Hi!
I finally tried to put openWRT to my router, but something went wrong and it's now a brick. It doesn't respond to pings, nor does it get an IP address with DHCP (from another router).
I tried the firmware openwrt-motorola-jffs2.bin and followed the instructions that appears at http://openwrt.org/OpenWrtDocs/Hardware/Motorola/WR850G, using the motorola firmware update page. After flashing the new firmware, the router posted a message stating that the upload had been successful and that it was needed to reboot in order changes to take effect. I rebooted and waited for about 15 min but nothing appeared on screen. It didn't respond to ping nor telnet and I couldn't reset it anyway.

I'm reading about making a short in the flash chip while rebooting, but I cannot find any information on which is the chip I have to short (everything stated is about linksys). In addition to this I don't know which pins are to be shorted. Some websites say it's 9 & 10 but others say it's 15 & 16. Any help on this? The only chip I can see on the board (there is a smaller board on top of the rest of the ICs from which the antenna cable is going out) has this written on it: AM29LV320DB. It is rectangular with 24 pins to each narrow side (with a total of 48 pins). I have photos in case it helps better identify the model (I think it's REV 1) and the chips.

Any suggestion or information/redirection will be deeply appreciated as I'd like to recover my router from death.

Thanks. LtGoose.

Shorting pins method may be harmful for your router. Have you got any way to get a serial console on it ? Locate 2x5 pins connector, or if there is no connector, you may have to solder one on the board.

There is also the "JTAG" way to debrick your router, but it requires a working bootloader, which I suppose you have. On linksys wrt54g, the JTAG connector is often really close to the serial one. It's a 2x6 connector which is usually not equiped with pins.

It would be great to post some photos in order to help people identifying where everything (if exists) is

Good luck with your router, and I think it is not yet totally bricked

Thanks for the help.
I have uploaded a photo of my router board (no chips on the back):

It can also be found here .

I don't know exactly if the holes (20 in two rows of 10) located to the right of the flash chip are the JTAG port you refer to... There's no serial connector, as far as I can see.

What is a bootloader? Is it a program? Where can I get one? Sorry for my ignorance

The main problem is that I cannot communicate with the router. No serial port, no ping response, no telnet, no http... I don't even know if shorting the pings will even make it wait for a new firmware via TFTP...

Thanks for any hint you could give me.
LtGoose.

I am not sure, but your 2x10 pins connector really looks like a JTAG one, same cabling method (2,4,6,8 are grounded).

The bootloader is a kind of program that tells the system where the linux kernel is.

I think you will have to make your own JTAG cable. Follow this documentation, and try to get the JTAG specifications for your board. Writing Motorola may be a good start for instance.

http://www.ranvik.net/prosjekter-privat … g_wrt54gs/

I've managed to reflash the old Motorola 4.03 firmware to the router. It was a matter of luck, because I was just driven by desperation After trying everything I had read, I finally gave the pin-short a try. As everything else I had already tried... it didn't work. However, I started shorting pins (don't know which, by the way) and noticed a change in the led pattern... the power led just stayed lit, without flashing every 6 seconds... GOOD! Furthermore, I noticed that pings started to respond and finally, the tftp worked!!

I've tried to upload different versions of the openwrt firmware, but none really worked. Even the last snapshot that was supposed to work with this modem didn't produce any effect. I finally tried the 4.03 firmware (tftp-ing it) and voilá! it rebooted automatically and the WiFi led started to blink again!!!

So I have brought it from the abyss, but still have had no luck with openwrt. So I'll have to start again from scratch.

It is strange, but when I go to frame_debug.asp page and write nvram set boot_wait=on or whatever, I get no response. The page loads again, but nothing else happens. Does someone know what is it supposed to output? I've read that you can list the nvram variables using this page, but I get no output from my commands. Is it possible that my HW version is not fully compatible with openwrt or with this bug used to set boot_wait?

As usual, any help/comment/redirection will be gratefully appreciated.
LtGoose.

LtGoose,

Although I have no additional advice for you, I can provide some comfort that misery likes company.

From your picture you’ve got a board that is laid out the same as mine, and apparently your luck with openWRT follows my experience as well.  Eventually I figured out the firmware trick, I can load (and have loaded) any firmware out there.  However I can only get the various Mot versions I have on hand (5.13 / 4.03) to work properly. 

After a scary set of rolling reboots (I believe this was caused by a metal flake shorting two of the flash pins together) I got it running.  Then I followed the directions to clear the NV ram and that was the last time I was able to successfully load openWRT.

With quick fingers you can hit the firmware load window by waiting for the four Ethernet link lights to extinguish, then start the tftp.  Even with boot_wait disabled I hit the window 90% of the time now.  (Guess my video game reflexes are good for something.)  Since I was up late, I cannot provide any detailed diagnostics on how I got the darn thing to work.  I do remember that the WAN interface took on the LAN addresses at one point.  However after clearing the NVRAM it never loaded openwrt again.  But it is a happy little Franken-router with 5.13 on it.  (Missing face plate, case held together by rubber bands…)  The fact I can, seemingly, always get back to the MOT firmware is a comfort and has enabled additional, yet fruitless, experimentation.

Good luck.  I have given up on this particular router and am pondering trying my hand with another victim.  However all the available candidates are currently in service so need to make some decisions.

Regards,

Matthew

Hiya-

I have a Motorola WR850G and have been happily running the stable (old, non-experimental) version 2005.02.02 of openwrt on it for months.  I upgraded to openwrt by the simple trick of tftp'ing into it the corresponding .trx file.

I've been a bit chicken to try the experimental versions; if you want to run openwrt, you might try the above.

P.S. As I recall, I opened router and the circuit board has a 4-hole, no header serial port on the board; unfortunately I don't have a picture of the board.  I didn't use the serial port in the upgrade, tho, so can't give any tips or tricks.

yawlhoo,

I tried yesterday to upload the stable 2005.02.02 version while recovering the router from death, but couldn't boot from it. Perhaps if I try it from scratch again, it could work. However, I can't say whether the frame_debug.asp page is working properly for me or not. Do you remember the effects of writing commands on the debug page? Any output on screen?
Do you remember what you exactly did to tftp the firmware? Did you start tftp'ing it upon reboot, with boot_wait on or just while it was on running the moto firmware? Detailed explanations would help me a lot, really, because I'm following your instructions of the other post with no luck.

I cannot see any 4-hole serial port on my board (take a look at the photo above), so perhaps they are not the same version. Can you tell me if your router is black or silver, has a detachable antenna or not or any other significant mark that could help me know if mine is the same version as yours?

Thanks a lot for the help. I'll keep trying to update the firmware and put openWRT on my moto router.

LtGoose.

(Last edited by LtGoose on 9 May 2005, 22:26)

Did you look at the thread:

http://openwrt.org/forum/viewtopic.php?id=664

ratbug later in that thread summarizes my "method":
====
Good one Yawlhoo.
I confirmed that. Tried that this morning
Yes, it works.

Downgrade to firmware 4.03
then
http://192.168.10.1/frame_debug.asp

then
1) nvram set boot_wait=on
2) nvram commit.

Have your tftp server ready to send openwrt-linux.trx to unit.

Thanks to yawlhoo
===
I looked at my notes from when I had the Moto opened up, I was wrong in my post above (I was thinking of my Belkin F5D7230-4), my system has a 9-pin header.  Rather than trying to decode my notes on the pins, have you looked at:

http://openwrt.org/OpenWrtDocs/Hardware … ardware%29

Mine is a v.3 router, black case.

Good luck.

That is the post I was refering to.

That's why I was asking you about your router. Mine is a v.1 (silver plastic housing with removable antenna). Perhaps that's why the frame_debug.asp works oddly for me. Do you remember if there was any output in your browser after using 'nvram set boot_wait=on' or whatever other command on the debug page? How did you reboot? I know I can reboot either writing reboot in the frame_debug.asp page or going to the router's start webpage and clicking the reboot button, but don't know which one keeps the boot_wait=on parameter.

Upon flashing the openWRT firmware, is it supposed to be accepting telnet sessions? Or does  it have a webserver inside? I can't get it clear from the documentation. I'll read it again to see if I can find it.

Thanks again for your comments. I'll try again this FW tonight. Hope it works this time.
LtGoose.

(Last edited by LtGoose on 10 May 2005, 06:55)

You asked:
===
Do you remember if there was any output in your browser after using 'nvram set boot_wait=on'...
===
No, sorry, I don't.  Did you try "nvram show"?  It should give a full dump of all the variables, I'm sure this worked.

I didn't do a special reboot, just did:
===
tftp -m binary 192.168.11.1
trace
rexmt 1
put whatever-it-is.trx
===
I pulled the power plug on the router, hit return at the "put.." line, then quickly reinserted the power plug.  You see a series of trace statements, then suddenly, if the put "takes", you see a numbered list of packets going over...

Then you should be able to telnet to 192.168.11.1, and run firstboot, maybe, depending on whether the /jffs is there or not.

Again, good luck.

Hi again.
I finally managed to put openWRT in the Motorola WR850G v.1. It was a complete surprise to see it booting this firmware, because I had been trying for a looong time with many different FWs and nothing happened (apart from bricking it). I believe now that the main problem was the old motorola firmware, that didn't allow me to use the frame_debug.asp page properly. Or perhaps the MS explorer web browser. After more than a week trying to get any output from the nvram commands, I finally got it using Konqueror with debian. After that, I only had to find the suitable firmware. I don't know if the file extension is also a problem. Perhaps I'll check it later on.

Just in case anybody finds this of help, I'll explain what I did to put the firmware on this router.
- First of all, manage to set boot_wait=on in the nvram, using original motorola firmware v4.03 in the frame_debug.asp web page.
- You should get a long list of variables as output. Sometimes I got a message saying 'invalid command', but I think it committed the change. However, you can keep on trying the command (as long as it is well written) and it should work anytime.
- Download the firmware openwrt-motorola-squashfs.bin and save it in your working directory.
- Put default configuration in your router, to make it easier to ping to upon reflashing.
- Configure your network card to have a convenient IP address (192.168.10.2 for example)
- When you have set boot_wait=on and committed the changes, you should unplug the power plug from the router.
- Prepare the tftp transfer with the following commands:

tftp 192.168.10.1
binary
rexmt 1
trace
verbose
put openwrt-motorola-squashfs.bin

- After hitting return in the last line, plug in again the router power cable and wait until you see the transfer taking place.
- If a timeout error shows, you should repeat the previous steps timing better the put command with the router plugging in.
- If no error occurred, then you'll se a transfere complete message or at least, see a bunch of messages stating how many packets were transferred. If everything when ok, the router will reboot automatically. Wait until you can ping or telnet to it again.
- Running telnet 192.168.10.1 should let you open a session in your freshly-flashed openwrt router.
- You should have a look at general openwrt documentation in order to configure properly your new firmware, but that get's far beyond my knowledge. [/list]

I hope this helps.

LtGoose

Mr. LtGoose:

I am so glad that you unbrick your motorola
what a pain I can imagine..............................................................................................

wj

LtGoose,

You're the man!  You have inspired me to try again, but all my gear is in use so it will have to wait until I can reconfigure my network.  For my sanity, can you confirm a few things:

1) You did not rename the firmware from .bin to .trx.
2) You were connected to the LAN port.

Thanks,

Matthew

Exactly, I used the file with its original name (i.e. openwrt-motorola-squashfs.bin) and I was connected through the lan port. Router IP: 192.168.10.1/24 (default) and PC IP: 192.168.10.2/24

Good luck with your router

LtGoose

Success!  Well, but I may have cheated.

Tried to load the new set of firmware on my 850g v1 without success.  Tried everything.  Depending upon the firmware either I could ping it, but not telnet after boot (squashfs) or it just would not boot after boot_wait was over (jffs2). 

I ended up with a spare wr850g v2 router.  (Marketed as a “G Performance Enhanced” or GP.)  Without enabling boot wait there was no window to do TFTP.  Downgraded to 4.03, used IE and enabled boot wait.  Loaded squashfs and . . .

Nothing.  Did not complete boot.

On a lark I decided to push the new motorola-jffs2 on it.  Ran the TFTP and walked away to get a drink.  Came back and was surprised to see the pings working.  Telneted in and …

Score!  (It works on openwrt!)

A few tidbits for thought:

1)    The v1 hardware exhibits a shorter boot_wait period than the v2.  The v2 gives a full five seconds while v1 is much shorter, like two.  Now through all the hell that I put that old router through (pulling box apart, shorting flash pins, blowing away nvram, giving it dirty looks) may have had some side effect.

2)    The different hardware revisions do behave differently with regards to the software.  (I am “Captain Obvious” for this one, but maybe we should make that statement in the openwrt docs.  V2 was hassle free while v1 still doesn’t work.)

3)    The time that I did get openwrt running on the v1 hardware was after I had, err, caused a slightly more permanent short between the flash pins.  (If you push too hard you make metal flakes that can short pin to pin.)  This caused a rolling reboot, swearing, and then corrective action on my part.  After that it booted on squashfs.  Soon to be lost when I blew the nvram away.

4)    Regardless of what experiments / abuse I subjected the box to, I could always recover it back to a Motorola firmware on the first shot.  This makes the risk neglegable and encourages additional experimentation.

5)    LtGoose is still the man.

Now off to configure the silly thing.

Regards and Thanks,

Matthew

i am having the exact same issue. i flashed to a tomato version.
the router was bricked and i brought it back by flashing it thru tftp and shorting the pins, i now have a router that responds to 192.168.1.1 for 4 pings ( as in boot wait is on) but i can not use ANY method to connect to the router, no pages no tfpt nada
the only thing i have not tried to push firmware to it is telnet and that is because  i know zero about it
its all chinese
i need this router, i cant afford to buy a new one,  does anyone have ANY suggestions?
at this point im desperate

how do you * telnet * into a router ?
help!
lol ty:)
and lol srry about reviving a 5 yr old thread,. i just realized that

i posted this here    https://forum.openwrt.org/viewtopic.php … 23#p105923 but have not gotten any replies
ty for your time

(Last edited by PURIFI3D on 3 Apr 2010, 17:35)