TJTAG - EJTAG De-Brick tool - IMPORTANT CHANGE:See 1st Post.

Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Index -> General Questions
Goto page Previous  1, 2, 3 ... 23, 24, 25 ... 82, 83, 84  Next
Author Message
Kamika007z
DD-WRT User


Joined: 03 Jul 2008
Posts: 103

PostPosted: Thu Jul 31, 2008 3:22    Post subject: Reply with quote
Can you use this utility to debrick a Netgear WNDR3300?

Thank you,
Kamika007z
Sponsor
Eko
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 5771

PostPosted: Thu Jul 31, 2008 13:16    Post subject: Reply with quote
Sure, if it has JTAG port.
russg
DD-WRT User


Joined: 03 Aug 2008
Posts: 80

PostPosted: Tue Aug 05, 2008 20:56    Post subject: Reply with quote
Anyone use or know if the DG-BJTAG-03 from diygadget.com will work with the current software tools? For 29USD I'd buy one over taking the time to source parts and build one.
--russ
Tornado
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 2087
Location: Odessa, Ukraine

PostPosted: Wed Aug 06, 2008 4:39    Post subject: Reply with quote
Yes it will work, with some special instructions though.
_________________
Want JTAG support - Donate a router
or Donate with PayPal !

My preferred parallel jtag adapter:
TIAO Parallel adapter

Tjtag website - http://tjtag.com

Compiling DD-WRT on:
AMD Phenom II X6 1090T @ 3926.667 Mhz

Aptosid X64 - Debian SID X64
Ubuntu 10.10 X64 - Arch X64
lloeki
DD-WRT Novice


Joined: 10 Jul 2008
Posts: 10

PostPosted: Thu Aug 07, 2008 18:13    Post subject: Reply with quote
Tornado,

it seems I have an unlisted chip (or I did something wrong):
MX29LV320CBTC-90G on a wnr834b v2

see this thread for some logs: http://dd-wrt.com/phpBB2/viewtopic.php?p=199263#199263
Tornado
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 2087
Location: Odessa, Ukraine

PostPosted: Fri Aug 08, 2008 6:41    Post subject: Reply with quote
Send me the datasheet and I will add it
_________________
Want JTAG support - Donate a router
or Donate with PayPal !

My preferred parallel jtag adapter:
TIAO Parallel adapter

Tjtag website - http://tjtag.com

Compiling DD-WRT on:
AMD Phenom II X6 1090T @ 3926.667 Mhz

Aptosid X64 - Debian SID X64
Ubuntu 10.10 X64 - Arch X64
felix19
DD-WRT User


Joined: 15 Oct 2006
Posts: 52

PostPosted: Fri Aug 08, 2008 14:53    Post subject: Reply with quote
@Tornado,
I have replaced on my GL v.1.1 the Flash by an 16MB Intel part JS28F128J3D-75. The part is not recognized by your tool, although a very similar part is included in your program.
Flashing with option /fc:65 seem to work for cfe.
Datasheet attached.
Thank - felix

Edit: nvram and kernel seem to flash incorrect with /fc:65.

Edit 2: I tried again today to flash the kernel, and *surprise* autodetect worked fine. Not sure what happend yesterday. Sorry for the cunfusion...
But I'm still not able to start the kernel. CFE is working fine. I verified the kernel flashed properly.It looks ok, but I'm unsure to have it flash to the right location (predefined in the jtag tools).
Do I need to shift with the 16MB Flash any memory mapping or anything else?



Intel_JS28F128D-xx.rar
 Description:

Download
 Filename:  Intel_JS28F128D-xx.rar
 Filesize:  748.13 KB
 Downloaded:  6614 Time(s)

felix19
DD-WRT User


Joined: 15 Oct 2006
Posts: 52

PostPosted: Sat Aug 09, 2008 21:35    Post subject: 16MB Flash Success Reply with quote
Finally I managed to get my WRT54GL running with 16MB Flash Very Happy
It is fairly easy if you are doing things right:
* Jtag Cable not longer than 35cm
* Place missing resistors (4k7, 0603) at jtag port
* Run wrt54g/tjtag tool with option /noreset
* tftp an original linksys firmware first
* now I got a lot of /jffs space on my GL :
* [/img] Very Happy Very Happy



flash_16MB_jffs.JPG
 Description:
 Filesize:  8.64 KB
 Viewed:  22362 Time(s)

flash_16MB_jffs.JPG


johnboi
DD-WRT Novice


Joined: 08 Aug 2008
Posts: 5

PostPosted: Sun Aug 10, 2008 2:14    Post subject: wrt54glv1.1 Reply with quote
I have tried everything to debrick my router. Every time I tried to flash cfe using -flash:cfe /noreset it stops at ifc02000 when I try and do a wholeflash it stops at the same address I can backup and erase the cfe but cannot flash past this point. I have tried various cfe including using skynets bootloader. Any suggestions.
felix19
DD-WRT User


Joined: 15 Oct 2006
Posts: 52

PostPosted: Sun Aug 10, 2008 10:25    Post subject: Re: wrt54glv1.1 Reply with quote
johnboi wrote:
I have tried everything to debrick my router. Every time I tried to flash cfe using -flash:cfe /noreset it stops at ifc02000 when I try and do a wholeflash it stops at the same address I can backup and erase the cfe but cannot flash past this point. I have tried various cfe including using skynets bootloader. Any suggestions.


What´s the length of your jtag cable? Reduce length as short as possible...
Did you place the missing resistors near the jtag connector? I think Linksys memoved these on newer gl v1.1 due to cost reduction.
linkysys
DD-WRT Novice


Joined: 20 Aug 2008
Posts: 4

PostPosted: Wed Aug 20, 2008 8:38    Post subject: unable to detect flash chip on wrt150n Reply with quote
router: linksys wrt150n v1.1
flash: Spansion S29AL032D90TF103
datasheet: http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/s29al032d_00_a1.pdf

Is this flash chip supported in this build?


C:\TJTAGV21\WINDOWS>tjtagv2 -probeonly

==========================================
EJTAG Debrick Utility v2.1.4-Tornado-MOD
==========================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 10010100011100000100000101111111 (9470417F)
*** Found a Broadcom BCM4704 KPBG Rev 9 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Probing Flash at (Flash Window: 0x1fc00000) ... Done

*** Unknown or NO Flash Chip Detected ***

*** REQUESTED OPERATION IS COMPLETE ***


Last edited by linkysys on Wed Aug 20, 2008 8:47; edited 1 time in total
Tornado
DD-WRT Developer/Maintainer


Joined: 07 Jun 2006
Posts: 2087
Location: Odessa, Ukraine

PostPosted: Wed Aug 20, 2008 8:44    Post subject: Reply with quote
try tjtag -probeonly /noemw

whats the output ?

_________________
Want JTAG support - Donate a router
or Donate with PayPal !

My preferred parallel jtag adapter:
TIAO Parallel adapter

Tjtag website - http://tjtag.com

Compiling DD-WRT on:
AMD Phenom II X6 1090T @ 3926.667 Mhz

Aptosid X64 - Debian SID X64
Ubuntu 10.10 X64 - Arch X64
redhawk0
DD-WRT Guru


Joined: 04 Jan 2007
Posts: 11563
Location: Wherever the wind blows- North America

PostPosted: Wed Aug 20, 2008 12:47    Post subject: Re: wrt54glv1.1 Reply with quote
johnboi wrote:
I have tried everything to debrick my router. Every time I tried to flash cfe using -flash:cfe /noreset it stops at ifc02000 when I try and do a wholeflash it stops at the same address I can backup and erase the cfe but cannot flash past this point. I have tried various cfe including using skynets bootloader. Any suggestions.


I've never had luck using the /noreset switch with a 5352 processor. (only 5354s)

It might be better to get the tftag program. It has many updates regarding newer flash chips

http://www.dd-wrt.com/dd-wrtv2/down.php?path=downloads%2Fothers%2Ftornado%2Fjtag/

Try

tjtagv2 -flash:cfe /noemw /nocwd

redhawk

_________________
The only stupid question....is the unasked one.
kingmoocow
DD-WRT Novice


Joined: 07 Jun 2008
Posts: 6

PostPosted: Sun Aug 24, 2008 1:26    Post subject: Linksys WRT54G-TM Reply with quote
Hoping someone can lend a suggestion, as I have 4 routers sitting in the same condition... I don't want to waste them. Crying or Very sad

I have flashed about 10-15 Linksys WRT54G-TM Routers successfully to dd-wrt mega, but have found that /sometimes/ I experience a phenomenon that seems to render my router bricked, and then refuses to flash anymore. It either freezes at Probing Flash, or when manually selecting the flash chip, it freezes at block 1. At this point, all lights are on.

I'm using a 6" non-buffered (I believe, I purchased it on e-bay) cable (3 actually - I've tried them all, they all have worked, but not on these 4 cases), and 3 different PC's, all with the exact same results.

Circumstance that leads to this:
I do a "tjtagv2 -erase:wholeflash /noemw /noreset" to clear the flash. Power Cycle. I create a CFE using Skynet, and then "tjtagv2 -flash:cfe /noemw /noreset" to load the CFE, but it would freeze during the erase. I power cycle the router while it's hung in the erase, and it start as soon as the power come back. It gets to 4%, and stops. On next power cycle, every time I try to clear, it hangs at Probing Flash", likewise when I just try to re-flash the cfe with the command mentioned earlier. it just stops. It's the same problems in the same places on all 4 routers.


C:\tjtag>tjtagv2.exe -probeonly /noemw
Quote:

==========================================
EJTAG Debrick Utility v2.1.4-Tornado-MOD
==========================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 00000101001101010010000101111111 (0535217F)
*** Found a Broadcom BCM5352 Rev 1 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Probing Flash at (Flash Window: 0x1fc00000) ... Done

Flash Vendor ID: 00000000000000000000000010001001 (00000089)
Flash Device ID: 00000000000000000000000000010111 (00000017)
*** Found a Intel 28F640J3 4Mx16 (8MB) Flash Chip ***

- Flash Chip Window Start .... : 1c000000
- Flash Chip Window Length ... : 00800000
- Selected Area Start ........ : 00000000
- Selected Area Length ....... : 00000000



*** REQUESTED OPERATION IS COMPLETE ***


tjtagv2 -flash:cfe /noemw /noreset
Quote:

C:\tjtag>tjtagv2 -flash:cfe /noemw /noreset

==========================================
EJTAG Debrick Utility v2.1.4-Tornado-MOD
==========================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 00000101001101010010000101111111 (0535217F)
*** Found a Broadcom BCM5352 Rev 1 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Probing Flash at (Flash Window: 0x1fc00000) ... ^C


Forcing flash chip manually:

Quote:
C:\tjtag>tjtagv2 -flash:cfe /noemw /noreset /fc:63

==========================================
EJTAG Debrick Utility v2.1.4-Tornado-MOD
==========================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 00000101001101010010000101111111 (0535217F)
*** Found a Broadcom BCM5352 Rev 1 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Manual Flash Selection ... Done

Flash Vendor ID: 00000000000000000000000010001001 (00000089)
Flash Device ID: 00000000000000000000000000010111 (00000017)
*** Manually Selected a Intel 28F640J3 4Mx16 (8MB) Flash Chip ***

- Flash Chip Window Start .... : 1c000000
- Flash Chip Window Length ... : 00800000
- Selected Area Start ........ : 1c000000
- Selected Area Length ....... : 00040000

*** You Selected to Flash the CFE.BIN ***

=========================
Flashing Routine Started
=========================
Total Blocks to Erase: 2

Erasing block: 1 (addr = 1c000000)...^C


Also tried with /bypass, but get no different result.

Tried to be thorough with my circumstance; maybe I left something out. I just can't think of anything else to test/try. Tried getting it immediately after boot, waiting 5 seconds, waiting 5 minutes - it doesn't make a difference.

Any help's appreciated -- thanks,
Shawn360
DD-WRT Guru


Joined: 26 Jul 2008
Posts: 1237

PostPosted: Sun Aug 24, 2008 1:59    Post subject: Re: Linksys WRT54G-TM Reply with quote
kingmoocow wrote:
Hoping someone can lend a suggestion, as I have 4 routers sitting in the same condition... I don't want to waste them. Crying or Very sad

I have flashed about 10-15 Linksys WRT54G-TM Routers successfully to dd-wrt mega, but have found that /sometimes/ I experience a phenomenon that seems to render my router bricked, and then refuses to flash anymore. It either freezes at Probing Flash, or when manually selecting the flash chip, it freezes at block 1. At this point, all lights are on.

I'm using a 6" non-buffered (I believe, I purchased it on e-bay) cable (3 actually - I've tried them all, they all have worked, but not on these 4 cases), and 3 different PC's, all with the exact same results.

Circumstance that leads to this:
I do a "tjtagv2 -erase:wholeflash /noemw /noreset" to clear the flash. Power Cycle. I create a CFE using Skynet, and then "tjtagv2 -flash:cfe /noemw /noreset" to load the CFE, but it would freeze during the erase. I power cycle the router while it's hung in the erase, and it start as soon as the power come back. It gets to 4%, and stops. On next power cycle, every time I try to clear, it hangs at Probing Flash", likewise when I just try to re-flash the cfe with the command mentioned earlier. it just stops. It's the same problems in the same places on all 4 routers.


C:\tjtag>tjtagv2.exe -probeonly /noemw
Quote:

==========================================
EJTAG Debrick Utility v2.1.4-Tornado-MOD
==========================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 00000101001101010010000101111111 (0535217F)
*** Found a Broadcom BCM5352 Rev 1 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Probing Flash at (Flash Window: 0x1fc00000) ... Done

Flash Vendor ID: 00000000000000000000000010001001 (00000089)
Flash Device ID: 00000000000000000000000000010111 (00000017)
*** Found a Intel 28F640J3 4Mx16 (8MB) Flash Chip ***

- Flash Chip Window Start .... : 1c000000
- Flash Chip Window Length ... : 00800000
- Selected Area Start ........ : 00000000
- Selected Area Length ....... : 00000000



*** REQUESTED OPERATION IS COMPLETE ***


tjtagv2 -flash:cfe /noemw /noreset
Quote:

C:\tjtag>tjtagv2 -flash:cfe /noemw /noreset

==========================================
EJTAG Debrick Utility v2.1.4-Tornado-MOD
==========================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 00000101001101010010000101111111 (0535217F)
*** Found a Broadcom BCM5352 Rev 1 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Probing Flash at (Flash Window: 0x1fc00000) ... ^C


Forcing flash chip manually:

Quote:
C:\tjtag>tjtagv2 -flash:cfe /noemw /noreset /fc:63

==========================================
EJTAG Debrick Utility v2.1.4-Tornado-MOD
==========================================

Probing bus ... Done

Instruction Length set to 8

CPU Chip ID: 00000101001101010010000101111111 (0535217F)
*** Found a Broadcom BCM5352 Rev 1 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32

Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Manual Flash Selection ... Done

Flash Vendor ID: 00000000000000000000000010001001 (00000089)
Flash Device ID: 00000000000000000000000000010111 (00000017)
*** Manually Selected a Intel 28F640J3 4Mx16 (8MB) Flash Chip ***

- Flash Chip Window Start .... : 1c000000
- Flash Chip Window Length ... : 00800000
- Selected Area Start ........ : 1c000000
- Selected Area Length ....... : 00040000

*** You Selected to Flash the CFE.BIN ***

=========================
Flashing Routine Started
=========================
Total Blocks to Erase: 2

Erasing block: 1 (addr = 1c000000)...^C


Also tried with /bypass, but get no different result.

Tried to be thorough with my circumstance; maybe I left something out. I just can't think of anything else to test/try. Tried getting it immediately after boot, waiting 5 seconds, waiting 5 minutes - it doesn't make a difference.

Any help's appreciated -- thanks,



Maybe bad flash chips, flashing that many routers you are bound to come across some bad ones.
Goto page Previous  1, 2, 3 ... 23, 24, 25 ... 82, 83, 84  Next Display posts from previous:    Page 24 of 84
Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Index -> General Questions All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum