De-bricking a Netgear WNR2000v2 with serial

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Goto page Previous  1, 2
Author Message
notorious.dds
DD-WRT User


Joined: 24 May 2012
Posts: 376
Location: Michigan

PostPosted: Mon Sep 01, 2014 1:58    Post subject: Reply with quote
Malachi wrote:
The v3 is atheros the v2 is Broadcom.
Yea, it's worth a shot.

My bad. Embarassed
Yeah, it may pretty much be worthless. Rolling Eyes
Sponsor
swinster
DD-WRT Novice


Joined: 24 Jul 2014
Posts: 16

PostPosted: Mon Sep 01, 2014 19:45    Post subject: Reply with quote
Cheers LOM. From what I have read, the WNDR3300 and my WNR2000v2 are similar and therfore I should upload this using the same offset (from https://www.dd-wrt.com/phpBB2/viewtopic.php?t=72874&postdays=0&postorder=asc&start=0)

Is this correct?
swinster
DD-WRT Novice


Joined: 24 Jul 2014
Posts: 16

PostPosted: Thu Sep 11, 2014 14:17    Post subject: Reply with quote
Hey all,

I have been super busy and have only just managed to get around to looking at this. The long short though, no real progress.

I found some useful output from a working WNR2000v2 here (http://www.linksysinfo.org/index.php?threads/tomato-nd-usb-mod-with-kernel-2-6-tomato-rt.31335/page-17#post-154650). This shows the offset for the board_data partition at:

Code:
0x003e0000-0x003f0000 : "board_data"


So, based on Dark_Shadow's attempts in his debrick for a WNDR3300, I tried to flash LOMs BIN file above to the offset listed above by using:

Code:
flash -noheader -offset=0x003e0000 192.168.1.2:board_data.bin flash1.trx


This resulted in an I/O error, but must have done something as it over wrote the routers IP address. As such this needed to be reset using the 'ifconfig' command. I then tried to flash the stock firmware, wait for the programming, and then reboot, but all seem to go back to the same as before. Have tried powering down and up as well.

I have tried a few variations such as using the -size parameter (-size=0x10000, which was calculated by taking the beginning Hex memory position for the board_data partition from the end Hex position) of the flash command, but no dice.

Sample output below:

Code:
CFE for WNR2000v2 version: v1.0.18
Build Date: Wed Sep  9 14:33:22 CST 2009
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found a 4MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.28
CPU type 0x19749: 300MHz
Tot mem: 32768 KBytes

Device eth0:  hwaddr 00-FF-FF-FF-FF-FF, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Startup canceled
CFE> ^C
CFE> ^C
CFE> ^C
CFE> flash -noheader -offset=0x003e0000 -
Invalid switch: -
*** command status = -8
CFE> flash -noheader -offset=0x003e0000 -size=0x10000 192.168.1.2:board_data.bin flash1.trx^C
CFE> flash -noheader -offset=0x003e0000 -size=0x10000 192.168.1.2:board_data.bin flash1.trx
Reading 192.168.1.2:board_data.bin: Done. 65536 bytes read
Programming...Failed.: I/O error
*** command status = -4
CFE> ifconfig
Device eth0:  hwaddr 00-FF-FF-FF-FF-FF, ipaddr not set, mask not set
        gateway not set, nameserver not set
*** command status = 0
CFE> ifconfig eth0 -hwaddr=001F33B6D005 -addr=192.168.1.1 -mask=255.255.255.0
Device eth0:  hwaddr 00-1F-33-B6-D0-05, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
*** command status = 0
CFE> nvram erase
*** command status = 0
CFE>
CFE>
CFE> flash : flash1.trx
Reading :: Failed.: Timeout occured
*** command status = -21
CFE> flash : flash1.trx
Reading :: Done. 3448890 bytes read
*** command status = -42
CFE> flash -noheader : flash1.trx
Reading :: Done. 3448890 bytes read
Programming...done. 3448890 bytes written
*** command status = 0
CFE> reboot
Decompressing..........done


CFE for WNR2000v2 version: v1.0.18
Build Date: Wed Sep  9 14:33:22 CST 2009
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found a 4MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.28
CPU type 0x19749: 133MHz
Tot mem: 32768 KBytes

Committing NVRAM...done
Waiting for reset button release...done▒Decompressing..........done
Decompressing..........done


CFE for WNR2000v2 version: v1.0.18
Build Date: Wed Sep  9 14:33:22 CST 2009
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found a 4MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.28
CPU type 0x19749: 300MHz
Tot mem: 32768 KBytes

Device eth0:  hwaddr 00-FF-FF-FF-FF-FF, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Checksum mismatch:
Image chksum: 0x8074F248
Calc  chksum: 0x01B700CF
Invalid boot block on disk
Start TFTP server
Reading ::



Looks like Dark_Shadow's ran into similar issues, but seemed to get around this by flashing a cut version of a whole flash backup (removing the initial CFE section - thanks the EKO and LOM). See page 6 (https://www.dd-wrt.com/phpBB2/viewtopic.php?t=72874&postdays=0&postorder=asc&start=75).

LOM, you don't happen to have a whole flash backup of the WVN2000v2 do you?

Otherwise, does anyone want to buy a partially used WNR2000v2 ? Very Happy
swinster
DD-WRT Novice


Joined: 24 Jul 2014
Posts: 16

PostPosted: Thu Oct 09, 2014 9:25    Post subject: Reply with quote
Hi all,

Many thanks for all the help with this, but I haven't been able to fix it. As such if anyone wants it to play with (UK) please let me know, otherwise I gonning to junk it.

Cheers all,
Goto page Previous  1, 2 Display posts from previous:    Page 2 of 2
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum