[SOLVED] Cannot erase nvram on a bricked Linksys WRT54GS v1.1 router

This site is best viewed in a modern browser with JavaScript enabled.

[SOLVED] Cannot erase nvram on a bricked Linksys WRT54GS v1.1 router

Luis

Hello to All
I have a bricked Linksys WRT54GS v1.1 router with the power led blinking constantly. Any method of accessing my router has failed so far.
I recently purchased TIAO's TUMPA adapter to try the JTAG recovery method. After downloading the TUMPA drivers and the zJTAG utility version 1.0 and making the cable connection, I believe I established a successful JTAG connection to my router:
==============================================
zJTAG EJTAG Debrick Utility v1.0
==============================================
cableid=0, cabletype=0
*** INFO - sleep <100> (ms) per internal command ***
Set I/O speed to 7500 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR chain Length is 8
CPU assumed running under LITTLE endian
CPU Chip ID: 00010100011100010010000101111111 (1471217F)
*** Found a Broadcom manufactured BCM4712 REV 01 CPU ***
- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
Detected Chip ID (VenID

evID = 0089 : 0017)
*** Found a Intel 28F640J3 4Mx16 (8MB) Flash Chip from Intel
*** REQUESTED OPERATION IS COMPLETE ***
When I execute the command to erase the NVRAM it seems to be successful.
==============================================
zJTAG EJTAG Debrick Utility v1.0
==============================================
cableid=0, cabletype=0
*** INFO - sleep <100> (ms) per internal command ***
Set I/O speed to 6000 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR chain Length is 8
CPU assumed running under LITTLE endian
CPU Chip ID: 00010100011100010010000101111111 (1471217F)
*** Found a Broadcom manufactured BCM4712 REV 01 CPU ***
- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
Detected Chip ID (VenID

[deleted]

Could you please also try zJTAG ver.0.4? To make sure that we didn't break anything in zJTAG since version 0.4

Luis

Hi Volkan
Thanks for your quick reply. Below you will find the results of running zjtag version 0.4:
zjtag -erase:NVRAM /L1:3 /cable:0 /delay:100
==============================================
TUMPA EJTAG Debrick Utility V0.4
==============================================
cableid=0, cabletype=0
*** INFO - sleep <100> (ms) per internal command ***
Set I/O speed to 7500 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR Length is 8
CPU assumed running under LITTLE endian
CPU Chip ID: 00010100011100010010000101111111 (1471217F)
*** Found a Broadcom manufactured BCM4712 REV 01 CPU ***
- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
Detected Chip ID (VenID

evID = 0089 : 0017)
*** Found a Intel 28F640J3 4Mx16 (8MB) Flash Chip from Intel
- Flash Chip Window Start .... : 1C000000
- Flash Chip Window Length ... : 00800000
- Selected Area Start ........ : 1C7E0000
- Selected Area Length ....... : 00020000
*** You Selected to Erase the NVRAM.BIN ***
=========================
Erasing Routine Started
=========================
Total Blocks to Erase: 1
Erasing block: 64 (addr = 1C7E0000)...Done
=========================
Erasing Routine Complete
=========================
elapsed time: 6 seconds
*** REQUESTED OPERATION IS COMPLETE ***
Then I ran the NVRAM backup again:
zjtag -backup:NVRAM /L1:3 /cable:0 /delay:100
==============================================
TUMPA EJTAG Debrick Utility V0.4
==============================================
cableid=0, cabletype=0
*** INFO - sleep <100> (ms) per internal command ***
Set I/O speed to 7500 KHz
USB TAP device has been initialized. Please confirm VREF signal connected!
Press any key to continue... ONCE target board is powered on!
Probing bus ... Done
Detected IR Length is 8
CPU assumed running under LITTLE endian
CPU Chip ID: 00010100011100010010000101111111 (1471217F)
*** Found a Broadcom manufactured BCM4712 REV 01 CPU ***
- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
Detected Chip ID (VenID

evID = 0089 : 0017)
*** Found a Intel 28F640J3 4Mx16 (8MB) Flash Chip from Intel
- Flash Chip Window Start .... : 1C000000
- Flash Chip Window Length ... : 00800000
- Selected Area Start ........ : 1C7E0000
- Selected Area Length ....... : 00020000
*** You Selected to Backup the NVRAM.BIN ***
=========================
Backup Routine Started
=========================
Saving NVRAM.BIN.SAVED_20121116_150653 to Disk...
Done (NVRAM.BIN.SAVED_20121116_150653 saved to Disk OK)
bytes written: 131072
=========================
Backup Routine Complete
=========================
elapsed time: 5 seconds
*** REQUESTED OPERATION IS COMPLETE ***
The VRAM backup file (NVRAM.BIN.SAVED_20121116_150653 in the example above) still shows non 0xFF bytes starting at offset 00018200h.
my JTAG cable pinout is the following (exactly as suggested in the tutorial):
Use a flex female to female to connect TDI together (PIN 3 on Router to PIN 5 on TUMPA's 20 PIN JTAG Header
Use a flex female to female to connect TCK together (PIN 9 on Router to PIN 9 on TUMPA's 20 PIN JTAG Header
Use a flex female to female to connect TMS together (PIN 7 on Router to PIN 7 on TUMPA's 20 PIN JTAG Header
Use a flex female to female to connect TDO together (PIN 5 on Router to PIN 13 on TUMPA's 20 PIN JTAG Header
Use a flex female to female to connect GND together (PIN 4 on Router to PIN 4 on TUMPA's 20 PIN JTAG Header
Thanks again

[deleted]

OK. then the problem is not related to zJTAG version.

Luis

Hi Volkan
A few weeks back when I initially bricked my router, I did not have a JTAG cable and my router was not reachable through ping or tftp. The only other option available to me at the time was trying the PIN-shorting method, which did not work for me. Looking back I now realize it was a stupid action.
When I received my TUMPA adapter, installed it and played with it for almost a day, I noticed the error erasing the NVRAM which I reported at the start of this thread.
After reading on the subject I found another thread which suggested to check that no PINs on the flash chip were shorted after attempting the PIN-shorting method.
Accordingly, I took the smallest screw driver I found and cleaned the space each PIN on the flash chip and then I used a dust cleaner spray to make sure there no metallic parts were left on the board which could short any PIN.
After waiting for 30 minutes I booted my router and this time I was able to erase the whole flash successfully and flashed my CFE.BIN file again. At this point my router came back to life (the power led stopped blinking constantly) and I was able to tftp the stock firmware for my router.
After rebooting my router it was fully functional again!
So guys if you are reading this, avoid the PIN shorting method before trying the JTAG recovery.
The TUMPA adapter and the zjtag program work great!!
Thanks and good luck

[deleted]

Thank you for the feedback.