WNDR3300 Brick - Will not take tftp flash [SOLVED!!]

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Goto page 1, 2, 3 ... 9, 10, 11  Next
Author Message
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2430
Location: Third Rock from the Sun

PostPosted: Thu May 27, 2010 2:16    Post subject: WNDR3300 Brick - Will not take tftp flash [SOLVED!!] Reply with quote
OK, let me start of by saying I bought this router bricked, so I don't know the real history of what bricked it. I was told that the router went back and forth between OpenWRT & dd-wrt. It bricked when dd-wrt was being upgraded. So I was told.

I have acheived serial communication with the CFE. The mac address' are almost all F's and some of the default nvram settings for the CFE are not the same as my known good working WNDR3300.

Code:
CFE> nvram show
os_ram_addr=80001000
boardrev=0x23
et0macaddr=00:ff:ff:ff:ff:ff <-----
boot_wait=off
watchdog=3000
et0mdcport=0
reset_gpio=6
pmon_ver=CFE 4.151.10.5
gpio0=robo_reset
os_flash_addr=bfc40000
boardtype=0x0472
et1macaddr=00:ff:ff:ff:ff:ff <-----
lan_netmask=255.255.255.0
et1mdcport=0
clkfreq=264
lan_ipaddr=192.168.1.1
sdram_config=0x0062
scratch=a0180000
boardflags=0x10
sdram_refresh=0x0000
sdram_ncdl=0xff0303 <-----
et0phyaddr=30
sdram_init=0x054B
dl_ram_addr=a0001000
et1phyaddr=4
boardnum=01
size: 494 bytes (32274 left)
*** command status = 0
CFE>


Also the line "dfs_ch_enable_default=1" is not in the above.

The CFE accepts the command "nvram erase", "tftpd", and "flash -noheader : flash1.trx"

When i erase the nvram and start the TFTPD, the file flash is sucessful, but I get

Code:
'
Image ID : 'U12H093T00_NETGEAR'
Reading ::


At this point it's waiting for a file to flash and I could upload a file until my finger bleeds and it always comes back to this.


When I erase the nvram and use "flash -noheader : flash1.trx" I get

Code:
CFE> flash -noheader : flash1.trx
Reading :: Done. 3711034 bytes read
Programming...done. 3711034 bytes written
*** command status = 0
CFE>


from there I type "go" and I get

Code:
CFE> go
Invalid image length: 0xffffffff
Invalid boot block on disk
Start TFTP server
Reading ::


At this point it is waiting for a file to flash from TFTP. But it's a never ending cycle.

It will always take the flash but come back and want another. I think the special partition or the cfe might be screwed up. I am just trying to find out what all I can exactly do at the cfe prompt. As I look at the situation, I think i might be a pioneer at this point.

Any insight or suggestion welcome, with the exception of giving up Very Happy

_________________
Peacock Thread-FAQ -- Firmware Recommendations -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki


Last edited by Dark_Shadow on Sat May 29, 2010 20:35; edited 1 time in total
Sponsor
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2430
Location: Third Rock from the Sun

PostPosted: Thu May 27, 2010 2:18    Post subject: Reply with quote
Was able to get OEM firmware flashed

Was able to flash dd-wrt same way

Router is still not quite right

Details to come.....

_________________
Peacock Thread-FAQ -- Firmware Recommendations -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki


Last edited by Dark_Shadow on Fri May 28, 2010 17:13; edited 1 time in total
redhawk0
DD-WRT Guru


Joined: 04 Jan 2007
Posts: 11449
Location: Wherever the wind blows- North America

PostPosted: Thu May 27, 2010 2:24    Post subject: Reply with quote
By any chance did you try the Stock FW.

See if it will take that...maybe something between multiple third party FW's has something locked up on the flash chip.

redhawk



WNDR3300_V1.0.29_1.0.29-WW.zip
 Description:

Download
 Filename:  WNDR3300_V1.0.29_1.0.29-WW.zip
 Filesize:  2.86 MB
 Downloaded:  987 Time(s)


_________________
I do NOT provide personal assistance through chat or phone....so please don't ask.
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2430
Location: Third Rock from the Sun

PostPosted: Thu May 27, 2010 2:32    Post subject: Reply with quote
redhawk0 wrote:
By any chance did you try the Stock FW.

See if it will take that...maybe something between multiple third party FW's has something locked up on the flash chip.

redhawk
I tryed the NA but didn't try WW until now, same result

Code:
'
Image ID : 'U12H093T00_NETGEAR'
Reading ::


And if I upload it again, same thing

@ anybody
Is there a way to upload a new cfe via tftp? or fix the special partition?

_________________
Peacock Thread-FAQ -- Firmware Recommendations -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Thu May 27, 2010 2:46    Post subject: Reply with quote
if flashing the stock firmware.. don't use -noheader.. ya big nut..

use -ctheader.. the header has the info to put the data in the right spot!

I have read that -noheader could foul things up in the right (or wrong) circumstance. Never used it except way back when when we all helped de-brick a 600.

I've never hooked up serial to my 3300 but some netgears have an extra partition containing device specific data (macs). The wnr834b will rebuild the partition.. dunno about the 3300 if it does have the extra partition.

btw... what happened to you? your router crash? Razz

_________________
[Moderator Deleted] Shocked
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2430
Location: Third Rock from the Sun

PostPosted: Thu May 27, 2010 3:19    Post subject: Reply with quote
barryware wrote:
if flashing the stock firmware.. don't use -noheader.. ya big nut..

use -ctheader.. the header has the info to put the data in the right spot!



Only options available

Code:
  OPTIONS

     -noerase     Don't erase flash before writing
     -offset=*    Begin programming at this offset in the flash device
     -size=*      Size of source device when programming from flash to flash
     -noheader    Override header verification, flash binary without checking
     -writechksum Write image checksum to the end of partition
     -mem         Use memory as source instead of a device


barryware wrote:

btw... what happened to you? your router crash? Razz

Nope HDD kicked the bucket, had a stick of ram give out on me last night Laughing

_________________
Peacock Thread-FAQ -- Firmware Recommendations -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki
Eko
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 5772

PostPosted: Thu May 27, 2010 4:15    Post subject: Reply with quote
Yep, your boarddata partition is erased. Usually it takes JTAG to flash it back - but there is no jtag on this router.

Maybe play with this: (replace mac address with your MAC).

1. setenv BOARD_ID U12H093T00_NETGEAR
2. Please find out the MAC address of your board. It should be written on the backside cover of that board. I have assumed it as 001122334455.
3. ifconfig eth0 -hwaddr=00:11:22:33:44:44 -addr=192.168.1.1
4. start tftpd at CFE
5. upload original wndr3300 firmware.
6. Boot the board.
7. After login execute these commands into shell
burnethermac 001122334455
burnboardid U12H093T00_NETGEAR
bunsn . Again you will find this serial number onto the backside cover of the board.

Reboot the board.



CFE> ^C
CFE> setenv BOARD_ID U12H093T00_NETGEAR
*** command status = 0
CFE> ifconfig eth0 -hwaddr=001122334455 -addr=192.168.1.1
Device eth0: hwaddr 00-11-22-33-44-55, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
*** command status = 0
CFE> tftpd
Start TFTP server
Reading :: Done. 3080286 bytes read


After that, do nothing!!!! It is needing the programming part.
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2430
Location: Third Rock from the Sun

PostPosted: Thu May 27, 2010 10:38    Post subject: Reply with quote
Sounds like a plan Eko, just a couple of details though.

There are 2 mac address' on the back of the WNDR3300's, labeled MAC 1 and MAC 2. I am assuming I will use MAC 1 since that is what is used on my working unit.

The spot for the serial number is blank on both my units, I have not purchaced one brand new so I cannot confirm this, but there is a sticker on the PCB on the left side of the below pic. Could somebody confirm this or part of this is the serial number?


_________________
Peacock Thread-FAQ -- Firmware Recommendations -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki
buddee
DD-WRT Guru


Joined: 06 Feb 2010
Posts: 7401
Location: Little Rock

PostPosted: Thu May 27, 2010 11:06    Post subject: Reply with quote
From what i have come to know about this unit, The 2 MAC's are for the 2 radios wl0 and wl1, wl0 being the main.

Far as the sticker goes i actually emailed netgear asking the same thing, they have chosen not to reply so im gonna do some more research on it, will let you know if i find something worth while about it.

_________________
Wireless N Config | Linking Routers | DD-WRT Wiki | DD-WRT Builds | Peacock - Broadcom FAQ

Having problems with port forwarding? Check out Port Forward Troubleshooting for more info.
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2430
Location: Third Rock from the Sun

PostPosted: Thu May 27, 2010 12:44    Post subject: Reply with quote
Well I didn't even get to the SN,

Code:
WNDR3300 Boot code V1.0.2
Build date: Thu Sep 20 13:11:58 CST 2007
Initializing Arena
Initializing Devices.
Boot partition size = 131072(0x20000)
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.150.10.5
et1: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.150.10.5
CPU type 0x29006: 264MHz
Total memory: 16384 KBytes


Device eth0:  hwaddr 00-FF-FF-FF-FF-FF, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Automatic startup canceled via Ctrl-C
CFE> ^C
CFE> ^C
CFE> ^C
CFE> ^C
CFE> setenv BOARD_ID U12H093T00_NETGEAR
*** command status = 0
CFE> ifconfig eth0 -hwaddr=001F33B6D005 -addr=192.168.1.1
Device eth0:  hwaddr 00-1F-33-B6-D0-05, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
*** command status = 0
CFE> tftpd
Start TFTP server
Reading :: Done. 3039290 bytes read
Board ID mismatch!
Board ID : '
'
Image ID : 'U12H093T00_NETGEAR'
Reading ::

_________________
Peacock Thread-FAQ -- Firmware Recommendations -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2430
Location: Third Rock from the Sun

PostPosted: Thu May 27, 2010 14:26    Post subject: Reply with quote
It looks like I can use the save command to tftp the cfe.bin onto the router, but after that I dunno where to flash it to or how. CFE doesn't recognize MTD commands
_________________
Peacock Thread-FAQ -- Firmware Recommendations -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Thu May 27, 2010 14:36    Post subject: Reply with quote
there is nothing wrong with your cfe.. It is the board data partition that is missing..

If someone could capture it, you can flash it via cfe commands using -offset= & -size=.

Problem is... I don't know the offset or size. Or even how to extract it via serial with my 3300. Maybe Eko has partition data.

Sounds like some fun. This is the good stuff. Very Happy

If someone can help me grab the partition data via serial console, I'll try to work on it this weekend.

_________________
[Moderator Deleted] Shocked
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7628

PostPosted: Thu May 27, 2010 15:11    Post subject: Reply with quote
Dark_Shadow wrote:


I have acheived serial communication with the CFE. The mac address' are almost all F's and some of the default nvram settings for the CFE are not the same as my known good working WNDR3300.



A useful command in most CFE's, also in your WNDR3300:

Save a region of memory to a remote file via TFTP

save [-options] host:filename startaddr length

There are no options implemented, so that makes it easier Smile

CFE> save host:file_name 80000000 1000
4096 bytes written to host:filename
*** command status = 0


to get the whole flash of your working WNDR3300 you would use:

CFE> save host:file_name 1fc00000 400000

and then you can use the board data partition from that one.
host is the ip address of the computer where you have a tftp server running.

_________________
Kernel panic: Aiee, killing interrupt handler!


Last edited by LOM on Thu May 27, 2010 15:37; edited 1 time in total
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Thu May 27, 2010 15:19    Post subject: Reply with quote
here is some stuff from openwrt...

http://oldwiki.openwrt.org/OpenWrtDocs(2f)Hardware(2f)Netgear(2f)WNDR3300.html

dunno why the link wont post right.. you need to copy & paste into your browser.

gives the layout of the flash partition(s).

_________________
[Moderator Deleted] Shocked
Eko
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 5772

PostPosted: Thu May 27, 2010 15:21    Post subject: Reply with quote
Whole flash backup (original firmware)
board data part is at offset 0x3E0000



U12H09300_V1.0.14.bin
 Description:

Download
 Filename:  U12H09300_V1.0.14.bin
 Filesize:  4 MB
 Downloaded:  987 Time(s)

Goto page 1, 2, 3 ... 9, 10, 11  Next Display posts from previous:    Page 1 of 11
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum