Joined: 31 Aug 2009 Posts: 2448 Location: Third Rock from the Sun
Posted: Thu May 27, 2010 2:16 Post subject: WNDR3300 Brick - Will not take tftp flash [SOLVED!!]
OK, let me start of by saying I bought this router bricked, so I don't know the real history of what bricked it. I was told that the router went back and forth between OpenWRT & dd-wrt. It bricked when dd-wrt was being upgraded. So I was told.
I have acheived serial communication with the CFE. The mac address' are almost all F's and some of the default nvram settings for the CFE are not the same as my known good working WNDR3300.
CFE> go
Invalid image length: 0xffffffff
Invalid boot block on disk
Start TFTP server
Reading ::
At this point it is waiting for a file to flash from TFTP. But it's a never ending cycle.
It will always take the flash but come back and want another. I think the special partition or the cfe might be screwed up. I am just trying to find out what all I can exactly do at the cfe prompt. As I look at the situation, I think i might be a pioneer at this point.
Any insight or suggestion welcome, with the exception of giving up _________________ Peacock Thread-FAQ -- dd-wrt Wiki
Joined: 26 Jan 2008 Posts: 13049 Location: Behind The Reset Button
Posted: Thu May 27, 2010 2:46 Post subject:
if flashing the stock firmware.. don't use -noheader.. ya big nut..
use -ctheader.. the header has the info to put the data in the right spot!
I have read that -noheader could foul things up in the right (or wrong) circumstance. Never used it except way back when when we all helped de-brick a 600.
I've never hooked up serial to my 3300 but some netgears have an extra partition containing device specific data (macs). The wnr834b will rebuild the partition.. dunno about the 3300 if it does have the extra partition.
btw... what happened to you? your router crash? _________________ [Moderator Deleted]
Joined: 31 Aug 2009 Posts: 2448 Location: Third Rock from the Sun
Posted: Thu May 27, 2010 3:19 Post subject:
barryware wrote:
if flashing the stock firmware.. don't use -noheader.. ya big nut..
use -ctheader.. the header has the info to put the data in the right spot!
Only options available
Code:
OPTIONS
-noerase Don't erase flash before writing
-offset=* Begin programming at this offset in the flash device
-size=* Size of source device when programming from flash to flash
-noheader Override header verification, flash binary without checking
-writechksum Write image checksum to the end of partition
-mem Use memory as source instead of a device
barryware wrote:
btw... what happened to you? your router crash?
Nope HDD kicked the bucket, had a stick of ram give out on me last night _________________ Peacock Thread-FAQ -- dd-wrt Wiki
Yep, your boarddata partition is erased. Usually it takes JTAG to flash it back - but there is no jtag on this router.
Maybe play with this: (replace mac address with your MAC).
1. setenv BOARD_ID U12H093T00_NETGEAR
2. Please find out the MAC address of your board. It should be written on the backside cover of that board. I have assumed it as 001122334455.
3. ifconfig eth0 -hwaddr=00:11:22:33:44:44 -addr=192.168.1.1
4. start tftpd at CFE
5. upload original wndr3300 firmware.
6. Boot the board.
7. After login execute these commands into shell
burnethermac 001122334455
burnboardid U12H093T00_NETGEAR
bunsn . Again you will find this serial number onto the backside cover of the board.
Reboot the board.
CFE> ^C
CFE> setenv BOARD_ID U12H093T00_NETGEAR
*** command status = 0
CFE> ifconfig eth0 -hwaddr=001122334455 -addr=192.168.1.1
Device eth0: hwaddr 00-11-22-33-44-55, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
*** command status = 0
CFE> tftpd
Start TFTP server
Reading :: Done. 3080286 bytes read
After that, do nothing!!!! It is needing the programming part.
Joined: 31 Aug 2009 Posts: 2448 Location: Third Rock from the Sun
Posted: Thu May 27, 2010 10:38 Post subject:
Sounds like a plan Eko, just a couple of details though.
There are 2 mac address' on the back of the WNDR3300's, labeled MAC 1 and MAC 2. I am assuming I will use MAC 1 since that is what is used on my working unit.
The spot for the serial number is blank on both my units, I have not purchaced one brand new so I cannot confirm this, but there is a sticker on the PCB on the left side of the below pic. Could somebody confirm this or part of this is the serial number?
Joined: 06 Feb 2010 Posts: 7401 Location: Little Rock
Posted: Thu May 27, 2010 11:06 Post subject:
From what i have come to know about this unit, The 2 MAC's are for the 2 radios wl0 and wl1, wl0 being the main.
Far as the sticker goes i actually emailed netgear asking the same thing, they have chosen not to reply so im gonna do some more research on it, will let you know if i find something worth while about it. _________________ Wireless N Config | Linking Routers | DD-WRT Wiki | DD-WRT Builds | Peacock - Broadcom FAQ
Joined: 31 Aug 2009 Posts: 2448 Location: Third Rock from the Sun
Posted: Thu May 27, 2010 14:26 Post subject:
It looks like I can use the save command to tftp the cfe.bin onto the router, but after that I dunno where to flash it to or how. CFE doesn't recognize MTD commands _________________ Peacock Thread-FAQ -- dd-wrt Wiki
I have acheived serial communication with the CFE. The mac address' are almost all F's and some of the default nvram settings for the CFE are not the same as my known good working WNDR3300.
A useful command in most CFE's, also in your WNDR3300:
Save a region of memory to a remote file via TFTP
save [-options] host:filename startaddr length
There are no options implemented, so that makes it easier
CFE> save host:file_name 80000000 1000
4096 bytes written to host:filename
*** command status = 0
to get the whole flash of your working WNDR3300 you would use:
CFE> save host:file_name 1fc00000 400000
and then you can use the board data partition from that one.
host is the ip address of the computer where you have a tftp server running. _________________ Kernel panic: Aiee, killing interrupt handler!
Last edited by LOM on Thu May 27, 2010 15:37; edited 1 time in total
