Forum: ASUS RT-N66U B1 Recovery Mode

Cytat

Recovery Method (RTN66U with 3 steady lights or bad CFE flash).

You will require the following before attempting this recovery (when in doubt, search the forums) :

1. Patience

2. Original CFE (If you remembered to backup it up before flashing) or an edited CFE of another RT-N66U firmware with your MAC ids and place it in your zjtag folder ie. CFE.BIN

3. TUMPA Board with device software (USB) installed - IMP: Verify that TTL-OUT is selected/enabled on the board and do not connect the board to the router with RS232-OUT enabled as you may cause damage to the board and/or router (see TUMPA PDF Manual)

4. 'Proper' soldering of JTAG J2 Pinouts (verify with ohm/voltmeter) including pinout diagram for Serial/Parallel connections and connecting wires should be no more than 45cm (for J2)

5. Windows XP/7 x86 - may work on x64

6. Latest version of zjtag - I remember also using tjtag/brjtag/xjtag at some point but we will try to first recover with zjtag (I believe the later progs were used for analysis)

7. Network cable with the static ip 192.168.1.10 set on your local network adapter

8. ASUS CFE Recovery software (preferred) or CFE recovery page available at 192.168.1.1

9. Latest merlin or asus firmware (if you are restoring a 32k CFE then stick with a 32k firmware and the same applies to 64k CFEs)

10. Latest CFE conversion script (if you wish to attempt to convert the CFE to 64k again)

My Logic & Method

Current jtag software zjtag, tjtag, brjtag do not properly support the flash type SPANSION S29GL256P (missing device id / improper CPU detection / initialization) or CPU type BROADCOM BCM4706 and after analysing the source code of brjtag and zjtag and going over the technical documentation of the spansion chip, I understood how flash / CPU chip support was built into the software and was able to identify a hack that would allow us to use zjtag with the nearest supported spansion flash chip type and unsupported CPU through a 2-step initialization process using the /noreset switch to maintain the active status of the first initialization (CPU) while carrying out a second initialization to activate the spansion chip and make it ready for command processing.

This was not easy as I had to first identify the actual instruction length that made our CPU tick and after attempting over 300 possible combinations of instrlen and divider values, I was able to initialize the CPU using:

Code:
zjtag -probeonly /cable:0 /instrlen:27 /L1:3 /noreset

Now that I had an initialized CPU, I then focused my efforts on initializing the spansion chip and was able do so by executing the following command to delete the CFE:

Code:
zjtag -erase:cfe /skipdetect /cable:0 /instrlen:5 /L1:3 /fc:116 /noreset /verbose

After deleting the CFE, I then proceeded to flash the original CFE I had backed up from an earlier attempt at converting it to 64k:

Code:
zjtag -flash:cfe /skipdetect /cable:0 /instrlen:5 /L1:3 /fc:116 /noreset /verbose

Now that I have flashed the CFE, I connected my network cable to the router and windows box/vm and then proceeded to manually powering off the router, disconnecting the power cable and pressing the power button to the on position (I saw a quick 3-light flash/blimp) followed by pressing the power button again to the off position.

I then connected the power cable and powered on. The router booted to CFE with a quick all light flash followed by a slowly glowing power led light which is an indicator that the router is now ready to accept new firmware. I proceeded with restoring the firmware and carried out a final reboot.

I was able to verify that the CFE was booting and the firmware flash was executed properly via the Serial connection.

Follow these instructions and your RT-N66U will be resurrected