need help unbricking wrt54g v6

This site is best viewed in a modern browser with JavaScript enabled.

need help unbricking wrt54g v6

wrt168

i have a bricked wrt54g v6 with blinking power led light and all lan port lights lit. i am using zjtag with a 20 pin diygadgetfta cable and i've had great success in the past unbricking a v5 without any issue. now i have in front of me a v6 that i'm unable to enter the cpu into debug mode hence unable to properly erase and flash. i've tried using the switch /fc:048 to erase and flash the CFE but the backup-ed CFE shows all 00.
other switches i have tried:
/fc:048 /noemw /nocwd /diygadgetfta -- same result; backup-ed CFE being all 00.
/fc:048 /nodma /diygadgetfta - hangs
any suggestion would be appreciated. thanks.

dvdrus

can you paste you output on a probe
zjtag -probeonly /verbose /debug
i will try and help.
P.S. really hate the captcha.... maybe no captcha for 10+ posts

wrt168

C:\zjtag1.7>zjtag -probeonly /verbose /debug /diygadgetfta
==============================================
zJTAG EJTAG Debrick Utility v1.7 R4
==============================================
cable=fta, cabletype=1
Selected port = 0x378
Detected IR chain length = 8
Probing bus ... Done
Defined IR chain Length is 8 bits
CPU assumed running under LITTLE endian
CPU Chip ID: 00000101001101010010000101111111 (0535217F)
*** Found a Broadcom manufactured BCM5352 REV 01 CPU ***
- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
Read raw Chip ID (MfrID

evID = 0000 : 0000)
Detected Chip ID (VenID

evID = 0000 : 0000)
Read Array Starting from offset
Array = 0x0000
Array = 0x0000
Array = 0x0000
Read Array Starting from offset
Array = 0x0000
Array = 0x0000
Array = 0x0000
Read Array Starting from offset
Array = 0x0000
Array = 0x0000
Array = 0x0000
Read Array Starting from offset
Array = 0x0000
Array = 0x0000
Array = 0x0000
*** Unknown or NO Flash Chip Detected ***
*** REQUESTED OPERATION IS COMPLETE ***

dvdrus

try forcing dma
/dma add this to that line

wrt168

C:\zjtag1.7>zjtag -probeonly /verbose /debug /dma /diygadgetfta
==============================================
zJTAG EJTAG Debrick Utility v1.7 R4
==============================================
cable=fta, cabletype=1
Selected port = 0x378
Detected IR chain length = 8
Probing bus ... Done
Defined IR chain Length is 8 bits
CPU assumed running under LITTLE endian
CPU Chip ID: 00000101001101010010000101111111 (0535217F)
*** Found a Broadcom manufactured BCM5352 REV 01 CPU ***
- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32
*** DMA Mode Forced On ***
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
Read raw Chip ID (MfrID

evID = 0000 : 0000)
Detected Chip ID (VenID

flipy

Some chips are tricky.
Turn the router on and then hit zjtag.

wrt168

i have done that too. 1/2 second right after powering on. played with different time delays before hitting the <return> key but still same result.