TEW-828DRU TFTP Firmware - Boot Recovery

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Author Message
penguinpages
DD-WRT Novice


Joined: 02 Feb 2018
Posts: 19

PostPosted: Tue Aug 06, 2019 16:59    Post subject: TEW-828DRU TFTP Firmware - Boot Recovery Reply with quote
I think this is somewhat linked to this thread https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=288702&highlight=828dru

Device: Trendnet TEW-828DRU v1.0 (I also have 1.1 doing same)

Both devices were new out of box. I have a third router I have not touched to avoid family wanting to kill me. I need more functions then the Trendnet firmware offers.. hense DDWRT.

I used GUI (per support ticket with Trend) to upgrade to:trendnet-828dru-webflash.bin (unpacked from dd-wrtfw_tew-828dru_v1(v3-r27490).zip )

Both routers did / are doing same thing.. so both are in same fubar state...

Boot up from factory.. login as admin. Skip wizard setup. Go to firmware and select to upload firmware: and it downloads successfully.

Reboot.. no device responds. I change my laptop to 192.168.10.44 and ping 192.168.10.1 (What DDWRT should come up as) and it pings about six times... then goes offline.

Wifi shows as ddwr in Wireless broadcast.. so I don't think it is dead.. just.. not booting correct.

I then do firmware recovery where I do a hard reboot.. and as soon as first ping happens from a shell push tftp file to the router:

PS C:\temp> TFTP.EXE -i 192.168.10.1 put .\trendnet-828dru-webflash.bin

File put successful

And when I do this.. if I am quick I even get a small HTML page for firmware upload.. but about 10 seconds after put completes.. IP stops responding.

I gave it 20 min no touch. Reboot. 30:30:30 all end in same.. I get 4-6 pings.. then goes back offline.

My guess, based on UI for that one brief time.. is it has some kind of low level DD-WRT firmware recovery mode, then attempts to boot... and drops off into la-la land.

Ideas on recovery. I have done this now to three routers. Trend replaced one under warranty but I can't ask them to do this on firmware outside their support.

Maybe if someone can explain / point me to forum entry of this lower level firmware POST cycle I can do a bit better debug.

PS: I did get it to work one time... programmed DDRRT router all up but VLAN and tagging was a bit obtuse so I did it wrong and wanted to start over..... hense the first fubar router.
Sponsor
penguinpages
DD-WRT Novice


Joined: 02 Feb 2018
Posts: 19

PostPosted: Wed Aug 07, 2019 14:24    Post subject: Reply with quote
Thanks for bumping to Brodcom SoC sub forum. I did a bit of googling and found:
https://www.smallnetbuilder.com/wireless/wireless-reviews/32719-trendnet-tew828dru-ac3200-tri-band-wireless-reviewed

BCM4709A CPU
128MB NVRAM flash


Firmware I should use trendnet-828dru-webflash.bin was correct 14MB size for 128MB target space:
ftp://ftp.dd-wrt.com/betas/2019/08-06-2019-r40559/trendnet-828DRU/

I read peacock posting again to see if I missed a step.

So current nvflash recovery boot it is in.. needs a recovery cycle (I believe) of:
1) tftp file to router when it reboots after 30:30:30
2) wait 5 min after successful transfer noted
3) pull power after transfer
4) boot up.. wait five min then 30:30:30

Any other thoughts on this>
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 14125
Location: Texas, USA

PostPosted: Wed Aug 07, 2019 14:28    Post subject: Reply with quote
You don't 30-30-30 a Broadcom ARM router.
penguinpages
DD-WRT Novice


Joined: 02 Feb 2018
Posts: 19

PostPosted: Wed Aug 07, 2019 17:26    Post subject: Reply with quote
I followed the following sequence:


##
PS C:\WINDOWS\system32> arp -a
Interface: 192.168.10.50 --- 0xf
Internet Address Physical Address Type
192.168.10.255 ff-ff-ff-ff-ff-ff static
224.0.0.2 01-00-5e-00-00-02 static
224.0.0.22 01-00-5e-00-00-16 static
224.0.0.251 01-00-5e-00-00-fb static
224.0.0.252 01-00-5e-00-00-fc static
239.255.255.250 01-00-5e-7f-ff-fa static

PS C:\temp> dir
Directory: C:\temp


Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/7/2019 10:17 AM 14589972 trendnet-828dru-webflash.bin

<< Power cycle router wait 10 seconds till first ping responded>>
PS C:\temp> TFTP.EXE -i 192.168.10.1 put .\trendnet-828dru-webflash.bin
Transfer successful: 14589972 bytes in 21 second(s), 694760 bytes/s
PS C:\temp>
PS C:\temp> date

Wednesday, August 7, 2019 12:46:11 PM


PS C:\temp> date

Wednesday, August 7, 2019 12:55:39 PM
PS C:\temp>

<<< Power cycle system >>>

After 20 min no response.

I apologize if this is a simple task of steps documented and well known. But new to me. I have searched forum, tried to find similar threads and process. My initial guess is it is in some low level boot mode, gets this OS image file, but the file is not correct for this hardware, or some aspect of it does not allow it to bootstrap it.

Without serial port, kind of hard to debug more with the knoweledge I have of these systems.

RTFM is ok.. just point me to the FM Smile
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 14125
Location: Texas, USA

PostPosted: Wed Aug 07, 2019 20:16    Post subject: Reply with quote
Google "serial recovery dd-wrt", "tftp flash dd-wrt" "recover from bad flash dd-wrt" .... you should find the wiki pages.
penguinpages
DD-WRT Novice


Joined: 02 Feb 2018
Posts: 19

PostPosted: Thu Aug 08, 2019 11:47    Post subject: Reply with quote
I appreciate the response. I am sure it is something stupid I am overlooking but I did:...


"recover from bad flash dd-wrt" ->This thread is noted as depreciated in favor (in my case of not one of those older models) Peacock posting:
https://wiki.dd-wrt.com/wiki/index.php/Recover_from_a_bad_flash

Read Peacock posting (as noted) where it notes that:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=51486
1) The 3rd 30 is what does something but should only be used when nothing else helps. It does not work in the u-boot boot loader (atheros, ralink, marvell) only in Broadcom.
2) Many notes on other brands of router using same chip but none on TRENDNet. As such notes about ASUS, WRT55x ,etc.
3) I saw notes aout Brainslayer 24 vs 26. But my CPU is 4709 vs 4704. So I believe the code I am trying to flash with ftp://ftp.dd-wrt.com/betas/2019/08-06-2019-r40559/trendnet-828DRU/ is the correct build. I am hoping at a minimum somoene could confirm that.
4) My understanding is that post firmware flash. steps happen within router to do compilation, so don't touch for a while. VS other switches and routers I work with which have a base ROM file to bootstrap the OS file. AKA the RAMDisk of the OS is pre-compiled. I believe DD-WRT does post upload processing so that is why it needs time.


One other note is that TRENDNEt directly posts their own version of DD-WRT for this unit. dd-wrtfw_tew-828dru_v1(v3-r27490).zip DD-WRT v3.0 r27490 trendnet-828dru-webflash.bin

I have tried this but same result.. So my guess is that I have the router at some lower level boot rom recovery mode. That I need to feed it via tftp a more basic bootstrap OS.

The last helpful note was about serial access to the unit https://wiki.dd-wrt.com/wiki/index.php/Serial_Recovery
1) None of the current documentation covers the Trednet model. As such I assume they do not directly apply with said step by step instructions.
2) After opening board it does not look like any easy method for serial connection. Looks like it would take some fancy soldering to connect to chip also.

If their is some lower level bootstrap file I should be pushing by tftp method. Knowing that would at least let me hunt down that avenue.

Thanks for patience.



IMG_0354.jpg
 Description:
TEW-828DRU Hardware Version 1.0RB
 Filesize:  4.22 MB
 Viewed:  3695 Time(s)

IMG_0354.jpg


kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 14125
Location: Texas, USA

PostPosted: Thu Aug 08, 2019 14:52    Post subject: Reply with quote
I think this device uses uboot, so the TFTP flash method is probably the only way you're going to recover it. https://wiki.dd-wrt.com/wiki/index.php/Tftp_flash ... the rule of thumb I use is ping, power, put. Ping the router IP, apply power to the router, have tftp ready to go and hit put.
penguinpages
DD-WRT Novice


Joined: 02 Feb 2018
Posts: 19

PostPosted: Thu Aug 08, 2019 15:16    Post subject: Reply with quote
Thanks for post response.

I do have consistency with the pattern of tftp put.

I noted that the router after 30second reset push .. pings longer time (30 packets or so vs 5-Cool.

So not sure if that is clue of NV recovery booting cylce.

I have tested with sniffer that 192.168.10.1 is the only IP it is booting with, so note about 192.168.1.1 is either NA for this manufacturer or just some tidit left over from previous flash it kept the DDWRT router IP (manufacture default is 192.168.1.1)

I have tested .. and never had issue with tftp put of files(see screen shot of put success):

S C:\temp\dd-wrtfw_tew-828dru_v1(v3-r27490) (1)> TFTP.EXE -i 192.168.10.1 PUT .\trendnet-828dru-webflash.bin
Transfer successful: 14520340 bytes in 16 second(s), 907521 bytes/s
PS C:\temp\dd-wrtfw_tew-828dru_v1(v3-r27490) (1)>


Here are firmware images I have attempted to Use:
TEW-828DRU_v1.0.8.1.bin -> Trendnet posted version of DD-WRT
trendnet-828dru-webflash.bin -> Version I believe is the latest version for my router and correct one from DD-WRT image library

Their is an entire section about K24 vs K26 builds but not sure if they are applicable. I am glad to "try anything" at this point... I have two routers happily burning electrons with no purpose.

One thing that i did find in process. Wanted to see if current boot kernel was DD-DRT or the Trendnet version. I did 30 second reset and did get that web UI to show for about 3 seconds and got screen shot. Seems it is some kind of Trendnet CFE recovery mode. And GUI never is around long enough to browse and upload.. but TFTP put works fine.

https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=52043
Note about Brainslayer's build. URL is no longer active.. so I did not get to try that.. and don't want to shot gun this and make it worse.
BrainSlayer builds (14929):
ftp://ftp.dd-wrt.com/others/eko/BrainSlayer-V24-preSP2/2010/08-12-10-r14929/broadcom/



tftp_put_successful.png
 Description:
tfp put success. ping post upgrade on 192.168.1.1 or 192.168.10.1 fails. 20 min wait.. reboot. still no pings beyond 5 or so 192.168.10.1 which is the recovery attempt again.
 Filesize:  86.91 KB
 Viewed:  3681 Time(s)

tftp_put_successful.png



CFE-Trendnet Mode.png
 Description:
Trendnet CFE Miniweb server firmware boot
 Filesize:  6.49 KB
 Viewed:  3683 Time(s)

CFE-Trendnet Mode.png


kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 14125
Location: Texas, USA

PostPosted: Thu Aug 08, 2019 16:31    Post subject: Reply with quote
That link to the old eko build will not work, those builds have been removed. The mini CFE web server is used to do recovery with, if I am not mistaken. You could have flashed stock firmware back to the device with that and started conversion to dd-wrt over. The 192.168.10.1 address sounds familiar for some reason, but I would have to dig a little. Sometimes, the best recovery method is to flash back to stock and start over. IF this is a Broadcom (ARM) Northstar unit, then the past few builds have been bad and bricking them / sending them into a bootloop depending on how it's configured. FWIW, I don't think that unit was even supported in 14929:

https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2010/08-12-10-r14929/

From the supported devices wiki, the minimum build info is listed:

https://wiki.dd-wrt.com/wiki/index.php/Supported_Devices#TRENDnet

https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2015/06-16-2015-r27332/trendnet-828DRU/
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum