Botched firmware installation. Need recovery help.

Discussion in 'Cisco/Linksys Wireless Routers' started by csete, Jan 15, 2008.

  1. csete

    csete LI Guru Member


    Let me apologize first to anyone that may also hang out on the DD-WRT forums for the cross post. My hope was that asking for help in another forum might get some new eyes with new ideas. The prior discussion can be found on the DD-WRT forums here:

    I recently attempted to make the transition from sveasoft to DD-WRT on my 3 routers in the house. The transition went smoothly for the first 2 routers, but somehow went very wrong for the 3rd. It happened while upgrading my WRT54GS V1 router to the latest stock Linksys firmware along the path to DD-WRT and I've been unable to revive the router using any of the methods I've found on the internet.

    I have a JTag cable and the router seems to be addressable with that or with ping and tftp. The JTag probe results look good to me:

    WRT54G/GS EJTAG Debrick Utility v4.8
    Probing bus ... Done
    Instruction Length set to 8
    CPU Chip ID: 00010100011100010010000101111111 (1471217F)
    *** Found a Broadcom BCM4712 Rev 1 CPU chip ***
        - EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
        - EJTAG Version ....... : 1 or 2.0
        - EJTAG DMA Support ... : Yes
    Issuing Processor / Peripheral Reset ... Done
    Enabling Memory Writes ... Done
    Halting Processor ... <Processor Entered Debug Mode!> ... Done
    Clearing Watchdog ... Done
    Probing Flash at (Flash Window: 0x1fc00000) ... Done
    Flash Vendor ID: 00000000000000000000000010001001 (00000089)
    Flash Device ID: 00000000000000000000000000010111 (00000017)
    *** Found a Intel 28F640J3 4Mx16       (8MB) Flash Chip ***
        - Flash Chip Window Start .... : 1c000000
        - Flash Chip Window Length ... : 00800000
        - Selected Area Start ........ : 00000000
        - Selected Area Length ....... : 00000000
    My latest attempts today involved the following steps:
    - Erase entire flash via JTag
    - Power cycle
    - Erase entire flash via JTAG
    - Power cycle
    - Flash CFE.BIN created from Skynet repair kit via JTag
    - Power cycle
    - Flash latest Linksys firmware via JTag
    - Power cycle

    Despite all of these commands completing successfully, the router always starts up with the power light blinking and the DMZ light blinking slowly. It will respond to ping requests and accept tftp transfers, but the web administration is not accessible.

    Is this thing truly dead or does the fact that the JTag connection appears to work offer me some hope? What other things can I try to revive this beast?

  2. HennieM

    HennieM Network Guru Member

    Try the reset to defaults using the 30 second reset button thing, and, if you can somehow manage, reset to defaults by software.

    I would also rather flash Tomato, dd-wrt, or something that might give you a telnet interface (if lucky), so you can get into the WRT. I'm not sure if there is a different Tomato/dd-wrt/Thibor firmware for a GS v1, but check that.
  3. csete

    csete LI Guru Member

    Any opinions for the best potential firmware for something like this?
  4. Randyored

    Randyored Network Guru Member

    You may find that you can only upload the proper stock Linksys firmware for the router. I ran into this and thought I had bricked the router. I teleneted in but it would not take any other firmware but the stock Linksys firmware.
  5. csete

    csete LI Guru Member

    Unfortunately, that hasn't seemed to work in my many attempts to use the Linksys stock firmware.
  6. HennieM

    HennieM Network Guru Member

    Can you not flash other firmware via tftp?
    Maybe try Thibor15c - that's pretty close to the stock firmware, but I can't remember if you get Telnet (I think you do though).
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice