WNDR3400 Pin short-how to

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Goto page 1, 2, 3  Next
Author Message
juanpedro012
DD-WRT Novice


Joined: 04 Nov 2011
Posts: 5

PostPosted: Thu Apr 19, 2012 16:35    Post subject: WNDR3400 Pin short-how to Reply with quote
I have pieced this how to-- together from various sources since I bricked my WNDR3400v1 after using this svn http://www.dd-wrt.com/site/support/other-downloads?path=others%2Feko%2FV24-K26%2Fsvn18946%2F build. Or I partially bricked it, if that is possible, since I received an orange light upon rebooting the router....

I was able to ping the router and briefly get a ttl=100 response which means that the router was waiting to be flashed, essentially. I was never able to flash the router though until I tried the pin short method I am about to explain, a little. Hopefully, this helps someone out.


1. Get the original WNDR3400 firmware (http://www.downloads.netgear.com/files/WNDR3400-V1.0.0.34_15.0.42.chk)

2. You need to open up the router casing, which means removing the six screws on the bottom of the router.

3. Connect a computer’s network cable to one of the router’s LAN interfaces. (not the wan port)

4. Configure your computer’s network interface with the following address information:

IP address: 192.168.1.10
Subnet Mask: 255.255.255.0
Default Gateway: 192.168.1.1

5. From your computer execute the following command:

ping 192.168.1.1 -t

6. Power ON the router

Once the router responds with a reply from 192.168.1.1 ping, short the pins as shown on the picture below. I used a phillips screwdriver to perform the short.


6. The router should start to continuously reply to PING or the power light will turn YELLOW and start to flash.

7. Use your desired tftp program to flash the router. I used tftp2 since it was easier. All you need to do is set the server line to: 192.168.1.1 and choose the file you want to flash with i.e. WNDR3400-V1.0.0.34_15.0.42.chk. http://www.shadowsoftware.net/shadowgameworld/downloads/tftp2.exe

Once finished you should see something like flash successfully completed and then you need to reboot the router.

Lastly, I am not an expert so do this at your own risk. It worked for me but it might not for you. I only tried it because I did not want to solder. Of course, if your router is bricked it may not matter to you.



Netgear_WNDR3400d.JPG
 Description:
WNDR3400v1 pin short picture
 Filesize:  639.81 KB
 Viewed:  35298 Time(s)

Netgear_WNDR3400d.JPG


Sponsor
wats6831
DD-WRT User


Joined: 20 Apr 2010
Posts: 205

PostPosted: Thu Apr 19, 2012 18:53    Post subject: Reply with quote
so what exactly is happening when we short these two pins on these Netgear flash chips?

Can you explain what exactly is happening.
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 12992
Location: Behind The Reset Button

PostPosted: Thu Apr 19, 2012 20:42    Post subject: Reply with quote
I too would like to know the "science" about how shorting:

pin 16 = SCLK (Clock Input)
Pin 15 = SI/SIO0 (Serial Data Input (for 1 x I/O) / Serial Data Input & output (for 2xI/O read Mode))

would do anything.. Maybe LOM could explain assuming it worked and the OP didn't just get lucky.

This is a serial flash chip. It is not like shorting a couple of address lines on a parallel chip.

_________________
[Moderator Deleted] Shocked
juanpedro012
DD-WRT Novice


Joined: 04 Nov 2011
Posts: 5

PostPosted: Thu Apr 19, 2012 20:43    Post subject: Reply with quote
The two articles below are what gave me the idea. Perhaps, the links can give you some insight.

http://www.myopenrouter.com/article/20501/Reset-Debrick-NETGEAR-WNR3500L-Pin-Short-Method/

http://www.dd-wrt.com/phpBB2/viewtopic.php?p=496526&highlight=#496526

Frankly, all I know is that it worked. I figured I had nothing to lose. So I just did it and hoped for the best. Maybe someone with more expertise could explain.
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 12992
Location: Behind The Reset Button

PostPosted: Thu Apr 19, 2012 21:21    Post subject: Reply with quote
i'm not being critical.. I just want to know (assuming it does work), what makes it work.

possibly by shorting the data line, the processor thinks the kernel is corrupt. For this to happen, the cfe has to be loaded and running so timing would be critical.

dunno..

_________________
[Moderator Deleted] Shocked
juanpedro012
DD-WRT Novice


Joined: 04 Nov 2011
Posts: 5

PostPosted: Thu Apr 19, 2012 22:17    Post subject: Reply with quote
barryware wrote:
i'm not being critical.. I just want to know (assuming it does work), what makes it work.

possibly by shorting the data line, the processor thinks the kernel is corrupt. For this to happen, the cfe has to be loaded and running so timing would be critical.

dunno..


I did not even know that you had posted until I submitted my reply to wats6831. I did not think that you were being critical even after I read your post, either. Of course, after I read my post, seeing yours too, I can see how mine might have sounded rude, I did not mean for it to come off as curt....

As for why it works, I am with you since I'd like to know how since I just went off a hunch and hope.
Very Happy
wats6831
DD-WRT User


Joined: 20 Apr 2010
Posts: 205

PostPosted: Fri Apr 20, 2012 2:23    Post subject: Reply with quote
Well I"m interested in LOM's take on this since I just recovered a WNR2000 by shorting the serial flash chip and if it also works on this one, I'm wondering if it may also work on the WNR35000 series. If so then we may have found a reliable way to debrick these routers without serial.
Dark_Shadow
DD-WRT Guru


Joined: 31 Aug 2009
Posts: 2430
Location: Third Rock from the Sun

PostPosted: Fri Apr 20, 2012 4:41    Post subject: Reply with quote
wats6831 wrote:
Well I"m interested in LOM's take on this since I just recovered a WNR2000 by shorting the serial flash chip and if it also works on this one, I'm wondering if it may also work on the WNR35000 series. If so then we may have found a reliable way to debrick these routers without serial.
Dunno bout reliable. 50/50 shot at toasting it.
_________________
Peacock Thread-FAQ -- Firmware Recommendations -- dd-wrt Wiki

Testing Multiple Routers -- Bootloader Collection Project -- My Wiki
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7618

PostPosted: Fri Apr 20, 2012 7:11    Post subject: Reply with quote
wats6831 wrote:
Well I"m interested in LOM's take on this since I just recovered a WNR2000 by shorting the serial flash chip and if it also works on this one, I'm wondering if it may also work on the WNR35000 series. If so then we may have found a reliable way to debrick these routers without serial.


Nah, I don't think you want to hear my opinion about it..

What you are asking for is my opinion about users who are too cheap to buy themselves a 3-4$ CA-42 adapter and do a safe recovery and instead are gambling the value of their router.
I do have some opinion about them but I'd better leave that out. Wink

_________________
Kernel panic: Aiee, killing interrupt handler!
wats6831
DD-WRT User


Joined: 20 Apr 2010
Posts: 205

PostPosted: Fri Apr 20, 2012 13:48    Post subject: Reply with quote
I didn't mean your opinion of the user's, I'm pretty sure I know what that is. I meant your take on what actually is happening when the pins are shorted and why it seems to induce an extended period of recovery mode or management mode or whatever.

And also why it may NOT be a good idea.
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 12992
Location: Behind The Reset Button

PostPosted: Fri Apr 20, 2012 14:01    Post subject: Reply with quote
you will only see posts about a successful "pin short" recovery.

you will never see a post from a user who pin shorted his router and toasted it completely.

A lot of users send me their routers to fix. most (not all) routers that can not be recovered have been pin shorted. The owner will deny it until I explain that I can see the marks on the chip pins. Then they will "remember".

The solder is relatively soft.. Good lighting and a good magnification, it is easy to see the "dented" solder from pin shorting.

There are a couple of posts on the forum in which a pin short was recommended by another user and when the owner preformed said "pin short", completely fubared his router.

Sooo.. I do not and never have attempted or recommended a pin short. LOM is correct.. 3 ~ 5 bucks for a serial adapter and you run no risk of doing any permanent damage to the router, you learn a bit, you have fun, and you are prepared for next time.

_________________
[Moderator Deleted] Shocked
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7618

PostPosted: Fri Apr 20, 2012 14:49    Post subject: Reply with quote
wats6831 wrote:
I didn't mean your opinion of the user's, I'm pretty sure I know what that is. I meant your take on what actually is happening when the pins are shorted and why it seems to induce an extended period of recovery mode or management mode or whatever.

And also why it may NOT be a good idea.


Google the topic in dd-wrt, I have explained it a couple of times in the past and am not interested in repeating it twice every year when yet another user posts about pin-shorting as a debrick solution.
It's like debating with the religious..

_________________
Kernel panic: Aiee, killing interrupt handler!
deviouswun
DD-WRT User


Joined: 03 Aug 2012
Posts: 98
Location: USA

PostPosted: Fri Aug 03, 2012 22:41    Post subject: Another 3400 pin success Reply with quote
This is my first post to this forum and most likely my last.
I bricked my Netgear WNDR3400v1 a couple of days ago and have been trying unsuccessfully to un-brick it using the tftp method.

To get a ping I would have to hold the reset on the router then plug it in, wait 30 seconds, release the reset button and then I would get 3 or 4 ttl 100.

I tried in vain to get tftp2 to transfer the WNDR3400-V1.0.0.34_15.0.42.chk file to my 3400v1.

I was about to travel down the serial/jtag route but gave up that idea due to my lack of soldering experience when I stumbled across this pin-short method.

Having already ordered another WNDR3400 from NewEgg (for $36.00! Why not?), spending $5 for a cable was not an issue,
I decided to give this pin method a try; I’m not big on soldering.

After spending about an hour reading and re-re-reading everyone’s post on this page
I decided to go for it.

So I got my file ready to tfp to the 3400v1 using tftp2.
First I started pinging the 3400v1 at 192.168.1.1
Then while pressing the reset button I plugged in the 3400v1 and kept the reset pressed in for 30 sec.
I then released the reset button, and when the first ping ttl 100 showed on my command prompt I shorted the pins as shown on the
picture attached by juanpedro012 from his post dated Apr. 19th 2012, ( thanks juanpedro012 ).

To my surprise the 3400v1 started pinging TTLs.
I removed the short from the pins and hit Upgrade on tftp2.
The original 3400v1 firmware was copied to the router and I waited until the lights returned to normal to reboot the 3400v1.
I next brought up Internet Explorer, entered the 3400v1 ip. address in the address bar and
SUCCESS I could login into my 3400v1 again using the default Netgear login info.

While I know this method is frowned upon by the purest, and most likely won’t work for other routers, it did work for me. I just wanted to add my 2 cents. Very Happy


Last edited by deviouswun on Tue Feb 10, 2015 20:18; edited 3 times in total
zuken
DD-WRT Novice


Joined: 18 Apr 2013
Posts: 4

PostPosted: Sun Apr 21, 2013 21:32    Post subject: Reply with quote
THANKS! to all of you.

I was able to recover my router with the instruction here.

Big thanks Laughing
JavaGuy147
DD-WRT Novice


Joined: 05 May 2013
Posts: 9
Location: Philadelphia, PA

PostPosted: Sun May 05, 2013 22:31    Post subject: Worked! Reply with quote
The pin shorting method above worked great for me! Thanks!
Goto page 1, 2, 3  Next Display posts from previous:    Page 1 of 3
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum