Please post anything that you need to debrick in here.

This is JTAG to debrick any JTAG device. Modem, cable boxes, dish boxes routers.
Post Reply
Spray
Junior Member
Posts: 6
Joined: Mon Jan 02, 2012 11:51 am

Post by Spray »

When is the best time for you?

edit: I've downloaded and installed teamviewer.
edit2: I've tried re-programming the kernel two times. Still nothing.

Copyright http://www.usbjtag.com 2008,2009,2010
USB JTAG NT 0.34a
-tap c
Eco :00000000
-tap a ffffffff
Eco :00C12000
-detect
IDCODE 1471217F
Broadcom BCM4712
IMPCODE 00800904
EJTAG V1, V2.0
DMA supoorted
Found Address= 9fc00000 CFI Intel 28F640J3
-tap c
Eco :00000000
-tap a ffffffff
Eco :04C12000
-ldram kernel
Check memory range. x 500 (approximate guess, was tired of counting)
-speed 2
-sprogram kernel
Program Starts...
Program speed 2.09 KB/s
Program time 00:14:05 (.984)
Program pass, if no further programming needed, power off/on the target
-scmpram kernel
Time 00:07:10 (.531)
Compare data OK

edit3: current state of the router:
power led: rapid flashing
dmz led: steady blink every 4 seconds

This usually means the router is pingable for tftp, but I already know afterwards it will brick again so I will wait for you to take a look at it.

Going to call it a night.
feedmaster
Junior Member
Posts: 9
Joined: Fri Feb 03, 2012 11:42 am

Android tablet problem

Post by feedmaster »

I have a cheap eken m001 android tablet that you can load new firmware but it will not boot past the android screen. I have heard of people reflashing the main chip or something because it gets corrupted? It just loads and loads and loads.
mesa412
Junior Member
Posts: 1
Joined: Mon May 18, 2009 4:38 am

Linksys WRT400N

Post by mesa412 »

I have a dead (power light flashing) Linksys WRT400N for which I can find ZERO support.

I can't seem to figure out how to write a script in USBJTAG_NT:confused: to detect the flash (Winbond 25X64VFIG).

Cpu: Atheros 7161 rev2

If someone could help, I follow directions VERY well.

Thanks for the tools and the knowledge. :)
CAPONE
Junior Member
Posts: 5011
Joined: Sat Dec 27, 2008 3:25 pm

Post by CAPONE »

mesa412 wrote:I have a dead (power light flashing) Linksys WRT400N for which I can find ZERO support.

I can't seem to figure out how to write a script in USBJTAG_NT:confused: to detect the flash (Winbond 25X64VFIG).

Cpu: Atheros 7161 rev2

If someone could help, I follow directions VERY well.

Thanks for the tools and the knowledge. :)
Thats an SPI Flash. You should be able to Detect if. A sript Has Nothing to do with Detect. What may be Needed is an XML, However you should still be able to detect the flash. You will need to provide power to Pin 2 Of flash if you Don't Know ( And I know you Don't ) Where the SPI Point Is...
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

mesa412 wrote:I have a dead (power light flashing) Linksys WRT400N for which I can find ZERO support.

I can't seem to figure out how to write a script in USBJTAG_NT:confused: to detect the flash (Winbond 25X64VFIG).

Cpu: Atheros 7161 rev2

If someone could help, I follow directions VERY well.

Thanks for the tools and the knowledge. :)
I am adding more and more SPI flash through JTAG. AR430W is an example.
I am not 100% sure if the algorithm of 7161 is already built in. 0.57 software will provide different mechanism of adding new SPI flash support by through external loadable module. But I also need more device to test on.
Your best bet is that NT already has the support and setup teamviewer and let me make the xml for you. If not you might consider donate this device for me to add support on it.
Mr Sand
Junior Member
Posts: 12
Joined: Wed Jun 06, 2012 9:18 am

WRT300N V 1.1 All lights on. debrick help

Post by Mr Sand »

What target should I use? it is similar as WRT350N? :confused:
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

If you think it is similar to WRT350N then select WRT350N.
You did not specify which target you are playing with.
Mr Sand
Junior Member
Posts: 12
Joined: Wed Jun 06, 2012 9:18 am

Post by Mr Sand »

usbbdm wrote:If you think it is similar to WRT350N then select WRT350N.
You did not specify which target you are playing with.
Oh, sorry, I should have been more specific.

I'm using this target

--WRT54G8M--

I get this:

USB JTAG NT 0.60
Target: WRT54G8M
-detect
IDCODE 1432117F
Broadcom BCM4321
IMPCODE 00000000
EJTAG V1, V2.0
DMA supoorted
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum 0000,0000


I'm doing exactly as the debrick video for WRT350N. Any suggestions?

Also I'm trying to detect the flash, using this commands:

tap c
tap a ffffffff

without success :confused:

This are the specs

WRT300N V 1.1

Serial Num. = CNP11
FCC ID = Q87-WRT300NV11
CPU Type = Broadcom BCM4705LKFBG (BCM4785 chip rev 2)
MIPS Rev = ?
CPU Speed = 300MHz
Bus = ?
Flash Type = Parallel
Flash Chip = Samsung K8D6316UBM
Flash Size = 8MB
Max Firmware Size = 7995392 bytes
RAM Size = 32MB
RAM Chip = 2x NANYA 0716 NT5DS8M16F5-5T 527114W1AC
nvram Size = 32kb
Switch = Broadcom BCM5325EKQMG
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

IMP code is not right.
Possible reason is that IRlength is not right. Try to fix this in XML and see if it works for you.
For router, the IRlength should either be 5 or 8.
Mr Sand
Junior Member
Posts: 12
Joined: Wed Jun 06, 2012 9:18 am

Post by Mr Sand »

usbbdm wrote:IMP code is not right.
Possible reason is that IRlength is not right. Try to fix this in XML and see if it works for you.
For router, the IRlength should either be 5 or 8.
I edited the XML file, but it doesn't work. :(
hr23-700
Junior Member
Posts: 59
Joined: Fri Jan 28, 2011 2:27 am

help please wrt54gv2

Post by hr23-700 »

im doing all the steps to dbricked ..but keep getting
unknown flash type..
when i do the
tap c
tap a ffffffff
then detect i get
this IDCODE 1471217F
BROADCOM BCM4712
IMPCODE 00800904
EJTAG V1 V2.0
DMA supoorted
but when i do erase cfe
thats when i get unknown flash..
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

hr23-700 wrote:im doing all the steps to dbricked ..but keep getting
unknown flash type..
when i do the
tap c
tap a ffffffff
then detect i get
this IDCODE 1471217F
BROADCOM BCM4712
IMPCODE 00800904
EJTAG V1 V2.0
DMA supoorted
but when i do erase cfe
thats when i get unknown flash..
You get stuck when detecting the flash.
Macho20041
Junior Member
Posts: 10
Joined: Mon Oct 20, 2008 7:07 am

Post by Macho20041 »

Dreambox500S

-detect
IDCODE 12955049
IBM STB02500
tipo flash desconocido
Informe de estos valores http://www.usbjtag.com/vbforum ffff,fffe
robbie1223
Junior Member
Posts: 13
Joined: Mon Mar 08, 2010 5:57 pm

Debrick DCT 700

Post by robbie1223 »

I have been doing cable modems for a long time and know how to debrick those....

Now I just bricked my first attempt of doing a cable box.

I don't have any lights so I cant detect. I do have a full flash backup.


any suggestions for best method to debrick???

Thanks in advance....I am using usbjtag nt and have windows 7 64bit
CAPONE
Junior Member
Posts: 5011
Joined: Sat Dec 27, 2008 3:25 pm

Post by CAPONE »

robbie1223 wrote:I have been doing cable modems for a long time and know how to debrick those....

Now I just bricked my first attempt of doing a cable box.

I don't have any lights so I cant detect. I do have a full flash backup.


any suggestions for best method to debrick???

Thanks in advance....I am using usbjtag nt and have windows 7 64bit
No Light = You erased flash but did not program it right after erase.

It is Fixable. Good Luck ;)
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
Post Reply

Who is online

Users browsing this forum: No registered users and 8 guests