Joined: 12 Jun 2007 Posts: 32 Location: Aachen, Germany
Posted: Tue Sep 25, 2018 20:32 Post subject: Tutorial: Debrick of an E2000 (converted WRT320N)
i've got an rather old WRT320n which was successfully converted to an E2000. See this threat by buddee. Thx dude.
After some time i thought about what a great idea to update to a more current dd-wrt version and bang chose the wrong image to flash. The unit ended up bricked...
Now i went through some threats, digging all info's together to might get the unit back an dfound others with similar problems failing to revive their units. So this is for you.
I recommend to read the full tutorial and prepare yourself before taking first actions.
This tutorial is mainly relying on the outstanding Serial Recovery Wiki. It is a good idea to start there.
What i needed:
- Notebook LAN Adapter set to a fix IP Adress of 192.168.1.2, Netmask 255.255.255.0, Gateway 192.168.1.1
- LAN Port speed to 10 Mbit halfduplex
- firewall off
- LAN cable directly connected to one of the E2000 lan port
- USB to TTL converter 3,3V / 5 V and jump wires. I used this
- USB-to-TTL converter connected to the serial interface of the E2000
- putty (serial interface software)
- tftp2.exe(win10) or tftp systemtool(win7). Use this
- Stock Firmware (Linksys/Cisco/Belkin) for E2000 Model. I used this
- DD-WRT Firmware of your choice. Make shure to have an e2000 trailed image. e.g. dd-wrt.v24-24461_NEWD-2_K2.6_mini-e2000.bin (smaller 4MB for inital flash, bigger once didn't work).
The unit has 2 serial interfaces available. One is accessable from the outside, beneath inside the wan port. Here you will find further information on how to connect to it and the signal layout.
The other serial port is inside the unit. I decided to use this one. Here you can find the pinout @ buddee's post. I soldered some 90° pinheader to it and connected the jumpwires according to the signal scheme to the usb-to-ttl adapter breakout.
You have to wire
txd (adaptor) to rxd (router) and
rxd (adaptor) to txd (router).
I did not connect the 3.3V supply, just ground (gnd) was enough.
In any case make sure to set the adapter to 3.3V operation otherwise you burn the router serial interface
Now make sure the the system driver for the usb-to-ttl adapter is installed (Windows machine).
Configure the serial interface according the following settings:
Within putty, configure the correct com port. You will find the number within the device manager of windows and start a serial connection.
Start tftp2.exe and enter the router's default ip which is supposed to be 192.168.1.1 at the server field.
Password keeps empty.
Point to the stock firmware file downloaded before (Cisco/Linksys/Belkin). Don't care about having it as US-version. I couldn't find a country specific, so i used the mentioned above one successfully.
Now in the putty session keep crtl+c constantly be pushed while powering up the router (I don't mean banging, just push and hold them down, you should notice the small blue led on the USB-to-TTL adapter flashing which indicates transmit signals to the serial side).
Now in the putty Session, you should see this prompted out:
CFE version 220.127.116.11 based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Fri Jul 9 18:33:07 CST 2010 (firstname.lastname@example.org)
Copyright (C) 2000-2008 Broadcom Corporation.
This is a Serial Flash
Boot partition size = 262144(0x40000)
Found a 8MB ST compatible serial flash
boot #00 00000000 -> 0003FFFF (262144)
trx #01 00040000 -> 0004001B (2
os #02 0004001C -> 007F0FFF (8064996)
nvram #03 007F1000 -> 007FFFFF (61440)
boot #00 00000000 -> 0003FFFF (262144)
trx #01 00040000 -> 007F0FFF (8065024)
nvram #02 007F1000 -> 007FFFFF (61440)
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 18.104.22.168
CPU type 0x19740: 354MHz
Tot mem: 32768 KBytes
if you get a error message right after starting the transfer like this:
CFE> flash -ctheader : flash1.trx
CMD: [flash -ctheader : flash1.trx]
Reading :: _tftpd_open(): retries=0/3
CODE Pattern is INCORRECT! (32XN) <---------- i meant this entry
*** command status = -1
you probably used the wrong firmware file (e.g. the dd-wrt one or you mistaken the stock firmware
and tried a wrt320n one... that was the case in my first attempts.
In case everything went smooth just enter
inside the putty session.
The router will now restart and load serveral things. You can follow up all on the putty session.
After the router finished loading things, you are good to try to reach the router via webbrowser http://192.168.1.1
In case you see the stock firmware interface, just login and now you can directly flash a propper dd-wrt image (remember, not bigger than 4MB).
I've verified this procedure 3 times on my rick. One addition is left. In one post i#ve saw it was mentioned to use this command
CFE> flash -noheader : flash1.trx
instead of the one mentioned before. This also works in this case, but for some reason you have to upload the stock firmware twice via tftp. After the first time when you enter
the unit falls back and tries contiuosly to draw the firmwarefile. If this is the case, just hit the upgrade button on tftp2 a second time. After the completed upload it will install the firmware as it should.
Some last words:
In the end, it is not that hard to do but be careful in case you are not so familiar with those things mentioned above.
Hope this helps.
Good luck! _________________ |2e4per