Hello all,

I am really new to the OpenWrt world. I've already bought 5 Netgear WNR2000 V5 routers in order to install OpenWrt on them and create a 802.11s mesh network. I am struggling to get it working as I can't find any documentation for V5 (Latest OpenWrt documentation for Netgear WNR2000 is for V4). Here is what I did:

1. Unlocked the Telnet Daemon.
2. From initial investigation, it turned out that V5 has only a "mtd0:u-boot" partition and no "mtd1:u-boot-env".
3. In order to test and try, I tried copying the WNR2000 V4 OpenWrt image [http://downloads.openwrt.org/chaos_calm … pgrade.bin] to the "firmware" partition.
4. After it was copied, the router rebooted and the power LED keeps blinking forever.
5. I can't access the router anymore "either telnet or SSH"

The router is probably bricked, which is okay, but I'd like some input or help from experts regarding what shall I do in order to start get it working with V5.
Also, if there is any information about debricking it, that would be really helpful.

Thanks in advance.

Hi Ahmed,

Did you ever resolve you issue? I just picked up one of these routers today for $50 AUD, and was hoping I could get openWRT on it. Like you I have only seen documentation for versions pre v5.

No wonder a v4 image doesn't work on a v5: They have different SoCs.

https://wikidevi.com/wiki/Netgear_WNR2000v4 -> AR9341
https://wikidevi.com/wiki/Netgear_WNR2000v5 -> QCA9531

@tmo26
the SoC does not matter. Both are supported from openwrt and also inside the image.

@all
I got the device, soldered serial connectors on it and i am nearly done with basic support. Nearly means: u-boot is blocking my propper image and i dont understand why.

From the beginning:
First i checked the oem firmware file with a hex editor.

device:WNR2000v5
version:V1.0.0.34
region:
hd_id:29764648+4+0+32+2x2+0

Then i read out the serial information:

hey, its already running openwrt...

...
Image Name:   MIPS OpenWrt Linux-2.6.31
...

...
Kernel command line: rootfstype=squashfs console=ttyS0,115200 mem=32M board=WNR2000V5 mtdparts=ath-nor0:128k(u-boot)ro,832k(kernel),2752k(rootfs),128k(language),64k(pot),64k(traffic_meter),64k(config),64k(a)
...

...
9 cmdlinepart partitions found on MTD device ath-nor0
Creating 9 MTD partitions on "ath-nor0":
0x000000000000-0x000000020000 : "u-boot"
0x000000020000-0x0000000f0000 : "kernel"
0x0000000f0000-0x0000003a0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=3A0000, len=0
0x0000003a0000-0x000000400000 : "rootfs_data"
0x0000003a0000-0x0000003c0000 : "language"
0x0000003c0000-0x0000003d0000 : "pot"
0x0000003d0000-0x0000003e0000 : "traffic_meter"
0x0000003e0000-0x0000003f0000 : "config"
0x0000003f0000-0x000000400000 : "art"
0x000000020000-0x0000003a0000 : "firmware"
u32 classifier
    Performance counters on
Netfilter messages via NETLINK v0.30.
...

Then i took those values and added them while creating a openwrt image. I used the profile for the wnr2000v3 because it was most simple for me.

I modified following lines:
...
wnr2000v3_mtdlayout=mtdparts=spi0.0:128k(u-boot)ro,3904k(firmware),64k(art)ro
...

...
$(eval $(call SingleProfile,Netgear,64kraw,WNR2000V3,wnr2000v3,WNR2000V3,ttyS0,115200,$$(wnr2000v3_mtdlayout),0x32303035,WNR2000V5,"" NA,-H 29764648+4+0+32+2x2+0))
...

After that the image get accepted from the oem installer and the device rebooted:

FILE: /tmp/uhttp-upgrade.img is download successfully!
dd: writing '/tmp/tmp11': No space left on device
1+0 records in
0+0 records out
Writing Image             [##                       ]   8%Sending discover...
Writing Image             [#######                  ]  28%Sending discover...
Writing Image             [#########                ]  36%sh: /www/cgi-bin/uhttpd.sh: not found
Writing Image             [############             ]  48%Sending discover...
Writing Image             [#########################] 100%sh: /sbin/ledcontrol: not found
Saving Data... Done!
Sending discover...
Restarting system.

Ok, great, i thought i am done. But then u-boot told:

...
Retry count exceeded; boot the image as usual

nmrp server is stopped or failed !
   Bad Magic Number
Trying eth0
eth0 link down
FAIL
Trying eth1

The Router is in TFTP Server Firmware Recovery mode NOW!
Listening on Port : 69, IP Address: 192.168.1.1...
...

The magic is correct so far. Its 0x32303035 and its written into the first bytes of the file. Thats why the updater have accepted the image.

Ok, lets write with tftp the self made openwrt image again:

Rcv:
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        ..........................................
Done!
Bytes transferred = 3539077 (360085 hex)
Bad Magic Number,it is forbidden to be written to flash!!
Trying eth0
eth0 link down
FAIL
Trying eth1

The Router is in TFTP Server Firmware Recovery mode NOW!
Listening on Port : 69, IP Address: 192.168.1.1...

???

Can someone help me? What magic does u-boot check?

Also a complete change to:

wnr2000v5_mtdlayout=mtdparts=spi0.0:128k(u-boot)ro,3904k(firmware),64k(art)ro
and
$(eval $(call SingleProfile,Netgear,64kraw,WNR2000V5,wnr2000v5,WNR2000V5,ttyS0,115200,$$(wnr2000v5_mtdlayout),0x32303035,WNR2000v5,"" NA,-H 29764648+4+0+32+2x2+0))

does not help. I always get the tftp error:
Bad Magic Number,it is forbidden to be written to flash!!

Working oem firmware:
http://www.downloads.netgear.com/files/ … 0.0.34.zip

The sourcecode from the working firmware and the installed u-boot:
http://www.downloads.netgear.com/files/ … pl_src.zip

In the file git_home/u-boot.git/net/net.c there is the check that answers "Bad Magic Number,it is forbidden to be written to flash!!":
(!board_model_id_match_open_source_id() && !image_match_open_source_fw_id(addr)) && (ntohl(hdr->ih_magic) != IH_MAGIC))

Can someone please help and tell me what other values then the first few bytes of the firmware file are checked?

Is there someone with the knowledge willing to create a device profile and make a build for this device ?

Yes, i think caspase/jclehner have the knowledge to help with this device. I asked him if he could take a look.
https://forum.openwrt.org/viewtopic.php?id=62656

(Last edited by kelhgvrb on 25 Feb 2016, 14:04)

Hi kelhgvrb,

the WNR2000v5-V1.0.0.34.img image you're referring to uses 0x27051956 (IH_MAGIC), see

$ hexdump -C -s 128 -n 64 WNR2000v5-V1.0.0.34.img
00000080  27 05 19 56 38 86 70 9a  55 37 5a a5 00 0c ff 40  |'..V8.p.U7Z....@|
00000090  80 00 20 00 80 1f 68 f0  40 e4 ad d2 05 05 02 03  |.. ...h.@.......|
000000a0  4d 49 50 53 20 4f 70 65  6e 57 72 74 20 4c 69 6e  |MIPS OpenWrt Lin|
000000b0  75 78 2d 32 2e 36 2e 33  31 00 00 00 00 00 00 00  |ux-2.6.31.......|
000000c0

Where did you get the 0x32303035 from?

I got the 0x32303035 by looking at hexdump at line 00000000.The naming i used is from the other wnr2000 revisions like for example here:
https://dev.openwrt.org/browser/trunk/t … file#L2452

The image i had build then with this magic flashed without problems with the default oem firmware but u-boot check fails. So oem webgui say "file is ok" and write it into ROM but u-boot say "file is not ok, i dont boot". That i didnt understand.

Are there two kind of magics and on newer devices the design of the magic have changed? What is then the magic design i used?

Here is how it looks like and still didnt work. Some magic for part 2(?) of the image seems to be missing:

original image:

hexdump -C -n 256 oem.img 
00000000  64 65 76 69 63 65 3a 57  4e 52 32 30 30 30 76 35  |device:WNR2000v5|
00000010  0a 76 65 72 73 69 6f 6e  3a 56 31 2e 30 2e 30 2e  |.version:V1.0.0.|
00000020  33 34 0a 72 65 67 69 6f  6e 3a 0a 68 64 5f 69 64  |34.region:.hd_id|
00000030  3a 32 39 37 36 34 36 34  38 2b 34 2b 30 2b 33 32  |:29764648+4+0+32|
00000040  2b 32 78 32 2b 30 0a 00  00 00 00 00 00 00 00 00  |+2x2+0..........|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000080  27 05 19 56 38 86 70 9a  55 37 5a a5 00 0c ff 40  |'..V8.p.U7Z....@|
00000090  80 00 20 00 80 1f 68 f0  40 e4 ad d2 05 05 02 03  |.. ...h.@.......|
000000a0  4d 49 50 53 20 4f 70 65  6e 57 72 74 20 4c 69 6e  |MIPS OpenWrt Lin|
000000b0  75 78 2d 32 2e 36 2e 33  31 00 00 00 00 00 00 00  |ux-2.6.31.......|
000000c0  6d 00 00 80 00 40 60 27  00 00 00 00 00 00 04 01  |m....@`'........|
000000d0  d7 43 c0 07 f1 86 7f 28  2c 6b 1b cb e4 ee 3b 7c  |.C.....(,k....;||
000000e0  f4 c1 12 37 50 51 15 cf  7b bc a0 cc 7a 5f 48 12  |...7PQ..{...z_H.|
000000f0  51 89 35 50 31 31 89 2b  78 77 b3 02 d4 5e e2 ca  |Q.5P11.+xw...^..|
00000100

self build image:

hexdump -C -n 256 owrt.img 
00000000  64 65 76 69 63 65 3a 57  4e 52 32 30 30 30 76 35  |device:WNR2000v5|
00000010  0a 76 65 72 73 69 6f 6e  3a 56 4f 70 65 6e 57 72  |.version:VOpenWr|
00000020  74 2e 72 34 38 37 38 30  0a 72 65 67 69 6f 6e 3a  |t.r48780.region:|
00000030  0a 68 64 5f 69 64 3a 32  39 37 36 34 36 34 38 2b  |.hd_id:29764648+|
00000040  34 2b 30 2b 33 32 2b 32  78 32 2b 30 0a 00 00 00  |4+0+32+2x2+0....|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000080  27 05 19 56 a9 c3 b3 d6  56 cf 05 12 00 13 34 00  |'..V....V.....4.|
00000090  bf 07 00 00 bf 07 00 00  97 b6 7b 86 05 05 07 00  |..........{.....|
000000a0  4d 49 50 53 20 4f 70 65  6e 57 72 74 20 4c 69 6e  |MIPS OpenWrt Lin|
000000b0  75 78 2d 34 2e 31 2e 31  36 00 00 00 00 00 00 00  |ux-4.1.16.......|
000000c0  73 71 73 68 00 00 00 03  00 00 00 00 00 00 00 00  |sqsh............|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 03 00 00  |................|
000000e0  00 00 00 10 40 01 00 56  cf 05 12 00 00 00 00 00  |....@..V........|
000000f0  00 00 8c 00 01 00 00 00  00 00 00 00 00 00 00 00  |................|
00000100

log output:

boot the image as usual

 nmrp server is stopped or failed !
   Verifying Checksum ... OK
 Begin Second part firmware check
Second part Bad Magic Number
Trying eth0
eth0 link down
FAIL
Trying eth1

The Router is in TFTP Server Firmware Recovery mode NOW!
Listening on Port : 69, IP Address: 192.168.1.1...

Okay, if this is the same method as used in the EX2700, then this "Second part" means that U-Boot expects to find another uImage header at the end of the last block of the kernel partition. For the EX2700 I did the following:

1. Pad the (lzma) compressed kernel to the nearest eraseblock size-128 bytes. For example, if your kernel is 1100 kB in size, and the block size is 64k, you must pad it to 1152 kB (that's 18 blocks), minus 128 byte (for 2 uImage headers: one for the kernel, and a fake one), that's 1152*1024-64  =1179584 bytes.

2. Create a uImage from the padded kernel (do NOT use the uImage that is automatically created by the OpenWrt build process).

3. Append a fake uImage header (for a 0 byte image) to the padded kernel uImage. The resulting image size is aligned to the block size (1152 kB in our example). You can find the fake header used in the EX2700 (which should work for you too) here.

In the end you'd do something along the lines of (use a helper function for this, because you'll also have to add a marker for the jffs2 partition after the squashfs part, otherwise you won't have a writeable filesystem):

$ cat kernel-wnr2000v5.uImage fakeroot.uImage root.squashfs

See https://dev.openwrt.org/changeset/48771/trunk for details.

(Last edited by caspase on 25 Feb 2016, 19:44)

I checked the HEX values and found the magic twice in the oem image. Once already known at beginning of 00000080 and a second time at the beginning of 000D0040. The memory directly before 000D0040 there is much just full with zero.

Could you help with that? I have no idea how to change your patch to what i am needing.
Would it make most sense to just say somehow in the openwrt sourcecode that this few bytes should be set to 0x27051956 and openwrt can use all the memory around them in the flash chip?

What's your current SingleProfile line? Also, have you tried setting the magic value to 0x27051956? Because 0x32303030 is esentially the string "2000" in the DNI header (the first 128 bytes); this header is not written to the flash, so U-Boot never sees it. The magic value it expects (and complains about) is the U-Boot magic, which in your case is 0x27051956.

(Last edited by caspase on 26 Feb 2016, 19:12)

Also, have a look at NetgearNAND. They do exactly this, but with a blocksize of 128k, and they ubinize the image, which is not neccessary for your device.

I use now as you told:
wnr2000v5_mtdlayout=mtdparts=spi0.0:128k(u-boot)ro,3904k(firmware),64k(art)ro

and

$(eval $(call SingleProfile,Netgear,64kraw,WNR2000V5,wnr2000v5,WNR2000V5,ttyS0,115200,$$(wnr2000v5_mtdlayout),0x27051956,WNR2000v5,"" NA,-H 29764648+4+0+32+2x2+0))

Thanks to you telling me the correct magic the error changed from
Bad Magic Number
to
Second part Bad Magic Number

As told i run a search for the magic number in the oem firmware that you found out in 00000080 and find it once again in 000D0040 inside the WNR2000v5-V1.0.0.34.img file.

I took a look into NetgearNAND by looking into https://dev.openwrt.org/changeset/38655
The main case there is to create different partitions and so on. The WNR2000v5 here have with 4MB flash too less space for such things. You say that this is been called ubinizing and that is not needed for the WNR2000v5. I cant find anything in NetgearNAND how to put just a Magic number to a exact place in a firmware file.

Could you maybe help with coding here and send some patch i could test?

Thanks!

Hi, has anybody pursued this further?  It sounds it is so close.

I also wish i could help but i'm totally lost in translation. It sounds very close though.
I'm willing to help but i really don't know what i can do.

Did any one got it to work on this router ?

I would really like this working myself. I can't get the stock firmware to log in to noip.com for my DDNS service to work, even though I know I have my username and password correct. I think it's because the stock firmware predates the switch from no-ip.com to noip.com.

Yes, the WNR2000v5 is working great with LEDE (OpenWrt is not beeing developed any more).

More information about the WNR2000v5 support you can find here:

https://github.com/lede-project/source/pull/1256

LEDE and OpenWrt are going to merge under the OpenWrt name.