Now i can upload an official firmware via serial 115200 8N1, but nothing happened after upload. No reboot.
here is an extract of what the router show me:
Code:
CFE for WNDR4000 version: v1.0.4
Build Date: Tue Nov 30 17:04:18 CST 2010
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found an ST compatible serial flash with 128 64KB blocks; total size 8MB
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 2010.09.30.0
CPU type 0x19740: 480MHz
Tot mem: 65536 KBytes
Device eth0: hwaddr 00-FF-FF-FF-FF-FF, ipaddr 192.168.1.1, mask 255.255.255.0 gateway not set, nameserver not set
Checksum length overflow!
Invalid boot block on disk
Device eth0 has been deactivated.
Device eth0: hwaddr 00-FF-FF-FF-FF-FF, ipaddr 192.168.1.1, mask 255.255.255.0 gateway not set, nameserver not set
Start TFTP server
Reading :: Done. 7258170 bytes read
Board ID : �
Image ID : U12H181T00_NETGEAR
Reading ::
and nothing....
i tried to set the good Board ID like this:
Code:
CFE> nvram set board_id=U12H181T00_NETGEAR
CFE> nvram commit
CFE> nvram set board_id
Joined: 26 Jan 2008 Posts: 13049 Location: Behind The Reset Button
Posted: Thu Mar 27, 2014 20:11 Post subject:
net gear routers typically have an extra partition on the flash chip called board_data (or something like that).
look at your output.. the hardware macs.. 00:FF:FF:FF:FF:FF and no board id..
this partition has been wiped out.
you are not the first. there are several threads about the forum in regard to restoring / rewriting this partition.. _________________ [Moderator Deleted]
after nvram set a lots of parameters,(et0macaddr,et1macaddr,sb/1/macaddr,pci/1/1/macaddr,...) then launching the go command, i have this:
CFE> go
Loader:raw Filesys:tftp Dev:eth0 File:192.168.1.2:vmlinuz Options:(null)
Loading: Failed.
Could not load 192.168.1.2:vmlinuz: Timeout occured
Checksum length overflow!
Invalid boot block on disk
Device eth0 has been deactivated.
Device eth0: hwaddr 2C-B0-5D-35-B5-4D, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Start TFTP server
Reading :: Done. 7258170 bytes read
Board ID :
Image ID : U12H181T00_NETGEAR
Reading :: Done. 7258170 bytes read
Board ID :
Image ID : U12H181T00_NETGEAR
Reading ::
I tried to push 2 times the same offical NETGEAR Router but nothing.
Can i try this kind of command:?
flash -noheader -writechksum : flash1.trx
I took a dd-wrt build,specifically dd-wrt.v24-23598_NEWD-2_K2.6_mini-WNDR4000.chk
opened it in a hex editor, deleted everything before HDR0 and saved it. Changed the .chk to a .bin.
in CFE, typed : CFE> flash -noheader -writechksum : flash1.trx
as soon as I hit enter, I sent it the .bin via tftp. It took it, programmed it and then I CFE>reboot after it was done
here is the output:
Code:
CFE for WNDR4000 version: v1.0.4
Build Date: Tue Nov 30 17:04:18 CST 2010
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found an ST compatible serial flash with 128 64KB blocks; total size 8MB
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 2010.09.30.0
CPU type 0x19740: 480MHz
Tot mem: 65536 KBytes
Device eth0: hwaddr 00-FF-FF-FF-FF-FF, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Checksum length overflow!
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3916 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
Linux version 2.6.24.111 (root@dd-wrt.buildserver) (gcc version 4.1.2) #19531 Wed Feb 19 04:16:59 CET 2014
CPU revision is: 00019740
Found a 8MB ST compatible serial flash
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
Normal 0 -> 16384
HighMem 16384 -> 16384
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0 -> 16384
Built 1 zonelists in Zone order. Total pages: 16384
Kernel command line: console=ttyS0,115200 root=1f02 rootfstype=squashfs noinitrd
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 512 (order: 9, 2048 bytes)
CPU: BCM4716 rev 1 at 480 MHz
Using 240.000 MHz high precision timer.
console [ttyS0] enabled
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 58628k/65536k available (3490k kernel code, 6852k reserved, 1369k data, 220k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Generic PHY: Registered new driver
PCI: Using membase 8000000
PCI: Initializing host
PCI: Reset RC
PCI: no core
PCI: Fixing up bus 0
PCI/PCIe coreunit 0 is set to bus 1.
PCI: Fixing up bridge
PCI: Fixing up bridge
PCI: Enabling device 0000:01:00.1 (0004 -> 0006)
PCI: Fixing up bus 1
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
WNDR4000 GPIO Init
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
io scheduler noop registered
io scheduler deadline registered (default)
HDLC line discipline: version $Revision: 4.8 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 8) is a 16550A
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
et_module_init: passivemode set to 0x0
eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.100.138.9
PCI: Enabling device 0000:01:01.0 (0000 -> 0002)
pflash: found no supported devices
bootloader size: 262144
nvram size: 65536
sflash: Filesystem type: squashfs, size=0x207e9c
partition size = 2170880
Updating TRX offsets and length:
old trx = [0x0000001c, 0x000009d0, 0x0015e000], len=0x00366000 crc32=0x2b33cb91
new trx = [0x0000001c, 0x000009d0, 0x0015e000], len=0x00370000 crc32=0xda8e5723
Done
Creating 6 MTD partitions on "sflash":
0x00000000-0x00040000 : "cfe"
0x00040000-0x007e0000 : "linux"
0x0019e000-0x003b0000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x007f0000-0x00800000 : "nvram"
0x003b0000-0x007e0000 : "ddwrt"
0x007e0000-0x007f0000 : "board_data"
Broadcom Watchdog Timer: 0.07 initialized.
u32 classifier
Performance counters on
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
ctnetlink v0.93: registering with nfnetlink.
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
ClusterIP Version 0.8 loaded successfully
TCP bic registered
TCP cubic registered
TCP westwood registered
TCP highspeed registered
TCP hybla registered
TCP htcp registered
TCP vegas registered
TCP scalable registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Welcome to PF_RING 3.2.1
(C) 2004-06 L.Deri <deri@ntop.org>
NET: Registered protocol family 27
PF_RING: bucket length 128 bytes
PF_RING: ring slots 4096
PF_RING: sample rate 1 [1=no sampling]
PF_RING: capture TX No [RX only]
PF_RING: transparent mode Yes
PF_RING initialized correctly.
PF_RING: registered /proc/net/pf_ring/
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
decode 1f02
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 220k freed
start service
starting Architecture code for broadcom
done
Booting device: Netgear WNDR4000
Need reboot now .....
kill -15 -1: No such file or directory
sleep 3: No such file or directory
kill -9 -1: No such file or directory
umount -a -r: No such file or directory
loading bcm57xx
loading switch-core
loading switch-robo
roboswitch: Probing device eth0: found a 53115!
/etc/preinit: line 66: can't create /proc/sys/net/ipv4/ip_conntrack_max: nonexistent directory
/etc/preinit: line 66: can't create /proc/sys/net/ipv4/ip_conntrack_max: nonexistent directory
Sending SIGTERM to all processes
BCMDOG: WDT device closed unexpectedly. WDT will not stop!
Sending SIGKILL to all processes
Restarting system.
Please stand by while rebooting the system...
Decompressing..........done
and i finally have an telnet access !!
but my problems with nvram values are not gone... if i reset the router, values are lost...
i will investigate tomorrow maybe.
Code:
root@DD-WRT:~# cat /proc/mtd
dev: size erasesize name
mtd0: 00040000 00010000 "cfe"
mtd1: 007a0000 00010000 "linux"
mtd2: 00212000 00010000 "rootfs"
mtd3: 00010000 00010000 "nvram"
mtd4: 00430000 00010000 "ddwrt"
mtd5: 00010000 00010000 "board_data"
root@DD-WRT:~# cat /proc/partitions
major minor #blocks name
