Posted: Mon Sep 23, 2013 18:03 Post subject: Bricked DIR 600 B1G Wireless 150 - Expert help needed
I'm posting this here after figuring out that my router is Ralink and not Atheros based.
I've got this router from a friend and experimented with it. First it worked and all of sudden bricks.
The brick is endless restart loop (led blinks alternating green/yellow)
If I reset or hold reset while inserting power I get slow blink and can reach recovery page and flash firmwares. However after firmware flashes successfully the router reboots back into the endless loop after around 2-3 minutes of waiting
I tried many flashes original or ddwrt for 300b and 600b with no luck
Just once a dir600-factory-webflash worked and the router bricked again after 20 mins of work (it was setup as repeater to my dsl router to extend wireless range, the brick happened suddenly without any flashing or firmware change)
I can't reach the router via telnet nor can I get to redboot via many scrips posted here in the forum, despite following all the information correctly and changing ipto 192.168.20.80
I found a user mentioning 600sec reset then telnet but I can't find any more info about the ip used and commands used to have this work.
I'm using windows xp/7 or 8 and tried many tools like recvudp.exe and readymade scripts, disabled uPnP and firewall with nothing changing
Max232 serial to ttl worked fine and showed my restart loop.
I managed to open the boot command prompt and I removed the write protection and erased the flash, then I had a sudden power problem and the router turned off before I could tftp the flash binary.
I know I'm in a very bad situation with an empty flash now, with no recovery or uboot, I've read my only option is to write the flash using LPT printer port:
My question is that 600B1G board is similar but not exactly the same as DIR300 and DIR825. So is there a map how to connect the LPT cable and run SPIPGM.
I brought the parallel port hardware and tried to find the SPI Flash in order to solder the wires...
However, it turned out that my DIR-600 B1G Wireless 150 router does not have an SPI flash but has a Macronix MX29LV320DBTI-70G which is completely different and has too many pins.
So I believe the parallel port solution described for Dir300 and Dir825 with SPI flash will not work in my case unless the is a workaround that I'm not aware of (I really searched for hours and couldn't find anything about flashing Macronix via LPT port)
In case any expert has any solution, please enlighten me, I have already bought max232 adapter for serial port and made my LPT parallel port conector as described in the dir-300 and dir-825 posts which both have the 16 pins SPI flash
I'll post screenshots of my routers hardware and about the different flashes later if needed
There is no exposed jtag port on most Ralink based routers since the i/o pins needed for jtag are already used for other purposes.
You can only rescue the router now by desoldering the flash chip and reprogram it in an external flash programmer.
The only part of flash which is write protected by default is the part where the boot loader resides, the write protection being there just to avoid trashing the boot loader.
It is therefore utterly stupid to remove the flash protection when flashing firmware only via serial cmd.. _________________ A: No.
Q: Should I include quotations after my reply?
Posted: Thu Sep 26, 2013 5:19 Post subject: blind testing
Thanks for your help,
I removed the protection because the flash was not writing correctly from emergency interface.
Anyways using a programmer will cost more than buying a new router, so that's not gonna happen.
Perhaps if there's a tool that tests for j-tag spots blindly when the spot is connected to the LPT port of a PC.
It'll only take some trial and error before finding them, or we can compare the spots on a board of similar router.