Joined: 31 Aug 2009 Posts: 2448 Location: Third Rock from the Sun
Posted: Tue Jan 10, 2012 16:12 Post subject: Netgear WNR3500 v2.0 Brick (solved)
Recovery instruction in this post below
***Original Post***
Alright, I used TJTAG and got it back to haveing serial output but no matter what image I flash it always say checksum mismatch. How do I get an image with the correct checksum?
CFE for WNR3500v2 version: v1.0.29
Build Date: Fri Jun 12 11:11:15 CST 2009
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found a 4MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.28
CPU type 0x19740: 453MHz
Tot mem: 32768 KBytes
Device eth0: hwaddr C0-3F-0E-AB-EC-84, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Checksum mismatch:
Image chksum: 0xFFFFFFFF
Calc chksum: 0x01B700CF
Invalid boot block on disk
Start TFTP server
Reading ::
And when I TFTP the firmware on i get
Code:
Reading :: Done. 3448890 bytes read
Reading ::
It just sets there. When I breakinto the cfe and issue flash -noheader : flash1.trx and tftp the firmware on I get
Code:
CFE> flash -noheader : flash1.trx
Reading :: Done. 3448890 bytes read
Programming...done. 3448890 bytes written
*** command status = 0
CFE> go
Checksum mismatch:
Image chksum: 0xFFFFFFFF
Calc chksum: 0x01B700CF
Invalid boot block on disk
Start TFTP server
Reading ::
5.The last step will backup the board data to "custom.bin, Using a Hex editer, check to make sure all the data looks similar to board_data.bin or post it to your thread in the dd-wrt forums and somebody can check it for you.
6.If it is similar, change "U12H127T70_NETGEAR" to "U12H127T00_NETGEAR". The mac address starts at Hex address 40 in the middle pane, make sure it's correct. The Serial number starts at Dec address 76 in the right pane, make sure it's correct. The Security Pin starts at Dec address 108 in the right pane, make sure it's correct. The actual board data starts at Dec address 256 in the right pane, make sure it matches board_data.bin. If it looks all messed up then start fresh with board_data.bin and make all the changes ti it. When done "save as" "custom.bin" without the quotes. Makes sure it's in the same folder as TJTAG.
7.Now do the same with the cfe128, mac sure mac address match(although not as important with the cfe). Check to see if is similar to cfe128.bin. If not or it's just totally messed up use the reference cfe128.bin. Just edit it to match the information from your router.
10.Have TFTP.exe ready in WindowsXP, with WNR3500v2-V1.2.2.28_25.0.85NA.chk from that zip file. Configure your computer with a static ip address of 192.168.1.10. Connect the router to the pc via network cable. Power on the router when it signals a connection click upgrade.
Joined: 26 Jan 2008 Posts: 13049 Location: Behind The Reset Button
Posted: Thu Jan 12, 2012 19:09 Post subject:
interesting..
see the image checksum?? 0xFFF~. That isn't right. The checksum of the image will be embedded in the image. That checksum embedded will be compaired to the checksum calculated.
If they do not match, the flash routine will think is was a bad flash (incomplete, noise, general error, etc)
What are you trying to flash? Have you tried -ctheader?
I don't know a lot about that router other than it has about 15 partitions on the flash chip. Maybe a needed partition is missing? dunno.. _________________ [Moderator Deleted]
Joined: 31 Aug 2009 Posts: 2448 Location: Third Rock from the Sun
Posted: Thu Jan 12, 2012 21:45 Post subject:
No important info was over written. The caldata is there and intact. The router is now supported by TJTAG. The Wholeflash was backup and checked, the cfe and caldata was stripped and byteswapped. Then put back on the router.
The infor with -42 is may fault wrong info, I will correct it with
Code:
CFE> flash -noheader : flash1.trx
Reading :: Done. 3448890 bytes read
Programming...done. 3448890 bytes written
*** command status = 0
CFE> go
Checksum mismatch:
Image chksum: 0xFFFFFFFF
Calc chksum: 0x01B700CF
Invalid boot block on disk
Start TFTP server
Reading ::
and then it just sits there, if i hit upgrade again on tftp it will take the image again and just sit there waiting for another. I need to figure out why the checksums aren't matching. _________________ Peacock Thread-FAQ -- dd-wrt Wiki
Joined: 31 Aug 2009 Posts: 2448 Location: Third Rock from the Sun
Posted: Thu Jan 12, 2012 22:41 Post subject:
fggs wrote:
If you don't mind asking.. how this router bricked in the first place?
From what I understand the wrong image was put on. I in my stupidity assumed the caldata had been over writen. Now we have TJTAG support for it. _________________ Peacock Thread-FAQ -- dd-wrt Wiki
Well, all the tips I have I told you, unfortunately it was nothing.. but I will be a good spectator now.
Netgear routers are tricky and you know that from your own experience! (Yes, I remember a router of yours that something happened with caldata and it was a pain to put it back in service).