Steps to debrick any WRT54G router with USB JTAG NT.

Routers, VOIP devices, etc.
Post Reply
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Steps to debrick any WRT54G router with USB JTAG NT.

Post by usbbdm »

These steps will debrick your WRT54G if you run out of option with any JTAG. (For old JTAG you get locked when detect). The whole process including program the dd-wrt or openwrt will not last loner than two minutes. Never need to use serial port and TFTP again.

1. type command.
tap c
tap a ffffffff

You should see DEBUG ON. If not power off/on the router.
2. Detect the flash
detect

You should be able to see the flash type now. The DEBUG should still be ON.
3. Erase and program the CFE
ldram cfe
erase cfe
sprogram cfe

You must use "sprogram".
4.Power off /on the router
detect

You should be able to see the flash type and DEBUG OFF.
5. Program the kernel with normal speed.
ldram kernel (dd-wrt or openwrt)
program kernel

Wait for erase and program.
6. (Optional) check to see if the program is ok (0.12)
cmpram kernel
cmpram cfe


If above does not bring the router back you need to erase the NVRAM in step 3.
Newb
Junior Member
Posts: 115
Joined: Mon Jan 31, 2011 1:34 pm

Post by Newb »

tried these steps but dont have kernel
step 5 says ldram kernel (dd-wrt or openwrt)
what do you mean ddwrt or openwrt?
where can we find the kernel file? need one fore wrt54g v3?
Everything I say is hy·po·thet·i·cal!
Everything I say I do Is hy·po·thet·i·cal!
I do this to exercise my deficient brain:cool:
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

Newb wrote:tried these steps but dont have kernel
step 5 says ldram kernel (dd-wrt or openwrt)
what do you mean ddwrt or openwrt?
where can we find the kernel file? need one fore wrt54g v3?
This is the firmware you can download from ddwrt or openwrt.
Newb
Junior Member
Posts: 115
Joined: Mon Jan 31, 2011 1:34 pm

Post by Newb »

i checked all over but found only cfe file no kernel file found at those sites.
trying with only cfe but doesnt debrick.
i think i need kernel file but cant find one.
Everything I say is hy·po·thet·i·cal!
Everything I say I do Is hy·po·thet·i·cal!
I do this to exercise my deficient brain:cool:
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

LightworkerNaven
Junior Member
Posts: 87
Joined: Fri Jul 20, 2012 11:34 am
Location: Ohio
Contact:

Post by LightworkerNaven »

I tried this and it doesn't say DEBUG ON when I do tap c and tap a ffffffff. Any idea why that could be? Its a WRT54G-TM and I found this other tutorial as well.

viewtopic.php?t=5253

This is the output. As its all Fs, I'm not sure what's causing it to not find the true values.

Copyright (C) 2010,2011,2012
USB JTAG NT 0.57
Target: WRT54G8M
-tap c
Eco :FFFFFFFF
-tap a ffffffff
Eco :FFFFFFFF
-detect
IDCODE FFFFFFFF
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

LightworkerNaven wrote:I tried this and it doesn't say DEBUG ON when I do tap c and tap a ffffffff. Any idea why that could be? Its a WRT54G-TM and I found this other tutorial as well.

viewtopic.php?t=5253

This is the output. As its all Fs, I'm not sure what's causing it to not find the true values.

Copyright (C) 2010,2011,2012
USB JTAG NT 0.57
Target: WRT54G8M
-tap c
Eco :FFFFFFFF
-tap a ffffffff
Eco :FFFFFFFF
-detect
IDCODE FFFFFFFF
This is a connection issue. I do not see the JTAG is talking to the CPU yet.
nyquist
Junior Member
Posts: 1
Joined: Fri Jul 01, 2011 7:19 am

unknown flash type

Post by nyquist »

I have a bricked WRT54G v1.1

I tried the above but won't switch to debug on - stays trap on

-detect
IDCODE 0471017F
Broadcom BCM4702
IMPCODE B6DB6DB2
EJTAG V2.6
DMA not supported
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum cffd,5fb9
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

nyquist wrote:I have a bricked WRT54G v1.1

I tried the above but won't switch to debug on - stays trap on

-detect
IDCODE 0471017F
Broadcom BCM4702
IMPCODE B6DB6DB2
EJTAG V2.6
DMA not supported
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum cffd,5fb9
Most likely you have programmed bad boot (firmware on boot).
One possible solution (risky) is to short pin the CE to 3.3V while enter DEBUG ON. This has to be done quickly. Then erase the boot and you are good to go.
Post Reply

Who is online

Users browsing this forum: No registered users and 5 guests