Kenny's Blog

Debrick Netgear Wireless Router WNDR3400 v1 with USB to UART TTL Converter CP2102

You find this article probably because you have a wireless router bricked by someone or maybe yourself. There are numerous ways to brick a wireless router: with a hammer, or an electric shocker, to name a few ;). This article tells you how to debrick a wireless router which was bricked by a failed flashing of firmware.

I bricked my wireless router when I tried to flash DD-WRT. After the firmware was uploaded, the router has only one yellow light on. I connected my laptop to its LAN port, and ping it when it booted, I can see a few message showing the ping responses with TTL 100. That means the router is still alive, but lacks firmware to run. The router can be waked up by sending firmware into its flash memory, by way of so called --- JTAG.  Either a serial port (RS232) or a parallel port can be used to JTAG your router.

Most of today's laptops or desktops abandoned serial port and parallel port. Instead, a few USB ports are provided.  To JTAG your router, you have to buy a usb to serial or parallel converter, otherwise you need to buy a special JTAG tool which is normally expensive.

Anyway, I found very cheap USB serial converters on ebay: http://www.ebay.com/sch/i.html?_nkw=usb+UART+TTL+CP2102.  They are cheap but good enough for our purpose: they can send firmware to your bricked router.

Suppose you've gotten such a USB to UART TTL gadget, what's the next step?  Right, you need to disassemble your router and get your hands on the PCB (printed circuit board).  Look carefully on the PCB to find a few soldering points with a printed word "JP1" aside of it, it also prints a "1" aside which means the #1 pin of the JTAG pinouts.  Different routers may have different socket code.  I found the socket information for Netgear WNDR3400 from http://infodepot.wikia.com/wiki/Netgear_WNDR3400.

1. Prepare.

Make sure your router is powered off but keep the network cable connects your computer and the LAN port of the router. Setup your computer network to a manual IP address "192.168.1.2", i. e., the same subnet as your router's LAN but different IP address as the router management IP address.

2. Wire the USB/UART converter toPCB.

Cool, now we got enough information for soldering the USB/UART converter to the PCB.  We need only three wires: Ground (GND), RX, and TX.  You need to connect the converter GND to PCB GND, converter RX to PCB RX, and converter TX to PCB TX.

3. Talk to your router through the converter.

Linux is my only OS so I'll give you the example how to do that under linux. You should be able to find lots of articles to debrick router from other operating systems.

Install a program named "minicom". On ubuntu:


Now you can start minicom:


It first goes to a screen to configure your minicom. You need to setup serial port to "/dev/ttyUSB0" or similar.  Set speed to 115200, data bits to 8 and stop bits to 1.  No parity, and no flow control.

After saving the configuration, you can power on your router.  You need to press Ctrl+C immediately after you power on your router.  This is tricky but you'll finally make it work after a few try, each time you need to close and restart minicom.  Once you succeed, you'll see minicom prints a dozen of lines and goes to a special state called "CFE". And here you can type:


This tells the router to start a tftp server so that you can upload the firmware directly into the router's flash memory.  Now open another terminal, type:


<netgear_wndr3400_firmware> is the file name of the firmware you downloaded from netgear.com.  In about half minute tftp will tell you that it successfully transferred the file to the router.

4. 30-30-30 reset.

Yay! Trust me, your router is back! Now you need to do a 30-30-30 reset of the router: with the power on, press the reset button for 30 seconds; hold on the reset button, power off your router, still hold the reset button for another 30 seconds; with the reset button held, power on your router for 30 seconds.  You'll press the reset button for at least 90 seconds in total. And now let the router start up.

5. Install DD-WRT if you'd like.

And enjoy your NEW router!


References:
1. http://infodepot.wikia.com/wiki/Netgear_WNDR3400
2. http://www.myopenrouter.com/article/19840/How-to-Debrick-Your-NETGEAR-WNR3500L-Using-Ubuntu-10.04-Lucid-Lynx/?textpage=2
3. http://wiki.openwrt.org/doc/hardware/port.serial

$ sudo setpci -s 00:02.1 f4.b=XX

这里 XX 是 00 - FF 的十六进制值。

1. 下载、编译、安装，不赘述
2. 在启动配置中取消 ibus 和 IMSettings Applet
3. sudo yum install gtk2-immodule-xim
4. 在英文环境下使用fcitx：
   vim /etc/gtk-2.0/i386-redhat-linux-gnu/gtk.immodules
   "xim" "X Input Method" "gtk20" "/usr/share/locale" "en:zh" # 前面加上一个en
5. 建立文件 /etc/X11/xinit/xinput.d/fcitx.conf
   XIM=fcitx
   XIM_PROGRAM=/usr/local/bin/fcitx
   XIM_ARGS=""
   GTK_IM_MODULE=fcitx
   QT_IM_MODULE=fcitx
   XMODIFIERS="@im=fcitx"
   
6. sudo alternatives --install /etc/X11/xinit/xinput.d/fcitx.conf xinputrc /etc/X11/xinit/xinput.d/fcitx.conf 70
7. alternatives --config xinputrc
8. 重启 Xwindow
   

删除包含“something”的所有行：

:g/something/d

也可以使用regex：

:g/^\s*$/d

反过来，也可以删除不符合给定模式的所有行：

:g!/^\s*"/d

g! 等价于 v，所以也可以这样删除不符合给定模式的所有行：

:v/^\s*"/d

Ubuntu:

修改文件 /etc/dhcp3/dhclient.conf，添加这一行：

send host-name "loongson";


==============


Fedora:

修改文件 /etc/sysconfig/network，添加这一行：

DHCP_HOSTNAME=loongson




如果你在 Debian / Ubuntu 中添加了新的apt源，那么经常会遇到如下的错误信息：

smartkenny@loongson:~$ sudo apt-get update
............
W: GPG error: ftp://ftp.uni-kl.de testing Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 07DC563D1F41B907
W: GPG error: ftp://ftp.uni-kl.de unstable Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 07DC563D1F41B907
W: You may want to run apt-get update to correct these problems

可以运行下面两个命令来解决这个问题：
smartkenny@loongson:~$ gpg --keyserver wwwkeys.eu.pgp.net --recv-keys 07DC563D1F41B907
smartkenny@loongson:~$ sudo apt-key add .gnupg/pubring.gpg

设置支持的 locale
/var/lib/locales/supported.d/local

重新生成支持的 locale
$ sudo dpkg-reconfigure locales

修改缺省的 locale
/etc/default/locale