Wndr3700v3 brick.

This site is best viewed in a modern browser with JavaScript enabled.

joecop67

I'm trying to recover a bricked wndr3700v3.
Here is what I have so far. Can anyone help?
C:\tjtag-win32\Windows32>tjtag3.exe -probeonly /cable:dlc5 /byte_mode
================================================
EJTAG Debrick Utility v3.0.2.1 Tornado-MOD
================================================
Selected port = 0x378
Detected IR chain length = 32
Number of device(s) = 1
IDCODE for device 1 is 0x1471617F
Idcode 0x1471617f IR Length 32
Jtag is in LV mode
switching to MIPS mode 1
Probing bus ... Done
Instruction Length set to 5
CPU Chip ID: 00000000000010001100000101111111 (0008C17F)
*** Found a Broadcom BCM4716 Rev 1 CPU in MIPS MODE chip ***
- EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000)
- EJTAG Version ....... : 3.1
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS32
Intial value of Control register is 000000C4
Intial value of status register is 0000007F
01111111 (0000007F)
Status bit 7 Busy Inverted pin 11 = 1
Status bit 6 *Ack pin 10 = 1
Status bit 5 Paper-out pin 12 = 1
Status bit 4 Select pin 13 = 1
Status bit 3 *Error pin 15 = 1
* means low = true, e.g., *Error
VCC connected
values of Control register after init 0x000000C4
value of status register after init 0x0000007F
system reset complete
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Init PrAcc ... Done
Clearing Watchdog ... Done
Chip ID 4716
Chip Rev 1
Package Options a
Number of Cores 9
Core Revision 79
Core Type 710
Core Vendor ID 19a10000
Flash Type 700
Flash Type = PFLASH
Flash bus is 8 bits
Dest is bits 0
Flash is byteswapped 0
Endian Type is LE 0
PLL Type 00000000
Enter Flash Probe
Probing Flash at (Flash Window: 0x1fc00000) ...
Enter SPI Flash Probe
Enter SPI Flash Probe
Enter SPI Flash Probe
Enter SPI Flash Probe
Done
*** Unknown or NO Flash Chip Detected ***
*** REQUESTED OPERATION IS COMPLETE ***
C:\tjtag-win32\Windows32>

joecop67

Here is the output with zjtag:
C:\zjtag.source_1.8>zjtag.exe -erase:nvram /diygadgetfta /cable:dlc5 /byte_mode
==============================================
zJTAG EJTAG Debrick Utility v1.8 RC1
==============================================
cable=fta, cabletype=1
cable=dlc5, cabletype=1
Selected port = 0x378
Detected IR chain length = 0
Probing bus ... Done
Defined IR chain Length is 5 bits
CPU assumed running under LITTLE endian
CPU Chip ID: 00010100011100010110000101111111 (1471617F)
*** Found a Broadcom manufactured BCM4716 REV 01 CPU ***
- EJTAG IMPCODE ....... : 10001101011111100001001110110011 (8D7E13B3)
- EJTAG Version ....... : Unknown (4 is a reserved value)
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k DINTsup ASID_8 ASID_6 MIPS64
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
Detected Chip ID (VenID

evID = 001A : 0000)
*** Unknown or NO Flash Chip Detected ***
*** REQUESTED OPERATION IS COMPLETE ***
C:\zjtag.source_1.8>

joecop67

The flash chip is Macronix MX25L6445E, if that helps?

joecop67

Results of flash_debug
C:\tjtag-win32\Windows32>tjtag3.exe -probeonly /byte_mode /cable:dlc5 /flash_deb
ug
================================================
EJTAG Debrick Utility v3.0.2.1 Tornado-MOD
================================================
Selected port = 0x378
Detected IR chain length = 32
Number of device(s) = 1
IDCODE for device 1 is 0x1471617F
Idcode 0x1471617f IR Length 32
Jtag is in LV mode
switching to MIPS mode 1
Probing bus ... Done
Instruction Length set to 5
CPU Chip ID: 00000000000010001100000101111111 (0008C17F)
*** Found a Broadcom BCM4716 Rev 1 CPU in MIPS MODE chip ***
- EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000)
- EJTAG Version ....... : 3.1
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS32
Intial value of Control register is 000000CC
Intial value of status register is 0000007F
01111111 (0000007F)
Status bit 7 Busy Inverted pin 11 = 1
Status bit 6 *Ack pin 10 = 1
Status bit 5 Paper-out pin 12 = 1
Status bit 4 Select pin 13 = 1
Status bit 3 *Error pin 15 = 1
* means low = true, e.g., *Error
VCC connected
values of Control register after init 0x000000CC
value of status register after init 0x0000007F
system reset complete
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Init PrAcc ... Done
Clearing Watchdog ... Done
Chip ID 4716
Chip Rev 1
Package Options a
Number of Cores 9
Core Revision 79
Core Type 710
Core Vendor ID 19a10000
Flash Type 700
Flash Type = PFLASH
Flash bus is 8 bits
Dest is bits 0
Flash is byteswapped 0
Endian Type is LE 0
PLL Type 00000000
spi_flash_read 0x1FC00000
spi_flash_mmr 0x00000000
spi_flash_mmr_size 0x00000000
spi_flash_ctl 0x18000040
spi_flash_opcode 0x18000044
spi_flash_data 0x18000048
spi_ctl_start 0x80000000
spi_ctl_busy 0x80000000
Enter Flash Probe
Probing Flash at (Flash Window: 0x1fc00000) ...
Byte Debug AMD Vendid-1 : 00000000000000000000000010010000 (00000090)
Byte Debug AMD Devdid : 00000000100100001001000010010000 (00909090)
Byte Debug AMD Vendid-2 : 00000000000000000000000010010000 (00000090)
Byte Debug AMD Devdid : 00000000000000000000000010010000 (00000090)
Debug AMD Vendid-3 : 00000000000000001001000010010000 (00009090)
Debug AMD Devdid : 00000000100100001001000010010000 (00909090)
Debug AMD Vendid-4 : 00000000000000000000000000000000 (00000000)
Debug AMD Devdid : 00000000000000000000000000000000 (00000000)
Debug SST Vendid : 00000000000000000000000000000000 (00000000)
Debug SST Devdid : 00000000000000000000000000000000 (00000000)
Debug BSC-SCS Vendid :00000000000000000000000000000000 (00000000)
Debug BSC-SCS Devdid :00000000000000000000000000000000 (00000000)
Enter SPI Flash Probe
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x00000000
REGWRITE32 ADDR MMR+REG 0x18000044 DATA 0x0000049F
SPI_FLASH_OPCODE 0x18000044 PTR_OPCODE 0x0000049F
REGWRITE32 ADDR MMR+REG 0x18000040 DATA 0x8000049F
SPI_FLASH_CTL SEND -> 0x18000040 reg 0x8000049F
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x0000049F
REGREAD32 spi_flash_mmr+reg 0x18000048 data 0xFFFFFFFF
Debug SPI id : 00000000111111111111111111111111 (00FFFFFF)
Debug SPI Vendid : 00000000000000000000000011111111 (000000FF)
Debug SPI Devdid : 00000000000000001111111111111111 (0000FFFF)
Byte Debug AMD Vendid-1 : 00000000000000000000000010010000 (00000090)
Byte Debug AMD Devdid : 00000000100100001001000010010000 (00909090)
Byte Debug AMD Vendid-2 : 00000000000000000000000010010000 (00000090)
Byte Debug AMD Devdid : 00000000000000000000000010010000 (00000090)
Debug AMD Vendid-3 : 00000000000000001001000010010000 (00009090)
Debug AMD Devdid : 00000000100100001001000010010000 (00909090)
Debug AMD Vendid-4 : 00000000000000000000000000000000 (00000000)
Debug AMD Devdid : 00000000000000000000000000000000 (00000000)
Debug SST Vendid : 00000000000000000000000000000000 (00000000)
Debug SST Devdid : 00000000000000000000000000000000 (00000000)
Debug BSC-SCS Vendid :00000000000000000000000000000000 (00000000)
Debug BSC-SCS Devdid :00000000000000000000000000000000 (00000000)
Enter SPI Flash Probe
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x00000000
REGWRITE32 ADDR MMR+REG 0x18000044 DATA 0x0000049F
SPI_FLASH_OPCODE 0x18000044 PTR_OPCODE 0x0000049F
REGWRITE32 ADDR MMR+REG 0x18000040 DATA 0x8000049F
SPI_FLASH_CTL SEND -> 0x18000040 reg 0x8000049F
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x0000049F
REGREAD32 spi_flash_mmr+reg 0x18000048 data 0xFFFFFFFF
Debug SPI id : 00000000111111111111111111111111 (00FFFFFF)
Debug SPI Vendid : 00000000000000000000000011111111 (000000FF)
Debug SPI Devdid : 00000000000000001111111111111111 (0000FFFF)
Byte Debug AMD Vendid-1 : 00000000000000000000000010010000 (00000090)
Byte Debug AMD Devdid : 00000000100100001001000010010000 (00909090)
Byte Debug AMD Vendid-2 : 00000000000000000000000010010000 (00000090)
Byte Debug AMD Devdid : 00000000000000000000000010010000 (00000090)
Debug AMD Vendid-3 : 00000000000000001001000010010000 (00009090)
Debug AMD Devdid : 00000000100100001001000010010000 (00909090)
Debug AMD Vendid-4 : 00000000000000000000000000000000 (00000000)
Debug AMD Devdid : 00000000000000000000000000000000 (00000000)
Debug SST Vendid : 00000000000000000000000000000000 (00000000)
Debug SST Devdid : 00000000000000000000000000000000 (00000000)
Debug BSC-SCS Vendid :00000000000000000000000000000000 (00000000)
Debug BSC-SCS Devdid :00000000000000000000000000000000 (00000000)
Enter SPI Flash Probe
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x00000000
REGWRITE32 ADDR MMR+REG 0x18000044 DATA 0x0000049F
SPI_FLASH_OPCODE 0x18000044 PTR_OPCODE 0x0000049F
REGWRITE32 ADDR MMR+REG 0x18000040 DATA 0x8000049F
SPI_FLASH_CTL SEND -> 0x18000040 reg 0x8000049F
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x0000049F
REGREAD32 spi_flash_mmr+reg 0x18000048 data 0xFFFFFFFF
Debug SPI id : 00000000111111111111111111111111 (00FFFFFF)
Debug SPI Vendid : 00000000000000000000000011111111 (000000FF)
Debug SPI Devdid : 00000000000000001111111111111111 (0000FFFF)
Byte Debug AMD Vendid-1 : 00000000000000000000000010010000 (00000090)
Byte Debug AMD Devdid : 00000000100100001001000010010000 (00909090)
Byte Debug AMD Vendid-2 : 00000000000000000000000010010000 (00000090)
Byte Debug AMD Devdid : 00000000000000000000000010010000 (00000090)
Debug AMD Vendid-3 : 00000000000000001001000010010000 (00009090)
Debug AMD Devdid : 00000000100100001001000010010000 (00909090)
Debug AMD Vendid-4 : 00000000000000000000000000000000 (00000000)
Debug AMD Devdid : 00000000000000000000000000000000 (00000000)
Debug SST Vendid : 00000000000000000000000000000000 (00000000)
Debug SST Devdid : 00000000000000000000000000000000 (00000000)
Debug BSC-SCS Vendid :00000000000000000000000000000000 (00000000)
Debug BSC-SCS Devdid :00000000000000000000000000000000 (00000000)
Enter SPI Flash Probe
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x00000000
REGWRITE32 ADDR MMR+REG 0x18000044 DATA 0x0000049F
SPI_FLASH_OPCODE 0x18000044 PTR_OPCODE 0x0000049F
REGWRITE32 ADDR MMR+REG 0x18000040 DATA 0x8000049F
SPI_FLASH_CTL SEND -> 0x18000040 reg 0x8000049F
REGREAD32 spi_flash_mmr+reg 0x18000040 data 0x0000049F
REGREAD32 spi_flash_mmr+reg 0x18000048 data 0xFFFFFFFF
Debug SPI id : 00000000111111111111111111111111 (00FFFFFF)
Debug SPI Vendid : 00000000000000000000000011111111 (000000FF)
Debug SPI Devdid : 00000000000000001111111111111111 (0000FFFF)
Done
*** Unknown or NO Flash Chip Detected ***
*** REQUESTED OPERATION IS COMPLETE ***
C:\tjtag-win32\Windows32>

[deleted]

Dear sir/madam,
Unfortunately we can not provide technical support for TJTAG due to copyright claim by William Henderson and due to lack of source-codes of the software (GPL violation).
I can recommend you to contact Tornado directly;
* using http://www.tjtag.com/contact
* or e-mail address tornado@tjtag.com
* or DD-WRT community forums
Thanks!

joecop67

I also posted output from zjtag. What about that? Does that contain any useful info for you?

[deleted]

Yes, I am hoping to continue the development of zJTAG in April 2014. You can support the development by donating.