[djhowzer]

ok understood. I was was thinking more of a reading attempt for a log more then flashing. I am not going to attempt anything, unless you think it is a good idea.

I figured that we new the address of the memory, because it might be in the flashing.txt file.

Example
------------
About to initialize [format] FLASH image system - continue (y/n)? y
*** Initialize FLASH Image System
... Erase from 0xbffe0000-0xbfff0000: .
... Program from 0x807f0000-0x80800000 at 0xbffe0000: .
------------
From what your saying (about not knowing where to flash) that is more then likely address for something else. I just figured thoes were the address that the jtag would be reading/flashing to also.

Let me know if you need anything else.

Thanks

[Sash]

i dont know if redboot is running on this unit ...find out plz

[djhowzer]

hard to tell, I can tell you this. Redboot was running. It did have a temp server that I was able to ping ect. Like I said, in the readme I was able to get thro it haft way before I sent that command to the the unit thro redboot.

I messed up when flashing over the ap51.rom file. UP to that time there was, and more then likely still is a version of redboot on the unit. Its just stuck in a reboot cycle.

I hope I answered that question.

[djhowzer]

just to let everyone know, I just got my serial flash in the mail. I am researching the pin outs still thoe. I will let you know if I come up with something.

[djhowzer]

ok I was playing around, which I should not be doing but I went ahead but got some promising results.

I hooked up the rx and the tx and the ground and opened putty. The log on the screen looks encrypted. I have attached it to this post.

More then likely it is hooked up wrong, but check this out.

When I plug the router in with putty open I get thoes fonts on the screen that I cant read, but the router stops rebooting, and the computer can hook up to the router with a static ip address, and it stays on. <--- WOW!!!

I can see the lights of the lan port that Iam using flashing to the computer. Appears to be working as a AP, but I still cant ping it, or telnet in to it, or anything.

Just seeems like a little box of hope now.

I only hooked up the rx and tx and the ground because there are only 2 traces goign away from that header, I also hooked up the ground wire for ground. When I swap the tx and rx I get no responce at all, when I remove the ground wire the screen repeats one Font, so I think that is far as likely that I will get with a seral connection using this header for a connection.

By any chance are there any other programs that can view what is going on besides putty ???

Just to let you know I have unhooked the serial board from the router, and have put it up for now, the router is pluged up by its self with the power light on and the status light. The status light is blinking once a second, If I reboot the router it will go back in to that loop cycle unless I hook the serial adapter back up to it to break the loop.

I wish I knew more about this flashing stuff so I can give yall better logs and results but I am very new to flashing, and really don't know what I am doing. Sorry if I come off as a nibooo.

[djhowzer]

ok, forget about the last post. I had the speed set wrong in putty. This is the startup log


ar531xPlus rev 0x00000087 firmware startup ...
VxWorks System Boot
Copyright 1984-2004 Wind River Systems, Inc.
CPU: Atheros AR5001AP Bountiful Wifi
Version: VxWorks5.5.1
BSP version: 1.0
Creation date: Feb 8 2008, 10:29:26




Press any key to stop auto-boot...
0
auto-booting...


boot device : tffs:
unit number : 0
processor number : 0
file name : /fl/APIMG1
inet on ethernet (e) : 192.168.0.1:0xffffff00
flags (f) : 0x0
startup script (s) : factory
other (o) : ae

Attaching to TFFS... tffsDevCreate failed.
usrTffsConfig failed.

Error loading file: errno = 0x0.
Can't load boot file!!

[djhowzer]

OK well now I am stuck. Kind of. I have managed to stop it from booting by pressing any key. I don't think I will be able to ping the router because redboot is not loaded because I stoped it from booting.

The Router is just siting there waiting for anything I guess.

I will try 18r, but going to do some research first. I only have one computer, and when I set static IP address I don't have access to the Internet. I am hoeing to find a way to re flash via serial, but the page I was reading about putty and re flashing I cant find for some reason. My power went out, so I am starting from scratch, and wish I remembered how I googled that page.

But the serial adapter is working, and I am able to freeze it from booting. Just trying to research whats next.

[djhowzer]

well, I was up all nite last nite working on this thing.

I have found other posts where people have been at the step that I am at now.

Seems the only way to re flash the unit is with a .elf file.

I was reading another post of someone trying just that, but had to do a jtag instead.

I have found that there are two different ways to boot the unit.

ae0 and tffs

From what I have gathered tffs can boot a .elf file from a directory that a TFPD server on my computer is running, as long as I have the .elf file in there.

Right now I am trying both, but not really shure if the tfpd32 server is running the way it is supposed to.

And to be honest I am not to sure how ae0 works, but I do know it has something to do with the lan ports on the router, but I thought tffs would do that also. I will be spending my time tonight researching on what I can find on this ae0 command and If I can use it in anyway.

Does anyone by any chance know how to test and see if the server is serving at all ??

I cant get any message telling me if the server is running or not.

PS I hope if I manage to fix this thing somebody can read this thread and save there selfs hours of work.

[Sash]

there should be some sort of emergency/recovery mode to reflash the device with the orig firmware.
but i dont now vxwork good enough to tell how it works.
nmap the device maybe u will finde some open ports. maybe there is a webserver running

[djhowzer]

sorry for short post, but I have to go to work.

nmap was not much help, and I know why. The router only seems to get any kind of reply out to a ping during the reboot stage. When I hit any key to stop the thing from booting, it seems all talks and replys from the router stop.

However I have a program called Colasoft Capsa 6.9 Enterprise, and it monitors alot of stuff.

It seems that the router is wanting to talk on port 1009.(only during the 10 second boot cycle, and durring the tfpt) I also noticed that there is a web interface on that the router ip address on that port. Only problem is that it displays an empty page, and empty view source log.

also I noticed it is using rsh protocol on some things as well as udp, or that might just be the serial port of my computer talking to vx works, but there is not a serial selected in the looging program just that network card.

I am able to log the packets going to and from the router during the attempted flashes using that program.

Iam talking about when I set the et0 command in vxworks and the 0x80 flag. When I try to download a .elf file

However I don't know where the errors are coming from. In fack I dont know what they mean.

I heard there is a elf file called art.elf that is used to re flash some other routers using this same chip set. By anychane does anyone know where I can download that file, because I cant find a link using google.

Guess it was a long post after all :)


Please if anyone knows where this art.elf file is please post a link.

[djhowzer]

Good read here

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=43685

Its to bad that the guy gave up thoe, because iam at this step right now, and he had to use a jtag to fix his unit by cloning another unit.

That would be easy for me, but not many people has this router laying around for me to open up and do a jtag dump. lol

When I get home tonight I am going to install that rsh server thing that he did, hopefully it can give me a few clues that can lead me to a serial unbrick method.

If I cant unbrick this by serial the only way iam going to be able to do it is buy buying another one, and at $300.00 a pop not that easy.

Funny When I search this forum I see many threads from last year with people wanting wrt for this router, so that leads me to believe that someone out there had one of theses with a working wrt flash. Looks like i am the only one with the brick thoe *SIGH*

[djhowzer]

Well I installed rshd server, and to be honest it seemed to fix the problems I was having with the router trying to talk to my computer.

Still very far away from debricking thoe. I don't know how it did it but now vxworks can see the files that I am trying to get it to load thats the good news.

The Bad News is that I am still at the same step of finding a elf file that I can load to it, and let me flash my factory bin to with. I really want to try that art.elf file because it has commands inside that help a lot better then this vxworks program. Plus it will let me see what loaders/files ect are on the router.

Strange good things that are happening now ....

When I try to load my factory bin in vxworks like so

boot device : ae
unit number : 0
processor number : 0
file name : factory.bin
inet on ethernet (e) : 192.168.0.1:0xffffff00
host inet (h) : 192.168.0.100
flags (f) : 0x80
startup script (s) : factory
other (o) : ae

Attaching interface lo0... done
Attached IPv4 interface to ae unit 0
Loading...

It will just sit here for a long time, other elf files that I have tried to load don't stay as long as this one, but longer then before I installed the rshd server. The files do give a error after it trys to load them.

Error loading file: errno = 0xd0003.
Can't load boot file!!

I have yet to see a error on the factory.bin file thoe(it just hangs there Network monitor confirmed), but I am not holding my breath, because you cant just load a bin file. It needs to have the proper elf headers in it and converted to elf, which I will be studying next week/month.

Anyways the strange things that happen thoe, are when its trying to load I get normal ping reply s from the router. Sound promising, but I still cant find a web interface. I still cant telnet in to redboot. By the way I am thinking redboot is more then likely lost at this point but I still tried just to see.

That Network Monitor program that I am using shows that the router is sending and receiving small packets on the 1009, 1007 ports.

Also it shows that when I try to open the web interface that the router is blocking me. The log I get on it is connection refused. Firewall ?? on bricked router ? Does not add up.

I willing to bet if I let the factory.bin file try to load for hours it will reach a point to where I will get a error. I will leave it running when I go to bed hopefully when I wake up the router will be restored back to factory condition(VERY UNLIKELY).

[Sash]

u can try if it would boot our redboot elf files from the dl section

ap51,ic+,16mb ram,4mb flash

[djhowzer]

Sash Thanks for the reply. I have some news, but to get straight to the point I downloaded the file that you wanted me to use and it did not work, it does thou seem like it’s trying to load something, but something not’s right when it comes to matching with my router. That’s not what I am here to report about, but I will get back to it 18r in my post, and the results when I run it.

Well just to let everyone know who is reading this I have been reading lots of stuff on vxworks, and it turns out that if you are using Tftp via the 0x80 flag the router wants to default to this rsh protocol(because of a blank password).

I researched this in the vxworks documents from google, and it turns out that if you try to boot to et0 with the 0x80 flag it will go thru the ftp command, and if the password/user is blank it uses the rsh protocol.

I have come to a conclusion that all of the files that I have tried to load have been hung at this point because I do not have anything on my host that will send the files thro the rsh protocol.

Now look I know this is not true for all routers running vxworks, but in my situation I had to go this route that I am about to explain.

Turns out if you have a username and a password set up in ftp the boot for vxworks will use the ftp protocol to download the boot image and Ignore any rsh commands that just get in the way. After I found that out I downloaded a Ftp Server called Serv-u. I created a domain called unbrick. I then created a user called brick and the password is brick.

boot device : ae0
processor number : 0
host name : unbrick
file name : factory.bin
inet on ethernet (e) : 192.168.0.1:0xffffff00
inet on backplane (b):
host inet (h) : 192.168.0.100
gateway inet (g) :
user (u) : brick
ftp password (pw) (blank = use rsh): brick
flags (f) : 0x80
target name (tn) :
startup script (s) :
other (o) : ae

Now in the above Example when I run this boot from vxworks it now for the first times really downloads files from my computer that the FTPSERVER is set to for user brick. I can tell because this Serv-uFTP program will show the router requesting and logging in to access the files.

Up to this point with hours of work I have yet to see any proof that any of these Tftpd programs were sending files. In fact all tftpd programs I ever used (and I used many) showed empty logs every time. So maybe the router was always hanging up on garbage data when I was trying to download from TFTP. Still does not explain why I get ping reply’s from it when it hangs.

I have tried to load all files listed here that I have found on the internet. None of them has helped me boot the router with a temp bootloader.

-1.bin (factory bin file for my router)

-ap51.bin (flash used to load temp boot to my router to get DD-WRT installed)

-ap51.rom (Not to sure if its same as above or not came with DD-WRT package)

-510APB_1121US.elf (Modified TrendNet bin file with elf headers removed, somebody was able to fix their net gear router with this by loading trendnet firmware temporally on their router to access a web Interface that was for a different router based on same chip set. Then they used that interface to upload there real firmware image to the router. Did not work for me.) Here is a link to how he recovered this router via serial flash. No Jtag http://www.embraceit.com.au/wgt624/

-redboot.elf (found on google does not match, or was made for my router. Tried anyways with no promise.)

-redboot_ap51_16M_4M_icplus.elf (file Sash suggested to use that loads then appears to hang.)

That last file was found at this link http://www.dd-wrt.com/dd-wrtv2/downloads/others/redboot_collection/
Funny I can’t go back to try others, it says forbidden now for some reason.

Here is a log when I try to load that file.
[VxWorks Boot]: @

boot device : ae
unit number : 0
processor number : 0
host name : unbrick
file name : redboot_ap51_16M_4M_icplus.elf
inet on ethernet (e) : 192.168.0.1:0xffffff00
host inet (h) : 192.168.0.100
user (u) : brick
ftp password (pw) : brick
flags (f) : 0x80
other (o) : ae

Attaching interface lo0... done
Attached IPv4 interface to ae unit 0
Loading... 187104
Starting at 0x800410bc...

And that’s it. Nothing else happens.

In telnet there is no redboot

Welcome to Microsoft Telnet Client
Escape Character is 'CTRL+]'
Microsoft Telnet> o 192.168.0.1 9000
Connecting To 192.168.0.1...Could not open connection to the host, on port 9000:
Connect failed
Microsoft Telnet>

No Ping reply’s also. On another note thou the status light on the router goes out when I load this file. The Ethernet light stays on and so does the power. Maybe I need a different file?

-----------------------------------
(UPDATE: change your ip to 192.168.1.100 and test telnet 192.168.1.2 9000 or any ip you think your router might have on that net. Turns out when it hangs Redboot is really running in ram, but does not report anything in putty. I found this out 18r as you will see)
-----------------------------------

Here is what happens when I run that 510APB_1121US.elf file.

[VxWorks Boot]: @

boot device : ae
unit number : 0
processor number : 0
host name : unbrick
file name : net.elf
inet on ethernet (e) : 192.168.0.1:0xffffff00
host inet (h) : 192.168.0.100
user (u) : brick
ftp password (pw) : brick
flags (f) : 0x80
other (o) : ae

Attaching interface lo0... done
Attached IPv4 interface to ae unit 0
Loading... 987712
Starting at 0x804846e0...


Data bus error
Exception Program Counter: 0x80010024
Status Register: 0x00000000
Cause Register: 0x7080841c
Error address: 0x00000000, Error ID: 0x0000
Task: 0x80ff6160 "tBoot"

$0 = 0 t0 = bc003068 s0 = 804846e0 t8 = 0
at = 80480000 t1 = 8055ad74 s1 = 80ff60e8 t9 = 0
v0 = 80010000 t2 = 7 s2 = a k0 = 1
v1 = 0 t3 = 68 s3 = 8072cf48 k1 = 0
a0 = 80558658 t4 = 80 s4 = 80ff60ec gp = 80748370
a1 = 80558658 t5 = 19 s5 = 80ff60f4 sp = 80ff5ce8
a2 = 0 t6 = d3 s6 = 80ff6104 s8 = 80ff6100
a3 = 0 t7 = bc s7 = 80ff60fc ra = 80484720
divlo = 73d45ee5 divhi = cfc42a2 sr = 0 pc = 80010024

As you can see its trying to load the TrendNet Firmware but does not work on this router.
Sash is there another file you can think of that I can try? Looks like I am now going to do some research on the chips of this router, and Do my best to find a different router that matches it, and hopefully there is a elf file out there for it. Also I am going to see if I can find a way to remove the elf headers if possible from my factory.bin file. There might be something I can find out in it. I have already downloaded a good hex editor, I have not used one for a long time, and even then I did not call myself an expert on it.

[djhowzer]

Big Breakthrough in the past 36 hours. To make a long story short I now have RedBoot !!!! <-YES !!!!
EDIT
-------------------------------
I loaded the ap51.bin file in vxworks like so, using my new FTP methode.

boot device : ae
unit number : 0
processor number : 0
host name : unbrick
file name : ap51.bin
inet on ethernet (e) : 192.168.0.1:0xffffff00
host inet (h) : 192.168.0.100
user (u) : brick
ftp password (pw) : brick
flags (f) : 0x80
other (o) : ae

It appearers to hang, but don't worry you do have redboot running on the router. You just have to connect to it on the same subnet. Change your ip back to 192.168.1.100 or whatever sub net your router was on before the brick, or where ever you think your router is at. Possible you are still there who knows you get the idea.

Then open telnet and connect to router ip on port 9000, you will see a redboot prompt.
-------------------------------
EDIT

Now I would really like some help on installing dd-wrt on this router. I have been trying to do it with the instructions I found on this web site a few weeks back, and to be honest none of it is working.

Here is the original flash.txt file