Recover from a bad flash

From DD-WRT Wiki

Revision as of 00:33, 29 June 2008 by Soulstace (Talk | contribs)
Jump to: navigation, search

So, you're afraid you've bricked your router. Don't worry, there are a number of things you can try to get your router working again before giving up and living with the fact that your router is now a paperweight.

It is also unfortunately possible to configure your router in ways which make it dead to the world. These techniques may be useful in these cases also.

Before you continue below, make sure you've first tried a hard reset to revive your router:

  1. Disconnect the router from UTP cables (not the power cable).
  2. Push reset button for 30 secs.
  3. Without releasing reset button, disconnect power cord.
  4. Hold the reset button for another 30 secs.
  5. Replug the power cord.
  6. Still hold the reset button for another 30 secs.
  7. Release the reset button and give the router about 10 secs to resettle.
  8. Disconnect power cord for another 10 secs and then reconnect.
  9. All should be in default settings now.



The LED display at the front of the router is the best way to determine what type of brick you have and its recovery method. You should at least check this to prevent unnecessarily opening the router.

When the web interface is no longer available, switch the router off first (remove the power jack) and remove all network cables from the equipment. After some seconds you restart the WRT54G. Now take note of the flashing LEDs.

  1. The power LED flashes very fast. If it keeps on flashing longer than 2 minutes, without having lit up the other LED's, then a defective bootloader is present. If you can ping you can try the TFTP recovery, otherwise you may need to open the router and use the JTAG recovery method below.
  2. The power LED flashes very fast and after some seconds the DMZ LED lights up for approximately 5 seconds. In this case the Bootloader is intact and only the kernel (firmware) is defective. In this case you could possibly still recover with an ethernet cable if you reflash the firmware via TFTP (see TFTP below).
  3. The power LED flashes very fast and after about 20 seconds it lights permanently, but the DMZ LED did not light up. In this case Bootloader and Kernel (firmware) are intact, only a wrong configuration from locked up the router. This can happen if a wrong or corrupt value exists in the NVRAM. Here simply clearing the NVRAM should solve the problem.

I'm the Professor, use Draytek uploader for this problem, flashing power led, defective bootloader <>. Cheers, Professor.

The Linksys site mentions 'Management Mode' which makes it trivial to recover from bad flashing (answer id 3176). Here's how to do it:

  1. Unplug the power cord from the back of the router.
  2. Hold down the Reset button.
  3. While holding down the Reset button, plug back in the power cord to the router.
  4. Continue to hold the Reset button for five (5) seconds. After five (5) seconds, release the button.
  5. Wait for about one (1) minute. Then, on a computer connected to the router, launch a web browser (for example, Internet Explorer or Mozilla Firefox).
  6. Type in the router's IP address of into the Address field and press the [Enter] key.
  7. The Management Mode - Firmware Upgrade interface should appear.

Note This technique only officially applies to hardware version 5 of the router ( what version do I have?). However, some version of the DD-WRT seem to have this ability on other versions of the hardware, so you might find it works anyway.

Linksys Firmware

If you cannot find a Firmware Auto-Upgrade utility at the Linksys Download Page, use a Setup Wizard as an alternative from other Linksys router (make sure to use your router's firmware).

Another tftp program is called tftp2 and is available here (this will start the download): tftp2.exe

Recovering with TFTP

During startup, the router will pause to accept a temporary firmware upload via tftp. On the Linksys routers, this procedure seems to work best with the official Linksys firmware. This is only used for booting and does not go into the router NVRAM.

Specific to version 5, to my knowledge anyway the DD-WRT micro firmware can be uploaded to the router via TFTP, in my case this was the only way I could actually recover the router, linksys firmware would not work. More on this will be put into the relevant areas below.

If pinging does not work, check the IP Address of your computer and make sure it is assigned an IP address in the subnet of the router IP. For simplicity sake you can assume "192.168.1.x" is good. If you do not have a good IP, the DHCP Server might not be working. So set your IP manually to something like with as your gateway and then try pinging the router again.

Power the router on with a continuous ping running in a command window:

ping -t -w 2

The -w 2 parameter forces a lower timeout for the ping answer, this makes easier to get an answer from the bricked router.

You should see at least some seconds, at least 2-3 pings, where it responds to ping of address. Do this several times to be sure. If it does you have good chance of simple recovery. If you still receive no response, the IP address may be something other than You should attempt to obtain the IP address of the router. Especially if previous firmware set the boot_wait variable to on, the router pauses even longer than normal during bootup to accept a recovery flash. All you need to do is provide a firmware to it via TFTP during this window of time.

On a version five, I had bricked it trying to increase the RAM from 8 to 16MB which I later found out is NOT able to be done on a WRT54GV5. Pinging did not show a response even initially after powering on. In this circumstance there is two options - the safer is use a JTAG cable to clear the NVRAM. In my case, powering on whilst shorting pins 15-16 to the ground on the antenna suddenly made the pings work plus on the front of the router you will notice that instead of 4 LAN lights being lit, only the connected one will be (do this as a last resort though, screwing this up could completely screw your router and it will be in an unbrickable state)

Prepare your PC, firmware file and TFTP software and play with the timing of powering it on and starting the TFTP session just after applying power. If you try it a number of times (at least 10) you will probably rescue the router with no fuss!

Windows: Microsoft Windows contains a TFTP client. Windows Vista will require that you enable it in Programs and Features. With TFTP, all of the information about the transfer is specified during the initial setup; there is little client/server interaction as compared with standard FTP. To flash a router using Microsoft Windows, open a command prompt, change to the directory containing the original Linksys firmware to use for this boot (this example assumes the firmware file name is code.bin), and then enter the following command (assuming your router IP

tftp -i PUT code.bin code.bin

In executing the above command for a V5 bricked from trying to set the NVRAM to 16MB, make sure you do it as soon as the router goes into a pingable state. If you dont the router seems to lose its ability to accept a file via TFTP quite fast and you wont be able to write the data you need.

Linux: Most Linux distros either include a tftp client or have one available in their packages. This example uses atftp.

atftp --option "mode octet" --verbose -p -l code.bin

After the PUT is complete the router will stop pinging for up to 30s while the firmware boots. Don't panic, this is normal. Once it pings again, give the router about 10-15 seconds to get the webserver started and at that point you should be able to re-upload the firmware to NVRAM via the web interface.

Notes: a) The -i specifies binary transfer mode; the two file names after the PUT command specify the SOURCE and DESTINATION file names.

b) Start the command and then power up the router. There is no indication of any transfer until it is complete.

c) The uploading via this command is pretty slow ~5.7kB/s so it will take about 10 minutes to upload ~3MB image. I would add another 2-4 minutes for it to write the image. - Running windows vista I managed to upload the DD-WRT Micro firmware in about 5 seconds and it is 1.7Mb, however this may have been inaccurate as I am unsure as to whether the whole image went across or just past it.

d) As mentioned elsewhere, you should use the Linksys image. You cannot use the dd-wrt images as the router will reject it. You will get "Error on server : code pattern incorrect" message. The WRT54GV5 however, does not seem to have an issue with this.

e) If TFTP does not work, try changing your network adapter to 10 Mbps half duplex before attempting to flash the router

f) For the WRT54GV5 after you get DD-WRT Micro uploaded you should wait, at least 5 minutes or longer just to be sure for the WLAN light to come on or for pings to start occuring again. Be aware though, if you had bricked your router the same way as I had (wrong NVRAM setting) your router settings will remain the same. Why does this matter? If you had set a different IP address you will notice your pings failing, try to ping whatever your routers address was set to. You should now be able to go into or whatever your routers IP was set to and connect to the router, goto firmware and select the ddwrt firmware of your choice.

g) Make sure that you set the router to 'Reset to default settings after flash' otherwise when the router reboots it will be straight back to a brick again. Once you have done this click upgrade.

h) Provided you have followed these steps correctly you should notice that the router will eventually reboot, in some cases it will require a power cycle (however if you power cycle wait at least 10 minutes to be sure the flash writing has occurred before you pull the plug).

i) Enjoy the fact that you did not waste $60 and that your router is now functioning again.

Recovery by JTAG cable

If the router isn't pingable anymore, there is little else you can do, but using a JTAG cable. For a pin-out see OpenWRT wiki. Then download the HairyDairyMaid Debrick Utility. Or...try the updated TJTAG program which includes the Newer Router Models.

  1. solder the JTAG cable following the above linked pin-out.
  2. solder a 12 pin header on the PCB of the router.
  3. to install the giveio.sys copy this file and loaddrv.exe into {windows}\system32\drivers
  4. double click loaddrv.exe in the system32 dir. This is important.
  5. append the filename giveio.sys onto the path in the utility
  6. press the load button and the start button, they should both confirm success. If this does not happen go no further, go back and fix this.
  7. from the command prompt cd to your Hairy Dairy directory and run wrt54g.exe to get a list of options
  8. to check your cable, plugin and power up the router and do wrt54g -probeonly
  9. it will then detect the CPU type. If not then check your cable.
  10. finally to erase your NVRAM (the usual cause of the problem) wrt54g -erase:nvram
  11. if that didn't work, erase the kernel (firmware): wrt54g -erase:kernel Now reflash the kernel via TFTP.
  12. if you still have no luck, you need to erase your CFE, but make sure you have a working cfe.bin for your router model! wrt54g -erase:cfe After that you have to reflash your CFE: wrt54g -flash:cfe

Flashing the KERNEL or WHOLEFLASH will take a very long time using JTAG via this utility. You are better off flashing the CFE & NVRAM files & then using the normal TFTP method to flash the KERNEL via ethernet.

If That Doesn't Work

WARNING - This method can cause permanent damage. Success rate is only about 20%. The other 80% is permanent damage to the flash chip rendering the router permanently inoperable. Use at your own risk. You've been warned.

If the above methods do not work for you, the [WRT54G Revival Guide] includes a second technique that involves snapping open the plastic case of the router and using a small metal tool (or paper-clip) to "short" two particular "pins" on the circuit board. It is quite clear that this carries risk of permanently damaging your flash via static discharge, and should be a measure of EXTREME last resort, not the first thing to try. You can very likely recover from a bad flash WITHOUT opening the router if you have some patience with the TFTP technique.

If you do have to use the EXTREME measure #4 from the revival guide as I did here is a additional tip uncovered from this forum. Voidman forum

I used the "earthing" technique to get the WRT54g v3.1 to respond to pings. Whenever I tried to tftp the dd-wrt firmware, it would cause the router to stop responding to pings ans just give a "timeout" error.

The solution was to first tftp an official LINKSYS firmware (WRT54G_4.30.5_US_code.bin which I renamed to "code.bin"). The router accepted it and rebooted properly. I was then able to upgrade to the latest dd-wrt v.23 SP2 through the WebGUI. This was discovered on GS v.4 which responded to unofficial firmware with "incorrect code pattern." Apparently this happens when tftp'ing to an empty flash chip.

There's also a collection of pointers and tips on how to recover from a bad flash at the external link location, but most of the information in that forum seems to have been collected into the WRT54G Revival Guide. So far this is just a starter wiki. If someone could move the important parts into this wiki, that'd be great. Probably organize it by recovery methods and list variations of each method below the method, or something.

Buffalo WHR-HP-G54 soft repair

I discovered that my bricked Buffalo WHR-HP-G54 router during the startup phase (with the reset buttom activated for 5 sec. during a power-on sequence) always responded positive with 3-5 pings on IP:, (no matter what IP address I've set it to) before the ping again timed out. So you might try this before you open the router:

  1. Set your computers ethernet cable interface to static IP address:, Network Mask: and Gateway IP:
  2. Connect the network cable to the bricked routers LAN port 4
  3. In Windows cmd interface start a "ping -t -w 10", continuous ping every 10 milliseconds
  4. Push the reset button (located in the buttom of the router), and keep it activated
  5. Unplug the routers 5v power cable, count slowly to 5 and reconnect the power cable.
  6. Count once again slowly to 5 and release the reset buttom

If you are lucky you will see 3-5 ping answers from your router on IP: before the ping command again start responding with the timeout message.

If you get a positive ping response then you can succesfully use the TFTP script "Another way is to use a (script) cmd file under Windows" from this page:

to flash your router with new software. You just have to modify the procedure and hold the reset buttom while you unplug the 5v power cable, keep the reset buttom activated, restore power after 5 seconds and release the reset buttom after another 5 seconds.

The TFTP flash procedure will update your bricked router with your new software. Wait for about 2 minutes, change the computers ethernet cable interface from static IP settings back to DHCP, wait a few seconds for the network interface restart and access your repaired router on IP:

Open Buffalo WHR-G54S and Buffalo WHR-HP-G54

If you have already tried pinging the Buffalo continuously through hard and soft resets, unplugging, plugging and any combination thereof, then you can open up the device in order to revive it.

In addition to the minimal tools to open the router, you will need:

  1. A sewing needle
  2. A 10cm length of wire from within an ethernet cable, or equivalent.
  3. Read this entire section first, to get an idea, then round up your tools and go!
  1. Follow the guide: How_to_open_my_router
  2. With the router unplugged, plug a patch cable into one of the 4 LAN ports on your router and plug the other end into your computer, or switch connected to your computer.
  3. Configure your network card on your computer with a static IP address: IP:, Network Mask:, no gateway. This is important:, not, as other guides for other routers may show. Buffalo uses x.11.x range for recovery / TFTP flash mode.
  4. Run the ping command in a terminal or command prompt:
    1. In Linux: "ping".
    2. In Windows "ping -t -w 10", continuous ping every 10 milliseconds.
  5. Locate pin 12 on the flash memory chip MX 29LV320ABTC-90 G, show here: image:BuffaloWHR-HP-G54_FlashChip.jpg. . . . . . . . . It is the 12th pin counter-clockwise from the dimple in the surface of the chip. See the specs for this chip here. This is the Reset pin.
  6. Strip both ends of your wire by about 2cm. Thread one end through the eye of the needle, and bend the tip of the wire and wrap to secure to the needle. Wrap the opposite end of the wire around a suitable ground point, such as the antenna block connector.
  7. Tricky: While holding the pointy end of the needle against pin 12, carefully plug in the power, and begin watching your computer screen for ping replies. When you see ping replies, remove the needle tip and put it safely away from the board. The router will now always wait about 10 or 15 seconds for a flash image when it is powered up.
  8. The pings may continue for a short while, then stop. Unplug the router. Leave the ping window running.
  9. Now you can power up the router, and when the ping replies begin from, use a second window to tftp in the firmware image of your choice. WAIT. The router is flashing the new image automatically. It continues to flash the DIAG LED (red in the middle-front), and then reboots, all on it's own. Do not interfere with this process. When it is finished, the power light is on (green, top-front), and the Wireless light is blinking (green, next to the power light). For more information, see the DD-WRT Wiki article: Installation#TFTP_Flashing_Buffalo_Routers_under_Windows on how specifically to upload a new firmware image to the router, now the router is accepting firmware images again!

Buffalo WHR-G125

I did the same as above with my whr-g125. It seemed bricked (not pingable), but connecting wires to pin 12 of the Samsung flash ram chip (the big one) restarted the router, which where pingable in 5-10 seconds afterwards. So i used the .bat script found elsewhere in the wiki to tftp the .bin after using this restarting method. And it worked!

Buffalo WHR-HP-G54 JTAG

Lets say the instant you switch on your buffalo it displays all GREEN LEDs, the switch is all green, the green power light is on but no other colours and nothing is blinking. Nothing changes and nothing you do has any effect, you can't ping nore and you have tried shorting pin 12 as above. This is the time for JTAG and the Hairy Dairy Maid utility! If you have heard of this then I expect you have been dieing to use it. JTAG is a 12 pin header on the board for which you will need to connect control 4 wires to your computers printer port (parallel) and 2 gound wires. JTAG allows the 'manual' operation of the boards circuits even if the CPU is well and trully crashed. A bit like brain surgery with the top of someones head removed. I did this on Windows 2000, it (and XP) does not like you messing with the parallel port so you need a special driver to allow this; giveio.sys. Without this nothing happens. You can get the program and instructions from here: Hairy Dairy Maid Now read those instructions and then read what I specifically had to do to get it working on our one.

  1. solder the 25 way D on your JTAG cable follow the standard pinout.
  2. solder the PCB end onto the JTAG header directly to the solder pads, evens are ground; 2+4+6+8=20+25, odds are signals; 3=2,5=13,7=4,9=3.
  3. this is standard JTAG, nothing special, forget the resistors the PCB already has them.
  4. to install the giveio.sys copy this file and loaddrv.exe into {windows}\system32\drivers
  5. double click loaddrv.exe in the system32 dir. This is important.
  6. append the filename giveio.sys onto the path in the utility
  7. press the load button and the start button, they should both confirm success. If this does not happen go no further, go back and fix this.
  8. from the command prompt cd to your Hairy Dairy directory and run wrt54g.exe to get a list of option
  9. to check your cable, plugin and power up the buffalo and do wrt54g -backup:nvram /noemw /fc:29
  10. it will detect the CPU type and you should see your data as FFFFFF and CFD1AFC nonsense whizz past. If not then check your cable.
  11. finnaly to erase your NVRAM (the usual cause of the problem) wrt54g -erase:nvram /noemw /fc:29

External Links