OpenWrt Forum Archive

Topic: Netgear EVG2000 (Yes, but needs b53 switch detection)

The content of this topic has been archived between 30 Mar 2018 and 22 Apr 2018. Unfortunately there are posts – most likely complete pages – missing.

I have just salvaged 2 x Netgear EVG2000 routers. The specs look quite good, but they are not currently supported.

It does say WIP, but is there anyone or anywhere that I can find out where the WIP is at or what work is remaining to get them working?

It is very similar to the DGND3700, sharing the same toolchain.

(Last edited by Xotic750 on 23 Apr 2016, 16:13)

I found netgear source code with toolchain for download, it is slightly older than what is running on the devices. … ogrammers- … are/files/

I also had a read of of the developers guide about first steps and adding a new platform

But I still have no idea at what stage the WIP is, whether there is a platform that could be easily modified, or how to go about using the netgear source and toolchain to add a platform.

If there is someone working on this, then I would be willing to help test builds, or even supply one or both of the devices that I have so that they could be worked on.

(Last edited by Xotic750 on 7 Apr 2016, 14:29)

A 'nmap' of the device shows

[graham@tyr telnetenable-0.4]$ nmap -A -T4

Starting Nmap 7.10 ( ) at 2016-04-07 10:31 CEST
Nmap scan report for
Host is up (0.00039s latency).
Not shown: 996 closed ports
53/tcp   open  domain     dnsmasq 2.15
| dns-nsid: 
|   id.server: 
|_  bind.version: dnsmasq-2.15
80/tcp   open  http
443/tcp  open  ssl/https?
| ssl-cert: Subject: organizationName=Internet Widgits Pty Ltd/stateOrProvinceName=Some-State/countryName=AU
| Not valid before: 2009-11-03T07:06:19
|_Not valid after:  2012-11-02T07:06:19
5000/tcp open  tcpwrapped
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at :

Service detection performed. Please report any incorrect results at .
Nmap done: 1 IP address (1 host up) scanned in 211.64 seconds

I doesn't show any telnet port but I tried 'telnetenable' on it anyway but just got a connection refused message. I even tried running '' but just got a 404.

(Last edited by Xotic750 on 7 Apr 2016, 11:37)

Here is the status page of the routers

Hi Xotic750. Your device should allow to enter into CFE failsafe mode by pressing the reset button while powering up the device, then you should be able to access to This way you can install new firmwares (openwrt or from the manufacturer).

If you want to add support to this router, the first thing you can do is to connect the serial console, this way it's more easy to debug possible problems. With the serial console you could also make a backup of the flash chip with cfetool.

Adding support for this router should be easy, the hardest part is the external switch. By trial and error you can guess the right configuration for the switch once you got Openwrt installed.

Probably the people who started hacking this device lost interest, or bricked the device, and no more progress was done.


Thanks. I hold the reset button while powering up but it doesn't enter CFE failsafe, it just boots into the TELE2 software. I'm wondering if they have made some change so that the CFE isn't available? On the GUI there is no firmware upgrade selection but I can get to one using

I don't have a soldering iron at present so can't attach a serial.

I have been unable to find a stock Netgear firmware for it.

You can extract the firmware from the flash backup (again the serial console would help). Or you can build a firmware your own using the sourcecode you mentioned.

The CFE bootloader is there for sure. Looks like Netgear make some modifications like disabling the web server for flashing, (this also happened in my DGND3700v1).

Then probably 2 firmwares should be produced.
- Factory firmware: for the first flashing over the OEM firmware. Probably with chk format used by Netgear
- Sysupgrade firmware: a regular firmware that can be flashed using any CFE bootloader or OpenWrt itself.

I get quite a long way with building the image with the latest netgear sources, but it fails.

make  install-exec-hook
make[5]: Entering directory '/home/graham/Downloads/EVG2000_v2.2.0.12_with_toolchain_src/EVG2000-TELE2-V2.2.1.64_src_full/EVG2000-TELE2/userspace/bcm963xx_ap/gpl/ntfs-3g-2009.3.8/libntfs-3g'
test -z "/lib" || mkdir -p -- "/lib"
if [ ! "/lib" -ef "/usr/local/lib" ]; then \
    /usr/bin/mv -f "//usr/local/lib"/* "//lib";  \
/usr/bin/mv: cannot stat ‘//usr/local/lib/*’: No such file or directory
Makefile:792: recipe for target 'install-exec-hook' failed
make[5]: *** [install-exec-hook] Error 1
make[5]: Leaving directory '/home/graham/Downloads/EVG2000_v2.2.0.12_with_toolchain_src/EVG2000-TELE2-V2.2.1.64_src_full/EVG2000-TELE2/userspace/bcm963xx_ap/gpl/ntfs-3g-2009.3.8/libntfs-3g'
Makefile:741: recipe for target 'install-exec-am' failed
make[4]: *** [install-exec-am] Error 2
make[4]: Leaving directory '/home/graham/Downloads/EVG2000_v2.2.0.12_with_toolchain_src/EVG2000-TELE2-V2.2.1.64_src_full/EVG2000-TELE2/userspace/bcm963xx_ap/gpl/ntfs-3g-2009.3.8/libntfs-3g'
Makefile:697: recipe for target 'install-am' failed
make[3]: *** [install-am] Error 2
make[3]: Leaving directory '/home/graham/Downloads/EVG2000_v2.2.0.12_with_toolchain_src/EVG2000-TELE2-V2.2.1.64_src_full/EVG2000-TELE2/userspace/bcm963xx_ap/gpl/ntfs-3g-2009.3.8/libntfs-3g'
Makefile:340: recipe for target 'install-recursive' failed
make[2]: *** [install-recursive] Error 1
make[2]: Leaving directory '/home/graham/Downloads/EVG2000_v2.2.0.12_with_toolchain_src/EVG2000-TELE2-V2.2.1.64_src_full/EVG2000-TELE2/userspace/bcm963xx_ap/gpl/ntfs-3g-2009.3.8'
Makefile:63: recipe for target 'install' failed
make[1]: *** [install] Error 1
make[1]: Leaving directory '/home/graham/Downloads/EVG2000_v2.2.0.12_with_toolchain_src/EVG2000-TELE2-V2.2.1.64_src_full/EVG2000-TELE2/userspace/bcm963xx_ap/gpl'
Makefile:137: recipe for target 'gpl' failed
make: *** [gpl] Error 2

Though what I'm really after is OpenWRT. smile

Just opened the case and can confirm a few chip numbers:

Wireless   BCM4322LKF86
Ethernet   BCM53115SKF86
Flash-Chip MX29GL128ELT2I-90G
RAM-Chip 2 x Nanya NT5DS8M16CS-5T

Photos look the same as the boards that I have.

In the wiki, the board ID is 96369PVG

But in the original source code, it says that the board ID is 96368VVW

But neither of those IDs are in the Target Profile selector of menuconfig from the trunk?

There is no support for your router in OpenWrt, and having the same board ID in another supported router means nothing, it could brick yours.

You really should attach the serial console before testing any firmware.

I wasn't intending to flash one until I know as much as possible, and have a serial cable in place. If I can manage to see the pins and hold my hand still enough to tag them on (had a stroke so I'm not the best at that type of thing these days). smile

Wrt to the CFE reset, I did a little more testing with that, I set a fixed IP on my network card,, and set a ping going ro I found that I only get a response in the first 3 seconds and then it boots the flash. This is different to any other Netgear that I have tried, they have all flashed the power LED and sat there in CFE. So, why is this one different, is this normal on any other Netgear? (Apparently not unusual

It would be really good to get this working, as there are a large number of these routers in Sweden (Austraila and Asia too so I believe), and many are now finding their way into the trash.

(Last edited by Xotic750 on 8 Apr 2016, 00:17)

I have now sourced a USB-RS232 adaptor for my PC. Prolific Technology, Inc. PL2303 Serial Port

Seems to be functioning happily with Linux. Now I just need to get a soldering iron and do the dirty. smile

Not sure, but I would say that adapter isn't compatible with the UART 3.3V TTL serial port at the router. Probably inside the adapter there are extra components soldered to the PL2303 for shifting the voltage levels.

Opening the adapater and soldering TX and RX directly to the PL2303 pins should solve this issue.

I've opened the adapter, I don't understand the description in the wiki about 3pin and 4pin type? Do you mean that VCC would be the problem (I thought not used?) or you mean the actual signal values on TX and RX? The chip is PL-2303HX (I think). I need to confirm otherwise I will have to source another, there isn't a chance that I can solder directly to the chip pins, I can hardly see them smile. I have a multimeter available if there is some kind of test that can be performed?

(Last edited by Xotic750 on 8 Apr 2016, 15:19)

VCC is never used, so that's not the problem. The problem is with TX and RX, as you can see there is another chip apart from the PL2303, probably is a level shifter which translates TX and RX to different voltage levels making it incompatible with the UART port at the router.

If you aren't able to hack the adapter then you better should get another adapter like the popular CP2102. Old data cables from mobile phones may also work.

Well that's a damn shame, this one didn't cost me anything. I also have an old laptop that has a built in serial port, but I would assume that this would have the same problem? (Reading further the answer would be yes)

A search for a CP2102 module available locally in Sweden has turned up zero. Had a look through the trash and was unable to find any old mobile cables (probably all been disposed of years ago smile ). So back to searching for a suitable one, otherwise I guess I will have to order one from Amazon or Ebay.

(Last edited by Xotic750 on 8 Apr 2016, 16:25)

I found this adapter, they ship free to Sweden without having to pay $40 odd dollars like many on Ebay and Amazon. Being pl2303 I guess that it should work with Linux, like my original cable above. Does this look like the correct type? … mrv8P8HAQ#

PL2303 USB To RS232 TTL Converter Adapter Module

Key Features

1, All kinds of satellites set-top box upgrade

2, Router,HDD,ADSL,broad band modem firmware upgrade or cracked upgrade

3,cellphone,XBOX360,GPS serial communication,vehicle inspection and test,DVD flash and so on

4,Burn write STC MCU,NXP MCU,renesas MCU,NEC MCU and so on

5, Simple UART communication,commonly used UART debugging tools in supper terminal

6, USB signal transferred to TTL signal,may be used by electronic enthusiasts


1, Adopt imported controller PL2303HX,which can stabilize the flash with high speed

2,500mA self recovery fuse for protection

3,Two data transmission indicator can monitor data transfer status in real time

4, Reserve 3.3V and 5V pin interface,easy for the DDWRT of different voltage system that need power

5, The entire board is coated by high quality transparent heat-shrinkable sleeve,making the PCB in insulation state from outside,
so that the board won't burnt down by material short cut.

6, Electrostatic package,insures the board will not be damaged before use

7,Support WIN7 system ,not support WIN8!

Alternatively they have this one, and use it with my current USB to RS232 cable (which is definitely working on my Linux install) … rm=

MAX3232 RS232 Serial Port To TTL Converter Module DB9 Connector

China model MAX3232CSE
Voltage: 3V to 5V
Maximum baud: 150kbps, not recommended higher value
Support for USB power and external power, with power, receive, three indicator light
Manual welding SMT production
Size: 31mm * 22mm (the dimensions do not include seat DB9)

Anyway, thoughts are welcome.

(I also found this Adafruit cable, which is PL2303)

(Last edited by Xotic750 on 9 Apr 2016, 03:24)

I have one like that PL2303 based module and it works OK. In some rare occasions some people reported they had problems with the PL2303 adapter. Might be more reliable the CP2102 based one.

I have the PL2303 and the CP2102 based modules, and they both work quite fine for me.


(Last edited by danitool on 8 Apr 2016, 17:15)

I'll keep looking and see if I can find a a CP2102 (without costing the earth in shipping), otherwise I guess I will choose from one of those 2 posted. Thanks.

(Soldering iron fixed)

(Cable and pins ordered, trying this one)

(Last edited by Xotic750 on 16 Apr 2016, 12:05)

So, I will have my cables and pin headers within about 20 days, then get them soldered in and working. Once that is completed I am wondering what my next steps will be, I can start doing some reading and stuff.

As noted, I will need to create a backup of the original firmware.

Then would I be working with the trunk code or with the CC 15.0.51 release?

The DGND3700 hardware is very similar in some respects, but the board ID is different 96368MVWG rather than 96369PV, and the onboard chip is BCM6368 rather than a BCM6369, but these chips are very similar from what I have understood.

Broadcom Imagetag

They both use BCM53115 for their ethernet switch, but the WIFI is BCM43222 rather than BCM4322 as on the EVG, but I believe there is support for this chip in the b43 driver.

I found some pastebins of someone that was trying to get OpenWRT on the EVG2000.

I also found some instructios from someone that was rebuilding the stock firmware for the DNGD3700, which uses the same toolchain as the EVG2000.

Also some instructions about de-bricking the DNGD3700, which had some useful tips regarding fitting the headers pins.

The USB seems to be similar in the 2 devices, and guess that it could be made to work (USB would be a plus)

As far as the 2 x telephone (SIP) ports, I am not at all interested in  having those working.

For the official support only patches based on latest trunk revisions are accepted.

The DGND3700v1 and WAP-5813n are very similar hardware to yours, but their firmwares aren't compatible with yours, because they have different flash chip sizes, or different partitions that you need to define to keep them untouched before flashing the device.

But the main differecence might be the ethernet switch. Spite they have the same BCM53115 Gb switch, it seems they are connected in a different way. From the tele2 source code I found this

    {{BP_ENET_EXTERNAL_SWITCH,              /* ucPhyType */
      0x0,                                  /* ucPhyAddress */
      BP_NOT_DEFINED,                       /* usGpioPhyReset */
      BP_NOT_DEFINED,                       /* usGpioPhyLinkSpeed */
      BP_ENET_CONFIG_MDIO_PSEUDO_PHY,       /* usConfigType */
      BP_ENET_RGMII2,                        /* usReverseMii */
      {0x5f, {0x00, 0x01, 0x02, 0x03, 0x18, 0x00, 0x00, 0x00}}},  /* sw */
     {BP_ENET_NO_PHY}},                     /* ucPhyType */

meaning the switch is configured via MDIO, not SPI like in the DGND3700. I'm not sure if the switch is magically autodetected when configured via MDIO, it should because with older SoCs it does.

For generating the CHK factory firmware, I guess this board ID should be used (found in the tele2 source code):


As an example you could take the the DGND3700 patches
To see where you need to add the code for supporting the board. Those patches were previous to CC release, so there were some variations, with different code in actual revisions.

Some of what you just said is like being thrown into a deep lake and being told to swim, when you don't even know what the words lake and swim mean, though I will give it my best shot to try. smile

At the moment my plan is:

1. Create a github fork/mirror, but where from, there are 2 possibles? Or perhaps direct from? git://

2. I have a laptop (from the trash, 4Gb:dual 64bit intel:300Gb HDD smile ) that I can set up on my current internet router (home), running Ubuntu 14.04.4 LTS at present but I could install whatever Linux OS is needed, where I can provide remote access to a working environment and connect the EVG2000 console to its USB and a LAN port to the home DMZ. (I need to set up some kind of DMZ with the home switch ports, another post may be coming if I can't figure it out myself (WNR1000v2 with 15.05.1) smile )

That should keep me busy for a few days. smile

What else may be required, other than the interest of developers that may be kind enough to help?

(Last edited by Xotic750 on 16 Apr 2016, 22:07)

Laptop is now fully installed with Ubuntu 14.04.1 and all the tools necessary to build OpenWRT. Cloned the trunk and built a test build and all compiles fine, so it should be ready for building images for the EVG2000 once configured and patched correctly.

I also installed virtualbox on it, and created a VM for Ubuntu 8.04.1, a version of OS that has been known to build factory images successfully. Followed the instructions at … _Toolchain, downloaded the prebuilt toolchain with fixes and installed in /opt/toolchains/, grabbed the source code for v2.2.0.12 that the toolchain was originally released with. Ran make PROFILE=TELE2 and it got much further than when I had previously tried with Fedora 22.

make[1]: Entering directory `/home/graham/EVG2000-TELE2/hostTools/libcreduction'
Optimizing C run-time library...
if [ "uclibc" = "uclibc" ]; then \
        python ./ -D -L /opt/toolchains/uclibc-crosstools-gcc-4.2.3-3/lib -L /opt/toolchains/uclibc-crosstools-gcc-4.2.3-3/usr/lib -L /opt/toolchains/uclibc-crosstools-gcc-4.2.3-3/usr/mips-linux-uclibc/lib -L /home/graham/EVG2000-TELE2/targets/TELE2/fs.install/lib/public -L/home/graham/EVG2000-TELE2/targets/TELE2/fs.install/lib/private -L /home/graham/EVG2000-TELE2/targets/TELE2/fs.install/lib  -L/home/graham/EVG2000-TELE2/targets/TELE2/fs.install/usr/lib --target=/opt/toolchains/uclibc-crosstools-gcc-4.2.3-3/usr/bin/mips-linux-uclibc- --ldlib -d uclibc `find /home/graham/EVG2000-TELE2/targets/TELE2/fs.install -path /home/graham/EVG2000-TELE2/targets/TELE2/fs.install/lib -prune -o -type f -print | file -f - | grep ELF | cut -d':' -f1`; \
I: Using as dynamic linker.
warning: /home/graham/EVG2000-TELE2/targets/TELE2/fs.install/bin/pppd may need rpath, but --root not specified
I: library reduction pass 1
425 symbols, 420 unresolved
I: library reduction pass 2
502 symbols, 36 unresolved
I: library reduction pass 3
505 symbols, 15 unresolved
I: library reduction pass 4
500 symbols, 9 unresolved
I: library reduction pass 5
500 symbols, 9 unresolved
I: stripping and copying dynamic linker.
# Do not use optimized version of libdl and dynamic linker (also libdl has different file names in new and old toolchain)
make[1]: Leaving directory `/home/graham/EVG2000-TELE2/hostTools/libcreduction'
cd /home/graham/EVG2000-TELE2/targets; \
    /home/graham/EVG2000-TELE2/hostTools/fakeroot/fakeroot ./buildFS
fakeroot: preload library not found, aborting.
make: *** [buildimage] Error 1

I know I don't need to build the factory image but it would be good to know that it works. Not sure what is missing or is wrong. I have seen a post where someone had a similar issue when building the code for a Netgear VVG2000

I solved it by installing Ubuntu's own fakeroot and linking it to the build folder:

cd <sources folder="">
sudo apt-get install fakeroot
mv hostTools/fakeroot/fakeroot hostTools/fakeroot/fakeroot.bak
ln /usr/bin/fakeroot hostTools/fakeroot/fakeroot

and the building the image once again.

Not sure if this is the correct thing to do, or what are the consequences, but it now builds?

/home/graham/EVG2000-TELE2/hostTools/lzmacmd e vmlinux.bin vmlinux.bin.lzma -d22 -lp2 -lc1

LZMA 4.43 Copyright (c) 1999-2006 Igor Pavlov  2006-06-04
Before compression: 2593292  After compression (level=2): 848204
Percent Compression = 67.29
    File tag size                 : 256
    Root filesystem image size    : 5345280
    Kernel image size             : 848216
    Combined image file size      : 6193752

    CFE image size                : 56408
    File tag size                 : 256
    Root filesystem image size    : 5345280
    Kernel image size             : 848216
    Combined image file size      : 6250160

createimg: Creating image with the following inputs:
    Board id                : 96368VVW
    Number of Mac Addresses : 11
    Base Mac Address:       : 02:10:18:01:00:01
    Main Thread Number:     : 0
    PSI Size:               : 24
    Input File Name         : bcmTELE2_cfe_fs_kernel
    Output File Name        : bcmTELE2_flash_image_96368VVW

    Image components offsets
    cfe offset              : 0xbfc00000    -- Length: 56408
    file tag offset         : 0xbfc20000    -- Length: 256
    rootfs offset           : 0xbfc20100    -- Length: 5345280
    kernel offset           : 0xc0139100    -- Length: 848216

    The size of the entire flash image is 6390360 bytes.
    A 8 MB or greater flash part is needed.

    The flash space remaining for a 2 MB flash part: -4293208 bytes.
    The flash space remaining for a 4 MB flash part: -2196056 bytes.

    bcmTELE2_flash_image_96368VVW flash image file is
    successfully created.

addvtoken: Output file size = 6390380 with image crc = 0xff1c5065
cd /home/graham/EVG2000-TELE2/targets/TELE2 && touch rootfs && \
    /home/graham/EVG2000-TELE2/hostTools/packet -k bcmTELE2_fs_kernel -f rootfs -b compatible.txt -oall kernel_rootfs_image \
            -i ../../userspace/project/acos/include/ambitCfg.h && \
    rm -f rootfs _*.chk && \
    cp kernel_rootfs_image.chk EVG2000_`date +%m%d%H%M`.chk
regionIndex = 0x1

-e Done! Image TELE2 has been built in /home/graham/EVG2000-TELE2/images.

As I said previously, I am hoping to put this laptop online and connect it serially to the EVG2000 so that if anyone can help with setting up the OpenWRT build, then they can get access. I am intending to download all the source that I can get my hands on and create a github repo of them, so all the changes can be easily seen between the factory versions.

(github repo for EVG2000 TELE2 factory source is now at

I have also now built the latest factory source code that I can find v2.2.1.64. I did not need to install fakeroot but I did have to change some permissions on some system directories and create a couple of directories.

LZMA 4.43 Copyright (c) 1999-2006 Igor Pavlov  2006-06-04
Before compression: 2715552  After compression (level=2): 908286
Percent Compression = 66.55
    File tag size                 : 256
    Root filesystem image size    : 5427200
    Kernel image size             : 908298
    Combined image file size      : 6335754

    CFE image size                : 56408
    File tag size                 : 256
    Root filesystem image size    : 5427200
    Kernel image size             : 908298
    Combined image file size      : 6392162

createimg: Creating image with the following inputs:
    Board id                : 96368VVW
    Number of Mac Addresses : 11
    Base Mac Address:       : 02:10:18:01:00:01
    Main Thread Number:     : 0
    PSI Size:               : 24
    Input File Name         : bcmTELE2_cfe_fs_kernel
    Output File Name        : bcmTELE2_flash_image_96368VVW

    Image components offsets
    cfe offset              : 0xbfc00000    -- Length: 56408
    file tag offset         : 0xbfc20000    -- Length: 256
    rootfs offset           : 0xbfc20100    -- Length: 5427200
    kernel offset           : 0xc014d100    -- Length: 908298

    The size of the entire flash image is 6532362 bytes.
    A 8 MB or greater flash part is needed.

    The flash space remaining for a 2 MB flash part: -4435210 bytes.
    The flash space remaining for a 4 MB flash part: -2338058 bytes.

    bcmTELE2_flash_image_96368VVW flash image file is
    successfully created.

addvtoken: Output file size = 6532382 with image crc = 0x5ae9d403
cd /home/graham/64/EVG2000-TELE2/targets/TELE2 && touch rootfs && \
    /home/graham/64/EVG2000-TELE2/hostTools/packet -k bcmTELE2_fs_kernel -f rootfs -b compatible.txt -oall kernel_rootfs_image \
            -i ../../userspace/project/acos/include/ambitCfg.h && \
    rm -f rootfs _*.chk && \
    cp kernel_rootfs_image.chk EVG2000_`date +%m%d%H%M`.chk
regionIndex = 0x1

-e Done! Image TELE2 has been built in /home/graham/64/EVG2000-TELE2/images.

(Last edited by Xotic750 on 18 Apr 2016, 04:12)

Sorry, posts 26 to 25 are missing from our archive.