hyperfrog
DD-WRT Novice
Joined: 03 Oct 2020
Posts: 6
|
 Posted: Wed Feb 14, 2024 15:25 Post subject: [SOLVED] Restoring board_config on D-Link DIR-825 Rev. B1 |
 |
I bricked my old DIR-825 Rev. B1 by flashing the wrong firmware.
So I put the router in recovery mode and flashed the latest factory-to-ddwrt_NA.bin, which worked. However, I noticed the GUI lost the "Wireless" tab, i.e. there were no radios.
So I searched the forums and found a solution. Apparently, "board_config" AKA "art" AKA "caldata" was corrupt and needed to be restored. The firmware I used in the first place was too large, and flashing it overwrote the board calibration data.
I thought I was in luck because I own two other routers of the exact same model.
So I logged in one of the working routers in order to make a copy of its board_config file:
| Code: |
root@DIR-825:~# cd /dev
root@DIR-825:/dev# ls
1-1 mtd5 nvram
console mtd5ro port
cpu_dma_latency mtd6 ppp
full mtd6ro ptmx
kmem mtd7 pts
kmsg mtd7ro random
mem mtdblock tty
mtd mtdblock0 ttyS0
mtd0 mtdblock1 urandom
mtd0ro mtdblock2 usb1
mtd1 mtdblock3 usb2
mtd1ro mtdblock4 usbdev1.1
mtd2 mtdblock5 usbdev1.2
mtd2ro mtdblock6 usbdev1.3
mtd3 mtdblock7 usbdev1.4
mtd3ro network_latency usbdev2.1
mtd4 network_throughput watchdog
mtd4ro null zero
root@DIR-825:/dev# cat /proc/mtd
dev: size erasesize name
mtd0: 00050000 00010000 "RedBoot"
mtd1: 007b0000 00010000 "linux"
mtd2: 00522000 00010000 "rootfs"
mtd3: 00170000 00010000 "ddwrt"
mtd4: 00010000 00010000 "nvram"
mtd5: 00010000 00010000 "FIS directory"
mtd6: 00010000 00010000 "board_config"
mtd7: 00800000 00010000 "fullflash"
root@DIR-825:/dev# dd if=/dev/mtd6ro of=/tmp/board_config
128+0 records in
128+0 records out
|
Using WinSCP, I copied that 64 kB file (/tmp/board_config) from the router. I opened it in a HEX editor, just to realize it contained only FF's. I knew it wasn't right, because that file should contain at least the MAC addresses of the working router, which have to be edited before transferring the file to the broken router.
So I tried :
| Code: |
root@DIR-825:/dev# dd if=/dev/mtd6 of=/tmp/board_config
128+0 records in
128+0 records out
|
With the same results (64 kB file, all FF's). And lastly :
| Code: |
root@DIR-825:/dev# dd if=/dev/mtdblock6 of=/tmp/board_config
128+0 records in
128+0 records out
|
Still got a 64 kB file containing only FF's.
What am I doing wrong?
*EDIT #1*
I made a full copy of the flash memory :
| Code: |
dd if=/dev/mtd7ro of=/tmp/fullflash.good
|
The calibration data seems to present from 0x00660000 to 0x0066FFFF. Should I just edit the MAC addresses at 0x0066FFA0 and 0x0066FFB4 and restore the full flash on the broken router?
*EDIT #2*
I decided to go on, so I edited a bunch of strings in the fullflash dump (MAC addresses and WPS PIN). Since a fullflash dump apparently includes the NVRAM parameters, there were several instances to edit.
Using WinSCP, I transferred the patched image to the broken router, which I then flashed with mtd:
| Code: |
root@DIR-825:~# cd /tmp
root@DIR-825:/tmp# mtd -f write fullflash.good.patched fullflash
Unlocking fullflash ...
[flash ]Could not unlock MTD device: fullflash
fullflash: No such file or directory
Writing from fullflash.good.patched to fullflash ... [w]
root@DIR-825:/tmp# reboot
|
It worked in spite of the warnings. After reboot, the "Wireless" tab was back, but the LAN MAC was wrong (00:11:22:33:44:55). After resetting the router to factory defaults, the LAN interface had the expected MAC address. |
|
