Successful recovery of a semi-bricked WRT310N v2

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message
the1williegeorge
DD-WRT Novice


Joined: 25 Jan 2014
Posts: 4

PostPosted: Sat Jan 25, 2014 18:22    Post subject: Successful recovery of a semi-bricked WRT310N v2 Reply with quote
Yesterday, I revived a semi-bricked WRT310N v2 that was stuck in management mode after a failed attempt to install DD-WRT. I didn't find anyone else that had posted the procedure that I ended up using, so I'm posting it in hopes that it can help someone else.

On this router, management mode would not accept ANY firmware, including the Linksys stock one, from ANY browser (and I tried several browsers on several OSes, including IE8 on XP). Using tftp and quick timing, I could get it to accept a firmware, but it would always go back to management mode whether simply power cycled or 30-30-30 reset.

Forum posts implied that a serial connection was my only hope. Then I noticed that the management mode links for reboot and nvram erase looked like the do.htm page was sending command line instructions. Putting "ping 192.168.1.23" after the "cmd=" resulted in the router sending a ping packet to my laptop. (I was watching with Wireshark.) So I decided to try the serial console commands. Using the recommended "flash -ctheader : flash1.trx" command, the router would start the tftp connection, but Wireshark showed the "code pattern incorrect" error. Then I tried the "-noheader" variant just to see. This resulted in the router accepting most any firmware file via tftp. I sent everything from stock, to DD-WRT to tomato. However, it always then returned to management mode.

After quite a bit more searching and trying various combinations of commands (over the course of 24 hours), the one that wound up working was:

erase nvram;flash -noheader : flash1.trx;mtd unlock linux;mtd write flash1.trx linux;nvram commit

which I URL-encoded and appended to the cmd parameter to end up with:

http://192.168.1.1/do.htm?cmd=erase%20nvram%3Bflash%20-noheader%20%3A%20flash1.trx%3Bmtd%20unlock%20linux%3Bmtd%20write%20flash1.trx%20linux%3Bnvram%20commit

in my address bar. After entering that and sending a firmware file (actually sent a tomato build on accident when I meant to send the stock file), my ping started timing out then came back to TTL=64 instead of 100! A 30-30-30 got me into tomato's web interface, from which I "upgraded" to the stock firmware.

I now have a fully functional WRT310N v2 on the stock firmware. I hope this information helps someone else with a semi-bricked router.
Sponsor
Murrkf
DD-WRT Guru


Joined: 22 Sep 2008
Posts: 10894

PostPosted: Sun Jan 26, 2014 17:00    Post subject: Reply with quote
This looks interesting...
_________________
SIG:
I'm trying to teach you to fish, not give you a fish. If you just want a fish, wait for a fisherman who hands them out. I'm more of a fishing instructor. So See this:
http://i31.tinypic.com/24mz3ms.png

LOM: "If you show that you have not bothered to read the forum announcements or to follow the advices in them then the level of help available for you will drop substantially, also known as Murrkf's law.."
flipy
DD-WRT Novice


Joined: 04 May 2012
Posts: 36

PostPosted: Sun Jan 26, 2014 19:56    Post subject: Reply with quote
Would be nice to put it on the wiki if it works for more routers.
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7020

PostPosted: Mon Jan 27, 2014 3:01    Post subject: Reply with quote
Murrkf wrote:
This looks interesting...


This looks totally wrong, some of those cmds can not work in conjunction with the others since some of them are CFE only cmds while others are Linux only cmds.
the1williegeorge
DD-WRT Novice


Joined: 25 Jan 2014
Posts: 4

PostPosted: Mon Jan 27, 2014 3:08    Post subject: Some may be wrong... Reply with quote
I admit that, after several hours of trying, I just started adding commands. I acknowledge that some may have not been needed, but that was the command line that I had in the address bar when it started working. If any of you know which ones were actually the ones that did anything, please add that info here!
t1er
DD-WRT Novice


Joined: 31 Jan 2014
Posts: 1

PostPosted: Fri Jan 31, 2014 1:01    Post subject: Reply with quote
This method seems to get me closest to unbricking the WRT310N v2. The command link works and directly after sending the command, tftp will accept a firmware file. The pings go dark, but after 10-15 seconds, it comes back with TTL=100 still and nothing has changed. Any ideas?
NoobWRT
DD-WRT User


Joined: 24 Mar 2012
Posts: 355
Location: 35.2269° N, 80.8433° W

PostPosted: Fri Jan 31, 2014 15:43    Post subject: Reply with quote
Murrkf wrote:
This looks interesting...


Shocked Why do people do unnecessary commands? Lmao. No wonder these routers go sour.
the1williegeorge
DD-WRT Novice


Joined: 25 Jan 2014
Posts: 4

PostPosted: Sat Feb 01, 2014 3:47    Post subject: Reply with quote
I did unnecessary commands because I was guessing. This router was sour before I started trying random commands.

I would very much like someone who knows more to clean this up into a real procedure.

For the guy trying to unbrick the router, try sending the nvram commit part separately once it comes back at TTL=100 after taking the firmware. Leery me know how that goes.
G33K
DD-WRT Novice


Joined: 27 Oct 2008
Posts: 7

PostPosted: Thu Apr 03, 2014 8:06    Post subject: Reply with quote
A huge kudos to the1williegeorge for posting this!!!

My stock router is a WRT310Nv2-CC which would not accept the dd-wrt firmware despite following the wiki to the letter. After lots and lots of googling found out that the cause is possibly the "-CC" which from what I understand was a distribution by comcast, (surprisingly the local microcenter store had loads of these for dirt cheap but they all turned out to be -CC, seems comcast offloaded a bunch of these left overs)

Anyway, I followed the OP's instructions and running the command let me tftp firmware to the router. I tried a bunch of them, including the trailed firmware but in the end what worked was the the dd-wrt.v24-14929_NEWD-2_K2.6_std_nokaid_small.bin.

In hindsight, the other firmwares might have worked too but its possible that I didn't wait long enough after sending the firmware and for me the pings started timing out after sending the firmware and never came back, the last one I ended up waiting a whole 10 minutes before rebooting the router and lo and behold, I was in dd-wrt!!

For the record, the link/command I used was:
http://192.168.1.1/do.htm?cmd=nvram+erase%3Bflash+-noheader+%3A+flash1.trx%3Bmtd+unlock+linux%3Bmtd+write+flash1.trx+linux%3Bnvram+commit

I read the comments about the commands being mixed between cte and linux, not too savvy about that, point is, it worked for me even with the commands mixed up. This definitely would be useful on the wiki!
the1williegeorge
DD-WRT Novice


Joined: 25 Jan 2014
Posts: 4

PostPosted: Thu Apr 03, 2014 12:58    Post subject: Reply with quote
Glad I could help!

As to the mixed up commands, I still wish that someone with the system-level knowledge to decipher this would look over my original post and G33K's post and tell us which parts of it actually did something. Then maybe it would be clean enough to be useful in other research on these and maybe other routers.
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum