TJTAG - EJTAG De-Brick tool - IMPORTANT CHANGE:See 1st Post.

Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Index -> General Questions
Goto page Previous  1, 2, 3 ... 28, 29, 30 ... 82, 83, 84  Next
Author Message
edheldur
DD-WRT Novice


Joined: 19 Oct 2008
Posts: 5

PostPosted: Mon Oct 20, 2008 18:15    Post subject: Reply with quote
Can anybody send me the cfe.bin for a wrt54gs v7?:

C:\tag>tjtagv2 -probeonly /noemw

==========================================
EJTAG Debrick Utility v2.1.4-Tornado-MOD
==========================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 00100101001101010100000101111111 (2535417F)
*** Found a Broadcom BCM5354 KFBG Rev 2 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000010000100100000100 (00810904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS16 MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Probing Flash at (Flash Window: 0x1fc00000) ... Done

Flash Vendor ID: 00000000000000000000000011101100 (000000EC)
Flash Device ID: 00000000000000000010001001110111 (00002277)
*** Found a K8D1716UBC 1Mx16 BotB (2MB) Flash Chip ***

- Flash Chip Window Start .... : 1fc00000
- Flash Chip Window Length ... : 00200000
- Selected Area Start ........ : 00000000
- Selected Area Length ....... : 00000000



*** REQUESTED OPERATION IS COMPLETE ***
Sponsor
dragonmas
DD-WRT Novice


Joined: 28 Sep 2008
Posts: 9

PostPosted: Mon Oct 20, 2008 23:44    Post subject: WRT54G-TM Reply with quote
Finally unbricked my WRT54G-TM.Probably took the long way around but got it back to stock firmware.

Took another TM and soldered on a header.Used tjtag and read/saved stock cfe,nvram and kernel.Flashed these to the bricked router.Reset router from the back.Logged into router and used clone function to set mac to orginal.

kernel took 4.6 hours to flash.
johnboi
DD-WRT Novice


Joined: 08 Aug 2008
Posts: 5

PostPosted: Thu Oct 23, 2008 7:01    Post subject: Reply with quote
I still have a bricked wrt54glv1.1 I have erased the wholeflash, flashed the cfe from skynets backed up the cfe and compared the 2 cfe files and they match. The router has a flashing power light and the lan leds are on. I cannot ping the router in fact even plugging into the lan ports shows no leds on the switch indicating that the lan side of the router is dead. I have tried a wholeflash by downloading the dd-wrt.v24_micro_generic.bin changing the name to wholeflash and flashing it still does not work. What can I now try?
redhawk0
DD-WRT Guru


Joined: 04 Jan 2007
Posts: 11563
Location: Wherever the wind blows- North America

PostPosted: Thu Oct 23, 2008 14:17    Post subject: Reply with quote
johnboi wrote:
I still have a bricked wrt54glv1.1 I have erased the wholeflash, flashed the cfe from skynets backed up the cfe and compared the 2 cfe files and they match. The router has a flashing power light and the lan leds are on. I cannot ping the router in fact even plugging into the lan ports shows no leds on the switch indicating that the lan side of the router is dead. I have tried a wholeflash by downloading the dd-wrt.v24_micro_generic.bin changing the name to wholeflash and flashing it still does not work. What can I now try?


No...you need to make the micro_generic.bin file the kernel.bin file...not wholeflash.

wholeflash always overwrites (or erases) the CFE part.

So now....do an -erase:wholeflash twice then reflash your cfe...then load the micro_generic.bin as the kernel.bin.


redhawk

_________________
The only stupid question....is the unasked one.
he6y3u
DD-WRT Novice


Joined: 19 Oct 2008
Posts: 3

PostPosted: Sat Oct 25, 2008 16:00    Post subject: Reply with quote
@Tornado
I can not erase two first blocks in flash and I can not flash in this block with key /noerase Sad...
My flash chip is marked as Spansion S29GL032A, (http://www.spansion.com/datasheets/s29gl-a_00_a12_e.pdf ).
Please, add this chip in next version of tjtagv2.
woyoubenben
DD-WRT Novice


Joined: 29 Apr 2008
Posts: 7

PostPosted: Sun Oct 26, 2008 9:17    Post subject: F5d7231-4 spansion s29al016m 2M flash Memory can't use Tjtag Reply with quote
F5d7231-4 spansion s29al016m 2M flash Memory can't use Tjtag....

TJTAG did not support spansion s29al016m 2M flash Memory ?
dragonmas
DD-WRT Novice


Joined: 28 Sep 2008
Posts: 9

PostPosted: Mon Oct 27, 2008 3:10    Post subject: wrt54glv1.1 Reply with quote
backed up the cfe,nvram and kernel.Tried to flash
a talisman bin for this version.Flash failed and now got flashing power and 5 solid leds.tried to reflash
cfe and stall out at aboy 4%.Nvram does same.??
woyoubenben
DD-WRT Novice


Joined: 29 Apr 2008
Posts: 7

PostPosted: Mon Oct 27, 2008 13:27    Post subject: Reply with quote
unfortunately I did not backup any BIN,So its a brick now
Eko
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 5771

PostPosted: Mon Oct 27, 2008 13:55    Post subject: Reply with quote
woyoubenben wrote:
unfortunately I did not backup any BIN,So its a brick now

try these



cfe.bin
 Description:

Download
 Filename:  cfe.bin
 Filesize:  128 KB
 Downloaded:  954 Time(s)


cfe.bin
 Description:

Download
 Filename:  cfe.bin
 Filesize:  128 KB
 Downloaded:  785 Time(s)

woyoubenben
DD-WRT Novice


Joined: 29 Apr 2008
Posts: 7

PostPosted: Mon Oct 27, 2008 13:57    Post subject: Reply with quote
Now it seen flashing, I use "TJTAGV2 -FLASH:WHOLEFLASH /FC:04 /BYPASS...but i dont know if router will work well.

Sorry for my English.
woyoubenben
DD-WRT Novice


Joined: 29 Apr 2008
Posts: 7

PostPosted: Mon Oct 27, 2008 14:00    Post subject: Reply with quote
thank Eko
,after flashing wholeflash,i will try the CFE you give
dragonmas
DD-WRT Novice


Joined: 28 Sep 2008
Posts: 9

PostPosted: Mon Oct 27, 2008 15:33    Post subject: Re: wrt54glv1.1 Reply with quote
dragonmas wrote:
backed up the cfe,nvram and kernel.Tried to flash
a talisman bin for this version.Flash failed and now got flashing power and 5 solid leds.tried to reflash
cfe and stall out at aboy 4%.Nvram does same.??


got the leds back to off, power light flashing.Is this bad cfe flash?
woyoubenben
DD-WRT Novice


Joined: 29 Apr 2008
Posts: 7

PostPosted: Mon Oct 27, 2008 16:21    Post subject: Re: wrt54glv1.1 Reply with quote
dragonmas wrote:
dragonmas wrote:
backed up the cfe,nvram and kernel.Tried to flash
a talisman bin for this version.Flash failed and now got flashing power and 5 solid leds.tried to reflash
cfe and stall out at aboy 4%.Nvram does same.??


got the leds back to off, power light flashing.Is this bad cfe flash?


All 4 LAN leds on my F5D7231-4 is red,WAN led red/green by chance.No flashing leds
mexus
DD-WRT User


Joined: 25 Apr 2007
Posts: 51

PostPosted: Wed Oct 29, 2008 18:34    Post subject: Reply with quote
I'm trying to JTAG bricked Netgear WNR834b v2.

I have tried setting LTP mode to Normal, EPP, ECP, EPP+ECP, still nothing.
The only respose i got is:
Quote:
==========================================
EJTAG Debrick Utility v2.1.4-Tornado-MOD
==========================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 11111111111111111111111111111111 (FFFFFFFF)
*** Unknown or NO CPU Chip ID Detected ***

*** Possible Causes:
1) Device is not Connected.
2) Device is not Powered On.
3) Improper JTAG Cable.
4) Unrecognized CPU Chip ID.
When the route is ON

Quote:

==========================================
EJTAG Debrick Utility v2.1.4-Tornado-MOD
==========================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** Unknown or NO CPU Chip ID Detected ***

*** Possible Causes:
1) Device is not Connected.
2) Device is not Powered On.
3) Improper JTAG Cable.
4) Unrecognized CPU Chip ID.

When the router is OFF


CPU: Broadcom BCM4704KPBG
Memory: MX 29LV320CBTC-90G

Please help me.

The JTAG cable i use
J12 1 to J1 1 using 100 ohm (a pair of 200 ohm).
J12 3 to LTP 2 using 100 ohm (a pair of 200 ohm).
J12 5 to LTP 13 using 100 ohm (a pair of 200 ohm).
J12 7 to LTP 4 using 100 ohm (a pair of 200 ohm).
J12 9 to LTP 3 using 100 ohm (a pair of 200 ohm).
J12 10 to LTP 20 and 25 (also tried connecting to ground of LTP).

Cable length is about 60cm (~33inch) I used patch cable.

edit: the same with 8 inch cable.


I have checked the soldering many times and it's fine.
Tried under Ubuntu 8.04 and WindowsXP, still the same.
You can see pictures of my JTAG here:
https://www.dd-wrt.com/phpBB2/viewtopic.php?p=222425#222425
(there are pretty big)

edit: I got a my friend's wnr834b v2 running DD-WRT (installed by me) here is the output of tjtag
Quote:

~$ sudo rmmod lp
~$ sudo ./tjtagv2 -probeonly

==========================================
EJTAG Debrick Utility v2.1.4-Tornado-MOD
==========================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 10010100011100000100000101111111 (9470417F)
*** Found a Broadcom BCM4704 KPBG Rev 9 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Probing Flash at (Flash Window: 0x1fc00000) ... Done

Flash Vendor ID: 00000000000000000000000011000010 (000000C2)
Flash Device ID: 00000000000000000010001010101000 (000022A8)
*** Found a MX29LV320B 2Mx16 BotB (4MB) Flash Chip ***

- Flash Chip Window Start .... : 1fc00000
- Flash Chip Window Length ... : 00400000
- Selected Area Start ........ : 00000000
- Selected Area Length ....... : 00000000



*** REQUESTED OPERATION IS COMPLETE ***

R278,377,376,375,374 should be open!
So what's the deal with mine? Should i somehow short the memory so it's erased and i can connect with jtag or lan????
busterbrown77
DD-WRT Novice


Joined: 31 Oct 2008
Posts: 1

PostPosted: Fri Oct 31, 2008 22:12    Post subject: Reply with quote
labrat_x wrote:
That second command made quite a difference, but i still seem to be stuck. Here is the output the command produces.

D:\windows>tjtag.exe -erase:nvram /noreset

=================================================
WRT54G/GS EJTAG Debrick Utility v4.8-Tornado-MOD
=================================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 00010101001101010100000101111111 (1535417F)
*** Found a Broadcom BCM5354 KFBG Rev 1 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000010000100100000100 (00810904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes

Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done

Probing Flash at (Flash Window: 0x1fc00000) ... Done

*** Unknown or NO Flash Chip Detected ***

*** REQUESTED OPERATION IS COMPLETE ***

D:\windows>





sorry if im being a noob and didnt read this elsewhere but i flashed my wrt54gs v07 with the v08 fw and i think its bricked, it froze after the install then i unplugged it and the only working light is ethernet 1, no power, nothing. im trying to find this debricking tool but have no luck, please tell me where to find it and what to do to fix this.
Goto page Previous  1, 2, 3 ... 28, 29, 30 ... 82, 83, 84  Next Display posts from previous:    Page 29 of 84
Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Index -> General Questions All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum