Flashing WNDR4300 SureWest with dd-wrt

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Atheros WiSOC based Hardware
Goto page 1, 2, 3  Next
Author Message
simcode.com
DD-WRT Novice


Joined: 29 Apr 2013
Posts: 5

PostPosted: Mon Apr 29, 2013 9:45    Post subject: Flashing WNDR4300 SureWest with dd-wrt Reply with quote
Hi!

I have a NetGear WNDR4300. The firmware displays it as WNDR4300SW. I've tried flashing dd-wrt and NetGear firmware using the web interface. It always fails. I assume because the image header is incorrect.

Is there any way I can flash the SW firmware with dd-wrt? Should using TFTP work?

So far all my attempts have failed. I have not been able to locate a copy of the SW image to try it. It's currently using:

WNDR4300-v1.0.0.2SW

Thanks.
Sponsor
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7095

PostPosted: Mon Apr 29, 2013 9:53    Post subject: Reply with quote
Tftp will not work, it does also check the software id.

You'll either need to provide Brainslayer with a firmware update file or retrieve the id string from the router. Google Netgear telnet backdoor and see if you can get into the router that way.
I can tell you how to dump the software id string once you have shell access in telnet.
simcode.com
DD-WRT Novice


Joined: 29 Apr 2013
Posts: 5

PostPosted: Thu May 02, 2013 3:18    Post subject: Reply with quote
Thank you!

I'm able to get a response using Telnet. It comes back saying OpenWrt and I have root access:

root@WNDR4300SW/#

What's the next step?

I'm guessing that the Software ID code from the current firmware needs to be inserted into the new firmware to fool the software check. Something like that.
Drew80
DD-WRT Novice


Joined: 19 Jun 2013
Posts: 1

PostPosted: Wed Jun 19, 2013 10:48    Post subject: Reply with quote
I know this is an old ass post but I am also looking for assistance with the same router from my ISP Surewest. I would love to turn the router into an actual useful router but of course I can't load any firmware on it. I have obtained telnet access and as simcode said it is showing that it has OpenWRT. Can someone help me with getting DD-WRT on this thing because I am 99.99% sure its a WNDR4300 with my ISP's custom firmware.
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7095

PostPosted: Wed Jun 19, 2013 11:08    Post subject: Reply with quote
Show me a dmesg output directly after booting the router, I need only to see the early part where mtd partition sizes and names are displayed.
_________________
I'm on a whiskey diet, lost 3 days already
simcode.com
DD-WRT Novice


Joined: 29 Apr 2013
Posts: 5

PostPosted: Mon Jun 24, 2013 5:08    Post subject: NetGear WNDR4300SW dmesg dump Reply with quote
Thank you! I'm still around, and appreciate the assist.

The dmesg command results down to the partition names and ranges:

root@WNDR4300SW:/# dmesg
Linux version 2.6.31 (root@dnixm-compiler1) (gcc version 4.3.3 (GCC) ) #1 Thu Nov 8 13:26:11 CST 2012
flash_size passed from bootloader = 0
CPU revision is: 0001974c (MIPS 74Kc)
ath_sys_frequency: cpu srif ddr srif cpu 560 ddr 400 ahb 200
Determined physical RAM map:
memory: 08000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
Normal 0x00000000 -> 0x00008000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00008000
On node 0 totalpages: 32768
free_area_init_node: node 0, pgdat 80304a60, node_mem_map 81000000
Normal zone: 256 pages used for memmap
Normal zone: 0 pages reserved
Normal zone: 32512 pages, LIFO batch:7
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512
Kernel command line: console=ttyS0,115200 rootfstype=squashfs board=WNDR4300 mtdparts=ath-nand:256k(u-boot)ro,256k(u-boot-env)ro,256k(caldata),512k(pot),2048k(language),512k(config),3072k(traffic_meter),1152k(kernel),24448k(rootfs),25600k@0x6c0000(firmware),256k(caldata_backup),-(reserved)
PID hash table entries: 512 (order: 9, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 126364k/131072k available (2591k kernel code, 4520k reserved, 499k data, 156k init, 0k highmem)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 279.55 BogoMIPS (lpj=559104)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
PCI init:ath_pcibios_init
ath_pcibios_init(294): PCI CMD write: 0x356
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:00.0: reg 10 64bit mmio: [0x000000-0x01ffff]
pci 0000:00:00.0: reg 30 32bit mmio: [0x000000-0x00ffff]
pci 0000:00:00.0: supports D1
pci 0000:00:00.0: PME# supported from D0 D1 D3hot
pci 0000:00:00.0: PME# disabled
Returning IRQ 64
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
Initializing usb led semaphore
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2 (NAND) (ZLIB) (RTIME) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 247
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
Atheros on-chip NAND FLash Controller Driver, Version 0.1 (c) 2010 Atheros Communications, Ltd.
Ath Nand ID[878555a0]: 2c:f1:80:95:02
ONFI MICRON MT29F1G08ABADAWP
Micron NAND 128MiB 3,3V 8-bit [128MB]
12 cmdlinepart partitions found on MTD device ath-nand
Creating 12 MTD partitions on "ath-nand":
0x000000000000-0x000000040000 : "u-boot"
0x000000040000-0x000000080000 : "u-boot-env"
0x000000080000-0x0000000c0000 : "caldata"
0x0000000c0000-0x000000140000 : "pot"
0x000000140000-0x000000340000 : "language"
0x000000340000-0x0000003c0000 : "config"
0x0000003c0000-0x0000006c0000 : "traffic_meter"
0x0000006c0000-0x0000007e0000 : "kernel"
0x0000007e0000-0x000001fc0000 : "rootfs"
mtd: find squashfs magic at 0x7e0000 of "ath-nand"
the correct location of partition "rootfs": 0x0000007e0000-0x000001fc0000
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=1080000, len=F40000
0x000001080000-0x000001fc0000 : "rootfs_data"
0x0000006c0000-0x000001fc0000 : "firmware"
0x000001fc0000-0x000002000000 : "caldata_backup"
0x000002000000-0x000008000000 : "reserved"
====== NAND Parameters ======
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7095

PostPosted: Mon Jun 24, 2013 13:19    Post subject: Reply with quote
log in via telnet and do:

cat /dev/mtd/7 | more

and look for something similar to U12H181T00_NETGEAR (just as example, that board-id is for WNDR4000)

_________________
I'm on a whiskey diet, lost 3 days already
simcode.com
DD-WRT Novice


Joined: 29 Apr 2013
Posts: 5

PostPosted: Mon Jun 24, 2013 16:29    Post subject: WNDR4300SW cat /dev/mtd/7 Reply with quote
I tried:

cat /dev/mtd/7 | more

Returns empty lines with a single tilde '~'.

I see there is no folder /dev/mtd/7, but there is a folder /dev/mtd7, so I tried that.

Same result. Blank line with a single tilde '~'.

I expected to see the contents of the partition listed a screen at a time.

Did I do something wrong>
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7095

PostPosted: Mon Jun 24, 2013 17:44    Post subject: Reply with quote
My error - the firmware header containing the board-id is of course stripped off before storing the firmware in flash.

The info should be there in either the caldata or the config partition, ie mtd2 or mtd5.

_________________
I'm on a whiskey diet, lost 3 days already
simcode.com
DD-WRT Novice


Joined: 29 Apr 2013
Posts: 5

PostPosted: Tue Jun 25, 2013 2:51    Post subject: WNDR4300SW caldata & config Reply with quote
I didn't find much in caldata. Config is filled with values, but a search for 'board_id' or '_NETGEAR' had no matches.

I see the board_id is stored in NVRAM. So far I haven't found the proper incantation to make it materialize.

I'll recheck.
badtlc
DD-WRT Novice


Joined: 08 Feb 2014
Posts: 2

PostPosted: Sat Feb 08, 2014 17:19    Post subject: Reply with quote
I'm in the same boat with this WNDR4300SW (surewest specific version). Did this get resolved?
badtlc
DD-WRT Novice


Joined: 08 Feb 2014
Posts: 2

PostPosted: Fri Feb 14, 2014 20:35    Post subject: Reply with quote
What about just flashing this router with the standard firmware? Would anyone be able to help with that?
gueriLLaPunK
DD-WRT Novice


Joined: 20 Sep 2010
Posts: 19

PostPosted: Tue Apr 01, 2014 21:03    Post subject: Reply with quote
Bump. You can't flash to a stock firmware since the SW firmware checks for it.

I found some info regarding an older SureWest router that had the same issue. They replaced the header information and deleted one byte and were able to flash to any firmware (openWRT in this case)

https://forum.openwrt.org/viewtopic.php?id=39142

The firmware that's linked in that thread doesn't work on the 4300. Is someone here able to replicate their efforts? I do not possess the technical skill to do it myself.

Quote:
1. Grab the firmware image you want to flash to.
2. Replace the 128 byte header with one from the existing firmware using a hex editor.
3. Delete the last byte of the modified firmware.
4. Use the appendsum script below (from the firmware source package) to append a new checksum byte: appendsum <firmware-mod-no-crc.img> <firmware-mod.img>
gueriLLaPunK
DD-WRT Novice


Joined: 20 Sep 2010
Posts: 19

PostPosted: Wed Jul 16, 2014 21:04    Post subject: Reply with quote
gueriLLaPunK wrote:
Bump. You can't flash to a stock firmware since the SW firmware checks for it.

I found some info regarding an older SureWest router that had the same issue. They replaced the header information and deleted one byte and were able to flash to any firmware (openWRT in this case)

https://forum.openwrt.org/viewtopic.php?id=39142

The firmware that's linked in that thread doesn't work on the 4300. Is someone here able to replicate their efforts? I do not possess the technical skill to do it myself.

Quote:
1. Grab the firmware image you want to flash to.
2. Replace the 128 byte header with one from the existing firmware using a hex editor.
3. Delete the last byte of the modified firmware.
4. Use the appendsum script below (from the firmware source package) to append a new checksum byte: appendsum <firmware-mod-no-crc.img> <firmware-mod.img>


Bump. Anyone have the technical skills to do the above steps?
betterjonshipman
DD-WRT Novice


Joined: 28 Jul 2014
Posts: 6

PostPosted: Mon Jul 28, 2014 3:58    Post subject: Reply with quote
Flash this:

[url]https://mega.co.nz/#!B55x0BhS!5Oh3u9aSiIbLPWCAJ4vxmp3m2RzpsMOpRFCpS6g_j5k[/url]

Downloaded the source from here: ftp://downloads.netgear.com/files/GPL/ then compiled it, copied the header over to the default.img from dd-wrt, appendsum the chkbit and it flashed fine.

The WAN took a few reboots to work, but that could have been my hardware. Posting from it now and speedtest comes in an a solid 30Mpbs (my cap).

If you feel the need to buy me a beer, http://jonshipman.com/ (my paypal is email on the top right)
Goto page 1, 2, 3  Next Display posts from previous:    Page 1 of 3
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Atheros WiSOC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum