Help, i think i bricked my Wr850G.
I did enable boot wait but after the tftp transfer i see Red Power LED and nothing else.

Here is what i did.

I enabled bootwait using frame_debug.asp
Then i ran tftp client set to 192.168.10.1

I rebooted the router, tftp came back with following message

C:download>tftp -i 192.168.10.1 put openwrt-linux.trx
Transfer successful: 1536000 bytes in 11 seconds, 139636 bytes/s

I thought everything went ok

Router did not reboot. Waited 5 min and then rebooted my self. Now all i see is a RED LED. Any wat to get this fixed ?.

thanks

I got further, now i am able to ping the router and tranfser via tftp. I had to reset flash by opening the box and shorting pins 15 and 16.

Even after i transfer the firmware, including the 4.03 firmware from motorola, i get red power LED and nothing else. It never boots normally. Seems like there is something i can do like, resetting flash memory to bring this back online.

finally i got it fixed. I had to flash via the console using the flash -noheader option.

I used the firmware "openwrt-generic-jffs2-4MB.trx"

This seem to have solved the problem of getting the openwrt on to the router. Now all set to play with the new open source firmware.

Also how do i get back to the OEM firmware if i have to. When i try to load it using the same flash -noheader option, it flashes fine but at reboot it says "Invalid boot block on disk".

thanks for all the efforts of the people on thsi forum.

Hi,

I manage to debrick my wr850g.  I am now have problem with my wan.  I can't connect to it.  I have no problem connecting (telnet/ssh) with lan.  BTW,  I have manage to put the openwrt experimental in it.  I have WR850G v3.0.  I works well without the wan now.  I do not use the wireless on this one.  I would really appriciate it if I could get a copy of your nvram.  Just send me the output of your nvram show (remove all the wireless setting line key, ssid).  I just need to learn whether I have miss something.

In return to this board,  I am going to describe my experience using JTAG connector to flash CFE and erase NVRAM on this router.  Here it is.

1.  I download the http://spacetoad.com/tmp/hairydairymaid_debrickv22.zip.  Follow the instruction on the pdf to wire and create your jtag cable.  I have found that the jtag pin in our cable  is the same as wrt54g(obvious).  Do not flash or erase your flash yet!  You can also buy jtag cable as long as they are pin compatible with Xilink DLC5.  Infact, I did not make my own cable.  I use jtag cable from insight.  Thank you to HairyDairyMaid aka LightBulb.  This tool is really a live safer.

2. Modify the wrt54G.c that is in the hairydairymaid_debrickv22.zip.  In function chip_detect, modify the

if (id == 0x1471217F)  // ID String: (Hi) 00010100011100010010000101111111 (Lo)
    {
        //chip_type = BCM4712_CHIP; to
        chip_type = BCM4702_CHIP
        printf("\nCHIP ID: ");
        ShowData(id);
        printf("*** Found a Broadcom BCM4712 Rev 1 chip ***\n\n");
        return;
    }

This is only to say the we are going to flash an AMD fash memory.  Before the above mods,  I think the code make assumption that if BCM4712, then it got to be intel flash memory.  This is not true for our router.  Our router comes with AMD flash memory.

3.  do make to build the wrt54 in your linux box.  pelase continue reading the instruction on the pdf.

4.  What I have confirm that work are backup:cfe, erase:cfe, flash:cfe and erase:nvram and erase:kernel work.  I did not play around with the flash:kernel.  It takes a long time to do this.  I guess you can develop your own cfe if you have the cfe know how on motorola and flash it with the JTAG.  Motorola CFE is different compared to other routers.  It defaulted to 192.168.10.1 instead of 192.168.1.1 on the linksys.  Once you have CFE uploaded and NVRAM erased, you should be able to tftp your choice of firmware.  I brought my bricked WR850G this way.

I hope that helps.  I hope that you can help me also on the nvram wan setting.

Thanks
Iman

Hi!
If it is still relevan to you , wen1 , I'll tell you what I have done to return the original firmware.
I'll open with a fact that I also had same problem with tftp and so on...
Someone on the irc suggested me to take the brcm-openwrt  image , and I was surprised to find out that it worked.Then I started checking why the motorola-openwrt and original wr850g_v403 don't work.
Well, the reason is in a file format, or actually in a file header. Brcm image is a real .trx image and that is a reason for successful TFTP for it.Motorola-openWRT and original motorola firmware are in a .bin format, and that is why router didn't "understand" them.
Now, to the part you were waiting for. In order to go back to your motorola firmware you should do the following :
1)Obtain some hex editor and run it .
2) Open both brcm-openwrt image and your wr850g_V403 image.
3) Compare the file headers and remove unneeded prefix (32 bytes if I recall right) from wr850g image.
If you compare the headers, you'll see what I mean.
4)Save modified wr850g firmware.
5 a)TFTP it to router (that one I didn't try , but it should work).
5 b) Tested one:
      |)Setup an ftp server on your computer (192.168.1.2 for examle).
     ||)Open telnet to your router (that now runs openWRT firmware) and type:
       wget ftp://192.168.1.2/wr850g.trx (for instance).
    |||) After successful file transfer (hopefully) , you should type :
       mtd -r write wr850g.trx linux
6)If all went ok so far , then now you have your original motorola firmware running on the router.
7)Enjoy!

I'll be glad to hear if it worked for you,
Fox Mulder.

I found some interesting things about the wrt54g debrick utility when trying to erase or flash the NVRAM on the Motorola WR850G v3. 

The program will not ERASE the flash in that location of the NVRAM 1fff0000.  If you attempt to flash that area it does try to erase it but really does not and then will only overwrite the nvram area with your nvram.bin by changing any 0 bits to a 1.  Trying to erase the NVRAM with the command wrt54g.exe -erase:nvram will not erase anything.  Trying to flash the NVRAM will result in a corrupted NVRAM because the program does not erase before flashing.   The -erase:nvram should change all bytes in the nvram area to FF but it doesn't - just gives the 0 blocks erased message. 

I believe this is happening because the minimum block size for the debrick utility is 128K and the flash area is only 64K. 

To get around this, I used a custom erase of
wrt54g.exe -erase:custom /window:1fc00000 /start:1ffe0000 /length:1  This will erase the upper 64K of the kernel (which isn't being used anyway) along with the entire 64K of NVRAM in flash memory.  Then I've been able to flash a new NVRAM.BIN or just let the CFE create a new one.

Jeff

(Last edited by dobkin on 29 Dec 2010, 01:36)