Posted: Mon May 01, 2017 11:53 Post subject: How to factory reset without reset switch
I have a WNDR3700 V3 flashed with Kong 22000++ which works perfectly except for the factory reset button which has broken off.
The good: Wifi is working. I can ping it on the Lan and I can see the setup/status page in a browser. Essentially there's nothing wrong with it.
The Bad: It hasn't been used for a couple of years and I've forgotten the login password. I can't reset it, nor get into recovery mode to use TFTP because of the broken switch.
The ugly: I do know the wireless password but can't login to the router with it..only connect to it. So although I can see it from almost every angle I just can't get in to change the settings so I can use it.
I was thinking about shorting the missing reset switch but don't know what to short. I don't mind if I blow the thing up so any and all suggestions how I might get inside would be gratefully received. Cheers
You could take it apart and short the pins where the reset switch used to be; or whatever remains of it. And/or solder a momentary switch to it... _________________ #NAT/SFE/CTF: limited speed w/ DD#Repeater issues#DD-WRT info: FAQ, Builds, Types, Modes, Changes, Demo#
OPNsense x64 5050e ITX|DD: DIR-810L, 2*EA6900@1GHz, R6300v1, RT-N66U@663, WNDR4000@533, E1500@353,
WRT54G{Lv1.1,Sv6}@250|FreshTomato: F7D8302@532|OpenWRT: F9K1119v1, RT-ACRH13, R6220, WNDR3700v4
Joined: 26 Jan 2008 Posts: 13049 Location: Behind The Reset Button
Posted: Tue May 02, 2017 14:29 Post subject:
The reset switch is behind a small hole on the bottom of the router (when laying flat) that needs a toothpick or paper clip inserted to activate / push the switch.
How can it be broken off / missing? _________________ [Moderator Deleted]
I did it 5 or 6 years ago when I was young and heavy-handed...the feedback/give from clicking the Netgear reset switch is actually rather subtle (and prone to misinterpretation by this keen newbie). This combined with all the dire warnings about flashing properly.... of course I had to make sure Use wooden toothpicks, not metal paperclips
I threw it in the cupboard and only pulled it out last week to have a look. It works like new except where the reset switch used to be there are now six tiny solder points.
I can't remember the password to save my life and I'm not ready to throw the router away just yet.
jwh7 is quite right. I need to replicate or bypass the old reset switch. I've tried shorting across the various pins but which ones, how many, etc? Logically it's probably 3 pins vs 3pins - tricky enough in itself - and for 10s or more. I will play around with it but thought it worth a shot to see if anyone knew. Cheers
The Wikidevi page for the (allegedly identical?) WNDR4000 only showed the circuit board top view, and I didn't look at mine when I had mine apart long ago...
The 6 pins are cuz you desoldered the switch? I would think there are 4 pins to mount the switch pad to the board, and two pins for the reset (one of which would be ground)...but I'm obviously guessing. Are the traces around the pad ok? Have you got a close-up pic?
Another thought; search for it's FCC ID (WNDR3700v3 Wikidevi says PY311200166) and maybe there are some bottom view pics (or schematic? ya right...) which might help figure out the circuit. _________________ #NAT/SFE/CTF: limited speed w/ DD#Repeater issues#DD-WRT info: FAQ, Builds, Types, Modes, Changes, Demo#
OPNsense x64 5050e ITX|DD: DIR-810L, 2*EA6900@1GHz, R6300v1, RT-N66U@663, WNDR4000@533, E1500@353,
WRT54G{Lv1.1,Sv6}@250|FreshTomato: F7D8302@532|OpenWRT: F9K1119v1, RT-ACRH13, R6220, WNDR3700v4
found this forum post showing which pins to short to put a WNDR4000 in recovery mode
Ha; that thread is how I recovered my WNDR4000 years ago, after years of using OEM f/w then trying to flash Shibby Tomato resulted in a brick. Shorted w/ a 10ohm resistor...
However, in this case, TFTP'ing firmware wouldn't reset the password, but you could `erase nvram` in serial mode. _________________ #NAT/SFE/CTF: limited speed w/ DD#Repeater issues#DD-WRT info: FAQ, Builds, Types, Modes, Changes, Demo#
OPNsense x64 5050e ITX|DD: DIR-810L, 2*EA6900@1GHz, R6300v1, RT-N66U@663, WNDR4000@533, E1500@353,
WRT54G{Lv1.1,Sv6}@250|FreshTomato: F7D8302@532|OpenWRT: F9K1119v1, RT-ACRH13, R6220, WNDR3700v4
I deleted my post after realizing the boards were nothing alike. If it was me I'd throw caution to the wind, drill out the reset hole to 3/8", fold a strip of foil over a pencil eraser and mash it on the ersatz switch's solder pads. This from a guy who no longer has a working ethernet port on his Smart TV. _________________ [Broadcom] Asus rt-ac66u r35531 ('66 should only be factory reset through the DD UI)
Fix RT-AC66U "wl1 [2.4 GHz TurboQAM]". DD-WRT failsafe UI @ http|https://169.254.255.1/
Joined: 16 Apr 2016 Posts: 307 Location: California
Posted: Fri May 05, 2017 21:49 Post subject: Agree
1) Serial Connection and erase nvram
2) tftp openwrt (sometimes clears the nvram on first boot)
3) Solder a new Button.
4) Final Option... Throw it against the wall at high velocity (will clear out the nvram, cpu, surface mounted resistors, cap's, diodes, etc...) _________________ My Karma ran over your Dogma
SploitWorks Custom Flashed Routers
The 6 pins are cuz you desoldered the switch? I would think there are 4 pins to mount the switch pad to the board, and two pins for the reset (one of which would be ground)...but I'm obviously guessing. Are the traces around the pad ok? Have you got a close-up pic?
Here's a pic...The switch actually came off by itself, getting more and more loose until it eventually broke off. I didn't think much of it at the time because the router and Kong Build were working fine – as they still are (albeit with the wrong setup for my network now). Sometime later when I removed the case to have a look all I saw were six tiny solder points flush with the board. I added a touch of solder to each one (ignore all the scuff marks - that's my rubbish soldering) to make them easier to test.
I appreciate the board looks a mess, but despite that, I'm figuring if the router is working then the circuit still has integrity and the reset function should still work.
Your pic is extremely helpful. Comparing it to mine, the layout is obviously identical, or close to, and as you say four of the pins are for mounting which leaves the top and bottom middle pins. I'll give them a try and let you know. If it works it'll be easy to add a new switch [/quote]
hubermania wrote:
If it was me I'd throw caution to the wind... This from a guy who no longer has a working ethernet port on his Smart TV.
I've got a Samsung C series 3D TV which I would dearly love to hack. It's still a great TV but few of the apps work any more, the internet's rubbish, and Samsung has moved on to greener pastures. I've dabbled many times but rummaging about in Hotel Mode, one click from permanently bricking what was a US$5,000 TV, is still a bit too rich for me. I did manage to crack the encryption they use to protect recorded material though.
So...I got in. Wasn't particularly difficult although it didn't use the points I expected.
If you take the photo and assign the pins numbers starting from the top left, 1 to 6 clockwise, checking all six with a multimeter I found the only active pins were:
1 to 2,4,5 and 6 and
3 to 2,4,5 and 6
All showed something like 3.5V
Naturally I tried shorting pins 1 to 3 which didn't work. Through trial and error it turns out 3 and 5 are used to reset the device.
Thanks for the advice. Much appreciated. Feels good to save something from the trash can.
Last edited by stivesstu on Sun May 07, 2017 22:54; edited 1 time in total
found this forum post showing which pins to short to put a WNDR4000 in recovery mode
Ha; that thread is how I recovered my WNDR4000 years ago, after years of using OEM f/w then trying to flash Shibby Tomato resulted in a brick. Shorted w/ a 10ohm resistor...
However, in this case, TFTP'ing firmware wouldn't reset the password, but you could `erase nvram` in serial mode.
I have a Netgear WNDR3700v2 and the reset switch also broke off for similar reasons. That said, I was able to reset the modem by shorting with a tweezers the two bottom pins of the switch.
One more noteworthy issue is that whilst I do run OpenWRT on my router not DD-WRT anymore, I was able to load drivers so that I have a console port that comes from a USB serial cable I plug into the USB port on my router. Thus, when OpenWRT starts up it notices the USB serial port adapter plugged into the USB port, loads the proper drivers and treats it as a console. Now I can use that to deal with isssues I'd otherwise need console access for. Just an idea that likely can also be applied to DD-WRT.
Joined: 16 Nov 2015 Posts: 6447 Location: UK, London, just across the river..
Posted: Sun Mar 10, 2024 21:16 Post subject:
new builds heave 5 boot fails option so, it will reset after...but its a
one good reason to have a ssh with key authorization only...as a back up plan so you can reset or change password if happens...
once in CLI mode to reset issue command:
nvram erase
reboot
this should be ok...
last resort serial..it works 99.9% ... _________________ Atheros
TP-Link WR740Nv1 ---DD-WRT 55630 WAP
TP-Link WR1043NDv2 -DD-WRT 55723 Gateway/DoT,Forced DNS,Ad-Block,Firewall,x4VLAN,VPN
TP-Link WR1043NDv2 -Gargoyle OS 1.15.x AP,DNS,QoS,Quotas
Qualcomm-Atheros
Netgear XR500 --DD-WRT 55779 Gateway/DoH,Forced DNS,AP Isolation,4VLAN,Ad-Block,Firewall,Vanilla
Netgear R7800 --DD-WRT 55819 Gateway/DoT,AD-Block,Forced DNS,AP&Net Isolation,x3VLAN,Firewall,Vanilla
Netgear R9000 --DD-WRT 55779 Gateway/DoT,AD-Block,AP Isolation,Firewall,Forced DNS,x2VLAN,Vanilla
Broadcom
Netgear R7000 --DD-WRT 55460 Gateway/SmartDNS/DoH,AD-Block,Firewall,Forced DNS,x3VLAN,VPN
NOT USING 5Ghz ANYWHERE
------------------------------------------------------
Stubby DNS over TLS I DNSCrypt v2 by mac913