De-bricking a Netgear WNR2000v2 with serial

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Goto page 1, 2  Next
Author Message
swinster
DD-WRT Novice


Joined: 24 Jul 2014
Posts: 16

PostPosted: Sun Aug 24, 2014 14:31    Post subject: De-bricking a Netgear WNR2000v2 with serial Reply with quote
Hi All,

After trying a few different methods and reading lots of posts, I purchased a USB to TTL adapter and made up a serial cable for this WNR2000v2. I can now get into the CFE> prompt, but following the instructions in http://www.dd-wrt.com/wiki/index.php/Serial_Recovery I get an odd "Checksum mismatch" and an "Invalid Boot block on disk". The rooter then reboots into a TFTP server mode.

I have tried TFTPing a stock firmware as advised (tried both V1.0.0.34_29.0.45 and V1.2.0.6_36.0.5Cool, but its a no go.

Any ideas?

Output from the terminal session:

Reading :: Decompressing..........done
Decompressing..........done


CFE for WNR2000v2 version: v1.0.18
Build Date: Wed Sep 9 14:33:22 CST 2009
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found a 4MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.28
CPU type 0x19749: 300MHz
Tot mem: 32768 KBytes

Device eth0: hwaddr 00-FF-FF-FF-FF-FF, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Startup canceled
CFE> ^C
CFE> nvram erase
*** command status = 0
CFE> flash -noheader : flash1.trx
Reading :: Failed.: Timeout occured
*** command status = -21
CFE> flash -noheader : flash1.trx
Reading :: Done. 3448890 bytes read
Programming...done. 3448890 bytes written
*** command status = 0
CFE> go
Checksum mismatch:
Image chksum: 0xFFFFFFFF
Calc chksum: 0x01B700CF
Invalid boot block on disk
Start TFTP server
Reading :: Decompressing..........done


CFE for WNR2000v2 version: v1.0.18
Build Date: Wed Sep 9 14:33:22 CST 2009
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found a 4MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.28
CPU type 0x19749: 133MHz
Tot mem: 32768 KBytes

Committing NVRAM...done
Waiting for reset button release...done▒Decompressing..........done
Decompressing..........done


CFE for WNR2000v2 version: v1.0.18
Build Date: Wed Sep 9 14:33:22 CST 2009
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found a 4MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.28
CPU type 0x19749: 300MHz
Tot mem: 32768 KBytes

Device eth0: hwaddr 00-FF-FF-FF-FF-FF, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Checksum mismatch:
Image chksum: 0xFFFFFFFF
Calc chksum: 0x01B700CF
Invalid boot block on disk
Start TFTP server
Reading ::
Sponsor
swinster
DD-WRT Novice


Joined: 24 Jul 2014
Posts: 16

PostPosted: Tue Aug 26, 2014 19:16    Post subject: Reply with quote
Can I take it that this is Sh**ged? Crying or Very sad
Malachi
DD-WRT Guru


Joined: 17 Jul 2012
Posts: 7209
Location: Columbus, Ohio

PostPosted: Tue Aug 26, 2014 21:50    Post subject: Reply with quote
After you stop the cfe type help.
I can't remember for sure but I think you need to type "tftpd" or something like that to transfer the firmware. Not flash -noheader : flas1.trx.

I could be wrong. It's been a whle since I did one of these.

_________________
I am far from a guru, I'm barely a novice.
swinster
DD-WRT Novice


Joined: 24 Jul 2014
Posts: 16

PostPosted: Tue Aug 26, 2014 22:44    Post subject: Reply with quote
Hay Malachi,

Thanks, but no go.

Firstly, no help from the CFE prompt!

Secondly, running 'tftpd' does indeed start the TFTP server and you can transfer the file, however, the router just sits there asking for another file. There is no way to brake out of this, so you need to hard re-boot the router. This is pretty much the same as when the router reboots again, and goes straight into the TFTP server.

Code:
CFE> ^C
CFE> nvram erase
*** command status = 0
CFE> tftpd
Start TFTP server
Reading :: Done. 3448890 bytes read
Reading ::


Reboot here

Code:
Decompressing..........done


CFE for WNR2000v2 version: v1.0.18
Build Date: Wed Sep  9 14:33:22 CST 2009
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found a 4MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.28
CPU type 0x19749: 133MHz
Tot mem: 32768 KBytes

Committing NVRAM...done
Waiting for reset button release...doneÍDecompressing..........done
Decompressing..........done


CFE for WNR2000v2 version: v1.0.18
Build Date: Wed Sep  9 14:33:22 CST 2009
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found a 4MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.28
CPU type 0x19749: 300MHz
Tot mem: 32768 KBytes

Device eth0:  hwaddr 00-FF-FF-FF-FF-FF, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Checksum mismatch:
Image chksum: 0xFFFFFFFF
Calc  chksum: 0x01B700CF
Invalid boot block on disk
Start TFTP server
Reading ::


And so on..
notorious.dds
DD-WRT User


Joined: 24 May 2012
Posts: 376
Location: Michigan

PostPosted: Wed Aug 27, 2014 1:37    Post subject: Reply with quote
Quote:
Secondly, running 'tftpd' does indeed start the TFTP server and you can transfer the file, however, the router just sits there asking for another file.

You may have tried this, but...

My router did something similar to this and it wouldn't recover until I tftp'd the file TWICE. I had to do it once to get things rolling and a second time when it got to the "Reading ::" prompt again. My guess is, you're screwed, but it's worth a shot if you have not tried sending it twice.
swinster
DD-WRT Novice


Joined: 24 Jul 2014
Posts: 16

PostPosted: Wed Aug 27, 2014 8:25    Post subject: Reply with quote
I have a feeling I have tried this (maybe even three times!), but will give it another go tonight.

My feeling is that the checksum is failing because it thinks that the hardware MAC address on the Ethernet adapter is wrong (showing as 00:FF:FF:FF:FF:FF). I don't ever remember resetting the MAC address as the router was used mainly as an access point.
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Wed Aug 27, 2014 13:58    Post subject: Reply with quote
swinster wrote:
I have a feeling I have tried this (maybe even three times!), but will give it another go tonight.

My feeling is that the checksum is failing because it thinks that the hardware MAC address on the Ethernet adapter is wrong (showing as 00:FF:FF:FF:FF:FF). I don't ever remember resetting the MAC address as the router was used mainly as an access point.

The board_data partition has been wiped out. That is why you have no mac's. I believe there are several threads about the forum in regard to rebuilding / restoring the partition.

_________________
[Moderator Deleted] Shocked
swinster
DD-WRT Novice


Joined: 24 Jul 2014
Posts: 16

PostPosted: Wed Aug 27, 2014 16:58    Post subject: Reply with quote
Ahhh. I shall have a route out for those.

I did have a check in the Peacock thread, but couldn't see anything in there.
swinster
DD-WRT Novice


Joined: 24 Jul 2014
Posts: 16

PostPosted: Wed Aug 27, 2014 17:51    Post subject: Reply with quote
Ok - looks like a chunk of work. Found this https://www.dd-wrt.com/phpBB2/viewtopic.php?t=72874&postdays=0&postorder=asc&start=0 so need to disseminate and understand as best I can, but methink I gonna have issues....
swinster
DD-WRT Novice


Joined: 24 Jul 2014
Posts: 16

PostPosted: Wed Aug 27, 2014 22:36    Post subject: Reply with quote
Oh dear, looks like this might be a no go.

From the previous post (although this relates to a WNDR3300 no a WNR2000v2), I thought I would try a few things.

However, some CFE command seem missing.
    First, there is no CFE help, and pressing TAB doens't bring up anything.
    Second, there is no "setenv" command to set the board_ID - which I think I have found out as being U12H114T00_NETGEAR
    Third, the MAC address of label has been demolished on the back of the router along with the serial number!
    Forth, I did try 'borrowing' a MAC address from another user WNR2000v2 serial print out and ran 'ifconfig eth0 -hwaddr=C03F0E947C5A -addr=192.168.1.1'. Whilst this seemed to take, when I flashed the stock firmware using the commands above and rebooted, I still end up on the TFTP reading prompt and the MAC has reverted to 00-FF-FF-FF-FF-FF
swinster
DD-WRT Novice


Joined: 24 Jul 2014
Posts: 16

PostPosted: Wed Aug 27, 2014 23:32    Post subject: Reply with quote
Maybe something:

Code:
CFE> nvram show
antswctl2g=2
os_ram_addr=80001000
rxchain=3
boardrev=0x1700
et0macaddr=00:ff:ff:ff:ff:ff
maxp2ga0=0x5C
boot_wait=off
watchdog=3000
maxp2ga1=0x5C
et0mdcport=0
reset_gpio=1
pmon_ver=CFE 5.10.56.28
gpio0=ses_button
ofdm2gpo=0x53211111
gpio3=robo_reset
vlan0ports=1 2 3 4 5*
gpio7=ses_led
mcs2gpo0=0x2221
mcs2gpo1=0x8522
mcs2gpo2=0x4333
triso2g=3
mcs2gpo3=0xA866
os_flash_addr=bfc40000
sromrev=8
mcs2gpo4=0x8888
mcs2gpo5=0xCCA8
mcs2gpo6=0x8888
boardtype=0xE4CD
mcs2gpo7=0xCCA8
aa2g=3
et1macaddr=00:ff:ff:ff:ff:ff
lan_netmask=255.255.255.0
extpagain2g=0
tssipos2g=1
bw40po=0x0000
itt2ga0=0x20
itt2ga1=0x20
wl0id=0x4329
ag0=0
ag1=0
pa2gw2a0=0xFA13
pa2gw2a1=0xF98F
xtalfreq=20000
antswitch=0
boardflags2=0x00000400
cfe_version=v1.0.18
wait_time=3
ledbh0=11
ledbh1=11
bwduppo=0
ledbh2=11
ledbh3=11
txchain=3
ledbh4=11
ledbh5=2
ledbh6=11
ledbh7=11
leddc=0xFFFF
pa2gw1a0=0x1894
pa2gw1a1=0x1944
clkfreq=300,150,75
lan_ipaddr=192.168.1.1
vlan1hwname=et0
sdram_config=0x0283
vlan1ports=0 5u
scratch=a0180000
ccode=US
boardflags=0x00040710
wandevs=et0
sdram_refresh=0x1a18
sdram_ncdl=0x4800001a
macaddr=00:90:4C:05:00:01
pdetrange2g=0
cck2gpo=0x1111
regrev=14
et0phyaddr=30
landevs=vlan0 wl0
pa2gw0a0=0xFE89
pa2gw0a1=0xFE7F
sdram_init=0x0419
stbcpo=0x0000
vlan0hwname=et0
dl_ram_addr=a0001000
parefldovoltage=45
cddpo=0x0000
boardnum=01
size: 1343 bytes (31425 left)
*** command status = 0
CFE>


BTW, the 'Show' command exists but 'show devices' doesn't and I can hit any other options for 'show'

From what I'm reading, I need a GOOD wholeflash file from a WVN2000v2, then hack it around to flash to this device. DOes anyone know where I might get hold of one of those?
swinster
DD-WRT Novice


Joined: 24 Jul 2014
Posts: 16

PostPosted: Sun Aug 31, 2014 20:12    Post subject: Reply with quote
I have a request - does anyone have good a WNR2000v2?

Looks like the only way I'm going to fix this is by write a good bit of code to the board_data partition, or so I believe.

Many thanks
notorious.dds
DD-WRT User


Joined: 24 May 2012
Posts: 376
Location: Michigan

PostPosted: Mon Sep 01, 2014 0:49    Post subject: Reply with quote
Well, if it gets down to it, I've got the board data for a WNR2000v3.

It's worth a shot if you have no access to the v2 data.
Malachi
DD-WRT Guru


Joined: 17 Jul 2012
Posts: 7209
Location: Columbus, Ohio

PostPosted: Mon Sep 01, 2014 1:12    Post subject: Reply with quote
The v3 is atheros the v2 is Broadcom.
Yea, it's worth a shot.

_________________
I am far from a guru, I'm barely a novice.
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Mon Sep 01, 2014 1:49    Post subject: Reply with quote
No, its not worth a shot using v3 board_data since the data is completely different.


board_data.bin
 Description:
WNR2000v2 board data

Download
 Filename:  board_data.bin
 Filesize:  64 KB
 Downloaded:  569 Time(s)


_________________
Kernel panic: Aiee, killing interrupt handler!
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum