DD-WRT :: View topic - TJTAG - EJTAG De-Brick tool

TJTAG - EJTAG De-Brick tool - IMPORTANT CHANGE:See 1st Post.

This topic is locked: you cannot edit posts or make replies.

DD-WRT Forum Index -> General Questions

Goto page Previous 1, 2, 3 ... 64, 65, 66 ... 82, 83, 84 Next

View previous topic :: View next topic

Author

Message

BlCa`
DD-WRT User

Joined: 16 Nov 2009
Posts: 135

Posted: Sat May 01, 2010 17:00 Post subject:

brainbone wrote:

BlCa` wrote:

hvandrie wrote:

2. Flashchip is an "MX25L6405-12G"

I second that request. I also need jtag support for this unit as I busted the CFE.

You could try adding an /fc:22.

Also, a /flash_debug will output more information on what tjtag is seeing for the flash device.

/fc:22 doesn't work. It looks like it does but it really reads/writes nothing from/on the flash chip. That's to be expected though as it isn't exactly the same flash chip model.
Also, /flash_debug is useless as it either outputs nothing (autodetect -> can't detect flash -> stops there) or has to be used forcing a known wrong flash chip.

Sponsor

akbor
DD-WRT Novice

Joined: 16 Apr 2010
Posts: 1

Posted: Sat May 08, 2010 21:45 Post subject: some news about the next TJTAG version?
Did anybody hear some news about the new TJTAG version? Im interested in support of 256 MBit Flashes, especially Spansion S29GL256P10TFI010 and Macronix MX29GL256EHT2I-90Q (used in RT-N16). Because /fc:91, Spansion S29GL256P U (32MB) in v 3.0.1 seems not to work properly

lijianch
DD-WRT User

Joined: 14 Jul 2007
Posts: 146

Posted: Sun May 09, 2010 21:46 Post subject:
I have a unit with two K8P3215UQB flash chips total capacity 8M. I can compile, jtag, and serial console. The CPU is Bcm6359. I can test the code here.

ser9ey
DD-WRT Novice

Joined: 30 Apr 2009
Posts: 26

Posted: Fri May 21, 2010 14:59 Post subject: bricked WRT54G2

Hello!
I have WRT54G2 v1.
Seems that there is broken flesh.
When turned on - all indicators light, no ping, no CFE prompt, quite on console.
TJTAG detecting processor, but can't detect flash, tells that flesh chip is absent or unknown.
Flesh chip is EN29LV160AB-70TCP. When put manualy /fc:05 or /fc:06 - it hangs.
and now tjtag do not detect SoC (all 000...0 or 111...1)
Could you advice what to do next?

lightix
DD-WRT User

Joined: 03 Dec 2008
Posts: 111

Posted: Tue May 25, 2010 9:52 Post subject:

I'm trying to erase/write flash EON EN29LV640L-90TIP over JTAG port Broadcom BCM5836PKPBG and tjtag v.3.01.
Program can't detect flash chip, but works with /fc:103 key. Also works with /bypass key.
Reads works perfectly, but writes/erases has no effect (program writes OK, but in flash nothing happens).

Thx for help
_________________
DD-WRT v24 sp2 MEGA on ASUS wl-520gc [with USB]

Last edited by lightix on Wed May 26, 2010 7:09; edited 1 time in total

lightix
DD-WRT User

Joined: 03 Dec 2008
Posts: 111

Posted: Wed May 26, 2010 7:08 Post subject:

JTAG Port

nTRST 1 14 GND
TDI 2 13 GND
TDO 3 12 GND
TMS 4 11 GND
TCK 5 10 GND
nSRST 6 9
7 8 VCC

I'm using this jtag cable, but connected ping 1 (nTRST) and pin 8 (VCC) on JTAG port, because by default nTRST has level "0":

Code:

# ./tjtag3 -probeonly

==============================================
EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 10010100011100000100000101111111 (9470417F)
*** Found a Broadcom BCM4704 KPBG Rev 9 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done

Probing Flash at (Flash Window: 0x1fc00000) ...
Done

*** Unknown or NO Flash Chip Detected ***

*** REQUESTED OPERATION IS COMPLETE ***

Code:

# ./tjtag3 -probeonly /fc:103

==============================================
EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 10010100011100000100000101111111 (9470417F)
*** Found a Broadcom BCM4704 KPBG Rev 9 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done

Manual Flash Selection ... Done

Flash Vendor ID: 00000000000000000000000001111111 (0000007F)
Flash Device ID: 00000000000000000010001011001001 (000022C9)
*** Manually Selected a EON EN29LV640 4Mx16 TopB (8MB) Flash Chip ***

- Flash Chip Window Start .... : 1c000000
- Flash Chip Window Length ... : 00800000
- Selected Area Start ........ : 00000000
- Selected Area Length ....... : 00000000

*** REQUESTED OPERATION IS COMPLETE ***

_________________
DD-WRT v24 sp2 MEGA on ASUS wl-520gc [with USB]

Last edited by lightix on Wed May 26, 2010 9:25; edited 1 time in total

ser9ey
DD-WRT Novice

Joined: 30 Apr 2009
Posts: 26

Posted: Wed May 26, 2010 7:25 Post subject:

lightix wrote:

I'm using this jtag cable, but connected ping 1 (nTRST) and pin 8 (VCC) on JTAG port, because by default nTRST has level "0":

Could you please describe where to connect pin "NC" on this JTAG cable? I didn't found such pin on router jtag port.

lightix
DD-WRT User

Joined: 03 Dec 2008
Posts: 111

Posted: Wed May 26, 2010 9:22 Post subject:

[quote="ser9ey"]

lightix wrote:

Could you please describe where to connect pin "NC" on this JTAG cable? I didn't found such pin on router jtag port.

Sorry, it was wrong image. Fixed.
_________________
DD-WRT v24 sp2 MEGA on ASUS wl-520gc [with USB]

ser9ey
DD-WRT Novice

Joined: 30 Apr 2009
Posts: 26

Posted: Wed May 26, 2010 10:10 Post subject:

lightix wrote:

Sorry, it was wrong image. Fixed.

Oh, I didn't connect pin 8 to 1.
How do you think, may it be the reason I can't properly autodetect flash and read/write it? In the same time, processor is been detected correctly.

lightix
DD-WRT User

Joined: 03 Dec 2008
Posts: 111

Posted: Wed May 26, 2010 10:38 Post subject:

ser9ey wrote:

Oh, I didn't connect pin 8 to 1.
How do you think, may it be the reason I can't properly autodetect flash and read/write it? In the same time, processor is been detected correctly.

No, I connect pin nRST to VCC because my processor didn't detected correctly.
_________________
DD-WRT v24 sp2 MEGA on ASUS wl-520gc [with USB]

lightix
DD-WRT User

Joined: 03 Dec 2008
Posts: 111

Posted: Thu May 27, 2010 4:21 Post subject:

Code:

# ./tjtag -probeonly /flash_debug

==============================================
EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 10010100011100000100000101111111 (9470417F)
*** Found a Broadcom BCM4704 KPBG Rev 9 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
spi_flash_read 0x1fc00000
spi_flash_mmr 0x00000000
spi_flash_mmr_size 0x00000000
spi_flash_ctl 0x18000040
spi_flash_opcode 0x18000044
spi_flash_data 0x18000048
spi_ctl_start 0x80000000
spi_ctl_busy 0x80000000

Probing Flash at (Flash Window: 0x1fc00000) ...

Debug AMD Vendid : 00000000000000000000000000000000 (00000000)
Debug AMD Devdid : 00000000000000000000000000000000 (00000000)

Debug SST Vendid : 00000000000000000000000000000000 (00000000)
Debug SST Devdid : 00000000000000000000000000000000 (00000000)

Debug BSC-SCS Vendid :00010000000000000000000000001001 (10000009)
Debug BCS-SCS Devdid :00000000000000000000000000000000 (00000000)
REGREAD32 data 0x00000000 spi_flash_mmr 0x00000000 reg 0x18000040
REG 0x18000044 REGWRITE32 0x0000049f
SPI_FLASH_OPCODE 0x18000044 PTR_OPCODE 0x0000049f
REG 0x18000040 REGWRITE32 0x8000049f
SPI_FLASH_CTL SEND -> 0x18000040 reg 0x8000049f
REGREAD32 data 0x0000049f spi_flash_mmr 0x00000000 reg 0x18000040
REGREAD32 data 0x00000000 spi_flash_mmr 0x00000000 reg 0x18000048

Debug SPI id : 00000000000000000000000000000000 (00000000)

Debug SPI Vendid : 00000000000000000000000000000000 (00000000)
Debug SPI Devdid : 00000000000000000000000000000000 (00000000)
Done

*** Unknown or NO Flash Chip Detected ***

*** REQUESTED OPERATION IS COMPLETE ***

_________________
DD-WRT v24 sp2 MEGA on ASUS wl-520gc [with USB]

lightix
DD-WRT User

Joined: 03 Dec 2008
Posts: 111

Posted: Thu May 27, 2010 9:46 Post subject:
How I can find flash base address? _________________ DD-WRT v24 sp2 MEGA on ASUS wl-520gc [with USB]

pball3485
DD-WRT Novice

Joined: 01 Jul 2006
Posts: 43

Posted: Tue Jun 01, 2010 22:28 Post subject: Success on Windows 7 x64

I would also like to post my findings regarding a testing version that Tornado made for 64 bit operating systems. I'm also using the Expresscard parallel/serial adapter linked earlier in this thread. (You have to disable driver signing, as MosChip hasn't released signed drivers for use with Windows 7 x64; that I know about at least.)

Code:

tjtag64.exe -probeonly /port:3000 /flash_debug

==============================================
EJTAG Debrick Utility v3.0.1 X64 Tornado-MOD
==============================================

Selected port = 0x3000

This is a 64bit system 1
Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 00010100011100010010000101111111 (1471217F)
*** Found a Broadcom BCM4712 Rev 1 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
spi_flash_read 0x1fc00000
spi_flash_mmr 0x00000000
spi_flash_mmr_size 0x00000000
spi_flash_ctl 0x18000040
spi_flash_opcode 0x18000044
spi_flash_data 0x18000048
spi_ctl_start 0x80000000
spi_ctl_busy 0x80000000

Probing Flash at (Flash Window: 0x1fc00000) ...

Debug AMD Vendid : 00000000000000000000000010001001 (00000089)
Debug AMD Devdid : 00000000000000000000000000010111 (00000017)
Done

Flash Vendor ID: 00000000000000000000000010001001 (00000089)
Flash Device ID: 00000000000000000000000000010111 (00000017)
*** Found a Intel 28F640J3 4Mx16 (8MB) Flash Chip ***

- Flash Chip Window Start .... : 1c000000
- Flash Chip Window Length ... : 00800000
- Selected Area Start ........ : 00000000
- Selected Area Length ....... : 00000000

*** REQUESTED OPERATION IS COMPLETE ***

Great job Tornado; it's great to see people keeping up with current technological trends and making these tools available to the masses Surprised

Tolyan
DD-WRT Novice

Joined: 19 May 2010
Posts: 5

Posted: Thu Jun 03, 2010 21:31 Post subject:

Dir-320
MACRONIX 29LV320DTTI-70G
tjtag -probeonly /flash_debug
==============================================
EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 00110101001101010100000101111111 (3535417F)
*** Found a Broadcom BCM5354 KFBG Rev 3 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000010000100100000100 (00810904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS16 MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
spi_flash_read 0x1fc00000
spi_flash_mmr 0x00000000
spi_flash_mmr_size 0x00000000
spi_flash_ctl 0x18000040
spi_flash_opcode 0x18000044
spi_flash_data 0x18000048
spi_ctl_start 0x80000000
spi_ctl_busy 0x80000000

Probing Flash at (Flash Window: 0x1fc00000) ...

Debug AMD Vendid : 00000000000000001011100000000000 (0000B800)
Debug AMD Devdid : 00000000000000000011110000000100 (00003C04)

Debug SST Vendid : 00000000000000001011100000000000 (0000B800)
Debug SST Devdid : 00000000000000000011110000000100 (00003C04)

Debug BSC-SCS Vendid :00111100000001001011100000000000 (3C04B800)
Debug BCS-SCS Devdid :00111100000001001011100000000000 (3C04B800)
REGREAD32 data 0x00000000 spi_flash_mmr 0x00000000 reg 0x18000040
REG 0x18000044 REGWRITE32 0x0000049f
SPI_FLASH_OPCODE 0x18000044 PTR_OPCODE 0x0000049f
REG 0x18000040 REGWRITE32 0x8000049f
SPI_FLASH_CTL SEND -> 0x18000040 reg 0x8000049f
REGREAD32 data 0x0000049f spi_flash_mmr 0x00000000 reg 0x18000040
REGREAD32 data 0x00000000 spi_flash_mmr 0x00000000 reg 0x18000048

Debug SPI id : 00000000000000000000000000000000 (00000000)

Debug SPI Vendid : 00000000000000000000000000000000 (00000000)
Debug SPI Devdid : 00000000000000000000000000000000 (00000000)
Done

*** Unknown or NO Flash Chip Detected ***

*** REQUESTED OPERATION IS COMPLETE ***

duncanidahoe
DD-WRT User

Joined: 29 Nov 2009
Posts: 354
Location: Dark Side of the Moon

Posted: Sat Jun 05, 2010 12:47 Post subject:

I guess I am repeating a question. Is the wrt320n going to be supported in jtag eventually? Apparently my cfe is corrupted, because when I connected my serial adapter to my other 320 I was able to go right into the cfe no problem. So I am going to need jtag to flash the cfe onto the problem router. By the way I've found the cfe on the forum, but here it is again just for anyone who may be looking for it. Also when you go into router information in the gui it lists the chip as a BCM4716 not a 4717 as is written on the chip itself.

cfe.bin

Description:

WRT320N CFE

Download

Filename:

cfe.bin

Filesize:

256 KB

Downloaded:

1364 Time(s)

_________________
E4200 w/ mega build 23838

4 wrt160n v3 w/ BrainSlayer dd-wrt.v24-15778_NEWD-2_K2.6_std_nokaid_small.bin

2 wrt320n w/ BrainSlayer dd-wrt v24-15778 NEWD-2_K2.6_big.bin

wndr3300 w/ dd-wrt.v24-14583_NEWD_std-nokaid_nohotspot_nostor.bin

wrt54g v6 w/ Brainslayer 14594 dd-wrt.v24_micro_generic.bin

wrt400n w/ 21676 build
__________________________________

Peacock Thread | BrainSlayer Builds | Eko Builds

Goto page Previous 1, 2, 3 ... 64, 65, 66 ... 82, 83, 84 Next

Display posts from previous:

Page 65 of 84

DD-WRT Forum Index -> General Questions

All times are GMT

Navigation

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum

Log in

TJTAG - EJTAG De-Brick tool - IMPORTANT CHANGE:See 1st Post.

Quick Links

Log in