[SOLVED] Need help debricking my RT-N66U

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Goto page Previous  1, 2
Author Message
W1SS
DD-WRT Novice


Joined: 11 Nov 2012
Posts: 13

PostPosted: Sat Mar 09, 2013 5:28    Post subject: RT-N66U - Bad CFE / Flash Recovery Reply with quote
I'm back! Thanks to all those that have been patient while I dealt with a family emergency.

Recovery Method (RTN66U with 3 steady lights or bad CFE flash).

You will require the following before attempting this recovery (when in doubt, search the forums) :

1. Patience

2. Original CFE (If you remembered to backup it up before flashing) or an edited CFE of another RT-N66U firmware with your MAC ids and place it in your zjtag folder ie. CFE.BIN

3. TUMPA Board with device software (USB) installed - IMP: Verify that TTL-OUT is selected/enabled on the board and do not connect the board to the router with RS232-OUT enabled as you may cause damage to the board and/or router (see TUMPA PDF Manual)

4. 'Proper' soldering of JTAG J2 Pinouts (verify with ohm/voltmeter) including pinout diagram for Serial/Parallel connections and connecting wires should be no more than 45cm (for J2)

5. Windows XP/7 x86 - may work on x64

6. Latest version of zjtag - I remember also using tjtag/brjtag/xjtag at some point but we will try to first recover with zjtag (I believe the later progs were used for analysis)

7. Network cable with the static ip 192.168.1.10 set on your local network adapter

8. ASUS CFE Recovery software (preferred) or CFE recovery page available at 192.168.1.1

9. Latest merlin or asus firmware (if you are restoring a 32k CFE then stick with a 32k firmware and the same applies to 64k CFEs)

10. Latest CFE conversion script (if you wish to attempt to convert the CFE to 64k again)

My Logic & Method

Current jtag software zjtag, tjtag, brjtag do not properly support the flash type SPANSION S29GL256P (missing device id / improper CPU detection / initialization) or CPU type BROADCOM BCM4706 and after analysing the source code of brjtag and zjtag and going over the technical documentation of the spansion chip, I understood how flash / CPU chip support was built into the software and was able to identify a hack that would allow us to use zjtag with the nearest supported spansion flash chip type and unsupported CPU through a 2-step initialization process using the /noreset switch to maintain the active status of the first initialization (CPU) while carrying out a second initialization to activate the spansion chip and make it ready for command processing.

This was not easy as I had to first identify the actual instruction length that made our CPU tick and after attempting over 300 possible combinations of instrlen and divider values, I was able to initialize the CPU using:

Code:
 zjtag -probeonly /cable:0 /instrlen:27 /L1:3 /noreset


Now that I had an initialized CPU, I then focused my efforts on initializing the spansion chip and was able do so by executing the following command to delete the CFE:

Code:
 zjtag -erase:cfe /skipdetect /cable:0 /instrlen:5 /L1:3 /fc:116 /noreset /verbose


After deleting the CFE, I then proceeded to flash the original CFE I had backed up from an earlier attempt at converting it to 64k:

Code:
 zjtag -flash:cfe /skipdetect /cable:0 /instrlen:5 /L1:3 /fc:116 /noreset /verbose


Now that I have flashed the CFE, I connected my network cable to the router and windows box/vm and then proceeded to manually powering off the router, disconnecting the power cable and pressing the power button to the on position (I saw a quick 3-light flash/blimp) followed by pressing the power button again to the off position.

I then connected the power cable and powered on. The router booted to CFE with a quick all light flash followed by a slowly glowing power led light which is an indicator that the router is now ready to accept new firmware. I proceeded with restoring the firmware and carried out a final reboot.

I was able to verify that the CFE was booting and the firmware flash was executed properly via the Serial connection.

Follow these instructions and your RT-N66U will be resurrected Very Happy
Sponsor
socal87
DD-WRT Guru


Joined: 30 Jun 2009
Posts: 944
Location: Here

PostPosted: Sun Mar 10, 2013 20:27    Post subject: Reply with quote
Okay, I got the CPU to initialize using zjtag 0.6, and /instrlen:27 and /l1:3 as directed. However, when I try to erase the CFE using /instrlen:5 and /l1:3, I get
stuck at
Code:

Halting Processor ... <Processor Entered Debug Mode!> ...


I can continue if I don't use the /L1:3 divider and instead run at 30MHz but I get error on write.

Zjtag 1.0 does not see the CPU at all using /L1:3. Without /L divider, it responds. Erase and flash don't work, though.

_________________
Click here for Eko beta
Click here for Brainslayer beta

>>>PEACOCK THREAD!<<<

I do NOT offer personal assistance.
Please do not PM me for help.

socal87
DD-WRT Guru


Joined: 30 Jun 2009
Posts: 944
Location: Here

PostPosted: Mon Mar 11, 2013 4:09    Post subject: Reply with quote
Here's what I'm getting:

Code:
zjtag -probeonly /cable:0 /instrlen:27 /L1
:3 /noreset

        ==============================================
               zJTAG EJTAG Debrick Utility v1.0
        ==============================================

cableid=0, cabletype=0

 Set I/O speed to 7500 KHz

USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!

Probing bus ... Done

Detected IR chain Length is 0

Instruction Length set to 27

CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** Unknown or NO CPU Chip ID Detected ***

*** Possible Causes:
    1) Router/Modem is not Connected.
    2) Router/Modem is not Powered On.
    3) Improper JTAG Cable.
    4) Unrecognized CPU Chip ID.


Code:
zjtag -probeonly /cable:0 /instrlen:27 /L1:0 /noreset /skipdetect

        ==============================================
               zJTAG EJTAG Debrick Utility v1.0
        ==============================================

cableid=0, cabletype=0

 Set I/O speed to 30000 KHz

USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!

Probing bus ... Done

Detected IR chain Length is 1

Instruction Length set to 27

CPU assumed running under LITTLE endian

CPU Chip ID: 11011011011101001011001111101000 (DB74B3E8)
*** CHIP DETECTION OVERRIDDEN ***

    - EJTAG IMPCODE ....... : 00000000000000000000000000000000 (00000000)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... DMA Write(x4) Addr = b8000080  Data = ERROR ON WRITE
Done
Loading CPU Configuration Code ... Skipped

Probing Flash at Address: 0x1FC00000 ...
DMA Write(x2) Addr = 1fc0aaaa  Data = ERROR ON WRITE
Detected Chip ID (VenID:DevID = 0000 : FFFF)
DMA Write(x2) Addr = 1fc00000  Data = ERROR ON WRITE
DMA Write(x2) Addr = 1fc00000  Data = ERROR ON WRITE
DMA Write(x2) Addr = 1fc00000  Data = ERROR ON WRITE
DMA Write(x2) Addr = 1fc0aaaa  Data = ERROR ON WRITE
DMA Write(x2) Addr = 1fc0aaaa  Data = ERROR ON WRITE
*** Unknown or NO Flash Chip Detected ***


 *** REQUESTED OPERATION IS COMPLETE ***


And so on.

_________________
Click here for Eko beta
Click here for Brainslayer beta

>>>PEACOCK THREAD!<<<

I do NOT offer personal assistance.
Please do not PM me for help.

VirtualEnder
DD-WRT Novice


Joined: 17 May 2013
Posts: 7

PostPosted: Sun Sep 08, 2013 3:18    Post subject: JTag or another way? Reply with quote
So I got a new RT-N66U today, and pulled it out and loaded up dd-wrt right away without looking to deeply at the forums. Turns out I should have read a bit more and I flashed the wrong version. Bricked my router right out of the gate.

So here is where I am right now. I have serial access to the router and can log in to dd-wrt locally. I get lights coming on when I plug in network cables, but not connectivity. From the CFE prompt it says there are no network devices. It shows a network device when I first boot into dd-wrt, but then it seems to disappear when they are initialized. I tried moving a CFE patch script to an SD card, but the SD card doesn't mount. I even tried an old ZModem style file transfer over serial as a last ditch effort, but no joy. I guess there is still the option of making the changes to the CFE manually, but I haven't found a good understanding yet as to exactly what I need to do.

As compared to the JTAG method, which would be more trouble? I don't have any JTAG hardware, but I can snag some this coming weekend if I have to. I'd REALLY like a way to fix this from the serial console if at all possible. If anyone can point me in the right direction, that would be awesome.
VirtualEnder
DD-WRT Novice


Joined: 17 May 2013
Posts: 7

PostPosted: Sun Sep 08, 2013 17:06    Post subject: which problem Reply with quote
Another thing I'm not sure about as I examine this is which problem I have, and how to identify it. I don't know if I have a 32k CFE and 64k dd-wrt image, or a 64k CFE and a 32k dd-wrt image. I initially installed the dd-wrt image straight from the dd-wrt router database when I bricked the router (dd-wrt.v24-18702_NEWD-2_K2.6_mini_RT-N66U.trx). I think that means I have a 64k CFE and a 32k dd-wrt, so the problem becomes, how do I modify dd-wrt to read the 64k nvram. Any suggestions would be helpful.
socal87
DD-WRT Guru


Joined: 30 Jun 2009
Posts: 944
Location: Here

PostPosted: Sun Sep 08, 2013 17:27    Post subject: Reply with quote
You probably bricked your router with an incorrect technique or build. See this:
http://www.dd-wrt.com/wiki/index.php/Asus_RT-N66U
Try clearing NVRAM and sending a fresh image over serial.


This thread was intended for those who bricked their routers trying to update the CFE to the newer 64k version.

_________________
Click here for Eko beta
Click here for Brainslayer beta

>>>PEACOCK THREAD!<<<

I do NOT offer personal assistance.
Please do not PM me for help.

VirtualEnder
DD-WRT Novice


Joined: 17 May 2013
Posts: 7

PostPosted: Sun Sep 08, 2013 18:03    Post subject: Thanks Reply with quote
Thanks for the pointer, can you point me in the direction of how to write a new image over serial? Looks like everything is TFTP and without the network ports active that is impossible. Looks like I might be stuck with JTAG repair after all, though from what I've read it would take weeks to flash a whole image over JTAG. I'm still hoping there is a way to repair this image, but I'm not finding much information out there on it. Thanks for your help.
Chance
DD-WRT Novice


Joined: 12 Jun 2006
Posts: 17

PostPosted: Sat May 24, 2014 16:40    Post subject: RT-N66U JTAG Reply with quote
Finally i was able to recover my RT-N66U, after trying to get support on several places on this issue, i've got a GREAT help at OpenOCD support/devs on this issue and they've done it real quick.

Important note:

http://openocd.zylin.com/#/c/2153/3/tcl/target/bcm4706.cfg,cm

Here's the patch:

http://openocd.zylin.com/#/c/2153/

These changes affect only config files, so it can be use precompiled 0.8.0 OpenOCD binaries with it.

A BIG THANK YOU for OpenOCD team Smile
xebbmw
DD-WRT Novice


Joined: 19 Jan 2008
Posts: 17

PostPosted: Fri Jun 13, 2014 2:06    Post subject: Re: RT-N66U JTAG Reply with quote
Chance wrote:
Finally i was able to recover my RT-N66U, after trying to get support on several places on this issue, i've got a GREAT help at OpenOCD support/devs on this issue and they've done it real quick.

Important note:

http://openocd.zylin.com/#/c/2153/3/tcl/target/bcm4706.cfg,cm

Here's the patch:

http://openocd.zylin.com/#/c/2153/

These changes affect only config files, so it can be use precompiled 0.8.0 OpenOCD binaries with it.

A BIG THANK YOU for OpenOCD team Smile


Would be interesting to know how you did it and what hardware you used. Could you describe the procedure in more details?

Thanks
Goto page Previous  1, 2 Display posts from previous:    Page 2 of 2
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum