WNR834B_V2 Bricked? This is how to unbrick it!

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message
DD-WRT Novice

Joined: 04 Nov 2007
Posts: 44
Location: Brazil

PostPosted: Sun Jul 12, 2009 23:32    Post subject: WNR834B_V2 Bricked? This is how to unbrick it! Reply with quote
If you get power light orange or all light on, or if you have power light blinking, ttl=100 do a tftp and still the same, than your router is bricked and you need to do the folowing steps.
I did this after brick my router for more than 8 times or every time i try to upload old BS firmware. I think wnr834b_V2 dos not like the old BS firmware.

There are 2 ways to unbrick this router.
The first is not safe but you can try on your on risk. Some times works and some don´t and you may burn your router.
All you have to do is:
1. Unplug power
2. open dos windows and type ping -t
3. short pins 16 and 17 using a small screwdriver on flash chip and plug power.
4. Then you shoud get power light blinking and ttl=100
5. take off the screwdriver and you read to tftp a new firmware.
If this dosen´t work, then only TJTAG.

The other and safe is using TJTAG, but some times you get "*** Unknown or NO Flash Chip Detected ***" like this:

tjtagv3 -probeonly /noemw /noreset
EJTAG Debrick Utility v3.0 RC1 Tornado-MOD

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 10010100011100000100000101111111 (9470417F)
*** Found a Broadcom BCM4704 KPBG Rev 9 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... ECR: 0x00000100 Done
Enabling Memory Writes ... Mem 0x00000000
Halting Processor ...
00000000001000000000000100000000 (00200100)
00000000001000000000000100000000 (00200100)
<Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Probing Flash at (Flash Window: 0x1fc00000) ...

*** Unknown or NO Flash Chip Detected ***


In this case, Use this:
tjtagv3 -probeonly /flash_debug.
You will get some like this:
Flash Vendor ID: 00000000000000000000000011000010 (000000C2)
Flash Device ID: 00000000000000000010001010101000 (000022A8)
*** Found a MX29LV320B 2Mx16 BotB (4MB) Flash Chip ***

- Flash Chip Window Start .... : 1fc00000
- Flash Chip Window Length ... : 00400000
- Selected Area Start ........ : 00000000
- Selected Area Length ....... : 00000000


Now that you find the flash chip, is better to erase wholeflash doing this:
Unplug power and plug again. Have to Be fast and type:

tjtagv3 -erase:wholeflash /fc:XX /noemw /noreset
where XX is the flash number, im this case 41 (MX29LV320B 2Mx16 BotB (4MB)), so /fc:41

power cicle and try tjtag -probeonly /noemw /noreset
Now you must have power and all lan light on, no ping, nothing and tjtag should find your flash chip (don´t ask me why)

Next step is to put a work CFE.
tjtag -flash:cfe /noemw /noreset
power cicle again and now you must have power light blinking, but don´t try to tftp it will not work.

Next step is to put a custom on your router, using the one you have with your mac address. (see next post for a generic custom.bin file you can edit - redhawk)
tjtag -flash:custom /window:1fc00000 /start:1ffe0000 /length:10000
power cicle and again you showd have green power light blinking.

Now you are read to tftp the netgear firmware.

set your IP to fixed.
some times is better set your lan card to 10mbs half-duplex.

Open a dos windows and type ping -t
If you get a ttl=100 than you can tftp the netgear firmware.
use this wnr834bv2_1_0_22_na.bin (with headers stripped out) found here http://www.dd-wrt.com/phpBB2/download.php?id=5495
I tryed the newest firmware from Netgear, but after that i can´t upload DD-WRT firmware again.

So open another dos windows.
unplug router power.
First window is with ping -t
On second type tftp -i PUT wnr834bv2_1_0_22_na.bin. Don´t hit enter.
Plug power and wait for ttl=100.
You should get something like this
Hardware error.
Hardware error.
Reply from bytes=32 time=2ms TTL=100
Reply from bytes=32 time=2ms TTL=100

When router respond ping hit enter on tftp windows.
On my took about 7 to 15sec to tftp.
After finish, don´t do anything and watch the ping windows. After 2/3 minutes showld respond ttl=64 power light green and lan light (1 or 2 or 3, 4) you are conected solid.
If ok, you will get your router back to netgear firmware, and than you can put back dd-wrt.chk firmware using webgui.

Sorry for a bad english.

JTAG pins
 Filesize:  1.31 MB
 Viewed:  11385 Time(s)


CFE for WNR834B_V2

 Filename:  cfe.bin
 Filesize:  128 KB
 Downloaded:  743 Time(s)


Joined: 04 Jan 2007
Posts: 11447
Location: Wherever the wind blows- North America

PostPosted: Mon Jul 13, 2009 12:19    Post subject: Reply with quote
Here is a generic custom.bin file that you can edit.

LAN MAC starts at location 40 (Red circle)
WAN MAC (LAN+1) starts at location 46 (blue circle)

There are no characters between the two MAC addresses.

In the file below the generic MAC is 00:1B:2F:00:00:01 and 00:1B:2F:0:00:02

Follow Vamp's instructions above for flashing it using tjtag.

Good luck.

BTW...I added a link to this thread in the wiki>>install>>wnr834bv2 section for recovering.


Picture of MAC locations.
 Filesize:  241.1 KB
 Viewed:  11351 Time(s)


generic MAC address 00:1B:2F:00:00:01

 Filename:  custom.bin
 Filesize:  64 KB
 Downloaded:  850 Time(s)

I do NOT provide personal assistance through chat or phone....so please don't ask.
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT


Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum