Advanced E3000 Debricking Questions

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message
marklg
DD-WRT Novice


Joined: 19 Oct 2017
Posts: 27

PostPosted: Sun Oct 27, 2019 0:47    Post subject: Advanced E3000 Debricking Questions Reply with quote
I have an E3000 bricked by a recent load. I've tried to debrick using TFTP and the procedure found in several places.

It boots and the power light is blinking, as well as the ethernet light for the port I am connected to. Pinging it results in responses for about 5 seconds and a few more ping responses in later bursts. If I start TFPP during the ping responses, it only gives a successful upload message if a small file was uploaded. If I upload a mega file, TFTP completes with no error but also no successful upload message. If an upload was done, ping responses continue with TTL=100.

In any case, waiting for at least an hour after an upload, the power light continues to blink. Ping responses usually continue, always with TTL=100, but sometimes eventually stop.

I've found postings describing how to short pins on the flash chip, but they are somewhat generic describing several different routers. There is a dot and two pins by the flash chip. Shorting those does not seem to make a difference. If only shorting pins on the flash works, I will solder some wires to them to make that easier and leave a button attached.
I guess there is JTAG also but that involves more effort.

Any suggestions are appreciated.

Luckily, I found another E3000 at a Hamfest and just flashed it and restored the settings I saved from the original one and had it up in a few minutes.

Regards,

Mark
Sponsor
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 7443
Location: Texas, USA

PostPosted: Sun Oct 27, 2019 1:51    Post subject: Reply with quote
It looks like the most likely solution if you can't get it to TFTP is probably serial recovery:



I've had the fun of trying to recover from a bad flash doing TFTP and it not working on an E4200. Luckily, it was already set up for serial and it wasn't an issue to recover it. BUT, TFTP is usually ping, power, put and you have to be pretty quick. Have you tried doing a 30-30-30 after?
marklg
DD-WRT Novice


Joined: 19 Oct 2017
Posts: 27

PostPosted: Sun Oct 27, 2019 3:08    Post subject: Reply with quote
kernel-panic69 wrote:
It looks like the most likely solution if you can't get it to TFTP is probably serial recovery:
<snip> BUT, TFTP is usually ping, power, put and you have to be pretty quick. Have you tried doing a 30-30-30 after?


It looks like the TFTP bootloader is loading, as I get ping responses for about 5 seconds. If I try to TFTP firmware, the ping responses continue, so something is different. But it does not appear to ever run the new firmware, whether or not the TFTP said programming was successful, times out with an error message or completes with no message.

I did try a 30-30-30 and no improvement.

Thanks for all the references, I think I have access to a 3.3V serial cable and I have a complete setup for SMT soldering, so I can work on that.

Regards,

Mark
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 7443
Location: Texas, USA

PostPosted: Sun Oct 27, 2019 3:39    Post subject: Reply with quote
The good thing about serial recovery I found when a recent alpha build bricked me into bootloop was I could flash a previous trailed build of DD-WRT without wiping nvram or reloading stock firmware first and it was good to go. Most likely you may have already reset it with the 30-30-30, but to be safe, follow the usual serial recovery / tftp method.

https://wiki.dd-wrt.com/wiki/index.php/Serial_Recovery

https://wiki.dd-wrt.com/wiki/index.php/Tftp_flash
marklg
DD-WRT Novice


Joined: 19 Oct 2017
Posts: 27

PostPosted: Fri Nov 01, 2019 18:30    Post subject: Reply with quote
kernel-panic69 wrote:
The good thing about serial recovery I found when a recent alpha build bricked me into bootloop was I could flash a previous trailed build of DD-WRT without wiping nvram or reloading stock firmware first and it was good to go. Most likely you may have already reset it with the 30-30-30, but to be safe, follow the usual serial recovery / tftp method.

https://wiki.dd-wrt.com/wiki/index.php/Serial_Recovery

https://wiki.dd-wrt.com/wiki/index.php/Tftp_flash


I got into serial recovery alright, and I sent the factory flash file by tftp right after the flash command:

CFE> flash -ctheader : flash1.trx (in other window tftp 192.168.1.1 PUT factory.bin)
Reading :: CODE Pattern is CORRECT!
upgrade_ver[v1.0.6] upgrade_ver[10006] 4712_ver[0]

and then it just hangs up, no CFE prompt after a long time.

TFTP returns with no completion message.

If I send other flash files it rejects them as code pattern is incorrect, which is expected.

Regards,

Mark
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 7443
Location: Texas, USA

PostPosted: Fri Nov 01, 2019 18:40    Post subject: Reply with quote
How long does it hang for? It takes a while between flash and 'programming' before you can issue the 'go' command, and that also takes a bit. If it hangs for more than 5 minutes or so, then that might be an issue, but otherwise, be patient, let it do it's thing. Did you start serial recovery with an nvram erase? If you are flashing factory firmware back to it from a bad DD-WRT flash, that's usually required AFAIK. I didn't have that issue when I reverted to a previous build via serial last time I had to do that, though.
_________________
Official Forum Rules, Guidelines, and Helpful InformationFirmware FAQInstallation WikiWhere Do I Download Firmware?
DON'T use Chromium-based browsersRTFM/STFW - TL;DR is NOT an excuse. • Why Should I Care What Color the Bikeshed Is?
Please DO NOT PM me with questions; Ask in the forum.

---------------------------------------------------------

Linux User #377467 counter.li.org / linuxcounter.net
marklg
DD-WRT Novice


Joined: 19 Oct 2017
Posts: 27

PostPosted: Fri Nov 01, 2019 21:48    Post subject: Reply with quote
kernel-panic69 wrote:
How long does it hang for? It takes a while between flash and 'programming' before you can issue the 'go' command, and that also takes a bit. If it hangs for more than 5 minutes or so, then that might be an issue, but otherwise, be patient, let it do it's thing. Did you start serial recovery with an nvram erase? If you are flashing factory firmware back to it from a bad DD-WRT flash, that's usually required AFAIK. I didn't have that issue when I reverted to a previous build via serial last time I had to do that, though.


Yes, I did an nvram erase, several times in fact.

It hangs for hours.

Regards,

Mark
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 7443
Location: Texas, USA

PostPosted: Fri Nov 01, 2019 23:50    Post subject: Reply with quote
I just re-read the serial recovery wiki, and noticed this. Did you try this:

https://wiki.dd-wrt.com/wiki/index.php/Serial_Recovery

Quote:
LOM on the E3000
The easiest way of flashing an E3000 when you have serial terminal attached is:
Code:
nvram set safe_mode_upgrade=on
nvram commit
reboot

Then open 192.168.1.1 to the CFE recovery GUI page where you can upload the firmware.

_________________
Official Forum Rules, Guidelines, and Helpful InformationFirmware FAQInstallation WikiWhere Do I Download Firmware?
DON'T use Chromium-based browsersRTFM/STFW - TL;DR is NOT an excuse. • Why Should I Care What Color the Bikeshed Is?
Please DO NOT PM me with questions; Ask in the forum.

---------------------------------------------------------

Linux User #377467 counter.li.org / linuxcounter.net
marklg
DD-WRT Novice


Joined: 19 Oct 2017
Posts: 27

PostPosted: Sat Nov 02, 2019 0:26    Post subject: Reply with quote
kernel-panic69 wrote:
I just re-read the serial recovery wiki, and noticed this. Did you try this:

https://wiki.dd-wrt.com/wiki/index.php/Serial_Recovery

Quote:
LOM on the E3000
The easiest way of flashing an E3000 when you have serial terminal attached is:
Code:
nvram set safe_mode_upgrade=on
nvram commit
reboot

Then open 192.168.1.1 to the CFE recovery GUI page where you can upload the firmware.


I tried that several times too, but the browser will not connect. It scrolls a bunch of stuff on the serial port, but I don't know what it is supposed to scroll.

If I boot to CFE and do a

nvram get safe_mode_upgrade=on

it says it is on.

Regards,

Mark
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 7443
Location: Texas, USA

PostPosted: Sat Nov 02, 2019 0:44    Post subject: Reply with quote
Maybe try this:

https://community.linksys.com/t5/Wireless-Routers/E3000-Bricked-3-Times-in-a-Row-bleep/td-p/334180/page/3

Quote:
Re: E3000 Bricked 3 Times in a Row!!!! **bleep**? [ Edited ]
Options
‎04-24-2011 07:32 AM - edited ‎04-24-2011 07:35 AM

I got it... I had to open it up and short pins 8-9, then it would take a full file transfer via TFTP. Works like a champ now. FYI for others, it's not hard to short the pins, but it requres a magnifying glass and a needle or something with a small enough tip to short the pins together.

The 30/30/30 reset did nothing for me.

The info in this link helped, also:

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=63371&postdays=0&postorder=asc&start=0

By the way, it still wasn't as easy as 1-2-3 after shorting the pins. I had to attempt the file transfer about 3 times before it took it. You'll know when it takes because the router will reboot almost instantly.

_________________
Official Forum Rules, Guidelines, and Helpful InformationFirmware FAQInstallation WikiWhere Do I Download Firmware?
DON'T use Chromium-based browsersRTFM/STFW - TL;DR is NOT an excuse. • Why Should I Care What Color the Bikeshed Is?
Please DO NOT PM me with questions; Ask in the forum.

---------------------------------------------------------

Linux User #377467 counter.li.org / linuxcounter.net
marklg
DD-WRT Novice


Joined: 19 Oct 2017
Posts: 27

PostPosted: Sat Nov 02, 2019 1:43    Post subject: Reply with quote
kernel-panic69 wrote:
Maybe try this:

https://community.linksys.com/t5/Wireless-Routers/E3000-Bricked-3-Times-in-a-Row-bleep/td-p/334180/page/3

Quote:
Re: E3000 Bricked 3 Times in a Row!!!! **bleep**? [ Edited ]
Options
‎04-24-2011 07:32 AM - edited ‎04-24-2011 07:35 AM

I got it... I had to open it up and short pins 8-9, then it would take a full file transfer via TFTP. Works like a champ now. FYI for others, it's not hard to short the pins, but it requres a magnifying glass and a needle or something with a small enough tip to short the pins together.

The 30/30/30 reset did nothing for me.

The info in this link helped, also:

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=63371&postdays=0&postorder=asc&start=0

By the way, it still wasn't as easy as 1-2-3 after shorting the pins. I had to attempt the file transfer about 3 times before it took it. You'll know when it takes because the router will reboot almost instantly.



Didn't try this yet, but in all the other things I've done, I can see a variety of memory errors print out on the serial console. Missed reads, writes, exceptions, kernel panics, etc. I am thinking it may be an actual hardware failure. I looked around with a microscope for cracked solder joints but did not see any.

Regards,

Mark
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 7443
Location: Texas, USA

PostPosted: Sat Nov 02, 2019 1:47    Post subject: Reply with quote
It may not hurt to try. Worst case would be replacing the flash chip and starting from scratch with JTAG, but you might get lucky.
_________________
Official Forum Rules, Guidelines, and Helpful InformationFirmware FAQInstallation WikiWhere Do I Download Firmware?
DON'T use Chromium-based browsersRTFM/STFW - TL;DR is NOT an excuse. • Why Should I Care What Color the Bikeshed Is?
Please DO NOT PM me with questions; Ask in the forum.

---------------------------------------------------------

Linux User #377467 counter.li.org / linuxcounter.net
danielwritesback
DD-WRT User


Joined: 29 Aug 2011
Posts: 239

PostPosted: Fri Dec 20, 2019 23:42    Post subject: Reply with quote
Pin shorts are for causing the power light to blink. But, that doesn't help if it was already blinking.

You just need method 1 (TFTP): https://www.wallada.tk/fix-bricked-linksys-e3000-router/
and
This firmware: https://forum.dd-wrt.com/phpBB2/download.php?id=43052
marklg
DD-WRT Novice


Joined: 19 Oct 2017
Posts: 27

PostPosted: Sat Dec 21, 2019 1:39    Post subject: Reply with quote
danielwritesback wrote:
Pin shorts are for causing the power light to blink. But, that doesn't help if it was already blinking.

You just need method 1 (TFTP): https://www.wallada.tk/fix-bricked-linksys-e3000-router/
and
This firmware: https://forum.dd-wrt.com/phpBB2/download.php?id=43052


Unfortunately, long past that method. Did not work. I did connect a serial port, but that did not succeed either. I really believe there is a hardware failure. Since I found another one at a swapmeet for a few bucks, I gave up on this one, too much time taken up already.

Regards,

Mark
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 7443
Location: Texas, USA

PostPosted: Sat Dec 21, 2019 2:07    Post subject: Reply with quote
Wish I had known, I could've given it a whirl.
_________________
Official Forum Rules, Guidelines, and Helpful InformationFirmware FAQInstallation WikiWhere Do I Download Firmware?
DON'T use Chromium-based browsersRTFM/STFW - TL;DR is NOT an excuse. • Why Should I Care What Color the Bikeshed Is?
Please DO NOT PM me with questions; Ask in the forum.

---------------------------------------------------------

Linux User #377467 counter.li.org / linuxcounter.net
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum