Tutorial: Debrick of an E2000 (converted WRT320N)

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Author Message
|2e4per
DD-WRT Novice


Joined: 12 Jun 2007
Posts: 32
Location: Aachen, Germany

PostPosted: Tue Sep 25, 2018 20:32    Post subject: Tutorial: Debrick of an E2000 (converted WRT320N) Reply with quote
Hello,

i've got an rather old WRT320n which was successfully converted to an E2000. See this threat by buddee. Thx dude.

After some time i thought about what a great idea to update to a more current dd-wrt version and bang chose the wrong image to flash. The unit ended up bricked... Crying or Very sad

Now i went through some threats, digging all info's together to might get the unit back an dfound others with similar problems failing to revive their units. So this is for you.

Arrow I recommend to read the full tutorial and prepare yourself before taking first actions. Exclamation

This tutorial is mainly relying on the outstanding Serial Recovery Wiki. It is a good idea to start there.

What i needed:

    - Notebook LAN Adapter set to a fix IP Adress of 192.168.1.2, Netmask 255.255.255.0, Gateway 192.168.1.1
    - LAN Port speed to 10 Mbit halfduplex
    - firewall off
    - LAN cable directly connected to one of the E2000 lan port
    - USB to TTL converter 3,3V / 5 V and jump wires. I used this
    - USB-to-TTL converter connected to the serial interface of the E2000
    - putty (serial interface software)
    - tftp2.exe(win10) or tftp systemtool(win7). Use this
    - Stock Firmware (Linksys/Cisco/Belkin) for E2000 Model. I used this
    - DD-WRT Firmware of your choice. Make shure to have an e2000 trailed image. e.g. dd-wrt.v24-24461_NEWD-2_K2.6_mini-e2000.bin (smaller 4MB Exclamation for inital flash, bigger once didn't work).


The unit has 2 serial interfaces available. One is accessable from the outside, beneath inside the wan port. Here you will find further information on how to connect to it and the signal layout.

The other serial port is inside the unit. I decided to use this one. Here you can find the pinout @ buddee's post. I soldered some 90° pinheader to it and connected the jumpwires according to the signal scheme to the usb-to-ttl adapter breakout.
You have to wire
txd (adaptor) to rxd (router) and
rxd (adaptor) to txd (router).
I did not connect the 3.3V supply, just ground (gnd) was enough.
Exclamation In any case make sure to set the adapter to 3.3V operation Exclamation otherwise you burn the router serial interface Exclamation

Now make sure the the system driver for the usb-to-ttl adapter is installed (Windows machine).
Configure the serial interface according the following settings:
Quote:

Baud: 115200
Data bits: 8
Stop Bits: 1
Parity: none
Flow control: None


Within putty, configure the correct com port. You will find the number within the device manager of windows and start a serial connection.

Start tftp2.exe and enter the router's default ip which is supposed to be 192.168.1.1 at the server field.
Password keeps empty.
Point to the stock firmware file downloaded before (Cisco/Linksys/Belkin). Don't care about having it as US-version. I couldn't find a country specific, so i used the mentioned above one successfully.

Now in the putty session keep crtl+c constantly be pushed while powering up the router (I don't mean banging, just push and hold them down, you should notice the small blue led on the USB-to-TTL adapter flashing which indicates transmit signals to the serial side).

Now in the putty Session, you should see this prompted out:

Quote:
CFE version 5.10.56.51 based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Fri Jul 9 18:33:07 CST 2010 (fpan@localhost.localdomain)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.

No DPN
This is a Serial Flash
Boot partition size = 262144(0x40000)
Found a 8MB ST compatible serial flash
Partition information:
boot #00 00000000 -> 0003FFFF (262144)
trx #01 00040000 -> 0004001B (2Cool
os #02 0004001C -> 007F0FFF (8064996)
nvram #03 007F1000 -> 007FFFFF (61440)
Partition information:
boot #00 00000000 -> 0003FFFF (262144)
trx #01 00040000 -> 007F0FFF (8065024)
nvram #02 007F1000 -> 007FFFFF (61440)
BCM47XX_GMAC_ID
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.51
CPU type 0x19740: 354MHz
Tot mem: 32768 KBytes

CFE mem: 0x80700000 - 0x807A1360 (660320)
Data: 0x80733440 - 0x80736700 (12992)
BSS: 0x80736700 - 0x8073B360 (19552)
Heap: 0x8073B360 - 0x8079F360 (409600)
Stack: 0x8079F360 - 0x807A1360 (8192)
Text: 0x80700000 - 0x80733438 (209976)

Boot version: v5.4
The boot is CFE
Nothing...

### CLKDIV= 0x80a082c, SFlashClkDiv=8 clkdivsf=2 ###
### Change it to 0x20a082c (2) ###
CMD: [ifconfig eth0 -addr=192.168.1.1 -mask=255.255.255.0]
Device eth0: hwaddr 68-7F-74-A6-8B-F2, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Automatic startup canceled via Ctrl-C / ESC
CFE> ^C
CFE> ^C
CFE> ^C
CFE>


good to go further.

The following steps must be carried out immediately.
On the putty session type
Quote:

CFE> flash -ctheader : flash1.trx


Push the ENTER-button and directly afterwards hit the upgrade button on tftp2.exe

if you were quick enough you should now see tftp2's progressbar moving forward.

After comleting you should see this within the putty session
Quote:

CFE> flash -ctheader : flash1.trx
CMD: [flash -ctheader : flash1.trx]
Reading :: _tftpd_open(): retries=0/3
_tftpd_open(): retries=1/3
_tftpd_open(): retries=2/3
Done. 5460992 bytes read
fname=flash1.trx
CODE Pattern is correct! (32XN) <---------- 1st goal
Programming...done. 5460960 bytes written
*** command status = 0 <---------- Yeah, done!
CFE>

if you get a error message right after starting the transfer like this:
Quote:
CFE> flash -ctheader : flash1.trx
CMD: [flash -ctheader : flash1.trx]
Reading :: _tftpd_open(): retries=0/3
_tftpd_open(): retries=1/3
CODE Pattern is INCORRECT! (32XN) <---------- i meant this entry
Failed.: Error
*** command status = -1

you probably used the wrong firmware file (e.g. the dd-wrt one or you mistaken the stock firmware
and tried a wrt320n one... that was the case in my first attempts.

In case everything went smooth just enter
Quote:
CFE> go
inside the putty session.

The router will now restart and load serveral things. You can follow up all on the putty session.
After the router finished loading things, you are good to try to reach the router via webbrowser http://192.168.1.1
In case you see the stock firmware interface, just login and now you can directly flash a propper dd-wrt image (remember, not bigger than 4MB).

Done.


I've verified this procedure 3 times on my rick. One addition is left. In one post i#ve saw it was mentioned to use this command
Quote:
CFE> flash -noheader : flash1.trx
instead of the one mentioned before. This also works in this case, but for some reason you have to upload the stock firmware twice via tftp. After the first time when you enter
Quote:
CFE> go
the unit falls back and tries contiuosly to draw the firmwarefile. If this is the case, just hit the upgrade button on tftp2 a second time. After the completed upload it will install the firmware as it should.


Some last words:
In the end, it is not that hard to do but be careful in case you are not so familiar with those things mentioned above.

Hope this helps.
Good luck!

_________________
|2e4per

all running site-to-site OpenVPN

4x WRT54GL v1.1 @ 14929
1x WRT320N chang'd to E2000 bricked -> debricked @ v3.0-r29519 mega
1x Archer C7 v2.0 @ v3.0-r29519 std
1x Archer C7 v4.0 @ v3.0-r35874 std
1x ASUS RT-AC68U H/W ver.E1 @ v3.0-r36070M kongac
2x Netgear R7000P @ v3.0-r36070M kongac


Last edited by |2e4per on Mon Oct 01, 2018 7:35; edited 3 times in total
Sponsor
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 10386
Location: Netherlands

PostPosted: Wed Sep 26, 2018 8:22    Post subject: Reply with quote
Thanks, I have exactly the same router, but still working at the moment, but I tinker a lot so might become handy one day
_________________
Routers:Netgear R7800, R7000, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
jwh7
DD-WRT Guru


Joined: 25 Oct 2013
Posts: 2666
Location: Indy

PostPosted: Thu Sep 27, 2018 15:08    Post subject: Re: Tutorial: Debrick of an E2000 Reply with quote
|2e4per wrote:
After some time i thought about what a great idea to update to a more current dd-wrt version and bang chose the wrong image to flash. The unit ended up bricked... Crying or Very sad

Now i went through some threats, digging all info's together to might get the unit back an dfound others with similar problems failing to revive their units. So this is for you.
Thanks; I've added a debrick section to the wiki, linked to this thread:
https://wiki.dd-wrt.com/wiki/index.php/Linksys_E2000#Debricking

_________________
# NAT/SFE/CTF: limited speed w/ DD # Repeater issues # DD-WRT info: FAQ, Builds, Types, Modes, Changes, Demo #
OPNsense x64 5050e ITX|DD: DIR-810L, 2*EA6900@1GHz, R6300v1, RT-N66U@663, WNDR4000@533, E1500@353,
WRT54G{Lv1.1,Sv6}@250
|FreshTomato: F7D8302@532|OpenWRT: F9K1119v1, RT-ACRH13, R6220, WNDR3700v4
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum