网件JNR3210救砖过程

常想一二

CPU：620M
RAM：128M
ROM：8M
lAN*4：1000M
wAN*1：1000M
WIFI：300M     天线可拆卸

"The Unicorn Arm" (79 episodes) - Complete Works
            采用了 Realtek RTL8198(620Mhz) + RTL8192CE   

详细测评在此http://www.360doc.com/content/12/0506/01/3220376_208948057.shtml

砖头是因为升级最新官方固件过程中断电所致，论坛没有该路由的相关资料，所以摸着石头过河！首先准备编程器，复制出原来坏的固件，提取出前128K CFE，然后烧写入闪存，焊接回路由，(因不知道怎么停止CFE启动，常规停止方法都是试过无效，故出此方法，单写CFE硬性停止，此处还望高手指点，后附正常CFE启动信息，可做参考，以备其他无编程器的同学思考)，再准备TFTP，设置好本地连接，设置好TTL比特率，如下图

本地连接设置




TTL比特率设置




路由TTL脚位定义



TFTP设置

Migrate to your own network disk


  
上述准备妥当后，连接好网线，通电，看到TTL显示如下图



启动至此见Enter TFTP_REC_wait4pkt时可以按TFTP更新固件按钮，TTL通信出现如下图



说明刷写正常，耐心等待，直到出现下图后提示闪存刷写固件成功，如图


然后断电重启，可见原厂固件界面，默认登录地址192.168.1.1登录账户为admin/password






至此救砖头成功!
。。。。。。。。。。。分。。。。。。割。。。。。线。。。。。。。。。。

附上正常固件状态下CFE启动信息

========== SPI =============
SDRAM CLOCK:181MHZ
------------------------- Force into Single IO Mode ------------------------
|No chipID  Sft chipSize blkSize secSize pageSize sdCk opCk      chipName    |
| 0 c22017h  0h  800000h  10000h   1000h     100h   86   45   MX6405D/05E/45E|
----------------------------------------------------------------------------
Reboot Result from Watchdog Timeout!

---RealTek(RTL8198)at 2012.01.04-09:50+0800 version v1.1f [16bit](620MHz)
Enter NMRP_main
NMRP func [NMRP_init] state is [0x00]  line [84]
Scanning Flash Section 0...
Scanning Flash Section 1...
Flash Sector Number : 128.
NMRP func [NMRP_init] state is [0x00]  line [93]
Set GPHY Parameter OK
NMRP func [NMRP_init] state is [[0x00]]  line [99]
Our ETH MAC:

4c 60 de 74 db 66
NMRPISTENING
Enter NMRP_handle_LISTENING_state
### No NMRP Server found ###
Scanning Flash Section 0...
Scanning Flash Section 1...
Flash Sector Number : 128.

***************************************************
    Sercomm Boot Version 1.4.0.0

***************************************************
Entering Firmware : Everything is OK.
Jump to image start=0x80500000...
decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
start address: 0x80003750
CPU revision is: 0000dc02
Determined physical RAM map:
memory: 08000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00008000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00008000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: console=ttyS0,38400 root=/dev/mtdblock1
icache: 16kB/32B, dcache: 8kB/32B, scache: 0kB/0B
NR_IRQS:48
PID hash table entries: 512 (order: 9, 2048 bytes)
console handover: boot [early0] -> real [ttyS0]
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 121712k/131072k available (2818k kernel code, 9192k reserved, 922k data,
108k init, 0k highmem)
Calibrating delay loop... 619.31 BogoMIPS (lpj=3096576)
Mount-cache hash table entries: 512
net_namespace: 528 bytes
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NTFS driver 2.1.29 [Flags: R/W DEBUG].
fuse init (API version 7.11)
msgmni has been set to 238
io scheduler noop registered
io scheduler cfq registered (default)
Realtek GPIO Driver for Flash Reload Default
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x18002000 (irq = 8) is a 16550A
Driver 'sd' needs updating - please use bus_type methods
PPP generic driver version 2.4.2
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
RTL8192C/RTL8188C driver version 1.4 (2010-12-22)
=====>>INSIDE rtl8192cd_init_one <<=====
PCIE reset (0)
Do MDIO_RESET
Find Port=0 Device:Vender ID=819110ec
vendor_deivce_id=819110ec
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====



Probing RTL8186 10/100 NIC-kenel stack size order[2]...
chip name: 8196C, chip revid: 0
==Set GPHY Parameter OK
NOT YET
Set threshould idx 0
eth0 added. vid=9 Member port 0x1...
eth1 added. vid=8 Member port 0x10...
eth2 added. vid=9 Member port 0x2...
eth3 added. vid=9 Member port 0x4...
eth4 added. vid=9 Member port 0x8...
eth5 added. vid=9 Member port 0x0...
[peth0] added, mapping to [eth1]...
port_num 0, link 0, speed: 0
port_num 1, link 0, speed: 0
port_num 2, link 0, speed: 0
port_num 3, link 0, speed: 0
port_num 4, link 0, speed: 0
SPI INIT
------------------------- Force into Single IO Mode ------------------------
|No chipID  Sft chipSize blkSize secSize pageSize sdCk opCk      chipName    |
| 0 c22017h  0h  800000h  10000h   1000h     100h   86    0   MX6405D/05E/45E|
----------------------------------------------------------------------------
SPI flash(MX6405D/05E/45E) was found at CS0, size 0x800000
Creating 11 MTD partitions on "flash_bank_1":
0x000000020000-0x000000770000 : "fs+kernel+multi-lang"
0x000000160000-0x000000750000 : "rootfs"
0x000000000000-0x000000020000 : "bootloader"
0x0000007e0000-0x0000007f0000 : "nvram"
0x0000007b0000-0x0000007c0000 : "OT"
0x0000007c0000-0x0000007d0000 : "traffic_meter"
0x0000007d0000-0x0000007e0000 : "DPF"
0x0000007f0000-0x000000800000 : "BRCM_NV"
0x000000750000-0x000000770000 : "English UI"
0x000000770000-0x000000790000 : "Chinese UI"
0x000000790000-0x0000007b0000 : "Other UI"
usbmon: debugfs is not available
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
rtl8652-ehci rtl8652-ehci.0: RTL8652 On-Chip EHCI Host Controller
rtl8652-ehci rtl8652-ehci.0: new USB bus registered, assigned bus number 1
read synopsys=0
read synopsys2=0
rtl8652-ehci rtl8652-ehci.0: irq 10, io base 0x18021000
rtl8652-ehci rtl8652-ehci.0: USB 0.0 started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
rtl8652-ohci rtl8652-ohci.0: RTL8652 OHCI
rtl8652-ohci rtl8652-ohci.0: new USB bus registered, assigned bus number 2
rtl8652-ohci rtl8652-ohci.0: irq 10, io mem 0x18020000
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (2048 buckets, 8192 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 17
Netlink[Kernel] create socket for igmp ok.
VFS: Mounted root (squashfs filesystem) readonly on device 31:1.
Freeing unused kernel memory: 108k freed
init started: BusyBox v1.13.4 (2013-05-13 20:27:34 CST)
starting pid 699, tty '/dev/console': '/usr/etc/rcS'
led_pb_api: module license 'Sercomm' taints kernel.
Disabling lock debugging due to kernel taint
Register LED ID <70>
Register LED ID <71>
Register LED ID <18>
Register LED ID <14>
Register LED ID <15>
Register LED ID <16>
Register LED ID <17>
Register LED ID <10>
Register LED ID <11>
Register LED ID <12>
Register LED ID <13>
Register LED ID <20>
Register LED ID <30>
Register LED ID <38>
Register LED ID <45>
Register LED ID <60>
Register LED ID <75>
Register LED ID <90>
Register LED ID <91>
Register LED ID <92>
netfilter dnshj choose interested dns queries module loaded !

余略。。。。。。。。。。。。。。

levees

十分感谢楼主啊。。。
在睡觉时记起那天进路由时提示升级。。结果固件下载完5分钟都没反应。。断电就洗白了。。
我的是JNR3000这种邪教版本路由网上没有资料。。翻阅一万篇网页后有幸看到楼主的帖子，
心想方案差不多就试试，于是从0点开始拆机，TNND TTL线孔都没有，还得打孔、焊TTL线。
连上后。。按楼主的方法试TTL输出正常，一阵欣喜。。。
开始TFTP刷写，但是在屏幕输出十万个 pkttype is [0x0800] 之间。。TFTP不成功 ping IP 也不通，试了八千次。。不成功。。还试了其他邪教IP。。均告失败。
遂欲放弃。。。。
于是乎想拿出我买了一年还没用过的WNDR3800来。。但还是不服气啊。。在拨TTL线之前一阵乱按。像是发泄。但是，居然看到TFTP传送了。。。然后。。就楼主描述差不多。。就成功了。。
我这次和楼主不同的网卡叉叉刚刚消失的时候TFTP 才成功的。。前八千次都失败了。。终于在八千零一次成功了。。。
重启路由。。设置丢失。。其他好像没什么问题。。。壳子还没装回去，先来发帖表示感谢。
Ultra-clear image quality

zqxyzx

楼主太有才了

frankw01

请问楼主用的是什么型号的USB转COM口的转换器？谢谢。

danielbin321

恭喜楼主，我正在努力救我的wndr3800 痛苦

audivv

请教，刷成了NETIS WF2780后，直接升级的WRT然后变砖了，请教怎么救砖？用原厂的长按reset加电8秒，TFTP还是耍不进去，怎么能救砖？

longth568

levees 发表于 2014-9-26 01:55
十分感谢楼主啊。。。
在睡觉时记起那天进路由时提示升级。。结果固件下载完5分钟都没反应。。断电就洗白 ...

玛雅，看着就激动，，，，