JTAG-adapter

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 12:53, 3 July 2006 (edit)
85.178.77.96 (Talk)
(Aufbau)
← Previous diff
Revision as of 17:22, 11 May 2010 (edit) (undo)
Glenn (Talk | contribs)
(wiki)
Next diff →
(21 intermediate revisions not shown.)
Line 1: Line 1:
 +{{Languages|JTAG-adapter}}
 +
__TOC__ __TOC__
----- 
 +===Intro===
-== Einführung ==+What is [http://en.wikipedia.org/wiki/JTAG JTAG]? JTAG is a communication/debug interface to access flash chips directly even when the OS is corrupted or not installed.<br>
-Falls man sich seinen WRT54G/GS kaputt geflasht hat, ist er praktisch so wie blockiert. Die POWER-LED blinkt nur noch, und er reagiert nicht mehr auf Pings oder Zugriffsversuche über den Browser. Normalerweise hilft dann meist ein Kurzschliessen der Pins 15+16 (Erfolgreich getestet beim WRT54Gv2, WRT54GS v4 - EU und WRT54GL) am Intel-Flash-Chip. Diese Pins sind jedoch so klein, dass dabei die Gefahr besteht andere Teile ebenfals kurzzuschliessen und den WRT unter Umständen ganz zu zerstören.+If you have [http://en.wikipedia.org/wiki/Brick_%28electronics%29 bricked] (nice story) your device by flashing it with incorrect firmware, interrupting the flashing process, etc., you can use JTAG to bring your device back to life! You can also use JTAG to make backups of your existing flash content. This is very useful for porting.<br>
-Abhilfe schafft da ggf. ein sogenannter [http://de.wikipedia.org/wiki/JTAG JTAG]-Adapter. Dieser wird an vorgesehene Pins am WRT und an einen parallelen 25poligen Anschluss am PC angeschlossen. Nun ist es einfach möglich über eine Software ganz gezielt bestimmte Bereiche (CFE, Kernel und NVRAM) des Intel-Flash-Chips zu sichern, löschen oder neu zu beschreiben.+
-== Aufbau ==+All you need is a short adapter cable, a piece of software, and of course a JTAG header on your device's circuit board. The JTAG header is usually located near the flash chip. In most cases it is a 12 to 14 pin header which must be assembled with 2,54mm pins.<br>
-Für den Aufbau benötigt man folgende Teile:+JTAG software is available from [http://www.dd-wrt.com/phpBB2/profile_sec.php?mode=viewprofile&u=103 Tornado] a DD-WRT developer. His current builds for windows and the source files for linux can be found in the DD-WRT download section in the "others->tornado" folder.<br>
 + 
 +===Building the Cable===
 + 
 +Building the cable is quite easy. You will need some parts you can get at every electronic store in your area, some soldering skills and a voltage/resistance meter.<br><br>
 + 
 +Parts:
<blockquote> <blockquote>
-*4x 100Ohm Widerstände +*4x 100Ohm resistors
-*1x 25pol.D-SUB-Stecker (für an den Parallel-Port des PCs) +*1x 25pol.D-SUB-Plug (PC Parallel-Port)
-*1x D-SUB-Kappe für den Stecker +*1x D-SUB-case for the plug
-*etwas Kabel/Flachbandkabel +*12 to 14 ping ribbon cable or single wires
-*nach Wunsch Wannenstecker und Pfostenbuchse fürs Flachbandkabel +*1x Pfostenbuchse (i dont know how its called in english. its the header pin which gets soldered to the board)
-*Lötkolben usw. +*1x Wannenstecker (i dont know how its called in english, too. its the plug which fits to the header on the board)
 +
</blockquote> </blockquote>
-Schaltplan:+Circuit:
<pre> <pre>
- D-SUB-Stecker JTAG (JP2 am WRT)+ D-SUB-Plug JTAG
Pin 2 -------[100Ohm]------- Pin 3 Pin 2 -------[100Ohm]------- Pin 3
D0 TDI D0 TDI
Line 41: Line 49:
GND GND
</pre> </pre>
-Wer keine 100 Ohm Widerstände zu Hand hat, kann sie u.U. auch weglassen: Die Eingänge der JTAG Schnittstelle sind ohnehin mit 4,7 KOhm Widerständen beschaltet. So war das zumindest bei meinem WRT54G v5, also bei anderen Versionen lieber nochmal nachschauen. 
-==Verwendung des Adapters==+===Using the Cable===
- +
-Nachdem man den Adapter gebaut hat und alle Kontakte überprüft sind, muss der WRT geöffnet werden.+
-Dazu den blauen vorderen Bereich von dem zweigeteilten hinteren Bereich entfernen. Geht etwas schwer anfangs.+
- +
-Nun die Kabelenden bzw. den Wannenstecker entsprechend dem Schaltplan anlöten und mit dem Adapter verbinden.+
- +
-Nun den Adapter an den PC anschliessen. (WRT ist dabei stromlos!)+
- +
-In der Konsole nun folgende Zeile eintippen aber noch nicht ausführen:+
- +
-<pre>./wrtjtag -erase:nvram</pre>+
- +
-Jetzt erst den WRT mit Strom versorgen und gleich dannachbinnerhalb von 0,5s bis 2,0s nach der Stromzufuhr Enter drücken und das Programm ausführen.+
-Es wird nun der NVRAM-Bereich gelöscht. Nach erfolgreichem Löschen den WRT wieder stromlos machen und obiges Spielchen mit folgender Zeile wiederhohlen:+
- +
-<pre>./wrtjtag -erase:kernel</pre>+
- +
-Wenn nun auch der Kernel erfolgreich gelöscht wurde, sollte der WRT auf eine neue Firmware warten. Diese kann man mittels TFTP an die IP 192.168.1.1 an den WRT senden (sollte unter 2,8MB sein):+
- +
- <pre>tftp -i 192.168.1.1 PUT Firmware.bin</pre>+
- +
-Der WRT erhält durch das Löschen automatisch die IP 192.168.1.1.+
-[http://www.linksysinfo.org/modules.php?name=Content&pa=showpage&pid=33 http://www.linksysinfo.org/modules.php?name=Content&pa=showpage&pid=33]+install the software, connect your device to the cable and the cable to your pc. leave the psu unplugged.
 +open a cli, go to the folder where the jtag software is stored.<br>
 +'''Always do a backup of your existing flash state before doing something else!''' This is necessary for recovering to the pre flash state and for testing that everything is working fine!<br>
 +Always let the software auto neg the right settings first.<br><br>
 +The flash areas you can modify are cfe (the broadcom bootloader), nvram (the system nonvolatile ram), kernel(the system) and wholeflash (takes a very long time).
 +The switches which can be used are -erase (purging the flash area), -backup and -flash.
 +<br><br>
 +If you have a brick caused by a bad flash the easiest way to debrick is to erase the kernel and nvram. After a powercycling the router it will wait for a [[Tftp_flash]] firmware flash. You can upload the new firmware via JTAG, too, but this will take hours! <br>
 +'''In a standard bricked situation you will never have to erase the cfe! Hands OFF!!'''<br><br>
 +Some examples:<br>
 +This console commands are for linux
 +Backup:<br>
 +<pre>./wrtjtag -backup:kernel</pre>
-[http://lonewolf.hacker-nin.com/wrt/cfe/cfe.php cfe.bin Datei]+Erase Kernel
-Lonewolf von Sveasoft betreibt eine Seite wo man die verschiedenen Versionen runterladen kann.+<pre>./wrtjtag -erase:kernel</pre>
 +These are for windows (maybe the .exe is called different):<br>
 +Backup:<br>
 +<pre>wrtjtag -backup:kernel</pre>
 +Erase Kernel
 +<pre>wrtjtag -erase:kernel</pre>
 +<br><br>
-[[Category:Deutsche Dokumentation]]+[[Category:jtag]]
 +[[Category:Documentation]]

Revision as of 17:22, 11 May 2010


Contents


Intro

What is JTAG? JTAG is a communication/debug interface to access flash chips directly even when the OS is corrupted or not installed.

If you have bricked (nice story) your device by flashing it with incorrect firmware, interrupting the flashing process, etc., you can use JTAG to bring your device back to life! You can also use JTAG to make backups of your existing flash content. This is very useful for porting.

All you need is a short adapter cable, a piece of software, and of course a JTAG header on your device's circuit board. The JTAG header is usually located near the flash chip. In most cases it is a 12 to 14 pin header which must be assembled with 2,54mm pins.

JTAG software is available from Tornado a DD-WRT developer. His current builds for windows and the source files for linux can be found in the DD-WRT download section in the "others->tornado" folder.

Building the Cable

Building the cable is quite easy. You will need some parts you can get at every electronic store in your area, some soldering skills and a voltage/resistance meter.

Parts:

  • 4x 100Ohm resistors
  • 1x 25pol.D-SUB-Plug (PC Parallel-Port)
  • 1x D-SUB-case for the plug
  • 12 to 14 ping ribbon cable or single wires
  • 1x Pfostenbuchse (i dont know how its called in english. its the header pin which gets soldered to the board)
  • 1x Wannenstecker (i dont know how its called in english, too. its the plug which fits to the header on the board)

Circuit:

 D-SUB-Plug JTAG
 Pin 2  -------[100Ohm]------- Pin 3
 D0                              TDI
 
 Pin 3  -------[100Ohm]------- Pin 9
 D1                              TCK
 
 Pin 4  -------[100Ohm]------- Pin 7
 D2                              TMS
 
 Pin 13 -------[100Ohm]------- Pin 5
 Select                          TD0
 
 Pin 20 ---+------------------ Pin 6
 GND       |                     GND
           |
 Pin 25 ---+
 GND

Using the Cable

install the software, connect your device to the cable and the cable to your pc. leave the psu unplugged. open a cli, go to the folder where the jtag software is stored.
Always do a backup of your existing flash state before doing something else! This is necessary for recovering to the pre flash state and for testing that everything is working fine!
Always let the software auto neg the right settings first.

The flash areas you can modify are cfe (the broadcom bootloader), nvram (the system nonvolatile ram), kernel(the system) and wholeflash (takes a very long time). The switches which can be used are -erase (purging the flash area), -backup and -flash.

If you have a brick caused by a bad flash the easiest way to debrick is to erase the kernel and nvram. After a powercycling the router it will wait for a Tftp_flash firmware flash. You can upload the new firmware via JTAG, too, but this will take hours!
In a standard bricked situation you will never have to erase the cfe! Hands OFF!!

Some examples:
This console commands are for linux Backup:

./wrtjtag -backup:kernel

Erase Kernel

./wrtjtag -erase:kernel

These are for windows (maybe the .exe is called different):
Backup:

wrtjtag -backup:kernel

Erase Kernel

wrtjtag -erase:kernel