WNDR3400 Pin short-how to

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Goto page Previous  1, 2, 3
Author Message
DD-WRT Novice

Joined: 24 Jan 2015
Posts: 2

PostPosted: Sun Jan 25, 2015 17:44    Post subject: Reply with quote
I'm an idiot. Disregard my statement about the wiki being wrong. I clicked the 2200++ link, went back a directory out of curiosity and didn't remember it having two "+"s, so I actually flashed 2200+ which does not work with this router (WNDR3400 v1.0).

Upgraded to 2200++ just fine.

Oh well, learned some awesome stuff and maybe help some other idiot like me. haha.
DD-WRT Novice

Joined: 04 Feb 2015
Posts: 10

PostPosted: Wed Feb 11, 2015 3:25    Post subject: WAHOO! Reply with quote
dubbat wrote:
First of all, I would like to give a BIG THANK YOU to the original poster. Saved from bad flash of 2200+ DLNA (big?) (wiki says it's recommended.. heh, not so http://www.dd-wrt.com/wiki/index.php/Netgear_WNDR3400 filename: usb-ftp-samba3-dlna-nv64k-broadcom.bin )

Now with THAT out of the way, I will tell you this is just preposterous how difficult it was. The guide is by no means complete (I will attempt to clear things up, but I might even fail). Maybe this will save someone else 2 hours of fiddling...

Here is how I did it:

(First the symptoms: solid power light of unknown color since I'm color blind, flashing LAN light when connected. NOTHING else)

Crack it open (duh).
Connect to LAN port (not the yellow)
Set PC to and gateway/dns to
ping -t (absolutely useless for now, but later it's helpful)
open tftp2 and select the .chk file mentioned in first post.
get your metal tool ready to short the pins in the pic (at the bottom if you can't read it as it's faint... look hard).
plug it in and as SOON as you see the blue wifi light come up, hold the tool against the pins (about 10 seconds or so to be sure).
The power light should start flashing and your cmd/ping window should start showing steady TTL=100's (if it's not obvious, you can stop shorting the pins now)
If the power light does not start flashing, push the power button in (toggle off) then press it again (toggle on) and try again (vary your timing... I got it to work numerous times after the blue wifi light went off as well).
Also, don't short the pins too fast or before powering on or it will hang with all the LAN lights lit up (you will need to power cycle it again).

The cmd/ping thing is useless at this stage (besides when you enter the flash mode successfully, but you can see the power light flashing anyways) as you are likely going to get a 10s delayed "ping timeout" (you might can set the timeout to 2ms or something, but not much point). So, waiting for a successful ping is timing/luck and too cumbersome.

As soon as the power light is flashing, you can stop shorting the pins and hit the "upgrade" button in tftp2 and it should fill the progress bar and say success (hopefully).


Watch your cmd/ping window. Eventually those TTL=100's should turn into ping timeouts.
Seriously.... wait. (roughly 80s, according to my 8 ping timeouts)
cmd/ping should eventually come back with 1-2 TTL=100's (if you are lucky, as mentioned).
Then more ping timeouts
WAIT AGAIN (roughly 40s according to my 4 ping timeouts)
You should start getting TTL=64's and wifi should come back up (according to light) and you can confirm by going to


You have a VERY small window to short the pins. It's EXACTLY when those ping responses come up. Seriously, it's much easier to just GUESS and short them shortly after the wifi LED shows up and just hold it there a few seconds. If you fail, just try try again.

Another thing is the guide says to just reboot. I flashed my router about 10 times successfully and it never came back up if I rebooted it manually afterwards. The flash may say success, but I firmly believe it is NOT done and you have to WAIT for it to reboot itself!

I'm a newb and maybe I am wrong, but this is how I got it to work and it was the ONLY way I got it to work. Maybe someone else will need this info or try something similar if my method doesn't work for them, nor the first post.

Here is an observation after even more fiddling (can't get enough): is the default recovery IP it tries to listen on. It becomes active every boot whether bricked or not and pings return TTL=100's. In order to boot into recovery via the pin shorting method, you seem to have to be making contact at the END of when it's responding. In essence, keep contacting the pins until it stops responding. If it doesn't enter recovery/flash mode, you weren't making good contact or did it too late.

Another strange anomaly is now after successfully recovering and then (semi-)purposely bricking, it now responds to pings for a good 10 seconds or so (20 something ping responses?). It's extremely easy now to recover. My original problem (and the reason for this post) was because I was getting an EXTREMELY short window in order to short the pins (the ping timeouts made it seem like it wasn't even listening!). Literally less than 1s (approximately). For whatever reason, it no longer does that even though I bricked it the same way (AFAIK) several times.

I successfully upgraded to dd-wrt.v24-21061_NEWD-2_K2.6_mega-nv64k.bin
Don't use the Wiki. Use the router database http://www.dd-wrt.com/site/support/router-database
Using anything not in the database at your own risk, lest you enjoy cracking this case open with a rare bit and shorting pins.

Also, I had a strange issue where I could not login to the factory firmware after one recovery. admin/password was not accepted even after a forced recovery of oldest AND latest. Required 30/30/30 reset (or simply hold it in while powered until the power light shuts off or flashes depending on current firmware). Wait for it to power cycle (LAN lights will all light up and pings turn to TTL=64's) and you should be able to use the default login correctly.

WORKED PERFECT on Netgear WNDR3400 v1! THANKS dubbat Smile

You're right about just catching the blue light at the beginning. But wow, what great instructions to the point I'm waiting like you said and it sequences to the next thing you said. I was so excited I didn't see capslock and changed password to capitol letters.

deviouswun deserves my thanks too. WAHOO! I'm a believer! 30-30-30 between every step too just so everyone knows.
DD-WRT Novice

Joined: 02 Mar 2015
Posts: 20

PostPosted: Fri Mar 06, 2015 7:43    Post subject: Hats off to you Mr. Juan Reply with quote
Awesome post.
Saved me from a big headache, revived my WNDR3400 that got bricked due to a bad firmware.
DD-WRT Novice

Joined: 16 Sep 2015
Posts: 1

PostPosted: Wed Sep 16, 2015 20:53    Post subject: Reply with quote
Method worked.
Was getting a single ping off router before it refused connection.

As soon as the router noticed a connection I shorted the line and it started to flash the power light, it accepted firmware!
DD-WRT Novice

Joined: 30 Nov 2008
Posts: 5

PostPosted: Fri May 26, 2017 15:40    Post subject: Reply with quote
Had a WNDR3400 that was working fine with DD-WRT for well over a year, then appeared bricked and would settle to mainly a solid yellow power light with pinging intermittently. Was a bit hesitant about the pin shorting method based on warnings in this and other threads, but figured had little to lose and was too lazy to order a serial adapter that would likely sit unused for years later. Good news is I've done surgery like this before and it worked fine as well in this case.

Some notes:
* Just turning on the router and shorting after ping start didn't work for me after many tries, so I tried the method of power on, holding reset for 30sec, releasing reset, then the shorting worked right away after ping started.

* The stock NetGear firmware was still linked properly off http://www.dd-wrt.com/wiki/index.php/Netgear_WNDR3400, but had a heck of a time finding the initial mini .chk flash image since the DD-WRT FTP links for /others/eko have been pruned so the link to that image wasn't working. Ended-up finding it thru the router database links for the WNDR3400 and here's where it points to now: https://secure.dd-wrt.com/routerdb/de/download/Netgear/WNDR3400/-/dd-wrt.v24-21061_NEWD-2_K2.6_mini-WNDR3400.chk/4039
DD-WRT Novice

Joined: 26 Oct 2015
Posts: 22

PostPosted: Thu Jan 17, 2019 8:32    Post subject: Reply with quote
Surprisingly, the short pin method works.

I somehow bricked WNDR3400 the other day. Pinging only got 1x TTL response. TFTP program therefore cannot flash the unit.

I shorted the two pins at almost the same time when I could already predict when the one shot TTL would come out. Then continuous TTL responses appeared. The unit then revived after tftp flashed with dd-wrt mini.
Goto page Previous  1, 2, 3 Display posts from previous:    Page 3 of 3
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT


Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum