OpenWrt Forum Archive

Topic: Intelbras NBox - dead, newbie first attempt!

The content of this topic has been archived on 29 Mar 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hi there, my name is João Ciocca and I'm a noob in this subject but I want to understand more about it.
I have a some network knowledge, and I like messing around things. I just remembered that I had this kinda old router lying around here - an Intelbras NBox router which seems to have died. Whenever I try to turn it on, power LED is blinking and nothing happens.

I tried to check out some documentation here to figure out what to do, but I figured it'd be easier asking for help from the more experienced - but yeah, I will totally understand if you just shoo me to go do more research.

From what I could gather so far: Intelbras is a Brazilian company, so the manual is obviously in portuguese but I couldn't find anything useful there, besides the name of CPU/chipset: "Ralink RT3352F" (which I could find a brief online that didn't help me at all)

I've read the "openwrt generic.debrick" document and I've already identified that the router board has 4 pins for serial - but I lack a DKU-5 cable, I only have common USB data cables around here... should I put this project on hold while I get the cable? Or should I get another cable? I found some "TTL RS-232 to USB" cables on a local arduino site...

The important aspect is that your serial cable must be 3.3V based (only connect GND, RX and TX, never Vcc); real RS-232C would use higher voltages and cook your SOC. Ages ago, DKU-5 was one option to find affordable TTL level/ 3.3V usb-serial devices, these days -with the proliferation of the RPi and other devboards- there are multiple other options (cp2102, ch340, pl2303 (not pl2303hx)) available, most cheaper and more convenient (already equipped with jumper cables) than a DKU-5 branded specimen (which uses the same chipset underneath).

Use a cable like this one:
https://www.amazon.com/JBtek-WINDOWS-Su … 2303+cable

The blue box at the USB plug end contains a PL2303 chip.  Connect the black wire to router ground and the green and white wires to data in and out respectively.  Do not connect the red wire.  If you don't know which pins are data in and out you, can try the white and green wires both ways.

mk24 wrote:

Use a cable like this one:
(edited, can't use URLs)

The blue box at the USB plug end contains a PL2303 chip.  Connect the black wire to router ground and the green and white wires to data in and out respectively.  Do not connect the red wire.  If you don't know which pins are data in and out you, can try the white and green wires both ways.

awesome! I found one like that around here! Thanks!

One edit - I need to correct myself, power LED isn't blinking, I remembered it wrong, it's always on. I still need the cable to figure out what's going on, right?

You need to start debugging somewhere...

  • I'd start by checking the PSU (measuring the voltage under load, if you can't do that, try to use a different one that meets the voltage/ current requirements).

  • If you don't care about the details why it fails, but just want to get the hardware working again, trying the various recovery methods (tftp et al) might be worth it.

  • If none of those actions help, the serial console is your best hope to find out what the problem is - or to invoke better recovery mechanisms (at bootloader level or even before).

..and knowing where to stop would also be handy.

Depending on your experience with debugging embedded hardware, your existing equipment (buying a usb-serial adaptor might be worth it, but beyond that (jtag, spi-flasher, multimeter, soldering equipment, hotair reflow, ...) would only be worth the expense if you know what you're doing and have other uses for it besides reviving one single, pretty dated, board). Judging from a very shallow internet search, that Intelbras NBox router is a pretty generic ramips rt305x router without anything special - justifying any expense (maybe above the usb-serial, maybe not) just to recover this one router might be misplaced. Fully operational and OpenWrt compatible routers with those capabilities should be around 5-10 EUR in used condition and around 20-40 EUR for brand new (and better equipped) ones.

(Last edited by slh on 22 Nov 2017, 03:26)

wow, that's a huge load of info for me, thanks slh! Let me try to digest this...

1- I have no idea what PSU means - I do know theoretically how to measure voltage, but I lack the equipment now. I do intend to go down that road to understand this subject better, though. ---OH! PSU, power supply unit? Just found on google, hehe!
2- At the moment, no I don't care about the details, but I'm trying to figure out how I could do this in a smart way. My main is desktop, but I have a notebook lying around. Probably will try to hook that one up to the router, while maintaining wifi and my desktop wired connection.
3- knowing where to stop, considering this is just a project, just to acquire knowledge... I don't think there's a where to stop, you agree?

Ok, going forward - zero experience with debugging embeds. Agreed that at the current almost non-existing level of knowledge anything higher/"costier" than the usb-serial adaptor isn't worth it.

I actually have another dead router around here - a TP-Link TL-WR841N(BR), same diagnostics: when trying to power on, power LED is on and nothing more. The only reason why I'm trying to revive the NBox instead is because I can't find any information online and I thought it'd do some good to this lazy brain of mine.

I don't have an impending need for a router - my ISP ADSL modem is working quite nicely (except for the ocasional wifi problem), but it's really nice to know out there it'd be that inexpensive. 5 EUR would amount to around 20 BRL, but I think our market is a little bit more knife in the back - I can't find any router here (dunno if OpenWRT compatible or not) for less than 150 BRL (around 40 EUR).

=======================================

So while I don't have the cable, I decided to check things out for the TP-Link I have here. I found this link wiki . openwrt.org/toh/tp-link/tl-wr841nd and tried following it. My WR841N is v8. Set up my notebook's IP to 192.168.0.66, cable to router, TFTP to folder with mr3420v2_tp_recovery.bin file and... nothing.

I hold reset button while router is off, power it on - I get power LED ok, around 15 seconds later I get padlock LED too, release reset button, after a while all the LED turn on... then all except power go off. And there's nothing on the TFTP logs, and nothing's happening with the router.

=======================================

Found yet another link about it forum . tp-link.com/showthread.php?81462-How-to-recovery-the-router-when-you-bricked-it, but still no luck. Nothing shows up on TFTP server log.

(Last edited by joao.ciocca on 22 Nov 2017, 08:55)

Do the Ethernet port lights come on when you plug in an Ethernet cable (connected to a working device on the other end of course).  If they don't, there is probably a hardware failure (usually caused by lightning or other electrical surge), and you won't see anything on the serial.

mk24 wrote:

Do the Ethernet port lights come on when you plug in an Ethernet cable (connected to a working device on the other end of course).  If they don't, there is probably a hardware failure (usually caused by lightning or other electrical surge), and you won't see anything on the serial.

wait, you mean port light - as the one right on the port where I stick the cable, right? Hmmmm I haven't checked those yet, I only kept an eye out for the LEDs!

Wherever the LED is located.  Most routers have only LEDs on the front and none at the cable plugs.  Also the carrier LED on the device at the other end of the cable should come on when you plug in.

yeah, no LED on the ports themselves, just the indicator LEDs on the top of the routers - both the TP-Link and NBox.

I've got my hands on a cheap TD-W8968, which I'm now using as the main piece of my network - since it has ADSL capabilities, I've ditched my ISPs modem.

Connecting the NBox to it, the port LED flashes on both routers, that's a good sign right? My other TP-link, on the other hand, still only lights the power LED, but if I connect it to the W8968, the port LED there lights up.

I've also got the serial to USB cable, so I'm gonna check it out now to see what is happening with them...
===================

Ok, we've got serial! big_smile 57600 com speed took me a while to figure out, but I got it past the garbled text. Starting up looks like this:

U-Boot 1.1.3 (Mar  2 2012 - 16:11:51)

Board: Ralink APSoC DRAM:  64 MB
rt2880 uboot v0.00e04 05/25/2006
SERIAL_CLOCK_DIVISOR =16
kaiker,,CONFIG_BAUDRATE =57600
SDRAM SIZE:04000000
Top of RAM usable for U-Boot at: 84000000
Reserving 298k for U-Boot at: 83fb4000
Reserving 260k for malloc() at: 83f73000
Reserving 44 Bytes for Board Info at: 83f72fd4
Reserving 36 Bytes for Global Data at: 83f72fb0
Reserving 128k for boot params() at: 83f52fb0
Stack Pointer at: 83f52f98
relocate_code Pointer at: 83fb4000
Now running in RAM - U-Boot at: 83fb4000

 monitor_flash_len =106608
Command "rf": 0x80202218 => 0x83fb6218
Command "mdio": 0x802069e8 => 0x83fba9e8
Command "erase": 0x80208350 => 0x83fbc350
Command "cp": 0x80208224 => 0x83fbc224
Command "reset": 0x80214600 => 0x83fc8600
Command "go": 0x80209290 => 0x83fbd290
Command "bootm": 0x80209a6c => 0x83fbda6c
Command "loadb": 0x8020a8c4 => 0x83fbe8c4
Command "tftpboot": 0x8020af10 => 0x83fbef10
Command "saveenv": 0x8020bf98 => 0x83fbff98
Command "setenv": 0x8020be4c => 0x83fbfe4c
Command "printenv": 0x8020b3e4 => 0x83fbf3e4
Command "?": 0x8020c150 => 0x83fc0150
Command "help": 0x8020c150 => 0x83fc0150
Command "version": 0x8020bff0 => 0x83fbfff0
Command "mw": 0x8020f0c8 => 0x83fc30c8
Command "nm": 0x8020f2dc => 0x83fc32dc
Command "mm": 0x8020f324 => 0x83fc3324
Command "md": 0x8020edf8 => 0x83fc2df8
spi_wait_nsec: 3c
spi device id: 1 2 16 4d 0 (2164d00)
find flash: S25FL064P
raspi_read: from:30000 len:1000
.*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 3.6.0.0
--------------------------------------------
ASIC 3352_MP (Port5<->None)
DRAM_CONF_FROM: Boot-Strapping
DRAM_TYPE: SDRAM
DRAM_SIZE: 512 Mbits
DRAM_WIDTH: 32 bits
DRAM_TOTAL_WIDTH: 32 bits
TOTAL_MEMORY_SIZE: 64 MBytes
Flash component: SPI Flash
Date:Mar  2 2012  Time:16:11:51
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384

 ##### The CPU freq = 400 MHZ ####
 estimate memory size =64 Mbytes

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.                     0

3: System Boot system code via Flash.
## Booting image at bc050000 ...
raspi_read: from:50000 len:40
.   Image Name:   WRN300 Nshared
   Created:      2013-07-15   2:45:38 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    7214901 Bytes =  6.9 MB
   Load Address: 80000000
   Entry Point:  80258000
raspi_read: from:50040 len:6e1735
...............................................................................................................   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80258000) ...
## Giving linux memsize in MB, 64

Starting kernel ...


LINUX started...

 THIS IS ASIC
Linux version 2.6.21.7 (wdk@wireless) (gcc version 3.4.2) #11 Mon Jul 15 10:45:28 CST 2013

 The CPU frequency set to 400 MHz
CPU revision is: 0001964c
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Built 1 zonelists.  Total pages: 16256
Kernel command line: console=ttyS1,57600n8 root=/dev/ram0
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = d0808020, status = 11000000
PID hash table entries: 256 (order: 8, 1024 bytes)
calculating r4koff... 00186a00(1600000)
CPU frequency 400.00 MHz
Using 200.000 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 56032k/65536k available (2084k kernel code, 9444k reserved, 311k data, 6300k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
detected lzma initramfs
detected lzma initramfs
initramfs: LZMA lc=3,lp=0,pb=2,dictSize=1048576,origSize=25114112
LZMA initramfs by Ming-Ching Tiew <mctiew@yahoo.com>................................................................................................................................................................................................................................................................................................................................................................................................deice id : 1 2 16 4d 0 (2164d00)
S25FL064P(01 2164d00) (8192 Kbytes)
mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 6 MTD partitions on "raspi":
0x00000000-0x00800000 : "ALL"
0x00000000-0x00030000 : "Bootloader"
0x00030000-0x00040000 : "Config"
0x00040000-0x00050000 : "Factory"
0x00050000-0x01000000 : "Kernel"
mtd: partition "Kernel" extends beyond the end of device "raspi" -- size truncated to 0x7b0000
0x007f0000-0x00800000 : "nvram"
RT3xxx EHCI/OHCI init.
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
fuse init (API version 7.8)
io scheduler noop registered (default)
Ralink gpio driver initialized
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.8 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize
loop: loaded (max 8 devices)
rdm_major = 253

eth2 mii.o query= phy_id:0, address:1 retval:7849
Ralink APSoC Ethernet Driver Initilization. v2.1  256 rx/tx descriptors allocated, mtu = 1500!
MAC_ADRH -- : 0x0000001a
MAC_ADRL -- : 0x3f9d96a8
PROC INIT OK!
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V0.17
PPTP driver version 0.8.1
block2mtd: version $Revision: 1.1.1.1 $
usbmon: debugfs is not available
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver libusual
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (512 buckets, 4096 max)
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
ipt_time loading
arp_tables: (C) 2002 David S. Miller
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Freeing unused kernel memory: 6300k freed
Algorithmics/MIPS FPU Emulator v1.5
devpts: called with bogus options
(stop_cron:1017)=> done
(stop_cron:1017)=> done
(start_cron:1075)=> starting cron
Jan  1 00:00:00 crond[700]: crond (busybox 1.12.1) started, log level 8

(start_cron:1080)=> done
(sysinit:285)=> done
(reap:274)=> Reaped 678
(convert_wdk_values:249)=> done
(gen_ralink_config:146)=> Make a new configuration again for wireless.
(reap:274)=> Reaped 709
insmod: usbcore.ko: module not found
insmod: ehci-hcd.ko: module not found
insmod: ohci-hcd.ko: module not found
insmod: ufsd.ko: module not found
rt2860v2_ap: module license 'unspecified' taints kernel.


=== pAd = c001b000, size = 622272 ===

<-- RTMPAllocAdapterBlock, Status=0
(main_loop:496)=> rc main: enter START state
(ifconfig:44)=> lo 4163 127.0.0.1
phy_tx_ring = 0x005f8000, tx_ring = 0xa05f8000

phy_rx_ring0 = 0x005f9000, rx_ring0 = 0xa05f9000
MAC_ADRH -- : 0x0000001a
MAC_ADRL -- : 0x3f9d96a8
255.0.0.0
(_evaRT305x_ESW: Link Status Changed
l:357)=> ifconfiCDMA_CSG_CFG = 81000007
g
(reap:274)=> GDMA1_FWD_CFG = C0710000
Reaped 725
(ifconfig:44)=> eth2 4163 (null) (null)
system: iwpriv ra0 set RadioOn=0
ra0       no private ioctls.

no usb disk found
.(_eval:357)=> vconfig
(_eval:357)=> vconfig
(ifconfig:44)=> eth2.1 4163 (null) (null)
(_evaeth2.2: Setting MAC address to l:357)=> ifconfi 00g
 1a 3f 9d 96 a9.
device eth2 entered promiscuous mode
VLAN (eth2.2):  Setting underlying device (eth2) to promiscious mode.
(ifconfig:44)=> eth2.2 4163 (null) (null)
(_eval:357)=> brctl
(_eval:357)=> brctl
(_eval:357)=> brctl
(_eval:357)=> brctl
(reap:274)=> Reaped 737
(_eval:357)=> brctl

eth2 mii.o query= phy_id:1, address:4 retval:5e1

eth2 mii.o query= phy_id:1, address:0 retval:3100

eth2 mii.o query= phy_id:1, address:5 retval:0
eth2.1: dev_set_promiscuity(master, 1)
device eth2.1 entered promiscuous mode
(reap:274)=> Reaped 738
## [rc] set lan_br0: port 1(eth2.1) entering learning state
if as 192.168.1.2/255.255.255.0
(ifconfig:44)=> br0 4163 192.168.1.2 255.255.255.0
(ifconfig:44)=> br0 4163 192.168.1.2 255.255.255.0
(_eval:357)=> udhcpd
(reap:274)=> Reaped 747
(_eval:357)=> /sbin/syslogd
(reap:274)=> Reaped 749
(_eval:357)=> /sbin/klogd
(reap:274)=> Reaped 751
br0: topology change detected, propagating
br0: port 1(eth2.1) entering forwarding state
insmod: hw_nat.ko: module not found
(ifconfig:44)=> eth2.2 0 (null) (null)
eth2.2: Setting MAC address to  4e 53 50 4f 4f 46.
(ifconfig:44)=> eth2.2 4163 (null) (null)
(start_wan:1025)=> wan_proto=dhcp, wan_ifname=eth2.2
(_eval:357)=> ifconfig
(_eval_udhcpc:432)=> udhcpc
udhcpc (v1.12.1) started
(ifconfig:44)=> eth2.2 4163 0.0.0.0 (null)
(rcl_firewall:1682)=> enter.
(rcl_firewall:1686)=> wanif=eth2.2,wanip=,lanif=br0,lanip=192.168.1.2,lanmask=24
(do_system:191)=> iptables -F -t filter 1>/dev/null 2>&1
(do_system:191)=> iptables -F -t nat 1>/dev/null 2>&1
(do_system:191)=> iptables -F -t mangle 1>/dev/null 2>&1
(do_system:191)=> killall schelper
killall: schelper: no process killed
(do_system:191)=> iptables -t filter -N wan_icmp_input 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -A INPUT -j wan_icmp_input 1>/dev/null 2>&1
(do_system:191)=> iptables -t nat -N remote_mangle_prerout 1>/dev/null 2>&1
(do_system:191)=> iptables -t nat -A PREROUTING -j remote_mangle_prerout 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -N remote_mangle_input 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -A INPUT -j remote_mangle_input 1>/dev/null 2>&1
(do_system:191)=> iptables -t nat -N port_forward 1>/dev/null 2>&1;
(do_system:191)=> iptables -t nat -A PREROUTING -j port_forward 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -N port_forward_filter 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -A FORWARD -j port_forward_filter 1>/dev/null 2>&1
(do_system:191)=> iptables -t nat -N port_trigger 1>/dev/null 2>&1
(do_system:191)=> iptables -t nat -A PREROUTING -j port_trigger 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -N port_trigger 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -A FORWARD -j port_trigger 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -N spi_forward 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -A FORWARD -j spi_forward 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -N spi_input 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -A INPUT  -j spi_input 1>/dev/null 2>&1
(wan_down:1600)=> done
(deconfig:81)=> done
(start_wan:1266)=> ######## started dhcp client daemon.
(start_wan:1306)=>
(start_httpd:558)=> done
(do_system:191)=> ap_mgrd&
MP AUTOMATION daemon (ver 1.0)
webs: Listening for HTTP requests at address 192.168.1.2
(_eval:357)=> /sbin/wpspbc
(do_system:191)=> iwpriv ra0 set WscConfMode=0 1>/dev/null 2>&1
(do_system:191)=> iwpriv ra0 set WscConfMode=7
ra0       no private ioctls.

(do_system:191)=> route add -host 239.255.255.250 dev br0 1>/dev/null 2>&1
(do_system:191)=> wscd -m 1 -a 192.168.1.2 -i ra0 &
Password for 'admin' changed
(_eval:357)=> /sbin/resetbutton
(_eval:357)=> lld2d

***** g_wl_interface = ra0 ******

libupnp: using UDP SSDP_PORT = 1900
(reap:274)=> Reaped 849
(do_system:191)=> route del -net 239.0.0.0 netmask 255.0.0.0 br0
(reap:274)=> Reaped 872
route: ioctl 0x890c failed: No such process
(do_system:191)=> route add -net 239.0.0.0 netmask 255.0.0.0 br0
(iptables_miniupnp_init:664)=> External IP =
(do_system:191)=> iptables -t nat -N MINIUPNPD
(reap:274)=> Reaped 878
(do_system:191)=> iptables -t nat -I PREROUTING 1 -j MINIUPNPD
(reap:274)=> Reaped 880
(do_system:191)=> iptables -t filter -N MINIUPNPD
(reap:274)=> Reaped 882
(do_system:191)=> iptables -t filter -I FORWARD 1 -j MINIUPNPD
(reap:274)=> Reaped 884
(iptables_miniupnp_init:678)=> done
(do_system:191)=> killall -q miniupnpd
(do_system:191)=> miniupnpd -f /etc_ro/miniupnpd/miniupnpd.conf -a 192.168.1.2/24
(start_upnp:746)=> done
(do_system:191)=> igmpproxy &
igmpproxy, Version 0.1 beta2, Build 130528
Copyright 2005 by Johnny Egeland <johnny@rlo.org>
Distributed under the GNU GENERAL PUBLIC LICENSE, Version 2 - check GPL.txt

(reap:274)=> Reaped 898
(start_igmp_proxy:869)=> done.
(start_ddns:485)=> Setup DDNS Server ...
(do_system:191)=> inadyn -u joao.ciocca@gmail.com -p CameL951 -a proveisso.no-ip.biz --dyndns_system default@no-ip.com &
Warn: Warning, No upstream interface assigned.
0x10000000: 0x33335452
0x10000004: 0x20203235
0x1000000c: 0x00000106
0x1000000c: 0x00000106
Thu Jan  1 00:00:06 1970: Inadyn version 1.98.1 -- Dynamic DNS update client.
Thu Jan  1 00:00:06 1970: Failed resolving hostname ip1.dynupdate.no-ip.com: Name or service not known
Thu Jan  1 00:00:06 1970: Will retry again in 120 sec...
(start_ddns:528)=> done
(rcl_static_route:124)=> enter.
(start_services:1364)=> done
(main_loop:539)=> rc main: enter TIMER state
(main_loop:544)=> rc main: enter IDLE state
0x1000000c: 0x00000106
0x1011009c: 0x0008a301
0x1011009c: 0x0008a301
0x1011009c: 0x0008a301
0x10110014: 0x00401555
0x10110014: 0x00401555
0x10110014: 0x00c01555
(reap:274)=> Reaped 901
(reap:274)=> Reaped 681
(reap:274)=> Reaped 684

And we're on.

Router login: admin
Password:
Jan  1 00:02:48 login[1040]: root login on 'console'


BusyBox v1.12.1 (2013-06-28 13:49:05 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

But I can't seem to get to the cfe> prompt described in www. dd-wrt.com/wiki/index.php/Serial_Recovery
I can use that option 4, enter boot command line interface, but this doesn't seem to get me on cfe>

You choosed 4
                                                                              0
raspi_read: from:40028 len:6
.

4: System Enter Boot Command Line Interface.

U-Boot 1.1.3 (Mar  2 2012 - 16:11:51)
RT3352 # help
?       - alias for 'help'
bootm   - boot application image from memory
cp      - memory copy
erase   - erase SPI FLASH memory
go      - start application at address 'addr'
help    - print online help
loadb   - load binary file over serial line (kermit mode)
md      - memory display
mdio   - Ralink PHY register R/W command !!
mm      - memory modify (auto-incrementing)
mw      - memory write (fill)
nm      - memory modify (constant address)
printenv- print environment variables
reset   - Perform RESET of the CPU
rf      - read/write rf register
saveenv - save environment variables to persistent storage
setenv  - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
RT3352 #

(Last edited by joao.ciocca on 26 Nov 2017, 02:57)

I thought this deserved a different posting - finally understood and got to upload NBox firmware via TFTP!
But.... still nothing? No ping reply, no web interface.... this is how it went:

2: System Load Linux Kernel then write to Flash via TFTP.
 Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
 Please Input new ones /or Ctrl-C to discard
        Input device IP (192.168.1.123) ==:192.168.1.123
        Input server IP (192.168.1.102) ==:192.168.1.100
        Input Linux Kernel filename (boot.bin) ==:boot.bin

 netboot_common, argc= 3

 NetTxPacket = 0x83FE6380

 KSEG1ADDR(NetTxPacket) = 0xA3FE6380

 NetLoop,call eth_halt !

 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 Header Payload scatter function is Disable !!

 ETH_STATE_ACTIVE!!
Using Eth0 (10/100-M) device
TFTP from server 192.168.1.100; our IP address is 192.168.1.123
Filename 'boot.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: Got ARP REPLY, set server/gtwy eth addr (90:2b:34:fb:15:cd)
Got it
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################Got ARP REQUEST, return our IP
################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ##################################################
done
Bytes transferred = 7907776 (78a9c0 hex)
NetBootFileXferSize= 0078a9c0
raspi_erase_write: offs:50000, count:78a9c0
raspi_erase: offs:50000 len:780000
........................................................................................................................
raspi_write: to:50000 len:780000
........................................................................................................................
raspi_read: from:50000 len:10000
.raspi_read: from:60000 len:10000
.raspi_read: from:70000 len:10000
.raspi_read: from:80000 len:10000
.raspi_read: from:90000 len:10000
.raspi_read: from:a0000 len:10000
.raspi_read: from:b0000 len:10000
.raspi_read: from:c0000 len:10000
.raspi_read: from:d0000 len:10000
.raspi_read: from:e0000 len:10000
.raspi_read: from:f0000 len:10000
.raspi_read: from:100000 len:10000
.raspi_read: from:110000 len:10000
.raspi_read: from:120000 len:10000
.raspi_read: from:130000 len:10000
.raspi_read: from:140000 len:10000
.raspi_read: from:150000 len:10000
.raspi_read: from:160000 len:10000
.raspi_read: from:170000 len:10000
.raspi_read: from:180000 len:10000
.raspi_read: from:190000 len:10000
.raspi_read: from:1a0000 len:10000
.raspi_read: from:1b0000 len:10000
.raspi_read: from:1c0000 len:10000
.raspi_read: from:1d0000 len:10000
.raspi_read: from:1e0000 len:10000
.raspi_read: from:1f0000 len:10000
.raspi_read: from:200000 len:10000
.raspi_read: from:210000 len:10000
.raspi_read: from:220000 len:10000
.raspi_read: from:230000 len:10000
.raspi_read: from:240000 len:10000
.raspi_read: from:250000 len:10000
.raspi_read: from:260000 len:10000
.raspi_read: from:270000 len:10000
.raspi_read: from:280000 len:10000
.raspi_read: from:290000 len:10000
.raspi_read: from:2a0000 len:10000
.raspi_read: from:2b0000 len:10000
.raspi_read: from:2c0000 len:10000
.raspi_read: from:2d0000 len:10000
.raspi_read: from:2e0000 len:10000
.raspi_read: from:2f0000 len:10000
.raspi_read: from:300000 len:10000
.raspi_read: from:310000 len:10000
.raspi_read: from:320000 len:10000
.raspi_read: from:330000 len:10000
.raspi_read: from:340000 len:10000
.raspi_read: from:350000 len:10000
.raspi_read: from:360000 len:10000
.raspi_read: from:370000 len:10000
.raspi_read: from:380000 len:10000
.raspi_read: from:390000 len:10000
.raspi_read: from:3a0000 len:10000
.raspi_read: from:3b0000 len:10000
.raspi_read: from:3c0000 len:10000
.raspi_read: from:3d0000 len:10000
.raspi_read: from:3e0000 len:10000
.raspi_read: from:3f0000 len:10000
.raspi_read: from:400000 len:10000
.raspi_read: from:410000 len:10000
.raspi_read: from:420000 len:10000
.raspi_read: from:430000 len:10000
.raspi_read: from:440000 len:10000
.raspi_read: from:450000 len:10000
.raspi_read: from:460000 len:10000
.raspi_read: from:470000 len:10000
.raspi_read: from:480000 len:10000
.raspi_read: from:490000 len:10000
.raspi_read: from:4a0000 len:10000
.raspi_read: from:4b0000 len:10000
.raspi_read: from:4c0000 len:10000
.raspi_read: from:4d0000 len:10000
.raspi_read: from:4e0000 len:10000
.raspi_read: from:4f0000 len:10000
.raspi_read: from:500000 len:10000
.raspi_read: from:510000 len:10000
.raspi_read: from:520000 len:10000
.raspi_read: from:530000 len:10000
.raspi_read: from:540000 len:10000
.raspi_read: from:550000 len:10000
.raspi_read: from:560000 len:10000
.raspi_read: from:570000 len:10000
.raspi_read: from:580000 len:10000
.raspi_read: from:590000 len:10000
.raspi_read: from:5a0000 len:10000
.raspi_read: from:5b0000 len:10000
.raspi_read: from:5c0000 len:10000
.raspi_read: from:5d0000 len:10000
.raspi_read: from:5e0000 len:10000
.raspi_read: from:5f0000 len:10000
.raspi_read: from:600000 len:10000
.raspi_read: from:610000 len:10000
.raspi_read: from:620000 len:10000
.raspi_read: from:630000 len:10000
.raspi_read: from:640000 len:10000
.raspi_read: from:650000 len:10000
.raspi_read: from:660000 len:10000
.raspi_read: from:670000 len:10000
.raspi_read: from:680000 len:10000
.raspi_read: from:690000 len:10000
.raspi_read: from:6a0000 len:10000
.raspi_read: from:6b0000 len:10000
.raspi_read: from:6c0000 len:10000
.raspi_read: from:6d0000 len:10000
.raspi_read: from:6e0000 len:10000
.raspi_read: from:6f0000 len:10000
.raspi_read: from:700000 len:10000
.raspi_read: from:710000 len:10000
.raspi_read: from:720000 len:10000
.raspi_read: from:730000 len:10000
.raspi_read: from:740000 len:10000
.raspi_read: from:750000 len:10000
.raspi_read: from:760000 len:10000
.raspi_read: from:770000 len:10000
.raspi_read: from:780000 len:10000
.raspi_read: from:790000 len:10000
.raspi_read: from:7a0000 len:10000
.raspi_read: from:7b0000 len:10000
.raspi_read: from:7c0000 len:10000
.raspi_read: from:7d0000 len:10000
.raspi_erase: offs:7d0000 len:10000
.
raspi_write: to:7d0000 len:10000
.
raspi_read: from:7d0000 len:10000
.Done!
## Booting image at bc050000 ...
raspi_read: from:50000 len:40
.   Image Name:   WRN300 Nshared
   Created:      2014-03-26   4:07:32 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    7907712 Bytes =  7.5 MB
   Load Address: 80000000
   Entry Point:  80258000
raspi_read: from:50040 len:78a980
.........................................................................................................................   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80258000) ...
## Giving linux memsize in MB, 64

Starting kernel ...


LINUX started...

 THIS IS ASIC
Linux version 2.6.21.7 (wdk@wireless) (gcc version 3.4.2) #1 Wed Mar 26 12:07:23 CST 2014

 The CPU frequency set to 400 MHz
CPU revision is: 0001964c
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Built 1 zonelists.  Total pages: 16256
Kernel command line: console=ttyS1,57600n8 root=/dev/ram0
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = d0808060, status = 11000000
PID hash table entries: 256 (order: 8, 1024 bytes)
calculating r4koff... 00186a00(1600000)
CPU frequency 400.00 MHz
Using 200.000 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 55368k/65536k available (2084k kernel code, 10112k reserved, 311k data, 6968k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
detected lzma initramfs
detected lzma initramfs
initramfs: LZMA lc=3,lp=0,pb=2,dictSize=1048576,origSize=28171264
LZMA initramfs by Ming-Ching Tiew <mctiew@yahoo.com>..............................................................................................................................................................................................................................................................................................................................................................................................................................................deice id : 1 2 16 4d 0 (2164d00)
S25FL064P(01 2164d00) (8192 Kbytes)
mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 7 MTD partitions on "raspi":
0x00000000-0x00800000 : "ALL"
0x00000000-0x00030000 : "Bootloader"
0x00030000-0x00040000 : "Config"
0x00040000-0x00050000 : "Factory"
0x00050000-0x007e0000 : "Kernel"
0x007e0000-0x007f0000 : "nvbackup"
0x007f0000-0x00800000 : "nvram"
RT3xxx EHCI/OHCI init.
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
fuse init (API version 7.8)
io scheduler noop registered (default)
Ralink gpio driver initialized
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.8 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize
loop: loaded (max 8 devices)
rdm_major = 253

eth2 mii.o query= phy_id:0, address:1 retval:7849
Ralink APSoC Ethernet Driver Initilization. v2.1  256 rx/tx descriptors allocated, mtu = 1500!
MAC_ADRH -- : 0x0000001a
MAC_ADRL -- : 0x3f9d96a8
PROC INIT OK!
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V0.17
PPTP driver version 0.8.1
block2mtd: version $Revision: 1.1.1.1 $
usbmon: debugfs is not available
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver libusual
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (512 buckets, 4096 max)
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
ipt_time loading
arp_tables: (C) 2002 David S. Miller
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
get crc wrong-----src_crc:131575------calu_crc:247-----------
Freeing unused kernel memory: 6968k freed
Algorithmics/MIPS FPU Emulator v1.5
devpts: called with bogus options
(stop_cron:1026)=> done
(stop_cron:1026)=> done
(start_cron:1084)=> starting cron
Jan  1 00:00:00 crond[699]: crond (busybox 1.12.1) started, log level 8

(start_cron:1089)=> done
(sysinit:305)=> done
(restore_defaults:179)=> restore_defaults:(null) 1
(restore_defaults:181)=>
## The configfile is wrong,and I will copy mtd5 to mtd6 ##
Unlocking nvram ...
Writing from /var/nvbaktonvram to nvram ...  [w]
(restore_defaults:185)=> restore_defaults:(null) 1
(restore_defaults:189)=>
## Restoring defaults... ##
Unlocking nvbackup ...
Writing from /var/nvramtonvbak to nvbackup ...  [w]
(copy_nvram_org2bak:141)=> nvr magic=0x48534c46, len=5984
(copy_nvram_org2bak:146)=> copy org to bak.
done
Unlocking nvbackup ...
Writing from /var/nvramtonvbak to nvbackup ...  [w]
(getDefaultPIN:178)=> mac:931C65
(getDefaultPIN:188)=> PIN:33299419
Default pin:33299419
(convert_wdk_values:249)=> done
(gen_ralink_config:146)=> Make a new configuration again for wireless.
(reap:274)=> Reaped 681
(reap:274)=> Reaped 740
insmod: usbcore.ko: module not found
insmod: ehci-hcd.ko: module not found
insmod: ohci-hcd.ko: module not found
insmod: ufsd.ko: module not found
rt2860v2_ap: module license 'unspecified' taints kernel.


=== pAd = c001b000, size = 622272 ===

<-- RTMPAllocAdapterBlock, Status=0
(main_loop:516)=> rc main: enter START state
(ifconfig:44)=> lo 4163 127.0.0.1
phy_tx_ring = 0x0261d000, tx_ring = 0xa261d000

phy_rx_ring0 = 0x0261e000, rx_ring0 = 0xa261e000
MAC_ADRH -- : 0x0000001a
MAC_ADRL -- : 0x3f9d96a8
255.0.0.0
(_evaRT305x_ESW: Link Status Changed
l:357)=> ifconfiCDMA_CSG_CFG = 81000007
g
(reap:274)=> GDMA1_FWD_CFG = C0710000
Reaped 756
(ifcRX DESC a08ed000  size = 2048
onfig:44)=> eth2 4163 (null) (nu<-- RTMPAllocTxRxRingMemory, Status=0
ll)
(ifconfig:44)=> ra0 4163 (null) (null)
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
MCS Set = ff ff 00 00 01
Main bssid = 00:1a:3f:9d:96:a8
<==== rt28xx_init, Status=0
0x1300 = 00064380
no usb disk found
.(_eval:357)=> vconfig
(_eval:357)=> vconfig
(ifconfig:44)=> eth2.1 4163 (null) (null)
(_evaeth2.2: Setting MAC address to l:357)=> ifconfi 00g
 1a 3f 9d 96 a9.
device eth2 entered promiscuous mode
VLAN (eth2.2):  Setting underlying device (eth2) to promiscious mode.
(reap:274)=> Reaped 770
(ifconfig:44)=> eth2.2 4163 (null) (null)
(_eval:357)=> brctl
(_eval:357)=> brctl
(reap:274)=> Reaped 773
(_eval:357)=> brctl
(reap:274)=> Reaped 774
(_eval:357)=> brctl
(reap:274)=> Reaped 775
(_eval:357)=> brctl

eth2 mii.o query= phy_id:1, address:4 retval:5e1

eth2 mii.o query= phy_id:1, address:0 retval:3100

eth2 mii.o query= phy_id:1, address:5 retval:0
eth2.1: dev_set_promiscuity(master, 1)
device eth2.1 entered promiscuous mode
(_eval:357)=> brctl
device ra0 entered promiscuous mode
insmod: hw_nat.kbr0: port 2(ra0) entering learning state
o: module not fobr0: port 1(eth2.1) entering learning state
und
(ifconfig:44)=> br0 4163 10.0.0.1 255.255.255.0
(_eval:357)=> udhcpd
(reap:274)=> Reaped 785
(_eval:357)=> /sbin/syslogd
(reap:274)=> Reaped 787
(_eval:357)=> /sbin/klogd
(reap:274)=> Reaped 789
br0: topology change detected, propagating
br0: port 2(ra0) entering forwarding state
br0: topology change detected, propagating
br0: port 1(eth2.1) entering forwarding state
RT305x_ESW: Link Status Changed
(start_wan:1025)=> wan_proto=dhcp, wan_ifname=eth2.2
(_eval:357)=> ifconfig
(reap:274)=> Reaped 815
(_eval_udhcpc:432)=> udhcpc
udhcpc (v1.12.1) started
(ifconfig:44)=> eth2.2 4163 0.0.0.0 (null)
(rcl_firewall:1811)=> enter.
(rcl_firewall:1815)=> wanif=eth2.2,wanip=,lanif=br0,lanip=10.0.0.1,lanmask=24
(do_system:191)=> iptables -F -t filter 1>/dev/null 2>&1
(do_system:191)=> iptables -F -t nat 1>/dev/null 2>&1
(do_system:191)=> iptables -F -t mangle 1>/dev/null 2>&1
(do_system:191)=> killall schelper
killall: schelper: no process killed
(do_system:191)=> iptables -t filter -N wan_icmp_input 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -A INPUT -j wan_icmp_input 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -N wan_igmp_input 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -A INPUT -j wan_igmp_input 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -N web_filter 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -A FORWARD -j web_filter 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -N spi_forward 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -A FORWARD -j spi_forward 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -N spi_input 1>/dev/null 2>&1
(do_system:191)=> iptables -t filter -A INPUT  -j spi_input 1>/dev/null 2>&1
(wan_down:1605)=> done
(deconfig:81)=> done
(start_wan:1266)=> ######## started dhcp client daemon.
Unlocking nvbackup ...
Writing from /var/nvramtonvbak to nvbackup ...  [w]
(start_wan:1306)=>
(start_httpd:567)=> done
(do_system:191)=> ap_mgrd&
(reap:274)=> Reaped 862
(_eval:357)=> /sbin/wpspbc
(do_system:191)=> iwpriv ra0 set WscConfMode=0 1>/dev/null 2>&1
webs: Listening for HTTP requests at address 10.0.0.1
killall: time_set: no process killed
(do_system:191)=> route delete 239.255.255.250 1>/dev/null 2>&1
MP AUTOMATION daemon (ver 1.0).
Password for 'admin' changed
(_eval:357)=> /sbin/resetbutton
(_eval:357)=> lld2d

***** g_wl_interface = ra0 ******

Unlocking nvbackup ...
Writing from /var/nvramtonvbak to nvbackup ...  [w](reap:274)=> Reaped 896
(do_system:191)=> route del -net 239.0.0.0 netmask 255.0.0.0 br0
route: ioctl 0x890c failed: No such process
(do_system:191)=> route add -net 239.0.0.0 netmask 255.0.0.0 br0                     [w](iptables_miniupnp_init:673)=> External IP =
(do_system:191)=> iptables -t nat -N MINIUPNPD                                       [w]
(do_system:191)=> iptables -t nat -I PREROUTING 1 -j MINIUPNPD
(reap:274)=> Reaped 909
(do_system:191)=> iptables -t filter -N MINIUPNPD
(reap:274)=> Reaped 911
(do_system:191)=> iptables -t filter -I FORWARD 1 -j MINIUPNPD
(reap:274)=> Reaped 913
(iptables_miniupnp_init:687)=> done
(do_system:191)=> killall -q miniupnpd
(do_system:191)=> miniupnpd -f /etc_ro/miniupnpd/miniupnpd.conf -a 10.0.0.1/24
(start_upnp:755)=> done
(do_system:191)=> igmpproxy &
(reap:274)=> Reaped 919
(start_igmp_proxy:878)=> done.
(do_system:191)=> iptables -t nat -F pptp_dmz 1>/dev/null 2>&1
igmpproxy, Version 0.1 beta2, Build 140326
Copyright 2005 by Johnny Egeland <johnny@rlo.org>
Distributed under the GNU GENERAL PUBLIC LICENSE, Version 2 - check GPL.txt

Warn: Warning, No upstream interface assigned.
0x10000000: 0x33335452
0x10000004: 0x20203235
0x1000000c: 0x00000106
0x1000000c: 0x00000106
(do_system:191)=> iptables -t nat -D PREROUTING  -j pptp_dmz 1>/dev/null 2>&1
(do_system:191)=> iptables -t nat -X pptp_dmz 1>/dev/null 2>&1
(reap:274)=> Reaped 927
(rcl_static_route:124)=> enter.
(start_services:1390)=> done
(main_loop:559)=> rc main: enter TIMER state
(main_loop:564)=> rc main: enter IDLE state
0x1000000c: 0x00000106
0x1011009c: 0x0008a301
0x1011009c: 0x0008a301
0x1011009c: 0x0008a301
0x10110014: 0x00401555
0x10110014: 0x00401555
0x10110014: 0x00c01555
(reap:274)=> Reaped 922
(reap:274)=> Reaped 685
(reap:274)=> Reaped 688
killall: ntp_set: no process killed
sync to ntp server.
(notification_send_rc:57)=> enter.
(notification_send_rc:71)=> send msg oid '1' to rc.
(notification_send_rc:75)=> send signal to rc.
 (rc_signal:356)=> get signal (16), state=4
(main_loop:487)=> rc main: enter SERVICE state
(notification_get_rc:90)=> enter.
(notification_get_rc:98)=> get message '1'.
(notification_get_rc:102)=> if doesn't need waiting, then delete the file of message.
(rcl_time:85)=> enter.
(rcl_services_ntpc:73)=> enter.
(stop_ntpc:37)=> done
(_eval:357)=> ntpclient
time.nist.gov: Unknown host
(reap:274)=> Reaped 1009
(start_ntpc:65)=> done
(notification_free_rc:111)=> delete the file of message.
(main_loop:564)=> rc main: enter IDLE state
(notification_send_rc:77)=> waiting for backing from rc.
 (notification_send_rc:79)=> done.
(reap:274)=> Reaped 1006
sync to ntp server.
(notification_send_rc:57)=> enter.
(notification_send_rc:71)=> send msg oid '1' to rc.
(notification_send_rc:75)=> send signal to rc.
 (rc_signal:356)=> get signal (16), state=4
(main_loop:487)=> rc main: enter SERVICE state
(notification_get_rc:90)=> enter.
(notification_get_rc:98)=> get message '1'.
(notification_get_rc:102)=> if doesn't need waiting, then delete the file of message.
(rcl_time:85)=> enter.
(rcl_services_ntpc:73)=> enter.
(stop_ntpc:37)=> done
(_eval:357)=> ntpclient
time.nist.gov: Unknown host
(reap:274)=> Reaped 1026
(start_ntpc:65)=> done
(notification_free_rc:111)=> delete the file of message.
(main_loop:564)=> rc main: enter IDLE state
(notification_send_rc:77)=> waiting for backing from rc.
 (notification_send_rc:79)=> done.

At this point, if I <enter>, it gives me the prompt for login again, and even if I log in it keeps repeating this:

sync to ntp server.
(reap:274)=> Reaped 1089
(notification_send_rc:57)=> enter.
(notification_send_rc:71)=> send msg oid '1' to rc.
(notification_send_rc:75)=> send signal to rc.
 (rc_signal:356)=> get signal (16), state=4
(main_loop:487)=> rc main: enter SERVICE state
(notification_get_rc:90)=> enter.
(notification_get_rc:98)=> get message '1'.
(notification_get_rc:102)=> if doesn't need waiting, then delete the file of message.
(rcl_time:85)=> enter.
(rcl_services_ntpc:73)=> enter.
(stop_ntpc:37)=> done
(_eval:357)=> ntpclient
time.nist.gov: Unknown host
(start_ntpc:65)=> done
(notification_free_rc:111)=> delete the file of message.
(main_loop:564)=> rc main: enter IDLE state
(reap:274)=> Reaped 1112
(notification_send_rc:77)=> waiting for backing from rc.
 (notification_send_rc:79)=> done.

Well then. In the end it all worked, actually! I forgot the default IP address for the NBox is 10.0.0.1, so that's why I couldn't reach it from my desktop, through the TD-W8968, after flashing the firmware back. Accessing directly, it was working nicely smile so, revival completed for the NBox! big_smile

Thought I'd then move on to try and revive the other TP-Link router, TL-WR841N... but this one doesn't have the connectors for the serial port, and I don't want to destroy the cable I've bought...
If you'd like to check out and spare any hints on what I could try.... https:/ /pbs.twimg.com/media/DPhxCRxWsAEmGI6.jpg:large

The discussion might have continued from here.