just received a WNDR4300v2 (should receive a v1 but heh...). As I'm curious and I have some tools which allows me to look inside some devices (serial cable & screwdriver), I opened the case and welded to the serial port.
The case is fixed by 6 Torx-8 screws:
When the case is opened, we can see a serial & JTAG ports. The serial parameters are: 115200 8n1. Using a 3,3V TTL serial cable you can access to the serial console. Once again, it seems there is no write access (I could not type anything to the console, as if the RX pin was disabled...):
Here is the back of the router:
Finaly, I removed the 2 faraday's covers, which hide the wireless chipsets, RAM and CPU:
Ok, now here is the original firmware bootlog: http://pastebin.com/rPXNFqUG
Fun thing, the original firmware is based on OpenWRT and is built using the WNDR4500v3 board:
Kernel command line: console=ttyS0,115200 rootfstype=squashfs board=WNDR4500v3 mtdparts=ath-nor0:256k(u-boot)ro,64k(u-boot-env)ro,64k(caldata_backup),64k(config),64k(traffic_meter),64k(pot),1408k(reserved),64k(caldata);ath-spi-nand:1152k(kernel),24448k(rootfs),25600k@0x0(firmware),2048k(language),128k(mtdoops),-(reserved)
Please be patient, while OpenWrt loads ...
Before trying anything, I wanted to be sure that I can reinject original firmware using TFTP, but it seems there is no TFTP recovery mode. Pushing the reset button does nothing.
Looking at the original firmware header, if I remember correctly, WNDR3700v4's firmware is similar:
I don't have more information for now, and I won't be able to do extra researches, I must return this router tonight.