Verification error on address 00000000

Skipping on how I got here, because it’s been a while and I’m not sure how I got here.

Got a WNDR3700v3 here. Using power supply to power it — consumes ~240-250mA. LEDs light up in a random state when powering on and they stay the same until reset. I’m assuming there’s just no HW pull up/down.

Hooked up to JP1 (serial interface), GND wasn’t hard to find, experimented with different Tx/Rx pin variations with 3.3V FTDI cable — no activity, while expected CFE prompt. Used the most obvious config 115200 8/no parity/1 stop bit.

Read when CFE is messed up (mine somehow was even before getting bricked — had WNDR3400 CFE) JTAG flashing might help. Wasn’t really sure which cable to buy and which tool to use to accomplish that. But found this https://github.com/oxplot/tjtag-pi and gave it a shot.

The utility appears to discover the chip, but it can’t do much else with it…

My chip is BCM4718A, but I read that they’re the same. And trying to do anything else, like -backup:cfe — same result. can’t detect the flash chip.

Also attempted to manually select a chip using /fc:22 (MX25L6405D) which is a close relative to MX25L6406E(which is the chip on board)

Questions #1: Is the CFE stored in the BCM4718A flash or in the MX flash?

MX model: MX25L6406E

Because the tjtag can detect the chip, I’m assuming the wiring is correct.

So, Questions 2: Any other suggestion on where to dig?

P.S. Got CH341A today, read the storage chip, read and backed up. because of the «start address» defined in the tjtag tool —

I am assuming the CFE lives on the BCM chip.

Any help is greatly appreciated. At this point, the time /resource investment outweighs such thing as «just get new router» — sure, but I refuse to give up + it is interesting. If I get this running, I’ll make a nice tutorial about the journey.

BTW, every other time I do any tjtag command the device hangs with this message, but again, just Ctrl+C and run again fixes it

https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=259297

So, I presume this device does not respond to ping and will not TFTP recover?

That’s about all the help I can give, sorry.

_________________
«Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity»

Contribute To DD-WRT

Pogo — A minimal level of ability is expected and needed…

At some point, people just get plain tired of this place.

Because they are tired of bottom-feeders and the same old hat.

———————-

Linux User #377467 counter.li.org / linuxcounter.net

Correct, no ping, no tftp — that’s how I originally flashed it with dd-wrt — using tftp.

Interesting that you say that about the flash. If the CFE is on flash, I theoretically should be able to flash it with when I directly connect to the flash. My problem with this is that I don’t know which address is correct. The CFE.bin is 256 KB, while the chip is 8MB. There’s gotta be some MBR record that specifies how to jump to CFE.

So I’m wondering, do you have any links to the memory layout on these chips?

The confusing part is when I use tjtag -flash:cfe and specify my 8MB flash it tries to flash areas that are outside of the flash memory size.

Only info so far that I can find I will link. The OpenWRT wiki has no flash layout for Broadcom, it seems (unless I’m blind…); not a f*cking thing in any forum threads (great!), nothing on wikidevi, deviwiki, or techinfodepot, or fandom infodepot (eyeroll)…

https://openwrt.org/toh/netgear/wndr3700

https://wikidevi.wi-cat.ru/Netgear_WNDR3700v3

https://deviwiki.com/wiki/Netgear_WNDR3700v3

http://en.techinfodepot.shoutwiki.com/wiki/Netgear_WNDR3700v3

https://infodepot.fandom.com/wiki/Netgear_WNDR3700_v3.0

_________________
«Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity»

Contribute To DD-WRT

Pogo — A minimal level of ability is expected and needed…

At some point, people just get plain tired of this place.

Because they are tired of bottom-feeders and the same old hat.

———————-

Linux User #377467 counter.li.org / linuxcounter.net

[Long post below I wrote while I was trying several steps. I will post a better summary on how to get things back to normal later]

Great progress last night! I found a memory mapping of the flash regions, thank you for pointing out that all the data is stored in the flash and not anywhere on the MCU. So I found this mapping here

Connected to the MX25L6406E (8MB flash) using the CH 341A. Reading the flash was OK, and flashing it was OK. I used AsProgrammer GUI for this and I noticed that it wasn’t doing the «erase» before flashing. So I tried to do full chip erase, but it was throwing me an error:

So, I decided to use one of the closed source programmers found here . I did a complete erase and switched back to the AsProgrammer and read the memory back — indeed it was empty (all 0xFF). Now I flashed the cfe file that I found for wndr3700v3 here

And we’ve got a beat (boot)! Output of the serial connection:

Strangely te CFE is still thinks it’s WNDR4000, not sure why. Of course since there was no firmware it went into the tftp mode. Then I flashed the original Netgear FW and ran a backup I had from when things were OK. it booted. The only problem now is that since all the board_data partition was erased the MAC address was 00-FF-FF-FF-FF-FF. The easiest way to modify board data is to flash dd-wrt. Had to use tftp (web gui wouldn’t allow me for some reason).

After flashing dd-wrt.v24-44715_NEWD-2_K2.6_mini-WNDR3700v3.chk the router booted and interestingly it somehow had almost correct MAC address in the GUI…

It was

LAN: 4C:60:DE:41:1C:2C

WAN: 4C:60:DE:41:1C:2E

Wireless: 4C:60:DE:41:1C:2F

The label has it as 4C:60:DE:41:1C:2D.

I assume it’s coming from the settings I restored using the Netgear backup file.

Anyhow, tried to flash the board_data.bin from here without even modifying the address, but it came up with a very strange address: 00-05-00-00-08-00 (coming from boot message)

BUT, the dd-wrt gui still has it as 4C:60:DE:41:1C:2C.

(btw I had configured SSH in the dd-wrt gui so I can scp files). So I backup the board_data partition to see what’s up.

Then I SCP the file from there to local system

Using https://hexed.it/ for a nice GUI I see that the MAC address is indeed set to 00-05-00-00-08-00 (starting @ 0x0000 0040)

Ok, at this point I am extremely confused, and perhaps you are — the reader of this journey. Time to take a bit more structured approach.

… I was able to get the router to it’s original state, will post a detailed, organized steps a bit later.

Make sure to try these instructions first to unbrick your router:

1. http://www.bernaerts-nicolas.fr/nas/346-wndr3700-openwrt-ddwrt-revert-stock-firmware —> restoring to the stock firmware.

2. https://chester.me/archives/2017/03/unbricking-a-wndr3700v3-netgear-n600-wireless-router/ —> a solid way to get into the recovery mode and update the firmware using tftp

If nothing else has worked for you and the serial connection doesn’t produce any output when you power on the router — most likely your CFE got compromised. From here, there are usually two ways to restore:

1. Connection to the flash directly, erase it, and flashing the CFE (bootloader)

2. Using JTAG connection with one of the tools like tjtag, brjtag, ujtag — requires you to build parallel cables and solder to the JTAG connector. I didn’t have a lot of luck with JTAG recovery on WNDR3700v3, but I’ll add a section below how to get the JTAG connection recognize your WNDR3700v3. (This is more or less documented approach for some routers, not much for WNDR3700v3)

The approach that debricked my WNDR3700v3 router:

1. Get yourself CH341A programmer with a clip (without a clip you’ll have to do some soldering)([url=amzn.com/B07V2M5MVH]like this[/url])

FYI, people online have mixed feelings about the clip approach, but it worked very easily for me, so be aware.

2. Take your WNDR3700v3 apart. Find the flash chip, it will looks like on attached picture «step 2» and have a marking like MX25L6406E.

3. Connected the clip to the flash you just found (do not plug in the CH34A to USB yet) (more details/pictures on the connection)

* DO NOT PLUG IN POWER TO YOUR ROUTER! this may damage the CH341A.

* Make sure the red cable on the clip aligned with the chip’s pin #1 (marked with an indented circle, not painted circle) picture attached.

4. Install the CH341 drivers. Plug in the CH341 into the USB and open the programmer GUI. There are lots of GUI and command line ways to use with CH341, for the ease of the example I’ll demonstrate using AsProgrammer v1.4.1 on Windows10.

5. In the AsProgrammer select the programmer CH341a by going Hardware->CH341a. And select your flash chip model by going IC->Search->Type your model->double click on the result—> close the search window. You’re ready to work with your flash!

6. First step is to read, to make sure your connection is nice and sound. And most importantly BACKUP. Click on the «Read button»(has a green arrow on it pointing right). Give it some time, you’ll see progress bar moving slowly-ish. When the chip is read save the binary by clicking the «Save» button.

7. Click «Erase» button(has a red X on it). If erase operation gives you an error like this

You can try a different programmer, I had this error and used CH341a Programmer V1.43

To make sure the erase worked, go back to AsProgrammer and read the chip, you should see memory filled with 0xFF — that’s good. (I like using AsProgrammer for it’s interface)

8. Open the CFE.bin file in the AsProgrammer. The only one I could find is HERE(also attached). Time to flash! Click «Programm IC» button (red arrow pointing left). After the write is complete, click «Verify IC» (green equals sign).

9. Disconnect CH341 from USB, then disconnect the clip, and power on your router. The power LED should start blinking GREEN — means the router is in the recovery mode.

The serial interface (JP1 over FTDI will start showing you some output )

Note:

This allows us to upload the firmware using tftp connection over the Ethernet. Nice instructions on the TFTP can be found HERE. START WITH STEP 3. You need to flash dd-wrt firmware to be able to restore your router’s «identity» — all the MAC addresses, serial number, etc. Check THIS PAGE on which FW to use

10. Now hopefully you followed along and your router is alive, the serial connection spitting out a bunch of logs, it is advertising dd-wrt, etc. Enable the SSH access to the router, using dd-wrt gui.

11. Login into your router over ssh. Sometimes people connect over wifi, or ethernet, up to you. Just make sure to disable all other ethernet adapters to avoid confusion(except the one you’re connected to the router). ssh into the router using «ssh root@192.168.1.1» and use the password you specified when first logged in into the GUI.

12. Let’s prepare your router’s identity! Download board_data.bin from HERE. Then using HexEd.it drag and drop the board_data.bin into the window. Edit the data in hex according to the info from the back of your router. Made a short clip on how to edit.

13. Time to upload! Read board data to make sure it’s empty using

Now SCP this file to your computer from the router:

You can check the binary using, again, the hexedit and it should be all 0xFF (since we did full chip erase)

Now, scp the modified board_data.bin to your router using

On the router

Restart the router by unplugging the power and then powering on. This makes sure the nvram is completely empty (if you type in reboot the dd-wrt will save the cache from RAm to the nvram partition)

Now your router should restart with CFE properly discovering your router’s model (WNDR3700v3) and boot up recognizing all the MAC addresses. At this point, you can do a cfe backup just in case.

step_2_flash_chip.jpg
Description:
Filesize:	236.84 KB
Viewed:	1193 Time(s)

step_6_reading_flash_280.jpg
Description:
Filesize:	49.6 KB
Viewed:	1192 Time(s)

wndr3700v3cfe.bin
Description:		Download
Filename:	wndr3700v3cfe.bin
Filesize:	256 KB
Downloaded:	44 Time(s)

Last edited by ozee on Mon Aug 23, 2021 12:34; edited 3 times in total