX|DD: DIR-810L, 2*EA6900@1GHz, R6300v1, RT-N66U@663, WNDR4000@533, E1500@353,
WRT54G{Lv1.1,Sv6}@250
|FreshTomato: F7D8302@532|OpenWRT: F9K1119v1, RT-ACRH13, R6220, WNDR3700v4
jwh7
DD-WRT Guru


Joined: 25 Oct 2013
Posts: 2670
Location: Indy

PostPosted: Thu May 04, 2017 16:25    Post subject: Reply with quote
Quote:
found this forum post showing which pins to short to put a WNDR4000 in recovery mode
Ha; that thread is how I recovered my WNDR4000 years ago, after years of using OEM f/w then trying to flash Shibby Tomato resulted in a brick. Smile Shorted w/ a 10ohm resistor...

However, in this case, TFTP'ing firmware wouldn't reset the password, but you could `erase nvram` in serial mode.

_________________
# NAT/SFE/CTF: limited speed w/ DD # Repeater issues # DD-WRT info: FAQ, Builds, Types, Modes, Changes, Demo #
OPNsense x64 5050e ITX|DD: DIR-810L, 2*EA6900@1GHz, R6300v1, RT-N66U@663, WNDR4000@533, E1500@353,
WRT54G{Lv1.1,Sv6}@250
|FreshTomato: F7D8302@532|OpenWRT: F9K1119v1, RT-ACRH13, R6220, WNDR3700v4
hubermania
DD-WRT User


Joined: 24 Aug 2012
Posts: 223

PostPosted: Fri May 05, 2017 15:09    Post subject: Reply with quote
I deleted my post after realizing the boards were nothing alike. Embarassed If it was me I'd throw caution to the wind, drill out the reset hole to 3/8", fold a strip of foil over a pencil eraser and mash it on the ersatz switch's solder pads. This from a guy who no longer has a working ethernet port on his Smart TV. Laughing
_________________
[Broadcom] Asus rt-ac66u r35531 ('66 should only be factory reset through the DD UI)
Fix RT-AC66U "wl1 [2.4 GHz TurboQAM]". DD-WRT failsafe UI @ http|https://169.254.255.1/
sploit
DD-WRT User


Joined: 16 Apr 2016
Posts: 307
Location: California

PostPosted: Fri May 05, 2017 21:49    Post subject: Agree Reply with quote
1) Serial Connection and erase nvram

2) tftp openwrt (sometimes clears the nvram on first boot)

3) Solder a new Button.

4) Final Option... Throw it against the wall at high velocity (will clear out the nvram, cpu, surface mounted resistors, cap's, diodes, etc...)

_________________
My Karma ran over your Dogma
SploitWorks Custom Flashed Routers
stivesstu
DD-WRT Novice


Joined: 11 Apr 2013
Posts: 6

PostPosted: Sun May 07, 2017 9:27    Post subject: Reply with quote
jwh7 wrote:
The 6 pins are cuz you desoldered the switch? I would think there are 4 pins to mount the switch pad to the board, and two pins for the reset (one of which would be ground)...but I'm obviously guessing. Are the traces around the pad ok? Have you got a close-up pic?


Here's a pic...The switch actually came off by itself, getting more and more loose until it eventually broke off. I didn't think much of it at the time because the router and Kong Build were working fine – as they still are (albeit with the wrong setup for my network now). Sometime later when I removed the case to have a look all I saw were six tiny solder points flush with the board. I added a touch of solder to each one (ignore all the scuff marks - that's my rubbish soldering) to make them easier to test.

I appreciate the board looks a mess, Embarassed but despite that, I'm figuring if the router is working then the circuit still has integrity and the reset function should still work.

Your pic is extremely helpful. Comparing it to mine, the layout is obviously identical, or close to, and as you say four of the pins are for mounting which leaves the top and bottom middle pins. I'll give them a try and let you know. If it works it'll be easy to add a new switch [/quote]

hubermania wrote:
If it was me I'd throw caution to the wind... This from a guy who no longer has a working ethernet port on his Smart TV. Laughing


I've got a Samsung C series 3D TV which I would dearly love to hack. It's still a great TV but few of the apps work any more, the internet's rubbish, and Samsung has moved on to greener pastures. I've dabbled many times but rummaging about in Hotel Mode, one click from permanently bricking what was a US$5,000 TV, is still a bit too rich for me. I did manage to crack the encryption they use to protect recorded material though. Cool
Malachi
DD-WRT Guru


Joined: 17 Jul 2012
Posts: 7209
Location: Columbus, Ohio

PostPosted: Sun May 07, 2017 11:48    Post subject: Reply with quote
Please make the picture smaller.
_________________
I am far from a guru, I'm barely a novice.
stivesstu
DD-WRT Novice


Joined: 11 Apr 2013
Posts: 6

PostPosted: Sun May 07, 2017 12:01    Post subject: Reply with quote
So...I got in. Wasn't particularly difficult although it didn't use the points I expected.

If you take the photo and assign the pins numbers starting from the top left, 1 to 6 clockwise, checking all six with a multimeter I found the only active pins were:
1 to 2,4,5 and 6 and
3 to 2,4,5 and 6

All showed something like 3.5V

Naturally I tried shorting pins 1 to 3 which didn't work. Through trial and error it turns out 3 and 5 are used to reset the device.

Thanks for the advice. Much appreciated. Feels good to save something from the trash can.


Last edited by stivesstu on Sun May 07, 2017 22:54; edited 1 time in total
stivesstu
DD-WRT Novice


Joined: 11 Apr 2013
Posts: 6

PostPosted: Sun May 07, 2017 12:06    Post subject: Reply with quote
Malachi wrote:
Please make the picture smaller.


Here's a smaller version....



WNDR3700V3 - small.jpg
 Description:
 Filesize:  26.77 KB
 Viewed:  10117 Time(s)

WNDR3700V3 - small.jpg


stuartbh
DD-WRT Novice


Joined: 14 May 2012
Posts: 12

PostPosted: Sun Mar 10, 2024 19:43    Post subject: Reply with quote
jwh7 wrote:
Quote:
found this forum post showing which pins to short to put a WNDR4000 in recovery mode
Ha; that thread is how I recovered my WNDR4000 years ago, after years of using OEM f/w then trying to flash Shibby Tomato resulted in a brick. Smile Shorted w/ a 10ohm resistor...

However, in this case, TFTP'ing firmware wouldn't reset the password, but you could `erase nvram` in serial mode.


I have a Netgear WNDR3700v2 and the reset switch also broke off for similar reasons. That said, I was able to reset the modem by shorting with a tweezers the two bottom pins of the switch.

One more noteworthy issue is that whilst I do run OpenWRT on my router not DD-WRT anymore, I was able to load drivers so that I have a console port that comes from a USB serial cable I plug into the USB port on my router. Thus, when OpenWRT starts up it notices the USB serial port adapter plugged into the USB port, loads the proper drivers and treats it as a console. Now I can use that to deal with isssues I'd otherwise need console access for. Just an idea that likely can also be applied to DD-WRT.

Stuart


Stuart
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 6410
Location: UK, London, just across the river..

PostPosted: Sun Mar 10, 2024 21:16    Post subject: Reply with quote
new builds heave 5 boot fails option so, it will reset after...but its a
one good reason to have a ssh with key authorization only...as a back up plan so you can reset or change password if happens...
once in CLI mode to reset issue command:

nvram erase
reboot

this should be ok...

last resort serial..it works 99.9% ... Cool Laughing Laughing

_________________
Atheros
TP-Link WR740Nv1 ---DD-WRT 55179 WAP
TP-Link WR1043NDv2 -DD-WRT 55303 Gateway/DoT,Forced DNS,Ad-Block,Firewall,x4VLAN,VPN
TP-Link WR1043NDv2 -Gargoyle OS 1.15.x AP,DNS,QoS,Quotas
Qualcomm-Atheros
Netgear XR500 --DD-WRT 55460 Gateway/DoH,Forced DNS,AP Isolation,4VLAN,Ad-Block,Firewall,Vanilla
Netgear R7800 --DD-WRT 55460 Gateway/DoT,AD-Block,Forced DNS,AP&Net Isolation,x3VLAN,Firewall,Vanilla
Netgear R9000 --DD-WRT 55363 Gateway/DoT,AD-Block,AP Isolation,Firewall,Forced DNS,x2VLAN,Vanilla
Broadcom
Netgear R7000 --DD-WRT 55460 Gateway/SmartDNS/DoH,AD-Block,Firewall,Forced DNS,x3VLAN,VPN
NOT USING 5Ghz ANYWHERE
------------------------------------------------------
Stubby DNS over TLS I DNSCrypt v2 by mac913
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum