Recover from a bad flash

From DD-WRT Wiki

Revision as of 20:50, 5 June 2007 by Alex Brown (Talk | contribs)
Jump to: navigation, search

So, you're afraid you've bricked your router. Don't worry, there are a number of things you can try to get your router working again before giving up and living with the fact that your router is now a paperweight.

It is also unfortunately possible to configure your router in ways which make it dead to the world. These techniques may be useful in these cases also.



The Linksys site mentions 'Management Mode' which makes it trivial to recover from bad flashing (answer id 3176). Here's how to do it:

  1. Unplug the power cord from the back of the router.
  2. Hold down the Reset button.
  3. While holding down the Reset button, plug back in the power cord to the router.
  4. Continue to hold the Reset button for five (5) seconds. After five (5) seconds, release the button.
  5. Wait for about one (1) minute. Then, on a computer connected to the router, launch a web browser (for example, Internet Explorer or Mozilla Firefox).
  6. Type in the router's IP address of into the Address field and press the [Enter] key.
  7. The Management Mode - Firmware Upgrade interface should appear.

Note This technique only officially applies to hardware version 5 of the router ( what version do I have?). However, some version of the DD-WRT seem to have this ability on other versions of the hardware, so you might find it works anyway.

Linksys Firmware

If you cannot find a Firmware Auto-Upgrade utility at the Linksys Download Page, use a Setup Wizard as an alternative from other Linksys router (make sure to use your router's firmware).

Another tftp program is called tftp2 and is available here (this will start the download): tftp2.exe

Recovering with TFTP

If pinging does not work, check the IP Address of your computer and make sure it is assigned an IP address in the subnet of the router IP. For simplicity sake you can assume "192.168.1.x" is good. If you do not have a good IP, the DHCP Server might not be working. So set your IP manually to something like with as your gateway and then try pinging the router again.

Power the router on with a continuous ping running in a command window. You should see at least some seconds, at least 2-3 pings, where it responds to ping of address. Do this several times to be sure. If it does you have good chance of simple recovery. Especially if previous firmware set the boot_wait variable to on, the router pauses even longer than normal during bootup to accept a recovery flash. All you need to do is provide a firmware to it via TFTP during this window of time.

Prepare your PC, firmware file and TFTP software and play with the timing of powering it on and starting the TFTP session just after applying power. If you try it a number of times (at least 10) you will probably rescue the router with no fuss!

Microsoft Windows contains a TFTP client. With TFTP, all of the information about the transfer is specified during the initial setup; there is little client/server interaction as compared with standard FTP. To flash a router using Microsoft Windows, open a command prompt, change to the directory containing the firmware to upload (this example assumes the firmware file name is code.bin), and then enter the following command (assuming your router IP

tftp -i PUT code.bin code.bin


a) The -i specifies binary transfer mode; the two file names after the PUT command specify the SOURCE and DESTINATION file names.

b) Start the command and then power up the router. There is no indication of any transfer until it is complete.

c) The uploading via this command is pretty slow ~5.7kB/s so it will take about 10 minutes to upload ~3MB image. I would add another 2-4 minutes for it to write the image.

d) As mentioned elsewhere, you should use the Linksys image. You cannot use the dd-wrt images as the router will reject it. You will get "Error on server : code pattern incorrect" message. e) Change your network adapter to 10 Mbps half duplex before attempting to flash the router

If That Doesn't Work

If the Linksys-approved method does not work for you, the [WRT54G Revival Guide] includes a second technique that involves snapping open the plastic case of the router and using a small metal tool (or paper-clip) to "short" two particular "pins" on the circuit board. It is quite clear that this carries risk of permanently damaging your flash via static discharge, and should be a measure of EXTREME last resort, not the first thing to try. You can very likely recover from a bad flash WITHOUT opening the router if you have some patience with the TFTP technique.

If you do have to use the EXTREME measure #4 from the revival guide as I did here is a additional tip uncovered from this forum. Voidman forum

I used the "earthing" technique to get the WRT54g v3.1 to respond to pings. Whenever I tried to tftp the dd-wrt firmware, it would cause the router to stop responding to pings ans just give a "timeout" error.

The solution was to first tftp an official LINKSYS firmware (WRT54G_4.30.5_US_code.bin which I renamed to "code.bin"). The router accepted it and rebooted properly. I was then able to upgrade to the latest dd-wrt v.23 SP2 through the WebGUI. This was discovered on GS v.4 which responded to unofficial firmware with "incorrect code pattern." Apparently this happens when tftp'ing to an empty flash chip.

There's also a collection of pointers and tips on how to recover from a bad flash at the external link location, but most of the information in that forum seems to have been collected into the WRT54G Revival Guide. So far this is just a starter wiki. If someone could move the important parts into this wiki, that'd be great. Probably organize it by recovery methods and list variations of each method below the method, or something.

Buffalo WHR-G54S

If you have already tried pinging the Buffalo continuously through hard and soft resets, unplugging, plugging and any combination thereof, then you will need to open up the device in order to revive it, similar in practice to the WRT54G Revival Guide Method #3.

  1. Unplug the router, and slide off the side trim panels. One will be covering a torx screw.
  2. Undo the screw and open up the router.
  3. With the router unplugged, plug a patch cable into one of the 4 LAN ports on your router and plug the other end into a computer.
  4. Configure your network card on your computer with a static IP address: IP:, NETMASK:, no gateway.
  5. Run a the ping command in a terminal or command prompt. In Linux: "ping". In Windows "ping -t" so that it doesn't stop trying to ping after 4 pings.
  6. Locate pin 12 on the flash memory chip. It is the 12th pin counterclockwise from the dimple in the surface of the chip. See the specs for this chip here.
  7. Short this pin to ground (bare solder around antennas, screw points).
  8. While holding the screwdriver there, plug in the power and watch your ping screen. You should see the pings starting to succeed.
  9. Remove the screwdriver and the pings should continue.
  10. Now use the tftp method to rewrite the firmware.

Buffalo WHR-HP-G54 JTAG

Lets say instantly you switch on your buffalo is all GREEN LEDs, the switch is all green, the green power light is on but no other colours and nothing is blinking. Nothing changes and nothing you do has any effect, you can't ping nore and you have tried shorting pin 12 as above. This is the time for JTAG and the Hairy Dairy Maid utility! If you have heard of this then I expect you have been dieing to use it. JTAG is a 12 pin header on the board for which you will need to connect control 4 wires to your computers printer port (parallel) and 2 gound wires. JTAG allows the 'manual' operation of the boards circuits even if the CPU is well and trully crashed. A bit like brain surgery with the top of someones head removed. I did this on Windows 2000, it (and XP) does not like you messing with the parallel port so you need a special driver to allow this; giveio.sys. Without this nothing happens. You can get the program and instructions from here: Hairy Dairy Maid Now read those instructions and then read what I specifically had to do to get it working on our one.

  1. solder the 25 way D on your JTAG cable follow the standard pinout.
  2. solder the PCB end onto the JTAG header directly to the solder pads, evens are ground; 2+4+6+8=20+25, odds are signals; 3=2,5=13,7=4,9=3.
  3. this is standard JTAG, nothing special, forget the resistors the PCB already has them.
  4. to install the giveio.sys copy this file and loaddrv.exe into {windows}\system32\drivers
  5. double click loaddrv.exe in the system32 dir. This is important.
  6. append the filename giveio.sys onto the path in the utility
  7. press the load button and the start button, they should both confirm success. If this does not happen go no further, go back and fix this.
  8. from the command prompt cd to your Hairy Dairy directory and run wrt54g.exe to get a list of option
  9. to check your cable, plugin and power up the buffalo and do wrt54g -backup:nvram /noemw /fc:29
  10. it will detect the CPU type and you should see your data as FFFFFF and CFD1AFC nonsense whizz past. If not then check your cable.
  11. finnaly to erase your NVRAM (the usual cause of the problem) wrt54g -erase:nvram /noemw /fc:29

External Links