Netgear R6400v2 full recovery

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message
barroshelder
DD-WRT Novice


Joined: 10 Jul 2020
Posts: 3

PostPosted: Fri Jul 10, 2020 14:07    Post subject: Netgear R6400v2 full recovery Reply with quote
Hi community,

I have bought a cheap used Netgear R6400v2 with a bootloop problem. After powering it up, I have seen that someone has tried to flash the firmware for the R7000p, so what I have done was to open it up, connect to the serial console and try to recover it to the factory firmware.
By booting with active serial console, I have seen that the CFE was reporting a strange MAC (00:FF:FF:FF:FF:FF) for LAN.
After some research, I have found that all vital configurations (like MAC, default SSID, default WiFi password, serial number, etc.) from this router are not stored on CFE, but on the board_data partition (mtd4 on last factory firmware).
It seems that if we use DD-WRT or FreshTomato and try to create a JFFS partition using the full flash size, the board_data partition will be deleted and so all the vital configuration.
This configurations are still on NVRAM but will be deleted as soon as we do an erase nvram (an this is why it enters probably on a bootloop).
Using the burn* tools from the factory firmware I could restore almost everything to factory defaults (the problem seems to be the RF calibration of the board that will be lost and this is why I now get poor wireless coverage on both frequencies).
This were the steps I did to recover the faulty R6400v2 to factory defaults (if we use the burn* tools without any parameter, they will show the actual stored values of the board_data partition):

Code:
# burnethermac [MAC address from the router label]
# burnsku 0x0002 (will change wireless location to world wide with sku_name="WW")
# burnsn [Serial number from the router label] (recover admin password on factory firmware is not possible without correct serial number)
# burnboardid U12H332T20_NETGEARHDR0 (some R6400v2 are U12H332T30_NETGEARHDR0. Check white label on board near serial console connection)
# burnssid [SSID from router label]
# burnpass [Wireless password from router label]
# burn5gssid [SSID from router label plus "-5G" at the end]
# burn5gpass [Wireless password from router label]
# burnpin [8 digit PIN] (will be shown on webgui of the factory firmware: WDS PIN)
# burnrf (this will store the RF calibration from NVRAM. I have found the following values on another forum from someone that also lost all vital data, so I do not know if they are correct. The first parameter with 0x0 is suspect.):

     pci/1/1/rpcal2g=0x0
     pci/2/1/rpcal5gb0=0x3b16
     pci/2/1/rpcal5gb1=0x3f0e
     pci/2/1/rpcal5gb2=0x4516
     pci/2/1/rpcal5gb3=0x521e
     pci/1/1/rxgainerr2ga0=0x521e
     pci/1/1/rxgainerr2ga1=0x521e
     pci/1/1/rxgainerr2ga2=0x521e
     pci/2/1/rxgainerr5ga0=2,0,0,2
     pci/2/1/rxgainerr5ga1=-6,0,0,-9
     pci/2/1/rxgainerr5ga2=-3,0,0,-4

All this values must be corrected with NVRAM SET command (ex. nvram set pci/1/1/rpcal2g=0x0) and stored at the end with burnrf command.

Here an example of the result of the burnrf command:

Write RF parameters...
pci/1/1/rpcal2g=0x0
pci/2/1/rpcal5gb0=0x3b16
pci/2/1/rpcal5gb1=0x3f0e
pci/2/1/rpcal5gb2=0x4516
pci/2/1/rpcal5gb3=0x521e
pci/1/1/rxgainerr2ga0=0x521e
pci/1/1/rxgainerr2ga1=0x521e
pci/1/1/rxgainerr2ga2=0x521e
pci/2/1/rxgainerr5ga0=2,0,0,2
pci/2/1/rxgainerr5ga1=-6,0,0,-9
pci/2/1/rxgainerr5ga2=-3,0,0,-4
burnrf OK!


It would be interesting if other owners of a working R6400v2 could post the RF calibration values to check if they change for every board. This could be done using the factory firmware (using telnet enabler for Netgear http://www.antinode.info/nte/index.html) or a 3rd party firmware like FreshTomato or DD-WRT.
This should be the correct commands to execute on telnet/ssh/serial console:

Code:
# nvram show | grep board
# nvram show | grep rpcal
# nvram show | grep rxgainerr


Just post your results so we can see if this RF calibration values are unique or the same for every board.

Hope this helps to fully unbrick the R6400v2 or even the R6700v3...

Thanks! Smile


Last edited by barroshelder on Fri Jul 10, 2020 14:58; edited 2 times in total
Sponsor
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 6408
Location: Netherlands

PostPosted: Fri Jul 10, 2020 14:32    Post subject: Reply with quote
Attached mtd4 maybe you can use it but I think the RF data are individual.

The R6400 DDWRT install and recovery: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
(but it appears you actually know all that stuff already Smile )

I think mtd1 has a lot of the data you mentioned and that mtd4 is specifically for the RF data but it has been a long time ago that I researched that



mtd4_boarddata.zip
 Description:

Download
 Filename:  mtd4_boarddata.zip
 Filesize:  1.03 KB
 Downloaded:  36 Time(s)


_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard Server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard Client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
barroshelder
DD-WRT Novice


Joined: 10 Jul 2020
Posts: 3

PostPosted: Fri Jul 10, 2020 14:42    Post subject: Reply with quote
Hi egc,

Thanks for the file, I will check it.
It would be better if we post the results of running the commands above so we can have "readable" values to compare (it also does not contain other data found on mtd4 like WiFi passwords, SSID, MAC, etc.)... Wink

Edit: This are the values found on your file:

Code:
Board_id: U12H332T30_NETGEAR
RF Values:
pci/1/1/rpcal2g=0x0
pci/2/1/rpcal5gb0=0x4916
pci/2/1/rpcal5gb1=0x4911
pci/2/1/rpcal5gb2=0x3a08
pci/2/1/rpcal5gb3=0x420d
pci/1/1/rxgainerr2ga0=0x420d
pci/1/1/rxgainerr2ga1=0x420d
pci/1/1/rxgainerr2ga2=0x420d
pci/2/1/rxgainerr5ga0=1,0,0,-1
pci/2/1/rxgainerr5ga1=-2,0,0,-4
pci/2/1/rxgainerr5ga2=5,0,0,0


Are this values from original backup or after unbricking or flashing 3rd party firmware?
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 6408
Location: Netherlands

PostPosted: Fri Jul 10, 2020 14:58    Post subject: Reply with quote
Original data
_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard Server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard Client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
barroshelder
DD-WRT Novice


Joined: 10 Jul 2020
Posts: 3

PostPosted: Fri Jul 10, 2020 15:01    Post subject: Reply with quote
egc wrote:
Original data


Thanks, would be nice to have more samples to check.
Did anyone know how a RF calibration works?

I have found a document that explains this parameters (attached), but I do not know how to use them. Any expert here? Rolling Eyes Laughing

Code:
Example:
rpcal2g = Defines 2G Edge channel power compensation (CH12/CH3/CH2/CH1) qdBm unit; 2’s compliment
• B[15:12]: Ch-12 offset
• B[11:8]: Ch-3
• B[7:4]: Ch-2
• B[3:0]: Ch-1 offset



002-14783_AN214783_OTP_Programming_and_NVRAM_Development_in_SDIO_Mode.pdf
 Description:

Download
 Filename:  002-14783_AN214783_OTP_Programming_and_NVRAM_Development_in_SDIO_Mode.pdf
 Filesize:  401.21 KB
 Downloaded:  39 Time(s)

Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum