TJTAG - EJTAG De-Brick tool - IMPORTANT CHANGE:See 1st Post.

Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Index -> General Questions
Goto page Previous  1, 2, 3 ... 66, 67, 68 ... 82, 83, 84  Next
Author Message
lijianch
DD-WRT User


Joined: 14 Jul 2007
Posts: 146

PostPosted: Wed Jun 23, 2010 19:03    Post subject: Reply with quote
you may not need the jtag to debrick your wrt320n unless you can not ping it. I just did it month ago. You need a serial to ttl converter $10 cost.

BlCa` wrote:
lijianch>> See, you've got your positive addition to the thread. First info about the next version of tjtag in months.

Hopefully, my wrt320n will come back to life in a not so distant future. That made my day.
Sponsor
BlCa`
DD-WRT User


Joined: 16 Nov 2009
Posts: 135

PostPosted: Wed Jun 23, 2010 19:37    Post subject: Reply with quote
lijianch wrote:
you do not need the jtag to debrick your wrt320n. I just did it month ago. You need a serial to ttl converter $10 cost.

BlCa` wrote:
lijianch>> See, you've got your positive addition to the thread. First info about the next version of tjtag in months.

Hopefully, my wrt320n will come back to life in a not so distant future. That made my day.


Thanks, but I know I do need jtag.
As a matter of fact, I messed with CFE and ended up corrupting it. This triggers some stupid protection that makes the unit automatically clear nvram and reboot in an infinite loop.
Maux
DD-WRT Novice


Joined: 11 May 2010
Posts: 2

PostPosted: Wed Jul 14, 2010 15:13    Post subject: Dir-300 Brick - Jtag Help Reply with quote
hello friends,

Excuse my English because I'm using google translator.

I need help, I have a Dlink-300 A1 Atheros ... Brick that has only left with the burning light of Power and I have no communication with the Ethernet LAN, ... as I saw that she had no way, build a Jtag cable tjtag3 and installed in my pc, it recognizes the chip Ar531X - 231X ok and communicates very well ....

well, I tried the Internet some tutorial how to save my dir-300, I found a lot of things but very confusing to me, is two weeks q'm trying to make the lights of Lan function, but this is all invalid, since erased everything that was in dir-300, Wholeflash, Nvram, CFE, Kernel, bsp ... I tried to find these files but not found to reset the Dir 300 a1.

Please, if anyone knows where I can download the files back (Wholeflash, Nvram, CFE, kernel, ..... etc) ... and I explain how I should use the jtag ... I'll be very thankful that I will be following the discussion in search of the answer .. Thanks!

Maux
mr_ace_sk
DD-WRT Novice


Joined: 19 Jul 2010
Posts: 1

PostPosted: Mon Jul 19, 2010 21:30    Post subject: rdaa-81 (airca8-pro) jtag Reply with quote
helo, my friend bricked his rdaa-81 (airca8-pro) router. it has 14pin v2.6 jtag.

i try to debrick it with tjtag (i have two working router Smile ), but the prog doesn't recognise the flash.
the cpu is Atheros AR2313A-001 & the flash is Spansion S29AL032D90TFI04
here is the result of /flash_debug:

Quote:
C:\jtag\Windows32>tjtag3 -probeonly /flash_debug

==============================================
EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000000000000000000000000000001 (00000001)
*** Found a Atheros AR531X/231X CPU chip ***

- EJTAG IMPCODE ....... : 01000000010000000100000000000000 (40404000)
- EJTAG Version ....... : 2.6
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R4k ASID_8 NoDMA MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
spi_flash_read 0x1fc00000
spi_flash_mmr 0x11300000
spi_flash_mmr_size 0x0000000c
spi_flash_ctl 0x00000000
spi_flash_opcode 0x00000004
spi_flash_data 0x00000008
spi_ctl_start 0x00000100
spi_ctl_busy 0x00010000

Enabling Atheros Flash Read/Write ... Done

.RE-Probing Atheros processor....
Probing Flash at (Flash Window: 0x1fc00000) ...

Debug AMD Vendid : 00000000000000000000000000000001 (00000001)
Debug AMD Devdid : 00000000000000000000000011111001 (000000F9)

Debug SST Vendid : 00000000000000000000000000000001 (00000001)
Debug SST Devdid : 00000000000000000000000011111001 (000000F9)

Debug BSC-SCS Vendid :00000000010000000000000001100000 (00400060)
Debug BCS-SCS Devdid :00000000000000000000000000000000 (00000000)
REGREAD32 data 0x00000000 spi_flash_mmr 0x11300000 reg 0x00000000
REG 0x00000004 REGWRITE32 0x0000009f
SPI_FLASH_OPCODE 0x00000004 PTR_OPCODE 0x0000009f
REG 0x00000000 REGWRITE32 0x00000131
SPI_FLASH_CTL SEND -> 0x00000000 reg 0x00000131
REGREAD32 data 0x00000000 spi_flash_mmr 0x11300000 reg 0x00000000
REGREAD32 data 0x00000000 spi_flash_mmr 0x11300000 reg 0x00000008

Debug SPI id : 00000000000000000000000000000000 (00000000)

Debug SPI Vendid : 00000000000000000000000000000000 (00000000)
Debug SPI Devdid : 00000000000000000000000000000000 (00000000)
Done

*** Unknown or NO Flash Chip Detected ***

*** REQUESTED OPERATION IS COMPLETE ***


i manualy set the flash type to something simillar - s29gl032 (/fc:85) & read out the cfe from flash (from another working router), but it seems to be that only odd bytes are readed out - even bytes are every time read out as 00.. i try to read it out with another types of 4mb flashes but the result was always same. take a look:

Quote:
C:\jtag\Windows32>tjtag3 -backup:cfe /bypass /fc:85

==============================================
EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000000000000000000000000000001 (00000001)
*** Found a Atheros AR531X/231X CPU chip ***

- EJTAG IMPCODE ....... : 01000000010000000100000000000000 (40404000)
- EJTAG Version ....... : 2.6
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R4k ASID_8 NoDMA MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done

Enabling Atheros Flash Read/Write ... Done

.RE-Probing Atheros processor....
Manual Flash Selection ... Done

Flash Vendor ID: 00000000000000000000000101111110 (0000017E)
Flash Device ID: 00000000000000000001101000000000 (00001A00)
*** Manually Selected a Spansion S29GL032M BotB (4MB) Flash Chip ***

- Flash Chip Window Start .... : 1fc00000
- Flash Chip Window Length ... : 00400000
- Selected Area Start ........ : 1fc00000
- Selected Area Length ....... : 00040000

*** You Selected to Backup the CFE.BIN ***

=========================
Backup Routine Started
=========================

Saving CFE.BIN.SAVED_20100719_213019 to Disk...
[ 0% Backed Up] 1fc00000: 00400060 003c0000 000300d8 00170000
[ 0% Backed Up] 1fc00010: 00000000 003c00bc 00350030 008d0000
[ 0% Backed Up] 1fc00020: 003c00bc 00350030 008d0000 0024000f
[ 0% Backed Up] 1fc00030: 002100ff 001500ff 00000000 003c00bc etc...........


then i try to erase the cfe area in wrong router - it is erased but read out is the same - odd bytes are erased to FF, even are still 00 Confused

Quote:
Saving CFE.BIN.SAVED_20100719_213058 to Disk...
[ 0% Backed Up] 1fc00000: 00ff00ff 00ff00ff 00ff00ff 00ff00ff
[ 0% Backed Up] 1fc00010: 00ff00ff 00ff00ff 00ff00ff 00ff00ff
[ 0% Backed Up] 1fc00020: 00ff00ff 00ff00ff 00ff00ff 00ff00ff
[ 0% Backed Up] 1fc00030: 00ff00ff 00ff00ff 00ff00ff 00ff00ff etc....


any idea, how to read/write correctly this type of flash!? Question Question Question

thanks, tom
alromh87
DD-WRT Novice


Joined: 19 Jan 2010
Posts: 10

PostPosted: Thu Jul 22, 2010 6:13    Post subject: Help with wx6615M Reply with quote
Hi im traying to get linux on this router so i want to backup flash, The CPU is not on the list but i get an id so i added to the list of cpu and i think is working but when i try to read the memory using similar model i only get 000, Thanks

CPU: 88W8510-BAN ARM9
Switch: 88E6060
Flash: MX29LV800TTC-70 (8M)
RAM: V54C316162VC (2x16M)

Some pics:
https://forum.openwrt.org/viewtopic.php?id=25722

Quote:

==============================================
EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================

Probing bus ... Done

Instruction Length set to 4

CPU Chip ID: 00010101100101000110001111010011 (159463D3)
*** Found a Marvell Libertas Test chip ***

- EJTAG IMPCODE ....... : 00000000000000000000000000000000 (00000000)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
spi_flash_read 0x1fc00000
spi_flash_mmr 0x11300000
spi_flash_mmr_size 0x0000000c
spi_flash_ctl 0x00000000
spi_flash_opcode 0x00000004
spi_flash_data 0x00000008
spi_ctl_start 0x00000100
spi_ctl_busy 0x00010000

Probing Flash at (Flash Window: 0x1fc00000) ...

Debug AMD Vendid : 00000000000000000000000000000000 (00000000)
Debug AMD Devdid : 00000000000000000000000000000000 (00000000)

Debug SST Vendid : 00000000000000000000000000000000 (00000000)
Debug SST Devdid : 00000000000000000000000000000000 (00000000)

Debug BSC-SCS Vendid :00000000000000000000000000000000 (00000000)
Debug BCS-SCS Devdid :00000000000000000000000000000000 (00000000)
REGREAD32 data 0x00000000 spi_flash_mmr 0x11300000 reg 0x00000000
REG 0x00000004 REGWRITE32 0x0000009f
SPI_FLASH_OPCODE 0x00000004 PTR_OPCODE 0x0000009f
REG 0x00000000 REGWRITE32 0x00000131
SPI_FLASH_CTL SEND -> 0x00000000 reg 0x00000131
REGREAD32 data 0x00000000 spi_flash_mmr 0x11300000 reg 0x00000000
REGREAD32 data 0x00000000 spi_flash_mmr 0x11300000 reg 0x00000008

Debug SPI id : 00000000000000000000000000000000 (00000000)

Debug SPI Vendid : 00000000000000000000000000000000 (00000000)
Debug SPI Devdid : 00000000000000000000000000000000 (00000000)
Done

*** Unknown or NO Flash Chip Detected ***

*** REQUESTED OPERATION IS COMPLETE ***
BlCa`
DD-WRT User


Joined: 16 Nov 2009
Posts: 135

PostPosted: Thu Jul 22, 2010 11:35    Post subject: Reply with quote
You've got unsupported flash chip so, you're screwed until (if ever) a new version of tjtag comes out.
Of course, it doesn't mean your specific model will be supported. There's such a huge backlog of unsupported routers now that you'd better have a damn popular one to make it into the hypothetical next release.
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Thu Jul 22, 2010 17:47    Post subject: Re: Help with wx6615M Reply with quote
alromh87 wrote:
Hi im traying to get linux on this router so i want to backup flash, The CPU is not on the list but i get an id so i added to the list of cpu and i think is working but when i try to read the memory using similar model i only get 000, Thanks

CPU: 88W8510-BAN ARM9
Switch: 88E6060
Flash: MX29LV800TTC-70 (8M)
RAM: V54C316162VC (2x16M)



I can't help you with your jtag problems, it is not that simple to only add cpu detection because the cpu must also be initialized with correct values - unknown for the 88W8510.

I can tell you though that your listed memory sizes are bits and not bytes, ie flash size of 1MByte and ram size of 4MByte.
There is no way you can run Linux on it, the flash size is way to small for that.

_________________
Kernel panic: Aiee, killing interrupt handler!
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Thu Jul 22, 2010 18:05    Post subject: Re: rdaa-81 (airca8-pro) jtag Reply with quote
mr_ace_sk wrote:


Quote:
Saving CFE.BIN.SAVED_20100719_213058 to Disk...
[ 0% Backed Up] 1fc00000: 00ff00ff 00ff00ff 00ff00ff 00ff00ff
[ 0% Backed Up] 1fc00010: 00ff00ff 00ff00ff 00ff00ff 00ff00ff
[ 0% Backed Up] 1fc00020: 00ff00ff 00ff00ff 00ff00ff 00ff00ff
[ 0% Backed Up] 1fc00030: 00ff00ff 00ff00ff 00ff00ff 00ff00ff etc....


any idea, how to read/write correctly this type of flash!? Question Question Question

thanks, tom


The flash is a parallel flash while the most common flashes used together with AR2313 is of serial SPI type.
AR2313 has only an 8 bit data bus for parallel flashes and tjtag does currently only support 16 bits operations on parallel flashes. Sad

_________________
Kernel panic: Aiee, killing interrupt handler!
alromh87
DD-WRT Novice


Joined: 19 Jan 2010
Posts: 10

PostPosted: Thu Jul 22, 2010 23:27    Post subject: Re: Help with wx6615M Reply with quote
LOM wrote:
alromh87 wrote:
Hi ...
CPU: 88W8510-BAN ARM9
Switch: 88E6060
Flash: MX29LV800TTC-70 (8M)
RAM: V54C316162VC (2x16M)



I can't help you with your jtag problems, it is not that simple to only add cpu detection because the cpu must also be initialized with correct values - unknown for the 88W8510.

I can tell you though that your listed memory sizes are bits and not bytes, ie flash size of 1MByte and ram size of 4MByte.
There is no way you can run Linux on it, the flash size is way to small for that.


Ooops, I forgot they where bits, and I was thinking on coding to get the chip supported now I know is not worth it, Thanks
Tornado
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 2087
Location: Odessa, Ukraine

PostPosted: Tue Aug 03, 2010 12:43    Post subject: Reply with quote
The above is an ad, would a mod please delete it
_________________
Want JTAG support - Donate a router
or Donate with PayPal !

My preferred parallel jtag adapter:
TIAO Parallel adapter

Tjtag website - http://tjtag.com

Compiling DD-WRT on:
AMD Phenom II X6 1090T @ 3926.667 Mhz

Aptosid X64 - Debian SID X64
Ubuntu 10.10 X64 - Arch X64
Andy2edb
DD-WRT Novice


Joined: 03 Aug 2010
Posts: 1
Location: Hungary

PostPosted: Tue Aug 03, 2010 16:59    Post subject: Bricked WRT54GC Reply with quote
alromh87 wrote:
Hi im traying to get linux on this router so i want to backup flash, The CPU is not on the list but i get an id so i added to the list of cpu and i think is working but when i try to read the memory using similar model i only get 000, Thanks

CPU: 88W8510-BAN ARM9
Switch: 88E6060
Flash: MX29LV800TTC-70 (8M)
RAM: V54C316162VC (2x16M)

Hi!
I have a bricked WRT54GC v2 router with same 88W8510 CPU and Macronix type flash. But with a still functional WRT54GC I've made a full flash backup (with H-JTAG software). The 16-pin header on the PCB is a standard ARM-Jtag connector, without the pins 17-20 (http://www.jtagtest.com/pinouts/arm20).
On the bad router the H-Flasher utility successfully recognized the hardware, because the initial part of the flash was untouched, thus the initializing ran properly. But when I tried to write back the "good" full flash (with modified MAC-address), the process stopped after the flash deletion. Now I have an absolutely empty flash chip, and the H-JTAG can not find and initialize the CPU / RAM / flash, only the CPU-ID is readable (0x159463D3, ARM946E-S).
My question is that somehow possible to decoding the initializing process from the binary full flash, and with that to create an init script (H-Flasher *.hfc-file) or a TJTAG-like debrick-utility?
slimey
DD-WRT User


Joined: 14 Feb 2007
Posts: 334
Location: Texas

PostPosted: Sun Aug 08, 2010 8:44    Post subject: Reply with quote
How come all I get is:


==============================================
EJTAG Debrick Utility v3.0.2 RC1 Tornado-MOD
==============================================

Selected port = 0x378

Intial value of Control register is 000000C0
Intial value of status register is 0000006F
01101111 (0000006F)

tried various switches for the type of cable im using, wiggler., this is a Win7 32bit pc, default bios settings lpt1 on port 0x378
Tornado
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 2087
Location: Odessa, Ukraine

PostPosted: Sun Aug 08, 2010 9:19    Post subject: Reply with quote
give me your complete command line your using ?

also if your not using /cable:wiggler or /cable:dlc5 like it says in the 1st thread, you will get nothing.

_________________
Want JTAG support - Donate a router
or Donate with PayPal !

My preferred parallel jtag adapter:
TIAO Parallel adapter

Tjtag website - http://tjtag.com

Compiling DD-WRT on:
AMD Phenom II X6 1090T @ 3926.667 Mhz

Aptosid X64 - Debian SID X64
Ubuntu 10.10 X64 - Arch X64
slimey
DD-WRT User


Joined: 14 Feb 2007
Posts: 334
Location: Texas

PostPosted: Sun Aug 08, 2010 10:41    Post subject: Reply with quote
tjtag302.exe -probeonly /cable:wiggler

==============================================
EJTAG Debrick Utility v3.0.2 RC1 Tornado-MOD
==============================================

Selected port = 0x378

Intial value of Control register is 000000C0
Intial value of status register is 0000006F
01101111 (0000006F)

and nothing till I ctrl-c back to prompt.

working with tjtag 3.0.1 and /wiggler
Tornado
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 2087
Location: Odessa, Ukraine

PostPosted: Mon Aug 09, 2010 5:41    Post subject: Reply with quote
I'm glad that 3.0.1 works for you on Win7 32bit, I have only written code for win7 64bit, so its good to know. Are you using the giveio.sys driver with 3.0.2 ?

What jtag adapter are you using ?

I only have win7 64bit, but I will try it today with the 3.0.2 32bit version to see what happens, and if I can work it out.

P.S. what router ?

_________________
Want JTAG support - Donate a router
or Donate with PayPal !

My preferred parallel jtag adapter:
TIAO Parallel adapter

Tjtag website - http://tjtag.com

Compiling DD-WRT on:
AMD Phenom II X6 1090T @ 3926.667 Mhz

Aptosid X64 - Debian SID X64
Ubuntu 10.10 X64 - Arch X64
Goto page Previous  1, 2, 3 ... 66, 67, 68 ... 82, 83, 84  Next Display posts from previous:    Page 67 of 84
Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Index -> General Questions All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum