Netgear WNR3500L v2 unbrick

I was playing with this router till I bricked it. Following is the recovery procedure it worked for me, tested on Xubuntu 12.04.

Firstly set your lan interface to obtain a fixed IP in the subnet 192.168.1.x subnet, such as 192.168.1.10, netmask 255.255.255.0 as usual.

 

Firmware download

Visit www.myopenrouter.com to have a look to the best firmwares available, this time I decided for the Tomato 093-AIO (All In One), all versions are here.

Download and extract the firmware with chk extension in a temporary directory.

 

The terminal

Built a TTL cable to use the terminal through the internal connector JP1 which has this pin out:

[1] VCC

[2] RX

[3] NC

[4] NC

[5] TX

[6] GND

 

Open a terminal emulator such as putty and configure the serial for a speed or 115200 baud and leave the other options set to default (8N1). On Xubuntu you can install it with a simple

sudo apt-get install putty

 

Enter the bootloader

Power cycle the router, press immediately and continuously  CTRL+C to interrupt the bootloader and get the CFE prompt (this assumes you have the TTL serial adapter connected and ready to go)

 

Decompressing...done

CFE for WNR3500Lv2 version: v1.0.9
Build Date: Fri May  6 11:54:17 CST 2011
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
NFLASH Boot partition size = 524288(0x80000)
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.136
CPU type 0x19749: 480MHz
Tot mem: 131072 KBytes

Device eth0:  hwaddr 74-44-01-33-BD-C2, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Startup canceled
CFE> ^C
CFE>

 

Nvram erase

Clear the nvram, missing this operation is often the cause of bricked routers

CFE> nvram erase
*** command status = 0
CFE> nvram commit
*** command status = 0

 

TFTP server

Start the TFTP server

CFE> tftpd
Start TFTP server
Reading ::

 

Firmware upload and upgrade

Move to the directory where the firmware was previously extracted and upload it to the router using a TFTP client

tftp -m binary 192.168.1.1 -c put tomato-Netgear-3500Lv2-K26USB-1.28.RT-N5x--093-AIO.chk

The procedure is quite silent, so don’t touch anything and after some minutes the router will reboot successfully

 

Open your browser to http://192.168.1.1 and enjoy your new firmware.

 

References

http://tomatousb.org/

http://www.myopenrouter.com


4 Comments

  • By StuckINEndlessSorrowDamnyouRouter, September 17, 2012 @ 7:35 am

    Hi

    I bricked mine as well and I get a connection with the router with a TTL cable. Problem is that I can’t interrupt the bootloader with CTRL+C. Tried repeatedly pressing C while booting but nothing.

    CFE for WNR3500Lv2 version: v1.0.9
    Build Date: Fri May 6 11:54:17 CST 2011
    Init Arena
    Init Devs.
    Boot partition size = 262144(0x40000)
    NFLASH Boot partition size = 524288(0x80000)
    et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.136
    CPU type 0x19749: 480MHz
    Tot mem: 131072 KBytes

    Device eth0: hwaddr 4C-60-DE-3B-B4-86, ipaddr 192.168.1.1, mask 255.255.255.0
    gateway not set, nameserver not set
    Checking crc…done.
    Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
    Loading: .. 5192 bytes read
    Entry at 0x80001000
    Closing network.
    Starting program at 0x80001000

    I get a ping response when pressing the power button but it quickly goes to a request timed out. I know there is a way to shortcut two pins but on this newer version of the WNR3500v2 there are no pins.

    I’m using a windows 7 so I will try to run Ubuntu and go that way.

  • By admin, September 17, 2012 @ 5:36 pm

    Hi,
    the interruption of CFE on this router is quite tricky. At the beginning I had some problems as well as you.
    First of all I suggest you to test the TTL cable and be sure the router receive the characters typed in putty. Then, immediately after you switch on the router, press continuously CTRL+C, even if you wait one second you will not interrupt the boot sequence.

    Hope it helps :)

  • By SyteCyer, May 22, 2013 @ 4:09 am

    You say that you “built” you TTL cable. May I ask how you accomplished this?

  • By Hachy, May 23, 2013 @ 5:58 pm

    Thanx, you just made my day by describing the pin layout. Found more tutorials for unbrick but no very clear pin layout.

    It worked, unbricked the thing and put DD-WRT on it.
    Thanx a lot.

Other Links to this Post

RSS feed for comments on this post. TrackBack URI

Leave a comment

WordPress Themes