R7000 is on a boot loop and keeps resetting.

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message
tninfr
DD-WRT Novice


Joined: 19 Dec 2017
Posts: 3

PostPosted: Tue Dec 19, 2017 14:23    Post subject: R7000 is on a boot loop and keeps resetting. Reply with quote
Having some issues with my R7000 with a Kong build on it.

I mistakingly add something to the script and made it execute on boot up, which just made the router go in a loop.

I bought a usb to ttl cable and can see everything, i can get a ping out of the router but only for a couple of seconds then its lost. here is some of the log.

The router is on a boot loop and keeps resetting.

When I ping the router I get mostly "Request time out" with a TTL=100 4 times in a row every now and again, then it restarts.

When using a serial usb cable and putty to flash firmware into it I can't successfully break (Ctrl+c)

It's never allowing me to break with putty.

Hope someone can help me out.
Sponsor
ddaniel51
DD-WRT Guru


Joined: 19 Feb 2013
Posts: 1310

PostPosted: Thu Dec 21, 2017 10:29    Post subject: Reply with quote
Overclocked the cpu?
_________________
Segment 1 R9000 10Gb LAN, 1Gb ISP BS
Test Bed R9000 10Gb LAN
Wired AP 1 R9000 10Gb LAN
Wired AP 2 R9000 1Gb LAN
Wired AP 3 R9000 1Gb LAN
Test Bed R7800 1Gb LAN OpenWRT Kong
www.desipro.de/openwrt/ (Kong's)
YAMon usage-
www.monitoring.com/manualInstall.php
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 2906
Location: UK, London, just across the river..

PostPosted: Thu Dec 21, 2017 11:35    Post subject: Reply with quote
well if you can successfully log in via serial than erase nvram and reboot this will clear the wrong script held in nvram i guess..
_________________
Atheros
TP-Link WR740Nv1 ------DD-WRT 33772 BS WAP/Switch (wired)
TP-Link WR1043NDv2 -----DD-WRT 41328 BS (AP,PPPoE,NAT,AD Blocking,AP Isolation,Firewall,Local DNS,Forced DNS,DoT)
TP-Link WR1043NDv2 -----DD-WRT 41321 BS (AP,NAT,AD Blocking,Firewall,Wi-Fi OFF,Local DNS,Forced DNS,DoT)
TP-Link WR1043NDv2 -----Gargoyle OS 1.11.0 (AP,NAT,QoS,Quotas)
Qualcomm/IPQ8065
Netgear R7800 ---------DD-WRT 40270M 4.9 Kong (AP,NAT,AD-Blocking,AP&Net Isolation,Firewall,Local DNS,DNSCrypt v2 x2)
Broadcom
Netgear R7000 ---------DD-WRT 40270M Kong (AP,NAT,VLAN,AD-Blocking,Firewall,Local DNS,Forced DNS,DoT)
------------------------------------------------------------------------------------------------
Stubby for DNS over TLS I DNSCrypt v2 via Entware by mac913
tninfr
DD-WRT Novice


Joined: 19 Dec 2017
Posts: 3

PostPosted: Thu Dec 21, 2017 13:58    Post subject: Reply with quote
Alozaros wrote:
well if you can successfully log in via serial than erase nvram and reboot this will clear the wrong script held in nvram i guess..


I made a serial connection with PUTTY and an USB-TTL cable....Ican see the log of the boot...but, it's impossible to interrupt the process and to get the C>...
Sad
Help plz
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 2906
Location: UK, London, just across the river..

PostPosted: Thu Dec 21, 2017 20:43    Post subject: Reply with quote
type quckly tpl and hit enter
must be quick

_________________
Atheros
TP-Link WR740Nv1 ------DD-WRT 33772 BS WAP/Switch (wired)
TP-Link WR1043NDv2 -----DD-WRT 41328 BS (AP,PPPoE,NAT,AD Blocking,AP Isolation,Firewall,Local DNS,Forced DNS,DoT)
TP-Link WR1043NDv2 -----DD-WRT 41321 BS (AP,NAT,AD Blocking,Firewall,Wi-Fi OFF,Local DNS,Forced DNS,DoT)
TP-Link WR1043NDv2 -----Gargoyle OS 1.11.0 (AP,NAT,QoS,Quotas)
Qualcomm/IPQ8065
Netgear R7800 ---------DD-WRT 40270M 4.9 Kong (AP,NAT,AD-Blocking,AP&Net Isolation,Firewall,Local DNS,DNSCrypt v2 x2)
Broadcom
Netgear R7000 ---------DD-WRT 40270M Kong (AP,NAT,VLAN,AD-Blocking,Firewall,Local DNS,Forced DNS,DoT)
------------------------------------------------------------------------------------------------
Stubby for DNS over TLS I DNSCrypt v2 via Entware by mac913
Malachi
DD-WRT Guru


Joined: 17 Jul 2012
Posts: 7211
Location: Columbus, Ohio

PostPosted: Thu Dec 21, 2017 23:50    Post subject: Reply with quote
Alozaros wrote:
type quckly tpl and hit enter
must be quick


It's an netgear r7000. Typing tpl won't stop the cfe.
Start hitting ctrl + c even before turning the router on. Hit them as fast as possible.

_________________
I am far from a guru, I'm barely a novice.
tninfr
DD-WRT Novice


Joined: 19 Dec 2017
Posts: 3

PostPosted: Tue Dec 26, 2017 9:55    Post subject: Reply with quote
I can't break the process with Ctrl-C...
Is it possible to erase nvram with another method ?
Is it possible to replace the CFE ?
How to Jtag the R7000 ?

This problem starts after a power failure ....


Thanx
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 2906
Location: UK, London, just across the river..

PostPosted: Tue Dec 26, 2017 10:42    Post subject: Reply with quote
the other thing i know is press 4 or 1 but yep again this is
for RTL router Smile

_________________
Atheros
TP-Link WR740Nv1 ------DD-WRT 33772 BS WAP/Switch (wired)
TP-Link WR1043NDv2 -----DD-WRT 41328 BS (AP,PPPoE,NAT,AD Blocking,AP Isolation,Firewall,Local DNS,Forced DNS,DoT)
TP-Link WR1043NDv2 -----DD-WRT 41321 BS (AP,NAT,AD Blocking,Firewall,Wi-Fi OFF,Local DNS,Forced DNS,DoT)
TP-Link WR1043NDv2 -----Gargoyle OS 1.11.0 (AP,NAT,QoS,Quotas)
Qualcomm/IPQ8065
Netgear R7800 ---------DD-WRT 40270M 4.9 Kong (AP,NAT,AD-Blocking,AP&Net Isolation,Firewall,Local DNS,DNSCrypt v2 x2)
Broadcom
Netgear R7000 ---------DD-WRT 40270M Kong (AP,NAT,VLAN,AD-Blocking,Firewall,Local DNS,Forced DNS,DoT)
------------------------------------------------------------------------------------------------
Stubby for DNS over TLS I DNSCrypt v2 via Entware by mac913
st3amco0ker
DD-WRT Novice


Joined: 22 Sep 2010
Posts: 4

PostPosted: Thu Jan 25, 2018 20:31    Post subject: Reply with quote
OP did u manage to find a solution? Bought another r7000 and was able to break into CFE. Not the case on the bad r7000.
r6300v2usr
DD-WRT Novice


Joined: 03 Jan 2017
Posts: 49
Location: Lindau, Germany

PostPosted: Fri Jan 26, 2018 5:59    Post subject: bebrick R7000/R6300v2 Reply with quote
A few weeks ago I bricked my R7000 and R6300v2 while trying WDS: Both router froze short befor DHCP would be enabled.
Assigning a static IP I could ping the router short after Power-Up and I could break the boot loop by CTRL-C on a serial console.

But there is an other method which is explained here for R6300V2 which works on R7000 as well:
https://www.dd-wrt.com/phpBB2/viewtopic.php?p=1049230

In short a recovery via tftp feature is explained:
During the possible pinging of the router after power-up the router assigns itself the IP 192.168.1.1 and tries to download a vmlinuz file via tftp protokoll from a tftp server running on 192.168.1.2.
To use this you have to install a tftp server and have a vmlinuz file for download (detailed explanation in the link, there you will find a vmlinuz file). Then assign the static IP 192.168.1.2 to your PC connected to the router via LAN network. After power up the router downloads this file and boots in this firmware. The vmwlinuz from the post is an openwrt software with a GUI and a SSH server, you can erase the NVRAM via SSH. Warning: In my config even MAC adresses and standard wlan KEY was erased, maybe more.
You should try if you can download the vmlinuz file from an other PC to see if the tftp server is configured correctly.

During playing around with different the vmlinuz files I renamed a dd-wrt firmware to vmlinuz. This file was downloaded as well. As It has not the correct format there was an error message after download and the boot process failed... and I got an serial console!
Don't know if this will happen every time but in my config I had this nice effect.

A reset of the settings via RESET button has not worked for me, even it explained in older posts. For me it seems that the RESET button has no function at all...

Recommendation:
- You can/should monitor this process with Wireshark.
- You see that the downloads starts as the pinging continues during download.
- Read the complete discussion in the link, there is even more information at the end.
- After eecovery rename the vmlinuz file and disable the tftp server. Otherwise the router will load this file after power up if the PC has the IP 192.168.1.2.
- Don't get confused with tftp client and server
- There are several tftp server available , maybe not all of then will work on the PC.

I did this all with a linux system using the build in tftpd service but windows it should be possible as well.

Good look and be patient. For me it took a few hours for the first recovery. The second was done in a few minutes, even with CTRL-C.
ghoffman
DD-WRT User


Joined: 03 Jan 2010
Posts: 451

PostPosted: Fri Jan 26, 2018 11:39    Post subject: Reply with quote
both the r7000 and r6300v2 have very good bootloaders, but i've managed to brick an r6300v2 and an r7000 by adventurous flashing of various homebrewed firmwares. i have not tried the ploit vmlinuz approach but that looks promising. it is not clear wot me whcih file to use for vmlinuz for an r7000.

one cause of bootloops on both r6300v2 and r7000 is firmware or nvram that has the gpio maps for reset button incorrect; this makes the firmware reboot becasue it * thinks * that that the reset button is being held down.

as far as i can tell, the most resilient bootloader for the r7000 platform boards (r7000, ea6900, ac68u) is the asus. there is a modified-for-r7000 asus cfe on the linksysinfo boards in an asuswrt-for-r7000 thread. i have been using this for the last year and have not scrod my r7000 yet, despite a number of errant flashes.

i have found that i could burn out the Rx serial line on routers by connecting the +3.3/+5v wire to the Rx pin. obviously stupid. i'm suggesting to get the +5v line off your serial adapter so you don't wreck your router. also, you can wreck the Tx line on your serial adapter by connecting it to the +3.3/+5v line on router. you probably have already tried another serial adapter.

finally, if you overclocked, you can try keeping the router in the freezer and breaking in to the bootloader while it is very cold, and erase your overclock settings. you have to do this before the cpu warms up enough to faial at the overclocked rate. i have read scattered success stories. i tried a couple times with failure.

i hope not to have to atone for router murders. i'm guilty on mnay counts.
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum