Bricked netgear r6100

Post new topic   Reply to topic    DD-WRT Forum Index -> Atheros WiSOC based Hardware
Goto page Previous  1, 2, 3
View previous topic :: View next topic  
Author Message
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647
PostPosted: Tue Jan 27, 2015 10:08    Post subject: Reply with quote
Malachi wrote:
I did open it with HxD and I could see the router model number at the beginning but still had no idea how much 128 bytes was.


Ehh? I filled 3 gallons of gasoline into my car today but have no idea of how much 3 gallons is... Very Happy

HxD displays columns and rows of bytes and displays the count in top and to the left, each row is 16 bytes so 128 bytes is of course 8 rows.

128 decimal is the same as 80 hexadecimal and you can see that the modified nand write cmd has a start address 0x80 higher and a write count 0x80 bytes less.
_________________
Kernel panic: Aiee, killing interrupt handler!
Back to top View user's profile Send private message
Sponsor
Malachi
DD-WRT Guru


Joined: 17 Jul 2012
Posts: 7209
Location: Columbus, Ohio
PostPosted: Tue Jan 27, 2015 11:48    Post subject: Reply with quote
Thanks for that LOM. Those are the type of things I like to learn.
_________________
I am far from a guru, I'm barely a novice.
Back to top View user's profile Send private message
Malachi
DD-WRT Guru


Joined: 17 Jul 2012
Posts: 7209
Location: Columbus, Ohio
PostPosted: Tue Jan 27, 2015 21:23    Post subject: Reply with quote
I think maybe I should give up, I must be doing something wrong.
Here is the output after doing those steps.

ar7240> loady
## Ready for binary (ymodem) download to 0x81000000 at 115200 bps...
CCxyzModem - CRC mode, 2(SOH)/9217(STX)/0(CAN) packets, 4 retries
## Total Size = 0x00900085 = 9437317 Bytes
ar7240> nand erase 0x80000 0x980000

NAND erase: device 0 offset 0x80000, size 0x980000 ath_nand_erase: 0x80000 76
75Skipped 0 bad blocks

OK
ar7240> nand write 0x81000080 0x80000 0x00900005

NAND write: device 0 offset 0x80000, size 9437189 ... 9437189 bytes written: OK

ar7240> find_hif: bootstrap = 0xaf055a
WASP BootROM Ver. 1.1
Nand Flash init
ONFI: Control setting = 0xb44
hdr: [0xbd004000 : 0xbd004000 : 0x3000 : 0xc200e86c]
nand_load_fw: read 6 pages
nand_load_fw: 0x10000 0x800 0xbd0047f0
nand_load_fw: 0x20000 0x800 0xbd004ff0
nand_load_fw: 0x30000 0x800 0xbd0057f0
nand_load_fw: 0x40000 0x800 0xbd005ff0
nand_load_fw: 0x50000 0x800 0xbd0067f0
f/w 0 read complete, jumping to 0xbd004000
initialize PLL & DDR

sri
Wasp 1.2
Wasp (32bit) ddr2 init
setting for 40
fw1: Nand Init
leave FW1
f/w 0 execution complete
hdr: [0xa0100000 : 0xa0100000 : 0x11000 : 0xf89107c4]
nand_load_fw: read 34 pages
nand_load_fw: 0x70000 0x800 0xa01007f0
nand_load_fw: 0x80000 0x800 0xa0100ff0
nand_load_fw: 0x90000 0x800 0xa01017f0
nand_load_fw: 0xa0000 0x800 0xa0101ff0
nand_load_fw: 0xb0000 0x800 0xa01027f0
nand_load_fw: 0xc0000 0x800 0xa0102ff0
nand_load_fw: 0xd0000 0x800 0xa01037f0
nand_load_fw: 0xe0000 0x800 0xa0103ff0
nand_load_fw: 0xf0000 0x800 0xa01047f0
nand_load_fw: 0x100000 0x800 0xa0104ff0
nand_load_fw: 0x110000 0x800 0xa01057f0
nand_load_fw: 0x120000 0x800 0xa0105ff0
nand_load_fw: 0x130000 0x800 0xa01067f0
nand_load_fw: 0x140000 0x800 0xa0106ff0
nand_load_fw: 0x150000 0x800 0xa01077f0
nand_load_fw: 0x160000 0x800 0xa0107ff0
nand_load_fw: 0x170000 0x800 0xa01087f0
nand_load_fw: 0x180000 0x800 0xa0108ff0
nand_load_fw: 0x190000 0x800 0xa01097f0
nand_load_fw: 0x1a0000 0x800 0xa0109ff0
nand_load_fw: 0x1b0000 0x800 0xa010a7f0
nand_load_fw: 0x1c0000 0x800 0xa010aff0
nand_load_fw: 0x1d0000 0x800 0xa010b7f0
nand_load_fw: 0x1e0000 0x800 0xa010bff0
nand_load_fw: 0x1f0000 0x800 0xa010c7f0
nand_load_fw: 0x200000 0x800 0xa010cff0
nand_load_fw: 0x210000 0x800 0xa010d7f0
nand_load_fw: 0x220000 0x800 0xa010dff0
nand_load_fw: 0x230000 0x800 0xa010e7f0
nand_load_fw: 0x240000 0x800 0xa010eff0
nand_load_fw: 0x250000 0x800 0xa010f7f0
nand_load_fw: 0x260000 0x800 0xa010fff0
nand_load_fw: 0x270000 0x800 0xa01107f0
f/w 1 read complete, jumping to 0xa0100000


U-Boot 1.1.4 (Jun 27 2013 - 10:48:26)

U-boot dni29 V0.9 for DNI HW ID: 29764434 flash 128MB RAM 128MB 1st Radio 2x2 2n
d Radio 2x2


DRAM: 128 MB
Atheros on-chip NAND FLash Controller Driver, Version 0.1 (c) 2010 Atheros Commu
nications, Ltd.
Ath Nand ID[87ff1178]: 2c:f1:80:95:04
ONFI MICRON MT29F1G08ABAEAWP
Micron NAND 128MiB 3,3V 8-bit [128MB]
====== NAND Parameters ======
sc = 0x87ff1158 bbt = 0x87f68008 bbt_size = 0x100 nf_ctrl = 0x344
page = 0x800 block = 0x20000 oob = 0x40
size = 128MB
Setting 0xb8116290 to 0x50a02d0f
Using default environment

In: serial
Out: serial
Err: serial
131072 bytes read: OK
Net: ag934x_enet_initialize...
4096 bytes read: OK
Fetching MAC Address from 0x87fe82f8
4096 bytes read: OK
Fetching MAC Address from 0x87fe82f8
wasp reset mask:c02300
WASP ----> S27 PHY
: cfg1 0x80000000 cfg2 0x7114
eth0: 04:a1:51:93:ff:91
s27 reg init
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
eth0 up
WASP ----> S27 PHY
: cfg1 0xf cfg2 0x7214
eth1: 04:a1:51:93:ff:90
s27 reg init lan
ATHRS27: resetting s27
ATHRS27: s27 reset done
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth1 up
eth0, eth1
Hit any key to stop autoboot: 0
enet1 port3 up
dup 1 speed 1000

Client starts...[Listening] for ADVERTISE...checksum bad
checksum bad
Tchecksum bad
Tchecksum bad
checksum bad
Tchecksum bad

Retry count exceeded; boot the image as usual

nmrp server is stopped or failed !

Loading from device 0: ath-nand (offset 0x1a0000)

** Bad partition size, kernel: 0x20000, rootfs: 0xb8ef9174 **

The Router is in TFTP Server Firmware Recovery mode NOW!
Listening on Port : 69, IP Address: 192.168.1.1...
checksum bad
checksum bad
len bad 96 < 161

Abort

Firmware recovering from TFTP server is stopped or failed! Sad
ar7240> <INTERRUPT>
_________________
I am far from a guru, I'm barely a novice.
Back to top View user's profile Send private message
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647
PostPosted: Wed Jan 28, 2015 11:41    Post subject: Reply with quote
A last attempt, this time writing kernel and rootfs separately.


nand erase 0x80000 0x980000

nand write 0x81000080 0x80000 0x11ff40

nand write 0x81120040 0x1c0000 0x7e0004
_________________
Kernel panic: Aiee, killing interrupt handler!
Back to top View user's profile Send private message
Malachi
DD-WRT Guru


Joined: 17 Jul 2012
Posts: 7209
Location: Columbus, Ohio
PostPosted: Thu Jan 29, 2015 0:13    Post subject: Reply with quote
No go. Thanks for your efforts Lom.
_________________
I am far from a guru, I'm barely a novice.
Back to top View user's profile Send private message
Goto page Previous  1, 2, 3 Display posts from previous:    Page 3 of 3
Post new topic   Reply to topic    DD-WRT Forum Index -> Atheros WiSOC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum