Posted: Sun Aug 02, 2015 20:04 Post subject: Belkin F5D8235-4 v2 unbrick
Hello, community,
I am new here. I got a router from a friend who says it's broken and it has been laying around for a few years. I don't know how it happened that the router is bricked but I googled and read these forums a lot to try recovering it. It still has the original firmware on it.
It's a Ralink-based router Belkin F5D8235-4 v2. Noone seems to have had this problem before so I am posting here, perhaps someone can point me in the right direction.
I opened it up and made a video to clearly show what happens.
After powering up, Wireless LED comes on for 2 seconds, then it goes off, Router LED comes on and stays that way. At this point, the Download LEDs start to make an animation (like an infinite progress bar). It stays forever this way.
My observations are:
- it does not matter to the router whether LAN cable is connected (LEDs exhibit the same behavior)
- the Ralink and RTL chips emit tolerable heat (they are not overheating) and the other chips are cool
- there are no bad capacitors
- power adapter is OK (tried with a spare one, still the same...)
- 30/30/30 is not working
- router does not react to Reset button or WPS button
- when I connect a PC to the LAN port, in PC network adapter shows cable is plugged in but it gets no IP address
- router cannot be contacted on 192.168.2.1 or 192.168.1.1 or 10.10.10.123 (I tried the steps from this topic), of course I configured the proper subnet mask...
- TFTPd32 shows no clients trying to connect
According to other forum posts, it is possible to attach to J2 and get some serial console running. I guess that would require some sort of serial-to-USB cable which I don't have (my PC does not have a serial interface).
Please, is there anything more I can try?
The router uses the das boot(uboot). The following menu is presented during boot and you have 1 second to enter a value.
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP.
Posted: Mon Aug 03, 2015 20:08 Post subject: Re: Belkin F5D8235-4 v2 unbrick
Mek7 wrote:
I guess that would require some sort of serial-to-USB cable which I don't have (my PC does not have a serial interface).
perhaps your PC has it onboard but not connected to the outside
Mek7 wrote:
Please, is there anything more I can try?
I don't think it makes sense w/o a serial connection. Therefore you have to solder and get you the right serial connector for your PC, must not be something fancy. Then you can see an act with the uboot menu. Then you might perhaps take a look here: http://dd-wrt.com/phpBB2/viewtopic.php?t=53235&postdays=0&postorder=asc&start=375
Thanks for your replies, guys. I ordered a CA-42 cable from ebay, can't wait to play with it
Please note that the cable is an USB to serial cable and you have to connect the USB connector to your PC and the serial side to the router and not the other way round. I.e. you don't connect the serial side to the PC and the USB side to the USB of the router. You have to open up the case of the router to access the internal circuit board and find J2 which is the serial interface for the router. Take a look at the link as shown on the post from member Specimen for more info about J2 on the router.
Of course, I already know that but thanks for pointing out for those who read this in the future. I got my cable and will get into it when I have time. Will post what I find here
OK, I soldered a connector to J2 and was able to establish serial connection and this is what I got:
Quote:
U-Boot 1.1.3 (Nov 7 2008 - 00:24:27)
Board: Ralink APSoC DRAM: 32 MB
relocate_code Pointer at: 81fa0000
=====config_usbotg =====
flash_protect ON: from 0xBF000000 to 0xBF02F0F7
protect on 0
protect on 1
protect on 2
protect on 3
protect on 4
protect on 5
protect on 6
protect on 7
protect on 8
protect on 9
flash_protect ON: from 0xBF030000 to 0xBF03FFFF
protect on 10
============================================
Ralink UBoot Version: 3.2
--------------------------------------------
ASIC 3052_MP2 (Port5<->GigaSW)
DRAM COMPONENT: 128Mbits
DRAM BUS: 32BIT
Total memory: 32 MBytes
Date:Nov 7 2008 Time:00:24:27
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384
##### The CPU freq = 384 MHZ ####
SDRAM bus set to 32 bit
SDRAM size =32 Mbytes
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP. 0
3: System Boot system code via Flash.
## Booting image at bf050000 ...
Image Name: Linux Kernel Image
Created: 2009-03-31 6:24:29 UTC
System Control Status = 0x10440000
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1178131 Bytes = 1.1 MB
Load Address: 80000000
Entry Point: 80364000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80364000) ...
## Giving linux memsize in MB, 32
Starting kernel ...
LINUX started...
THIS IS ASIC
Linux version 2.6.21 (root@localhost.localdomain) (gcc version 3.4.2) #16 Tue Mar 31 14:22:41 CST 2009
The CPU feqenuce set to 384 MHz
CPU revision is: 0001964c
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Built 1 zonelists. Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock2
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 800060, status = 1100ff00
PID hash table entries: 128 (order: 7, 512 bytes)
calculating r4koff... 00177000(1536000)
CPU frequency 384.00 MHz
Using 192.000 MHz high precision timer.
Console: colour dummy device 80x25
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 28756k/32768k available (2832k kernel code, 4012k reserved, 636k data, 132k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
fuse init (API version 7.
io scheduler noop registered (default)
FLASH_API: MAN_ID=C2 DEV_ID=22CB SIZE=8MB
Ralink RT2880 gpio driver initialized
Gemtek LED init...
Ralink gpio driver initialized
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
loop: loaded (max 8 devices)
smi_major=249
0 smi_init check[0x05c]1=0x5937
rdm_major = 254
GDMA1_MAC_ADRH -- : 0x00000000
GDMA1_MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v1.60 128 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, weight = 0, Tx Ring = 128, Rx Ring = 128
GDMA1_MAC_ADRH -- : 0x0000000c
GDMA1_MAC_ADRL -- : 0x43305277
PROC INIT OK!
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
ralink flash device: 0x1000000 at 0xbf000000
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Creating 5 MTD partitions on "Ralink SoC physically mapped flash":
0x00000000-0x00050000 : "uboot"
0x00050000-0x007e0000 : "Kernel and Rootfs"
0x001d0000-0x007e0000 : "Rootfs"
0x007e0000-0x007f0000 : "Nvram"
0x007f0000-0x00800000 : "Factory"
block2mtd: version $Revision: 1.1.1.1 $
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Fully Cone
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
lo: Disabled Privacy Extensions
tunl0: Disabled Privacy Extensions
Mobile IPv6
IPv6 over IPv4 tunneling driver
sit0: Disabled Privacy Extensions
NET: Registered protocol family 17
create_proc_read_write_entry: fail
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 132k freed
BUG: at fs/squashfs/uncomp.c:135 sqlzma_un()
Call Trace:
[<8000780c>] dump_stack+0x8/0x34
[<800dab84>] sqlzma_un+0x134/0x2b8
[<800d1700>] squashfs_read_data+0x380/0x8e4
and that was all.
Googling didn't yield much useful results. I have read more forum posts here and decided to go with this procedure:
1. Set IP address on PC to 192.168.1.3
2. Start TFTPd32 with stock Belkin firmware in the folder configured in TFTPd
3. Power up the router while attached to console
4. Quickly press 2 to load system image from TFTP
5. Answer a few questions from the router. It asked which IP it should use (I left 192.168.2.1 as that was the default), then it asked for IP of TFTP server (which is my PC so I entered 192.168.1.3) and at last, file name to load so I entered "test.bin".
6. After that, the router downloaded the bin file successfully, erased some memory blocks and replaced them with new content. When this process finished, it booted again successfully!
So now I have a working router and I learned a lot of new stuff. Thanks for assistance and for these forums, they are great source of knowledge.
Posted: Tue Jan 07, 2020 15:40 Post subject: Re: well done
Hello everyone, I love this device, but I decided to somehow put open-wrt and eventually forcibly erased the entire bootloader now it does not show any signs of life. 1) Where to get the loader to flash through telnet 2) how to sew the loader if there is no jtag? P. s sorry for my English
