Hello everyone,

I've recently got a WNDR3700v5 and I wanted to know if it supports OpenWRT. I've previously worked a lot on the WNDR3700v4 but OpenWRT was already supported and I've only compiled some packages on it.

Today, we don't have much information on this new device that's why I start this topic to get some help.
Currently, my researches are only limited to the hardware but I'm completely new at this so, here is what I've found.

First, the case is fixed with 4 Torx T-8 screws:

When opening the case, we can see this:

Here is the back:

Then, I starting to look at some components. On the following picture, we can see the RAM and the CPU:

The RAM chipset is a Nanya NT5CB64M16FP-DP. More specs can be found here but this device offers 128Mb of RAM.

The CPU is a MT7621ST from MediaTek-Ralink. From this documentation, the target is ramips. More information can be found here. The frequency is 880MHz.

I've also found the Flash chipset :
It's a Macronix MX25L12835F which provides 128Mb of Flash memory. Some specs can be found here.

Then I started to look at the Serial port. Voltage is 3.3V.

Sadly, I do not have a 3.3V serial cable for now, so I do not have more information on the serial port. Anyway, I should receive a 3.3V cable tomorrow and then I will be able to test.
EDIT: The WNDR3700v5 uses 57600 b/s 8 N 1 and no flow control.
It seems there is no JTAG port.

This is the only information I have for now. I've also found this in the OpenWRT trunk : https://dev.openwrt.org/browser/trunk/t … order=name. It contains a folder named mt7621.
Do you think there is any chance that OpenWRT works on the WNDR3700v5?

Francis.

(Last edited by Francis on 10 Apr 2015, 16:59)

There is some Ralink info available on the wiki: http://wiki.openwrt.org/doc/hardware/soc/soc.ralink.

The chip you mention (or at least a similarly named one) is on that list.

Hi,

thank you for your reply. Yeah, I've already seen these information on the wiki. I started to compile an OpenWRT image for this Ralink chip, I hope it will be finished tomorrow to try to flash the WNDR3700v5 with it.

Francis.

ah very interesting - previous rumor was that it was atheros-based.

(Last edited by drawz on 10 Apr 2015, 02:36)

Hi,

The compilation failed this night, so I just restarted it. Sadly, I still have not received the 3.3V serial cable so I think I'll have to wait next monday to perform more researches.

EDIT 3h57 PM:
I received the TTL 3.3V cable! I soldered the cable to the serial port (cf the following photo). Also, I've updated the photo in my first post where I've added the TX and RX position.

Currently, I'm trying to get an output from the serial using Tera Term Pro. However, I've tried all baud rates but I only get junk data. I've also tried to switch RX and TX wire but I was right the first time. I will update this topic when I get correct serial data.

Francis.

(Last edited by Francis on 10 Apr 2015, 15:14)

Thanks for your effort.  I'll be waiting to hear what you discover.

Hi,

Finally, I found the right baud rate! The WNDR3700v5 uses 57600 b/s 8 N 1 and no flow control.
Here is a dump of the boot process: http://pastebin.com/EhH5MmEB

Moreover the OpenWRT image has finished to compile, I think I will test to flash the WNDR3700v5 with it, next monday.
As it is the first time I do that, if there is someone experimented, who understands these logs and is able to give more information, do it before I do something wrong

Francis.

Some of the bootlog reveals that there is something common with Netgear R6220...
Build_for__Netgear_R6220_k2.6.36_2014-10-22_lke_9.0.0_r237695_b2
https://wikidevi.com/wiki/Netgear_R6220

Francis, I have added some basic info on the v5 to the WNDR3700 wiki article - FYI .

Hi,

firstly, thanks for the info hnyman and thank you Borromini!

Currently, I'm blocked. There is one thing I can't understand. When the Netgear starts, I can see the following line:

Press Ctrl+C to Enter the Main loop...

Sadly, I can't write anything to the terminal. I used both Tera Term Pro and Putty but it didn't change anything.

So I decided to try to flash the router using the web-upgrade page. However, when I built the firmware, I had only *.bin files but Netgear only accepts *.img files. The OpenWRT documentation specifies that we can generate custom image files using their "Image Builder" tool. So I tried using this Image Builder but it doesn't produce any *.img file.

So I started to create my own profile in ./target/linux/ramips/mt7621/profiles/
I copied the 00-default.mk file to netgear.mk and instead of calling this line:

$(eval $(call Profile,Default))

I call this one (this is the one used for the WNDR3700v4):

$(eval $(call Profile,WNDR4300))

Obviously, it doesn't work and my bin directory only contains *.bin files. By any chance, I tried to inject the file openwrt-ramips-mt7621-mt7621-squashfs-sysupgrade.bin, renaming to openwrt-ramips-mt7621-mt7621-squashfs-sysupgrade.img but again, it failed:

[upgrade_flash.c::read_to_file():162] enter , CONTENT_LENGTH =  <2884039>
[upgrade_flash.c::read_to_file():168] Read first buffer size  =  <8192>
[upgrade_flash.c::read_to_file():193] boundary is <-----------------------------46381848113282>
[upgrade_flash.c::read_to_file():233] length is <2883834> len is <1024>
[upgrade_flash.c::read_to_file():242] image length is <2883588>
[libupgrade.c::check_checksum():101] checksum of /tmp/fw.img is <0x6a>
Checksum check fail!
Image Check fail!

If someone can help, it would be really appreciated!

Francis.

(Last edited by Francis on 13 Apr 2015, 10:46)

Hi,

correct me if I'm wrong but it seems that the RX link is not connected to the motherboard:

This must explain why I can't type Ctrl+C or any other key.

I also did some researches on the image builder, using the official firmware image from Netgear. They use an odd Sercomm packer and I found the following code declaration in their sources:

typedef struct sercomm_pid
{
    unsigned char    magic_s[7];    /* sErCoMm */
    unsigned char    ver_control[2];    /* version control */
    unsigned char    download[2];    /* download control */
    unsigned char    hw_id[32];      /* H/W ID */
    unsigned char    hw_ver[2];      /* H/W version */
    unsigned char    p_id[4];        /* Product ID */
    unsigned char    protocol_id[2];    /* Protocol ID */
    unsigned char    fun_id[6];    /* Function ID */
    unsigned char    fw_ver[2];    /* F/W version */
    unsigned char    start[2];    /* Starting code segment */
    unsigned char    c_size[2];    /* Code size (kbytes) */
    unsigned char    magic_e[7];    /* sErCoMm */
}sercomm_pid_t;

int is_downgrade(char *file);
void show_and_exit(int index);
int image_is_correct(char *file);
void gw_fw_update(char *img);

//upgrade_flash.h

EDIT:
The upgrade code seems to be proprietary code, managed by a program called 'scfgmgr' which can be found in the original Netgear firmware (in /usr/sbin). I'm currently looking at it, I hope I will find useful information...

Francis.

(Last edited by Francis on 15 Apr 2015, 16:24)

Good news!

After some researches on the 'scfgmgr' and 'upgrade_flash.cgi' executables with IDA, I am able to create a firmware image which is validated by differents Sercomm checks.
Sadly, as I expected, OpenWRT doesn't boot because of a bad magic thing that I don't know about, but I am now looking at this error.

Here is the flash process log: http://pastebin.com/28FAh6Zw.

After that, I though the router was bricked, but hopefully, there is a TFTP recovery mode and I was able to inject the original firmware using the following command:

tftp -i 192.168.1.1 put WNDR3700v5_V1.0..0.17_1.0.1_FW.img

Also, I sent an email to a Netgear dev which replied that the chipset combination is: MT7621s+MT7603E+MT7612E. My previous work was on the v4, he said: 'WNDR3700v4 and WNDR3700v5 is different chipset and design, also different ODM'.

What's an ODM?

Anyway, I will update this topic when OpenWRT will try to boot correctly

Francis.

ODM = Original Design Manufacturer

Hi,

thank you for the info, tunk!

It was pretty quick, OpenWRT is installed! Sadly, I got a kernel panic on boot
Here is the boot log: http://pastebin.com/2nQMYxcf
I used the original *.bin file from OpenWRT repository, it can be found here.

It seems to fail when mounting partitions:

[    2.540000] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    2.550000] Please append a correct "root=" boot option; here are the available partitions:
[    2.570000] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    2.570000] ---[ end Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

If someone has an idea, it will be greatly appreciated. I will also try to access to the TFTP recovery mode, because my router is currently bricked

Francis.

(Last edited by Francis on 17 Apr 2015, 10:14)

Hi,

finally, it's unbricked! After some researches, I found a tool called SercommFirmwareUpdater which allows to upload a *.bin file to flash the router. The process is a bit long (~15 minutes) but at least it works! Tested under Windows XP, when powering on the router, you need to push the reset button until WAN and WiFi LED light up and flash.

I will be able to test other OpenWRT firmware

Francis.

The error is

Cannot open root device

AFAIK   is the root device in the initrd, initial RAM disk.

The idea I (a non native english speaker) want to tell, is check the initrd that is in the "image" that you are using.

Other thing:   -sysupgrade.bin is for upgrades when OpenWRT is allready installed ...

Regards
Geert Stappers
Who respects Francis for diving such deep  into WNDR3700v5

Hello,

thanks for your support stappers! I really appreciate it!
Sadly, I'm not working anymore on this device, I'll have to wait the end of June to get the WANDR3700v5 back.

I was already aware about *sysupgrade files but if you compile the ramips-mt7621 firmware, you won't obtain a compatible firmware for this device

So I used the sysupgrade file to create a complete flash file, from Netgear to OpenWRT.
Anyway, as I said, I might continue my work on it in one month, more or less.

Francis.

Hello Francis,

are there any news? I ordered Netgear WNDR3700 (WNDR37AV) and hoped that the coming version v4. Unfortunately, however, came a new version v5. So I am waiting to be support available in OpenWRT for this version. Without it I have just a nice piece of hardware for decoration :-( Many thanks in advance for your status update. Have a nice day.

Regards,

Marek

Hi xuher !

No, I don't have more news to bring to you. I still have no access to this router, I might get it back the 29th June. Anyway as I said before, I might not work on it anymore. If it is the case, I might buy this router for myself and continue my researches...

Francis.

(Last edited by Francis on 24 Jun 2015, 19:14)

I'm in the exact same boat

Already appreciate the work you put into this Francis! Keep it up

Kind regards
Ben

Same issue here with approx. ten v5 router. We have to use them out-of-the-box *urgs*

Still hoping for development on openwrt for this nice piece of hardware.

@bennnnnnn, @AlexK Where did you get the 3700v5? I'd like to get one, but don't want to end up with a 3700v4.

Hi,

3700v4 are not built anymore, you will get a 3700v5 for sure.

Francis.

Hi all,

is there some new progress? My WNDR3700 (WNDR37AV) v5 device still lying uselessly on the shelf :-( Many thanks in advance for any status update. Have a nice day.

Regards,

Marek

Hi xuher,

I'm not working on it anymore. I don't have free time and I'm currently working on other things.
I might re-work on it in a few months but not immediately

Francis.