unbricking wrt54GS v7

This site is best viewed in a modern browser with JavaScript enabled.

DoctorDroid

Hello all,
Here is the story so far (and sorry for long post, but I wanted to give as much detail as I could). I bought a wrt54GS off ebay since the ddwrt database indicated all wrt54GS routers were compatible. When it arrived, I found it was a v7. Looking at the wiki I saw that there were issues mentioned about "intel" flash chip versions. However, there were other comments about it working. Hence, I gave it a try using vxkiller for v7, but I had not read all the thread and so once it had flashed via the router gui, I pulled the power cord and rebooted -> brick (power light dimm, ethernet ports all on solid...). I then read that the newer vxkiller is supposed to reboot the router itself. Anyway, regardless, the router was dead. I tried various unbrick methods suggested on forums, such as trying to get it into admin mode to accept a new kernel. However, I believe the CFE is snaffooed.
Hence, did some googling and came across JTAG methods and a couple of CFE files that I could try. Bought the DIYGadget buffered Blackcat cable since it said it would debrick the wrt54GS and should be better than unbuffered cables. I set everything up and I know I got a good communication between zjtag software and router because running the probe-only command (zjtag.exe -probeonly /diygadgetblackcat) results in it reading information about the router such as the cpu type:
(*** Found a Broadcom manufactured BCM5354 REV 02 CPU ***).
However, in the section about the flash chip it states:
"Probing Flash at Address: 0x1FC0000...
Detected Chip ID (VenID

evID = 0000 : 0090)
*** Unknown or NO Flash Chip Detected ***
*** REQUESTED OPERATION IS COMPLETE ***
Any other command I try to run to read or write to the flash or erase nvram results in the same type of output. Comparing this with the tutorial, I can see that the tutorial output does show chip information instead.
Does this mean that the flash chip in my router is not supported by this cable/software? What options do I have? I bought this jtag cable to unbrick this specific router, so if it does not work, this is particularly unfortunate. I at least hoped that I would be able to get the original Linksys firmware put back on it even if ddwrt is not an option. My router has serial number CGNB1G915678 and appears to have been made in August or Sept 2007. The flash chip on the PCB has the following codes on it JS28F160, C3BD70, A7217051.
Any help anyone can provide would be very welcome since right now I am stuck with a completely dead router and no way to fix it. If you need more information or want the full zjtag screen output, please let me know. One thought I did have was whether tJTAG software might work? Looking at the tJTAG site shows flash chips supported that sort of look like the same numbers that are typed on the chip in my router. However, I don't know if the tJTAG software will work with the Blackcat cable?
Update: looking at sourceforge site for zJTAG I can see (like tJTAG) it also supports:
/fc:048 (0089 88C3) ......... Intel 28F160C3 1Mx16 BotB (2MB)
/fc:049 (0089 88C2) ......... Intel 28F160C3 1Mx16 TopB (2MB)
Are either of these my chips (looks suspiciously similar numbers)? If so, which one? I am not sure what the "BotB" and "TopB" mean (sorry if this is a dumb question). I don't want to just try it in case something gets broken (more than already!).
Thanks in advance and sorry for the long post, but I wanted to give as much detail as I could.

david.lynch

Hello,
Could you please try:

If I remember correctly, one thing that I've done before I could get Debug Access and Flash identification was:
zjtag.exe -probeonly /erasechip /L1:3

From: *** Unknown or NO Flash Chip Detected *** & no results even with correct /fc
Please give feedback.

DoctorDroid

Hello David
Thanks for the suggestion.
/erasechip on its own made no difference (still unknown or no flash chip)
adding in /L1:3 -> Warning - Invalid option </L1:3> specified
Was it maybe another option you used? Looking at the list of switches I don't see anything obvious.
From the list of supported flash chips, there does appear to be 2 candidates (fc:048 and fc:049). I could skip the autodetect and chose to erase the chip and write a new cfe to a manually chosen chip, but I need to know which one to use. I have been googling like mad and cannot find out what the BotB and TopB actually mean and how to tell which one a particular chip is. I hesitate to just charge on and try one since I don't want to kill the router completely (assuming it is not already beyond hope). I am also not 100% sure that either of the above candidates is actually the chip I have in my router.
Anyone have any other thoughts?
Thanks in advance.

DoctorDroid

Replying to my own post...
I decided that backing up the cfe should be less likely to damage anything than erasing or writing new cfe. Hence tried:
zjtag.exe -backup:cfe /fc:048 /diygadgetblackcat
-> Saving CFE.BIN.SAVED.... to Disk...
-> Done (CFE.BIN.... saved to disk OK)
-> bytes written: 262144
it did this in 69 seconds.
I looked at the file in HxD (hex editor). It is junk. Does not look like any of the CFEs I managed to locate that might be replacements for my snaffooed cfe. Hence, thought maybe it is because I specified the wrong chip. Hence, tried the same with /fc:049
-> bytes written: 262144
it did this in 69 seconds.
ie identical to the first one. I compared the two using HxD = identical byte order
Hence, not sure that it makes any difference which chip of the two to try. Possible answers:
1. It makes no difference which chip option (of the two) is used and what I got is the real contents of the CFE (and hence, reason why router is bricked).
2. It is not either of these chips and so what I got back is rubbish because it is not reading the chip correctly.
Anyone know what happens when an incorrect flash chip is specified? Should it error because it cannot read it or does it just read rubbish? I could try specifying a different flash chip again and seeing what that does. I would still like to know which version of the flash chip (BotB or TopB) I really should be using since this is presumably going to be important when trying to write to the chip.
As always, thanks in advance to taking the time to read and (esp) comment.

david.lynch

Contacts are the best possible?
(My model is USB, so some switches would not apply, I think.)

DoctorDroid

david.lynch wrote: Contacts are the best possible?
(My model is USB, so some switches would not apply, I think.)

Thanks David. The other switch was probably for the usb cable then.
Contacts? I guess you mean are headers soldered onto the pcb? No they are not, because the last time I had to do some soldering on a pcb (admitedly it was an electric toothbrush and not a router), the heat from the soldering I was doing to replace the battery managed to desolder a small component from the pcb. I tried to resolder it on, but the toothbrush was dead and I had to buy a whole new one. Hence my desire not to solder anything unless absolutely necessary...! So far every operation I have run using the zjtag software has resulted in "correct" operation and no error messages (apart from the obvious one about not detecting the flash chip type). Also, the downloading of the CFE files I did above resulted in exact copies with no obvious copy errors, so I thought that the push-on connections were good. I would rather exhaust other possible solutions before starting to solder headers (which were supplied with the jtag cable) onto the pcb due to chance of permanent damage to the router.
Is identification of the flash chip (as opposed to the CPU, which is identified with problem every time) particularly sensitive to connection issues with the cable?
Still very interested in getting any advice about what the BotB and TopB designation means and also whether the codes on my chip (as in original post) identify it as either the 48 or 49 flash chips (or another!) that can be selected manually. Maybe this is more a question that Tornado or Volkan-k can answer if they have time for this issue

DoctorDroid

DoctorDroid wrote: Still very interested in getting any advice about what the BotB and TopB designation means and also whether the codes on my chip (as in original post) identify it as either the 48 or 49 flash chips (or another!) that can be selected manually. Maybe this is more a question that Tornado or Volkan-k can answer if they have time for this issue

Replying to my own post again. I managed to find a technical specification sheet for the JS28F160C3BD70 flash chip. This resolves the issue and so I am posting in case it helps anyone else. TopB and BotB refer to whether the chip boots from the top or bottom of the memory range. This is important since the two chips are arranged differently in terms of memory space. Crucially, the way to tell is the letter immediately after the "C3". In my case it is "B" and this means Bottom boot. If it were a "T" (as in JS28F160C3TD70), then it would be a Top boot chip. Hence, the answer is that my chip can be manually identified by specifying flag "/fc:048" on the command line. My chip is therefore supported by the zJTAG software and Blackcat cable.
I have now been able to flash a replace CFE and delete NVRAM, but it was late last night and I have not been able yet to see if the router is alive again. I'll start a new post if/when the next stage becomes an issue!
In the meantime, please can the mods close down this thread since it should be answered now. Thanks to david.lynch for his input.

[deleted]

DoctorDroid wrote: I have now been able to flash a replace CFE and delete NVRAM, but it was late last night and I have not been able yet to see if the router is alive again. I'll start a new post if/when the next stage becomes an issue!
In the meantime, please can the mods close down this thread since it should be answered now. Thanks to david.lynch for his input.

Thank you for the feedback. I am closing the topic as requested.