Posted: Fri Apr 20, 2018 15:44 Post subject: Can't get into CFE mode
I have a Netgear R7000 and I'm trying to get into CFE mode.
I used a USB to TTL cable and followed the instructions to get into CFE mode. I rapidly pressed CTRL+C and no luck getting it to work. I've tried many different patterns of pressing it.
Putty is displaying everything properly and it just continues on to boot.
Is there something I missed? Any help would be appreciated. Thanks.
Posted: Fri Apr 20, 2018 18:50 Post subject: Re: Can't get into CFE mode
nick323 wrote:
I used a USB to TTL cable and followed the instructions to get into CFE mode. I rapidly pressed CTRL+C and no luck getting it to work. I've tried many different patterns of pressing it.
Putty is displaying everything properly and it just continues on to boot.
After it boots, can you press <enter> and get a prompt? If not, your Tx line isn't right. If so, are you doing ctrl-c simultaneous to powering on the R7000? You only have a second. _________________ #NAT/SFE/CTF: limited speed w/ DD#Repeater issues#DD-WRT info: FAQ, Builds, Types, Modes, Changes, Demo#
OPNsense x64 5050e ITX|DD: DIR-810L, 2*EA6900@1GHz, R6300v1, RT-N66U@663, WNDR4000@533, E1500@353,
WRT54G{Lv1.1,Sv6}@250|FreshTomato: F7D8302@532|OpenWRT: F9K1119v1, RT-ACRH13, R6220, WNDR3700v4
Serial and TFTP has always been a step 1 step 2 thing for me
and I consistently failed at step one till the introduction of the hub.. which is now step 0.5 for me
I never got the opportunity to fail at step 2 without the hub...because I could never made it that far
Don't get me wrong.. I'm in no way disagreeing with you
I guess my current success rate is due to experience? then? and not the hub
That said..nick323 keep doing the power on/keyboard button mash thing, you'll get it, and remember it's nvram erase while in CFE if you are wanting to erase nvram while in there _________________ Location 1
R7800- DD-WRT v3.0-r53562 (10/03/23) Gateway
WNDR3400v1 DD-WRT v3.0-r35531_mega-nv64k (03/26/18 ) Access Point
WRT160Nv3 DD-WRT ?v3?.0-r35531 mini (03/26/18 ) Access Point
WRT54GSv5 DD-WRT v24-r33555_micro_generic (10/20/17) Repeater
Location 2
R7800- DD-WRT v3.0-r51855 (02/25/23) Gateway
R6300v2- DD-WRT v3.0-r50671 (10-26-22) Access Point
WNDR3700v2 DD-WRT v3.0-r35531 std (03/26/18 ) Access Point
E1200 v2 DD-WRT v3.0-r35531 mega-nv64k (03/26/18 ) Gateway(for trivial reasons)
RBWAPG-5HACT2HND-BE RouterOS-v6.46.4 (2/21/20) Outdoor Access Point
2x RBSXTG-5HPACD RouterOS-v6.46.4 (2/21/20) PTP Bridge 866.6Mbps-1GbpsLAN
Location 3
2x R7000- DD-WRT v3.0-r50671 (10/26/22) Access Points
2x RBWAPG-60AD RouterOS-v6.45.9 (04/30/20) PTP Bridge 2.3Gbps-1GbpsLAN
2x RBSXTsqG-5acD RouterOS-v6.49.7 (10/14/22) PTP Bridge 866.6Mbps-1GbpsLAN Thank You BrainSlayer for ALL that you do & have done, also to "most" everyone here that shares their knowledge
CFE for Foxconn Router R7000 version: v1.0.21
Build Date: Wed Aug 7 19:11:17 CST 2013
Init Arena
Init Devs.
Boot up from NAND flash...
Bootcode Boot partition size = 524288(0x80000)
DDR Clock: 800 MHz
Info: DDR frequency set from clkfreq=1000,*800*
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.15.1 (r407936)
CPU type 0x0: 1000MHz
Tot mem: 262144 KBytes
nvram erase
Digital core power voltage set to 1.0V
Decompressing...done
CFE for Foxconn Router R7000 version: v1.0.21
Build Date: Wed Aug 7 19:11:17 CST 2013
Init Arena
Init Devs.
Boot up from NAND flash...
Bootcode Boot partition size = 524288(0x80000)
DDR Clock: 400 MHz
Info: DDR frequency set from clkfreq=1000,*800*
Warning: invalid DDR setting of 800 MHz ignored. DDR frequency will be set to 400 MHz.
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.15.1 (r407936)
CPU type 0x0: 1000MHz
Tot mem: 262144 KBytes
Committing NVRAM...done
Waiting for reset button release...donDigital core power voltage set to 1.0V
Decompressing...done
Digital core power voltage set to 1.0V
I did have xwrt-vortex 384.x loaded before and realized what had happened.
boochi99 was kind enough to email me a backup copy of the stock CFE file since we share the same version/model.
My bootloader isn't corrupted other than the nvram erase line of code that I need to get rid of.
I just want to restore the stock CFE file and everything will be back to normal.
Well that's making more sense.....but then it doesn't
You restore your CFE through SSHd or telnet
I'm not telling you to do this for obvious reasons but
you need to place your good CFE file in DD-WRT's /tmp directory (I believe edited with your mac addresses, with a hex editor)
Again not telling you to do this...
in SSHd or telnet
Code:
mtd unlock cfe press enter
mtd write -f /tmp/cfe_new.bin cfe press enter
Hopefully someone with more knowledge will comment but I believe your "nvram erase" is coming from within your CFE..
Telling me that you have not applied it yet
You being more up front with your info/situation would only be more helpful to you _________________ Location 1
R7800- DD-WRT v3.0-r53562 (10/03/23) Gateway
WNDR3400v1 DD-WRT v3.0-r35531_mega-nv64k (03/26/18 ) Access Point
WRT160Nv3 DD-WRT ?v3?.0-r35531 mini (03/26/18 ) Access Point
WRT54GSv5 DD-WRT v24-r33555_micro_generic (10/20/17) Repeater
Location 2
R7800- DD-WRT v3.0-r51855 (02/25/23) Gateway
R6300v2- DD-WRT v3.0-r50671 (10-26-22) Access Point
WNDR3700v2 DD-WRT v3.0-r35531 std (03/26/18 ) Access Point
E1200 v2 DD-WRT v3.0-r35531 mega-nv64k (03/26/18 ) Gateway(for trivial reasons)
RBWAPG-5HACT2HND-BE RouterOS-v6.46.4 (2/21/20) Outdoor Access Point
2x RBSXTG-5HPACD RouterOS-v6.46.4 (2/21/20) PTP Bridge 866.6Mbps-1GbpsLAN
Location 3
2x R7000- DD-WRT v3.0-r50671 (10/26/22) Access Points
2x RBWAPG-60AD RouterOS-v6.45.9 (04/30/20) PTP Bridge 2.3Gbps-1GbpsLAN
2x RBSXTsqG-5acD RouterOS-v6.49.7 (10/14/22) PTP Bridge 866.6Mbps-1GbpsLAN Thank You BrainSlayer for ALL that you do & have done, also to "most" everyone here that shares their knowledge
Last edited by Dr_K on Sat Apr 21, 2018 3:43; edited 1 time in total
I used telnet and I entered these commands one at a time. The CFE is in the mtd0 folder.
1. mtd unlock mtd0
2. mtd write -f /tmp/stock-cfe.bin mtd0
3. erase nvram
4. reboot
Thanks again boochi99. Thumbs up for you!
I was missing the last piece to your step 2 (mtd0).
My R7000 is working without it erasing the NVRAM each time I reboot.