Serial Recovery

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 20:36, 15 July 2012 (edit)
Buddee (Talk | contribs)
(Serial Interfaces - remove taiwan link for driver - no longer works and their tw site now requires a guest login to download anything, will revert links when it works again.)
← Previous diff
Current revision (22:52, 11 January 2024) (edit) (undo)
Kernel-panic69 (Talk | contribs)
((add note to inform users this wiki relates to Broadcom only to avoid confusion))
 
(37 intermediate revisions not shown.)
Line 1: Line 1:
 +{{Languages|Serial Recovery}}
 +'''NOTE: THIS WIKI ARTICLE APPLIES TO BROADCOM DEVICES. FOR INFORMATION RELATED TO OTHER DEVICES, CHECK THE DEVICE-SPECFIC WIKI, DD-WRT FORUM, OpenWRT WIKI, OR DO A WEB SEARCH.'''
 +__TOC__
==Introduction== ==Introduction==
 +Routers with a serial port AND working CFE (bootloader) can often be recovered with a serial adapter, using CFE low-level commands. Otherwise [[JTAG]] is required to debrick, if available, which can also replace a corrupted CFE. The last resort is to desolder the flash chip and use a programmer to flash CFE (if needed) and firmware.
-Routers that have a serial port can often be recovered by using a serial adapter. This is an alternative to Jtag.+Serial ports are normally four or five pins on the router board. Unless it has an OEM header, you have to either solder the wires to the pads, or remove solder from the holes to install an appropriate header. Some routers [http://www.dd-wrt.com/phpBB2/viewtopic.php?t=62998 have serial ports inside the WAN port], and here is a link to some [[Serial port pinouts]].
-You MUST have a working boot loader on the router to use serial commands. If your boot loader is corrupted, you MUST use jtag to recover. If your router does not have a jtag port, and your boot loader is toast, put the router on a shelf and wave to it occasionally.+====Redhawk0 summary====
 +Serial cable can be either USB or DB9 connection type and be capable of voltage level shift to +3.3V, '''not +5V'''. There are three or four connections for serial to function properly: Vcc (+3.3V, but usually not connected), GND, Tx and Rx. Some boards are NOT marked with pin designation, so use a multimeter to determine power and ground to avoid shorting the serial cable TTL chip. Then you can guess at the Rx and Tx lines. Rx and Tx are labeled relative to the cable, so Rx line needs connected to the router's Tx, because the router labels are also relative to it, so Tx and Rx get crossed for proper connection. On routers with two Serial ports (Tx0/Tx1 and Rx0/Rx1), use the "0" ports for your connections (I've not seen a router yet that connects to the "1" side).
-Serial ports are normally a four or five pins on the router motherboard. Usually, you have to solder to pads or remove solder from the holes and install a four or five pin header.+==Command Terminals==
 +You connect and talk to the router from a PC using terminal/console programs such as:
 +*PuTTY (All), HyperTerminal (WinXP and older), minicom (Linux), picocom (Linux), terminalbpp (Win)
-Here is a link to some serial pinouts:+Terminal settings:
-[[Serial port pinouts]]+ Baud: 115200
 + Data bits: 8
 + Stop Bits: 1
 + Parity: none
 + Flow control: None
-Some routers have serial ports inside the wan ports:+HyperTerminal in Windows XP: Start Button->All Programs->Accessories->Communication->HyperTerminal
-http://www.dd-wrt.com/phpBB2/viewtopic.php?t=62998+*To save the configuration, click File-->Save As, and select a save location
-Redhawk0 summarized this information this way:+Putty: check the ''Device Manager'' (Win) or `dmesg` output (Linux) for the COM port name
- +*Select Serial under Connection, use the port used for serial (e.g. ''COM3'' in Windows)
-''Serial cable is required to possibly debrick units without JTAG port. Serial cable can be either USB or DB9 connection type. It must be capable of doing voltage level shift to +3.3V not just +5V. There are 4 connections that are required for Serial to function properly. +3.3V, GND, Tx and Rx. Some boards are NOT marked with pin designation. You must ohm out your power and GND in this case so things don't get connected backwards and blow out your cable chip. Then you can guess at the last 2 Rx and Tx lines. The cable has Rx and Tx but these are relative to the cable...so Rx line needs to be connected to the routers Tx line....because the router's designator's are relative to the router. So Tx and Rx get crossed for proper connection. On routers that have 2 Serial ports (Tx0, Tx1 and Rx0, Rx1) you generally use the zero port for your connections (I've not seen a router yet that you connect up to the "one" side) Once you make the connection setup your computer Serial terminal display for 115200 8-N-1. Plug in your router and you should see text on the screen. You can monitor the tty output of the boot loader as it is booting...or break in, usually by typing Cntl-C, and enter low level commands to try to fix things. The most useful for our purpose is the "nvram show" and "nvram erase" commands. Once the nvram is erased...type "reboot" or power cycle it....now tftp your firmware....or just let it boot up if firmware was previously loaded properly.''+*To save the configuration: Click Session, enter a name for your connection under saved sessions, ''Save''
- +
-==Hyperterminal and Putty==+
- +
-You connect to the router with the programs hyperterminal or putty.+
- +
-The settings you want are:+
-Baud: 115200+
-Data bits: 8+
-Stop Bits: 1+
-Parity: none+
-No Flow control+
- +
-On Windows XP:+
- +
-Hyper terminal Setup+
-In Windows XP, Click Start Button-->All Programs-->Accessories-->Communication-->HyperTerminal+
-Enter a name for the connection, Click ok+
-Choose com port you adapter is plugged into, Click ok+
-Set:+
-Bits per second = 115200+
-Data Bits = 8+
-Parity = none+
-Stop bits = 1+
-Flow control = none+
-Click ok+
-Click File-->Save As, and select a place to save it to so you don't have to enter the settings again.+
- +
-Putty Setup+
-After installing putty, run it+
-Serial line = The COM port your using for serial (ie. COM3)+
-Speed = 115200+
-Click on Serial under Connection+
-Serial line to connect to = same as above (Serial line)+
-Speed (baud) = 115200+
-Data bits = 8+
-Stop bits = 1+
-Parity = None+
-Flow control = None+
-Click Session+
-Enter a name for your connection under saved sessions+
-Click Save+
-Click Open+
==Serial Interfaces== ==Serial Interfaces==
 +You NEED a level shifting 3.3v TTL serial adapter. This is a special serial adapter. YOU CANNOT USE A SERIAL ADAPTER THAT IS NOT LEVEL SHIFTING! The Nokia CA-42 cable is a level shifting serial adapter. Other proper serial adapter are available from ebay and amazon and other online sources. You can get Nokia CA-42 cables online for about 3.00 and cut the phone end off. Then you have to figure out what each wire does. You need only grd, tx and rx connected properly for the serial interface to work. Tx on the adapter goes to rx on the router and rx on the adapter goes to tx on the router.
-You need a level shifting 3.3v TTL adapter. You can get Nokia CA-42 cables online for about 3.00 and cut the phone end off. Then you have to figure out what each wire does. You need only grd, tx and rx connected properly for the serial interface to work.+See [https://forum.dd-wrt.com/phpBB2/files/ca_42_dku_5_pinout_352.jpg this picture]: You only need the wires connected to pins 8, 7, and 6.
- +*If no wire is connected to pin 8, the pin marked pin 2 in this picture should be ground instead.
-See this picture: You only need the wires connected to pins 8, 7, and 6 in this picture:+
-(If no wire is connected to pin 8, the pin marked pin 2 in this picture should be ground instead)+
- +
-http://www.dd-wrt.com/phpBB2/files/ca_42_dku_5_pinout_352.jpg+
Here is what redhawk0 did: Here is what redhawk0 did:
-I cut the connector end off and found 3 wires. Blue, Red, and Orange.+*I cut the connector end off and found 3 wires: Blue, Red, and Orange.
 +*Using an Ohm meter I determined that the Orange wire is Ground.
 +*Using the "guess" method, the Blue wire connects to the router Rx and Red connects to router Tx
 + Orange = GND
 + Blue = Rx
 + Red = Tx
 +*The cable was not recognized in XP and no drivers found during the PnP process.
 +*I downloaded a utility determining the attached hardware [http://www.users.on.net/~fzabkar/USB_IDs/UVCView.x86.exe UVCViewer]
 +*Then downloaded the [https://web.archive.org/web/20140112235523/http://prolificusa.com/drivers/PL2303/PL2303_Prolific_DriverInstaller_v130.zip Prolific driver]
 +*The [https://web.archive.org/web/20140112235626/http://prolificusa.com/drivers/PL2303/PL2303_Prolific_DriverInstaller_v1417.zip updated 1.4.17 driver] supposedly provides better support for Vista/Win7.
 +*Once loaded and connected, my laptop sees the unit attached to COM8 to configure Putty, and all is well.
 +
 +[LOM] No there is no fixed standard for the colours of the wires and obviously not on the number of wires either. My first CA-42 had 3 wires and the ones I bought later had 5, the picture in my post above is from one of those.You can carefully remove the plastic molding of the phone connector and see where each wire is going and find out which colour the respective signals are on. Nokia phone connector: [http://www.hardwarebook.info/Pop-Port Schematic]
-Using an Ohm meter I determined that my Orange Wire is Ground.+[strfr] The "level shifting 3.3v TTL adapter" is a must, you can't connect router straight to standard RS232 serial interface. Cheap CA-42 is ok, even the Chinese clone with ARK3116 chip, thus you will not find proper driver for Win7 64bit system. Windows XP mode is the solution in such a case.
-Then using the "guess" method, I found the Blue wire gets connected to the router's Rx line and the Red wire gets connected to the router's Tx line.+[Malachi] I have purchased a few of the Nokia clones that didn't work, for that reason I buy USB to uart adapters like [https://www.ebay.com/itm/NEW-CP2102-USB-2-0-to-UART-TTL-6PIN-Module-Serial-Converter-Free-Cables-/201497833130 these].
-When I plugged it into my XP rig...the cable was not recognized and no drivers found during the PnP process.+[pmarion] The following is the link for the only prolific driver listed for PL2303:<br>
-I downloaded a utility determining the attached hardware (UVCViewer):+https://prolificusa.com/wp-content/uploads/2019/06/PL23XX_Prolific_DriverInstaller_v408.zip<br>
-http://www.users.on.net/~fzabkar/USB_IDs/UVCView.x86.exe+Windows Driver Installer Setup Program ( Win7 / Win8.1 / Win10 / Win11)<br>
 +Installer version & Build date: 4.0.8 (2022-07-28)
-Then downloaded the Prolific Driver from here:+UPDATE: The Nokia cables are no longer cheaply or readily available as of 2023. Instead, use a standard CH340 module off Amazon. These generally cost around $4.00USD Here is a picture of one:<br>
-http://prolificusa.com/drivers/PL2303/PL2303_Prolific_DriverInstaller_v130.zip+[[Image:CH340s.jpg]]
 +<br>
 +Drivers are included with Windows 11 and it will automatically load and install them when plugged into a USB port. The TX and RX are jumpered for loopback testing purposes. The 3v and 5v output pins are not used. A picture of one of these in use to debrick a Netgear WNDR3400 is located here [https://wiki.dd-wrt.com/wiki/index.php/Serial_port_pinouts]
-And the updated 1.4.17 driver which supposedly provides better support for Vista/Win7 Machines:+==Break CFE Boot==
-http://prolificusa.com/drivers/PL2303/PL2303_Prolific_DriverInstaller_v1417.zip+'''There is less than a second at power-up'' to break CFE and stop the boot, thus allowing keyboard entry in a terminal. Do this by rapidly hitting Cntl-C (tpl for TP-Link routers) JUST as the router is starting up. The time window to do this is less than a second or two. It helps to get someone to help with this process, or have good dexterity.<br>
 +'''NOTE:''' Ensure the Scroll Lock key is ''off'' and ''Flow Control'' is ''off'' or ''none'', or the boot will not stop.
-So...+==CFE Commands==
 +To see the built-in CFE default parameters (restored after a `nvram erase` or reset):
 + devinfo show
 +`devinfo set {parameter}="{value}" can be used to change values.
-Orange = GND+To list the devices and descriptions:
-Blue = Rx+ show devices
-Red = Tx+
-Once loaded and connected...my laptop sees the unit attached to COM8....configured Putty....and all is well.+====Nvram Parameters====
- +These can be checked with `nvram show`. Also see [[Hardware#NVRAM]]<br>
-LOM stated:+`nvram set {parameter}="{value}" can be used to change values.
-''No there is no fixed standard for the colours of the wires and obviously not on the number of wires either. My first CA-42 had 3 wires and the ones I bought later had 5, the picture in my post above is from one of those.You can carefully remove the plastic molding of the phone connector and see where each wire is going and find out which colour the respective signals are on. Schematic of the Nokia phone connector here: http://www.hardwarebook.info/Pop-Port''+====Erase Nvram====
- +The most common CFE command is "nvram erase". Bad nvram values are often the cause of bricked routers.<br>
-strfr stated:+'''NOTE:''' the OS (Linux->DD-WRT) reset command [[Hard_reset_or_30/30/30#Erasing_NVRAM]] depends on the build/date.
-The "level shifting 3.3v TTL adapter" is must, you can't connect router straight to standard RS232 serial interface. Learned after hours of trying.. ;] Cheap CA-42 is all right, even the chinese clone with ARK3116 chip thus you will not find proper driver for Win7 64bit system. Windows XP mode is the solutions in such a case.+
- +
-==Serial Commands==+
- +
-Barryware does this:+
- +
-You have less than a second to stop the boot. If it goes too far, you will not be able to stop it.+
-===Erase Nvram===+
- +
-Power cycle the router and while it is booting hit control C quickly just as your router starts You should get a CFE> prompt+
- +
- +
-The most common command you will use is the "nvram erase" command. +
-This command will erase the nvram values that are often the cause of bricked routers+
At the cfe prompt: At the cfe prompt:
 + cfe> nvram erase [press enter]
-cfe> nvram erase [enter]+In some cases more specific commands may be required for recovery. Do a `show devices` first. E.g.:
 + flash -erase nflash1.nvram
 + flash -erase nflash1.brcmnand
-===To flash the firmware===+==To flash the firmware==
 +This assumes a ttl adapter is connected and ready. There is reference to stock firmware. This does not apply to routers that ran VxWorks on OEM firmware, as they should have jtag.
-This assumes you have a ttl adapter connected and ready to go. There is reference to stock firmware. This does not apply to router that used to run vxworks. All of those, have jtag tmk..+Connect the router to your serial adapter with com parameters: 115200, 8, 1, n, no flow control
-connect that bitch (the router to your serial adapter).. 115200,8,1,n and no flow control are the com, param's+Watching the terminal window, boot the router and immediately start hitting ctrl-c to get the cfe prompt:
 + cfe>
-I use hyperterminal. In the terminal, boot the router.+Execute the '''nvram erase''' command at the CFE prompt. It may also help to '''erase linux''' to debrick.
-Immediately start hitting ctrl-c. If you hit it right you will be at the cfe prompt:+Prepare the tftp utility to flash the STOCK firmware for your router so all you need to do is hit enter to launch.
-cfe>+Now to get the router to accept a tftp flash for the firmware. It times out quickly so get the utility ready to launch!
- +
-Execute the nvram erase command at the CFE prompt+
- +
-Get the tftp utility ready to flash the STOCK firmware for your router so all you need to do is hit enter to launch.+
- +
-You are going to tell the router to accept a tftp flash of firmware. It times out quickly so that is why you need to get the utility ready to launch.+
- +
-Static ip on your rig.. 192.168.1.10, mask 255.255.255.0, not necessary but gateway 192.168.1.1+
-If you have a linksyse router, at the cfe prompt:+Static IP: 192.168.1.10, mask 255.255.255.0, not necessary but gateway 192.168.1.1
-flash -ctheader : flash1.trx+If you have a Linksys router, at the cfe prompt:
 + flash -ctheader : flash1.trx
For other routers try: For other routers try:
 + flash -noheader : flash1.trx
-flash -noheader : flash1.trx+Another option to try is to manually force the TFTP daemon:
 + tftpd
-hit enter.. the router will want an upload of the firmware. It will time out after three tries. Don't let it time out, now launch the tftp utility. It will upload, program and then you will be back at the cfe prompt. This will take some time. You will see what is happening in the console.+Hit enter and the router will wait for firmware upload. It will time out after three tries, so now launch the tftp utility to upload, program, then return to the cfe prompt. This will take some time, and the console can be monitored for the status.
You will be back at the cfe prompt when it is done: You will be back at the cfe prompt when it is done:
 + cfe>
-cfe>+Issue a "go" command:
- + go [enter]
-issue a "go" command:+
- +
-go [enter]+
- +
-the router will launch its new firmware.+
- +
-Let it boot. It will boot 2 ~ 3 times.. You are done.+
- +
-Now install dd-wrt again.+
- +
-Good Luck..+
- +
-====Barryware's Detailed Instructions for Linksys====+The router will launch its new firmware. Let it boot: 2 ~ 3 times. Now reinstall DD-WRT.
 +====Barryware Instructions for Linksys====
Start banging ctrl-c at the same time you power up the router. If successful, you will be at the cfe prompt: Start banging ctrl-c at the same time you power up the router. If successful, you will be at the cfe prompt:
cfe> cfe>
have your tftp utility all que'd up to flash the STOCK LINKSYS firmware for your router. Make sure you have a static ip on your rig.. The router will not have the dhcp server running. have your tftp utility all que'd up to flash the STOCK LINKSYS firmware for your router. Make sure you have a static ip on your rig.. The router will not have the dhcp server running.
At the cfe prompt type: At the cfe prompt type:
-nvram erase [enter] ([enter] means hit the enter key Wink )+ nvram erase [enter] ([enter] means hit the enter key Wink )
a couple of seconds later, you will get a command status = 0.. that is good. You will be back at the cfe prompt. a couple of seconds later, you will get a command status = 0.. that is good. You will be back at the cfe prompt.
Now type: Now type:
-flash -ctheader : flash1.trx [enter]+ flash -ctheader : flash1.trx [enter]
(note the space before & after the colon) (note the space before & after the colon)
Now immediately launch the tftp utility on your computer. The router will listen 3 times, after that it will time out so you gotta be fast. Now immediately launch the tftp utility on your computer. The router will listen 3 times, after that it will time out so you gotta be fast.
You will see that it is programming.. this will take a bit of time. When it is done, you will again be back at the cfe prompt. You will see that it is programming.. this will take a bit of time. When it is done, you will again be back at the cfe prompt.
After the flash chip is programmed and you are back at the cfe prompt, either power cycle the router (I prefer) or type: After the flash chip is programmed and you are back at the cfe prompt, either power cycle the router (I prefer) or type:
-go [enter]+ go [enter]
the router will boot three times. then you are good to go with stock firmware. From there, install dd-wrt again following the normal procedures. the router will boot three times. then you are good to go with stock firmware. From there, install dd-wrt again following the normal procedures.
Have fun.. Good luck Have fun.. Good luck
One more time, for those who need repetitive instructions: One more time, for those who need repetitive instructions:
 +#Serial is to communicate with the router and issue the commands.
 +#All data to flash goes through the lan ports.
 +#Stop the boot via ctrl-c (You have to be faster than humanly possible to hit ctrl-c fast enough!)
 +#Tell it to accept a tftp upload of the firmware (through the lan port(s) (eth0)) by issuing the command:<br>''flash -ctheader : flash1.trx'' [then press enter key]
 +#'''Immediately''' launch the tftp utility on your computer and send the proper firmware to the router.
 +#*It times out very fast so issue the command and immediately launch the utility.
 +#Flash stock linksys firmware when debricking a router. (You can flash dd-wrt again, following the wiki instructions for your model of router.
-# serial is to communicate with the router and issue the commands.+When back at the cfe prompt:
-# All data to flash goes through the lan ports.+ nvram erase [enter]
-# Stop the boot via ctrl-c (You have to be faster than humanly possible to hit ctrl-c fast enough!)+ reboot [enter]
-# tell it to accept a tftp upload of the firmware (through the lan port(s) (eth0)) by issuing the comand: flash -ctheader : flash1.trx [enter] ([enter] = hit the enter key) +The router will boot 3 times. Don't be scared.
-# then immediately launch the tftp utility on your computer and send the proper firmware to the router. It times out fast so issue the command, launch the utility. +
-# Flash stock linksys firmware when debricking a router. (You can flash dd-wrt again, following the wiki instructions for your model of router.+
-when back at the cfe prompt:+====LOM on the E3000====
 +The easiest way of flashing an E3000 when you have serial terminal attached is:
 + nvram set safe_mode_upgrade=on
 + nvram commit
 + reboot
 +Then open 192.168.1.1 to the CFE recovery GUI page where you can upload the firmware.
-nvram erase [enter]+==Troubleshooting==
-reboot [enter]+''Some'' USB ttl converters also need Vcc connected, but most only need Tx, Rx, and ground.
-the router will boot 3 times. Don't be scared.+If you are unable to write data to the flash chip due to a bad boot block, try writing to another location. '''This should be done with caution as a last resort.'''
-==Links==+Find the "Boot partition size =" at the cfe boot (just under ''Initializing Devices'' in my case), to get the flash command address location offset: ''Boot partition size = '''262144'''(0x40000)''
-Serial Thread in the Broadcom Forum: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=56739+So for my Windows PC at 192.168.2.10, hosting the firmware via a tftp server:
 + flash -offset=262144 -noheader 192.168.2.10:dd-wrt.v24_micro_generic.bin flash0
 +The command above tells the cfe to flash the firmware at a particular address location on the flash chip, instead of the location that the cfe thinks is the correct one, which obviously is not if it reports a bad boot block.
 + 
 +If you receive no output, remove the Tx & Rx wires from the router and twist them together. Open a terminal session and type something to see if the characters are echo'd correctly in the terminal. If you see what you typed, the COMPUTER is set up properly, so check the router connection next. If still is no output, the problem is with the computer setup. Check your com parameters. Depending on the hardware & driver, you may have to set Device Manager parameters, as well as your terminal software.
 + 
 +Garbage characters on the screen usually is a bad connection, especially a bad ground. Also try swapping the Tx and Rx. Recheck your connections with a multimeter.
 + 
 +If you cannot get a cfe prompt it is usually due to not being fast enough. Get someone to assist in turning on the router while you hit control c over and over again as fast as superman or Barryware. If that doesn't work try reversing the tx and rx to make sure that you are actually transmitting the command.
 + 
 +==Links==
 +[http://www.dd-wrt.com/phpBB2/viewtopic.php?t=56739 Serial Thread] from the Broadcom forum.
-[[Category:Hardware]]+[[Category:Hardware]][[Category:Recovery]]

Current revision

NOTE: THIS WIKI ARTICLE APPLIES TO BROADCOM DEVICES. FOR INFORMATION RELATED TO OTHER DEVICES, CHECK THE DEVICE-SPECFIC WIKI, DD-WRT FORUM, OpenWRT WIKI, OR DO A WEB SEARCH.

Contents

[edit] Introduction

Routers with a serial port AND working CFE (bootloader) can often be recovered with a serial adapter, using CFE low-level commands. Otherwise JTAG is required to debrick, if available, which can also replace a corrupted CFE. The last resort is to desolder the flash chip and use a programmer to flash CFE (if needed) and firmware.

Serial ports are normally four or five pins on the router board. Unless it has an OEM header, you have to either solder the wires to the pads, or remove solder from the holes to install an appropriate header. Some routers have serial ports inside the WAN port, and here is a link to some Serial port pinouts.

[edit] Redhawk0 summary

Serial cable can be either USB or DB9 connection type and be capable of voltage level shift to +3.3V, not +5V. There are three or four connections for serial to function properly: Vcc (+3.3V, but usually not connected), GND, Tx and Rx. Some boards are NOT marked with pin designation, so use a multimeter to determine power and ground to avoid shorting the serial cable TTL chip. Then you can guess at the Rx and Tx lines. Rx and Tx are labeled relative to the cable, so Rx line needs connected to the router's Tx, because the router labels are also relative to it, so Tx and Rx get crossed for proper connection. On routers with two Serial ports (Tx0/Tx1 and Rx0/Rx1), use the "0" ports for your connections (I've not seen a router yet that connects to the "1" side).

[edit] Command Terminals

You connect and talk to the router from a PC using terminal/console programs such as:

  • PuTTY (All), HyperTerminal (WinXP and older), minicom (Linux), picocom (Linux), terminalbpp (Win)

Terminal settings:

Baud: 115200
Data bits: 8
Stop Bits: 1
Parity: none
Flow control: None

HyperTerminal in Windows XP: Start Button->All Programs->Accessories->Communication->HyperTerminal

  • To save the configuration, click File-->Save As, and select a save location

Putty: check the Device Manager (Win) or `dmesg` output (Linux) for the COM port name

  • Select Serial under Connection, use the port used for serial (e.g. COM3 in Windows)
  • To save the configuration: Click Session, enter a name for your connection under saved sessions, Save

[edit] Serial Interfaces

You NEED a level shifting 3.3v TTL serial adapter. This is a special serial adapter. YOU CANNOT USE A SERIAL ADAPTER THAT IS NOT LEVEL SHIFTING! The Nokia CA-42 cable is a level shifting serial adapter. Other proper serial adapter are available from ebay and amazon and other online sources. You can get Nokia CA-42 cables online for about 3.00 and cut the phone end off. Then you have to figure out what each wire does. You need only grd, tx and rx connected properly for the serial interface to work. Tx on the adapter goes to rx on the router and rx on the adapter goes to tx on the router.

See this picture: You only need the wires connected to pins 8, 7, and 6.

  • If no wire is connected to pin 8, the pin marked pin 2 in this picture should be ground instead.

Here is what redhawk0 did:

  • I cut the connector end off and found 3 wires: Blue, Red, and Orange.
  • Using an Ohm meter I determined that the Orange wire is Ground.
  • Using the "guess" method, the Blue wire connects to the router Rx and Red connects to router Tx
Orange = GND
Blue = Rx
Red = Tx
  • The cable was not recognized in XP and no drivers found during the PnP process.
  • I downloaded a utility determining the attached hardware UVCViewer
  • Then downloaded the Prolific driver
  • The updated 1.4.17 driver supposedly provides better support for Vista/Win7.
  • Once loaded and connected, my laptop sees the unit attached to COM8 to configure Putty, and all is well.

[LOM] No there is no fixed standard for the colours of the wires and obviously not on the number of wires either. My first CA-42 had 3 wires and the ones I bought later had 5, the picture in my post above is from one of those.You can carefully remove the plastic molding of the phone connector and see where each wire is going and find out which colour the respective signals are on. Nokia phone connector: Schematic

[strfr] The "level shifting 3.3v TTL adapter" is a must, you can't connect router straight to standard RS232 serial interface. Cheap CA-42 is ok, even the Chinese clone with ARK3116 chip, thus you will not find proper driver for Win7 64bit system. Windows XP mode is the solution in such a case.

[Malachi] I have purchased a few of the Nokia clones that didn't work, for that reason I buy USB to uart adapters like these.

[pmarion] The following is the link for the only prolific driver listed for PL2303:

https://prolificusa.com/wp-content/uploads/2019/06/PL23XX_Prolific_DriverInstaller_v408.zip
Windows Driver Installer Setup Program ( Win7 / Win8.1 / Win10 / Win11)
Installer version & Build date: 4.0.8 (2022-07-28)

UPDATE: The Nokia cables are no longer cheaply or readily available as of 2023. Instead, use a standard CH340 module off Amazon. These generally cost around $4.00USD Here is a picture of one:
Image:CH340s.jpg
Drivers are included with Windows 11 and it will automatically load and install them when plugged into a USB port. The TX and RX are jumpered for loopback testing purposes. The 3v and 5v output pins are not used. A picture of one of these in use to debrick a Netgear WNDR3400 is located here [1]

[edit] Break CFE Boot

'There is less than a second at power-up to break CFE and stop the boot, thus allowing keyboard entry in a terminal. Do this by rapidly hitting Cntl-C (tpl for TP-Link routers) JUST as the router is starting up. The time window to do this is less than a second or two. It helps to get someone to help with this process, or have good dexterity.
NOTE: Ensure the Scroll Lock key is off and Flow Control is off or none, or the boot will not stop.

[edit] CFE Commands

To see the built-in CFE default parameters (restored after a `nvram erase` or reset):

devinfo show

`devinfo set {parameter}="{value}" can be used to change values.

To list the devices and descriptions:

show devices

[edit] Nvram Parameters

These can be checked with `nvram show`. Also see Hardware#NVRAM
`nvram set {parameter}="{value}" can be used to change values.

[edit] Erase Nvram

The most common CFE command is "nvram erase". Bad nvram values are often the cause of bricked routers.
NOTE: the OS (Linux->DD-WRT) reset command Hard_reset_or_30/30/30#Erasing_NVRAM depends on the build/date.

At the cfe prompt:

cfe> nvram erase [press enter]

In some cases more specific commands may be required for recovery. Do a `show devices` first. E.g.:

flash -erase nflash1.nvram
flash -erase nflash1.brcmnand 

[edit] To flash the firmware

This assumes a ttl adapter is connected and ready. There is reference to stock firmware. This does not apply to routers that ran VxWorks on OEM firmware, as they should have jtag.

Connect the router to your serial adapter with com parameters: 115200, 8, 1, n, no flow control

Watching the terminal window, boot the router and immediately start hitting ctrl-c to get the cfe prompt:

cfe>

Execute the nvram erase command at the CFE prompt. It may also help to erase linux to debrick.

Prepare the tftp utility to flash the STOCK firmware for your router so all you need to do is hit enter to launch.

Now to get the router to accept a tftp flash for the firmware. It times out quickly so get the utility ready to launch!

Static IP: 192.168.1.10, mask 255.255.255.0, not necessary but gateway 192.168.1.1

If you have a Linksys router, at the cfe prompt:

flash -ctheader : flash1.trx

For other routers try:

flash -noheader : flash1.trx

Another option to try is to manually force the TFTP daemon:

tftpd

Hit enter and the router will wait for firmware upload. It will time out after three tries, so now launch the tftp utility to upload, program, then return to the cfe prompt. This will take some time, and the console can be monitored for the status.

You will be back at the cfe prompt when it is done:

cfe>

Issue a "go" command:

go [enter]

The router will launch its new firmware. Let it boot: 2 ~ 3 times. Now reinstall DD-WRT.

[edit] Barryware Instructions for Linksys

Start banging ctrl-c at the same time you power up the router. If successful, you will be at the cfe prompt: cfe> have your tftp utility all que'd up to flash the STOCK LINKSYS firmware for your router. Make sure you have a static ip on your rig.. The router will not have the dhcp server running. At the cfe prompt type:

nvram erase [enter] ([enter] means hit the enter key Wink )

a couple of seconds later, you will get a command status = 0.. that is good. You will be back at the cfe prompt. Now type:

flash -ctheader : flash1.trx [enter]

(note the space before & after the colon) Now immediately launch the tftp utility on your computer. The router will listen 3 times, after that it will time out so you gotta be fast. You will see that it is programming.. this will take a bit of time. When it is done, you will again be back at the cfe prompt. After the flash chip is programmed and you are back at the cfe prompt, either power cycle the router (I prefer) or type:

go [enter]

the router will boot three times. then you are good to go with stock firmware. From there, install dd-wrt again following the normal procedures. Have fun.. Good luck

One more time, for those who need repetitive instructions:

  1. Serial is to communicate with the router and issue the commands.
  2. All data to flash goes through the lan ports.
  3. Stop the boot via ctrl-c (You have to be faster than humanly possible to hit ctrl-c fast enough!)
  4. Tell it to accept a tftp upload of the firmware (through the lan port(s) (eth0)) by issuing the command:
    flash -ctheader : flash1.trx [then press enter key]
  5. Immediately launch the tftp utility on your computer and send the proper firmware to the router.
    • It times out very fast so issue the command and immediately launch the utility.
  6. Flash stock linksys firmware when debricking a router. (You can flash dd-wrt again, following the wiki instructions for your model of router.

When back at the cfe prompt:

nvram erase [enter]
reboot [enter]

The router will boot 3 times. Don't be scared.

[edit] LOM on the E3000

The easiest way of flashing an E3000 when you have serial terminal attached is:

nvram set safe_mode_upgrade=on
nvram commit
reboot

Then open 192.168.1.1 to the CFE recovery GUI page where you can upload the firmware.

[edit] Troubleshooting

Some USB ttl converters also need Vcc connected, but most only need Tx, Rx, and ground.

If you are unable to write data to the flash chip due to a bad boot block, try writing to another location. This should be done with caution as a last resort.

Find the "Boot partition size =" at the cfe boot (just under Initializing Devices in my case), to get the flash command address location offset: Boot partition size = 262144(0x40000)

So for my Windows PC at 192.168.2.10, hosting the firmware via a tftp server:

flash -offset=262144 -noheader 192.168.2.10:dd-wrt.v24_micro_generic.bin flash0 

The command above tells the cfe to flash the firmware at a particular address location on the flash chip, instead of the location that the cfe thinks is the correct one, which obviously is not if it reports a bad boot block.

If you receive no output, remove the Tx & Rx wires from the router and twist them together. Open a terminal session and type something to see if the characters are echo'd correctly in the terminal. If you see what you typed, the COMPUTER is set up properly, so check the router connection next. If still is no output, the problem is with the computer setup. Check your com parameters. Depending on the hardware & driver, you may have to set Device Manager parameters, as well as your terminal software.

Garbage characters on the screen usually is a bad connection, especially a bad ground. Also try swapping the Tx and Rx. Recheck your connections with a multimeter.

If you cannot get a cfe prompt it is usually due to not being fast enough. Get someone to assist in turning on the router while you hit control c over and over again as fast as superman or Barryware. If that doesn't work try reversing the tx and rx to make sure that you are actually transmitting the command.

[edit] Links

Serial Thread from the Broadcom forum.