Bricked Dynalink DL-WRX36?

deepakvinod · February 3, 2025, 1:24am

Followed the steps in the wiki for installation using the ssh route. I'm not a total newb, but have previously used well supported models with more polished install process.

Everything worked okay but at the end the router is not responding after restart.

I tried with the prebuilt NSS enabled snapshot from Agustin's repo

Installation shell output:

root@OpenWrt:~# ls -l /tmp/
-rw-r--r--    1 root     root             5 Jan  1 00:00 TZ
-rw-r--r--    1 root     root           641 Jan  1 00:00 board.json
-rw-r--r--    1 root     root            61 Jan  1 00:00 dhcp.leases
drwxr-xr-x    2 root     root            40 Jan  1 00:00 dnsmasq.cfg01411c.d
drwxr-xr-x    4 root     root           100 Jan  1 00:00 etc
-rw-r--r--    1 root     root      20840448 Jan  1 00:04 factory_image.ubi
drwxr-xr-x    2 root     root            80 Jan  1 00:00 hosts
drwxr-xr-x    3 root     root            60 Jan  1 00:00 lib
drwxrwxrwt    2 root     root           560 Jan  1 00:00 lock
drwxr-xr-x    3 root     root           100 Jan  1 00:00 log
-rw-r--r--    1 root     root            47 Jan  1 00:00 resolv.conf
drwxr-xr-x    2 root     root            60 Jan  1 00:00 resolv.conf.d
drwxr-xr-x   11 root     root           420 Jan  1 00:00 run
drwxrwxrwt    2 root     root            40 Jan  1 00:00 shm
drwxr-xr-x    2 root     root            80 Jan  1 00:00 state
drwxr-xr-x    2 root     root            80 Jan  1 00:00 sysinfo
drwxr-xr-x    2 root     root            40 Jan  1 00:00 tmp
root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00100000 00020000 "0:sbl1"
mtd1: 00100000 00020000 "0:mibib"
mtd2: 00080000 00020000 "0:bootconfig"
mtd3: 00080000 00020000 "0:bootconfig1"
mtd4: 00300000 00020000 "0:qsee"
mtd5: 00300000 00020000 "0:qsee_1"
mtd6: 00080000 00020000 "0:devcfg"
mtd7: 00080000 00020000 "0:devcfg_1"
mtd8: 00080000 00020000 "0:apdp"
mtd9: 00080000 00020000 "0:apdp_1"
mtd10: 00080000 00020000 "0:rpm"
mtd11: 00080000 00020000 "0:rpm_1"
mtd12: 00080000 00020000 "0:cdt"
mtd13: 00080000 00020000 "0:cdt_1"
mtd14: 00080000 00020000 "0:appsblenv"
mtd15: 00100000 00020000 "0:appsbl"
mtd16: 00100000 00020000 "0:appsbl_1"
mtd17: 00080000 00020000 "0:art"
mtd18: 06100000 00020000 "rootfs"
mtd19: 00900000 00020000 "0:wififw"
mtd20: 06100000 00020000 "rootfs_1"
mtd21: 00900000 00020000 "0:wififw_1"
mtd22: 01600000 00020000 "ubifs"
mtd23: 00080000 00020000 "0:ethphyfw"
mtd24: 00280000 00020000 "certificate"
root@OpenWrt:~# cat /proc/mtd | grep -i rootfs
mtd18: 06100000 00020000 "rootfs"
mtd20: 06100000 00020000 "rootfs_1"
root@OpenWrt:~# ubiformat /dev/mtd18 -y -f /tmp/factory_image.ubi
ubiformat: mtd18 (nand), size 101711872 bytes (97.0 MiB), 776 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 775 -- 100 % complete
ubiformat: 776 eraseblocks have valid erase counter, mean value is 4
ubiformat: flashing eraseblock 158 -- 100 % complete
ubiformat: formatting eraseblock 775 -- 100 % complete
root@OpenWrt:~# ubiformat /dev/mtd20 -y -f /tmp/factory_image.ubi
ubiformat: mtd20 (nand), size 101711872 bytes (97.0 MiB), 776 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 775 -- 100 % complete
ubiformat: 776 eraseblocks have valid erase counter, mean value is 0
ubiformat: flashing eraseblock 158 -- 100 % complete
ubiformat: formatting eraseblock 775 -- 100 % complete
root@OpenWrt:~# fw_setenv mtdids 'nand0=nand0'
root@OpenWrt:~# cat /sys/class/mtd/mtd18/offset
127926272
root@OpenWrt:~# fw_setenv mtdparts 'mtdparts=nand0:0x6100000@0x7a00000(fs),0x6100000@0
x1000000(fs_1)'
root@OpenWrt:~# fw_setenv bootcmd 'run openwrtusb; run openwrtboot'
root@OpenWrt:~# fw_setenv openwrtboot 'setenv bootargs console=ttyMSM0,115200n8 ubi.mt
d=rootfs rootfstype=squashfs rootwait; ubi part fs; ubi read 0x44000000 kernel; bootm
0x44000000#config@rt5010w-d350-rev0'
root@OpenWrt:~# fw_setenv bootcmd 'usb start && fatload usb 0:1 0x44000000 openwrt-qua
lcommax-ipq807x-dynalink_dl-wrx36-initramfs-uImage.itb && bootm 0x44000000; bootipq'
root@OpenWrt:~# reboot
root@OpenWrt:~# Connection to 192.168.1.1 closed by remote host.
Connection to 192.168.1.1 closed.

Current state:

Main LED is solid purple
The WAN yellow and green LEDs flash twice during boot
Any LAN port connected only has the yellow LED

Things I have tried:

Changing the LAN ports.
DHCP server is not up, so setting ip/route manually and trying to ping/telnet/ssh 192.168.1.1, no difference.
Trying to use the USB recovery process, nothing happens.
Tried to rename and use 24.10.0-rc7 initramfs on the USB, no dice.
Tried to use the failsafe but apart from the WAN port LEDs, nothing blinks. I tried with the WPS button, no dice.

hnyman · February 3, 2025, 4:59am

deepakvinod:

root@OpenWrt:~# fw_setenv bootcmd 'run openwrtusb; run openwrtboot'
root@OpenWrt:~# fw_setenv openwrtboot 'setenv bootargs console=ttyMSM0,115200n8 ubi.mt
d=rootfs rootfstype=squashfs rootwait; ubi part fs; ubi read 0x44000000 kernel; bootm
0x44000000#config@rt5010w-d350-rev0'
root@OpenWrt:~# fw_setenv bootcmd 'usb start && fatload usb 0:1 0x44000000 openwrt-qua
lcommax-ipq807x-dynalink_dl-wrx36-initramfs-uImage.itb && bootm 0x44000000; bootipq'
root@OpenWrt:~# reboot

You made error with the bootcommands...
You started setting the more complex usb fallback bootcmd with openwrtbusb and openwrtboot lines, then you set openwrtboot line ok, but never set openwrtusb...
Instead, you reset the bootcmd to the "try usb and then OEM firmware" (that you do not have any more)

You need to have correctly named image on usb stick, openwrt-qualcommax-ipq807x-dynalink_dl-wrx36-initramfs-uImage.itb

Ps. Really great that you saved the installation commands log. It helps to understand what happened.

deepakvinod · February 3, 2025, 4:20pm

Hey, thank you so much!

That makes sense and such an obvious mistake. I wanted to make sure that I used the same filename and ended mixing up the rest.

Unfortunately what has fucked me over is that there is newline in the filename in shell output because I inserted from the buffer instead of pasting. So it doesn't work with

openwrt-qualcommax-ipq807x-dynalink_dl-wrx36-initramfs-uImage.itb

but I rather need

openwrt-qua
lcommax-ipq807x-dynalink_dl-wrx36-initramfs-uImage.itb

I have been trying to rename the file to that in both fat16 and fat32 with no dice. I see that uboot supports ext2/f2fs/ufs maybe one of these will work.

I am wondering if linebreaks in this will have some horrible consequences as well:

fw_setenv openwrtboot 'setenv bootargs console=ttyMSM0,115200n8 ubi.mt
d=rootfs rootfstype=squashfs rootwait; ubi part fs; ubi read 0x44000000 kernel; bootm
0x44000000#config@rt5010w-d350-rev0'

Would this be something that is recoverable through serial in the worst case?

hnyman · February 3, 2025, 4:32pm

Yeah, it should be recoverable via serial, as it is only about u-boot variables.

You might try attaching that usb stick to another Linux router, and try renaming via mv, including an \n in the filename string.

Ps. note that DL-WRX36 has an unusually narrowly pitched serial connector.

Pps.

Likely not, as that variable is currently dormant. Nothing calls it. Just set it correctly again before setting bootcmd.

deepakvinod · February 3, 2025, 5:37pm

Thank you, I'll watch out for the connectors.

My laptop runs linux and I tried to with no dice. This is the output I get on FAT32/16

mv: cannot move 'openwrt-qualcommax-ipq807x-dynalink_dl-wrx36-initramfs-uImage.itb' to a subdirectory of itself, 'openwrt-qua'$'\n''lcommax-ipq807x-dynalink_dl-wrx36-initramfs-uImage.itb'

mv: cannot move 'openwrt-qualcommax-ipq807x-dynalink_dl-wrx36-initramfs-uImage.itb' to a subdirectory of itself, 'openwrt-qua\nlcommax-ipq807x-dynalink_dl-wrx36-initramfs-uImage.itb'

Thank you. That is a relief to hear.

Dantes · February 3, 2025, 5:49pm

Yeah, that newline is not supported under FATxx afaik. Assuming ext2/4 is not supported, you could edit the file allocation table. I've seen it done with a * once. So that filename is somewhere in the /dev/sdX . I'm not advocating it but just in case you are desperate.

first of all you need to rename the file with extra character on the \n place
openwrt-quaalcommax-ipq807x-dynalink_dl-wrx36-initramfs-uImage.itb

hexdump -C /dev/sdX | grep 'quaalcomm' and note the offset, if it comes up empty try other parts of the filename since hexdump shows 16 chars per line, so it could span over multiple lines.

once the offset is found you can use hexedit or some other tool to change the extra a in quaalcomm to a newline, which is 0xa

deepakvinod · February 4, 2025, 6:16pm

Hey,

I was desperate enough to try your method and sort of got it to work. It turns out that in hex there are gaps so you need to search like

hexdump -C /dev/sdXn | grep '.q.a.'

Unfortunately it still isn't booting.

My serial adapter arrived yesterday but as you had pointed out, they have 2.5mm female connectors rather than 2mm ones and I haven't been able to figure out what to do. Any ideas?

At this point the cost is mounting

An unrelated observation that I made; the lan ports are orange when connected to either of my laptops but they light up green (without yellow) when connected to my ISP router, but the device isn't showing up as connected on the shitty optimum router or in nmap on 192.168.1.0/32.

hnyman · February 4, 2025, 6:59pm

I bought separately a suitable 2mm pitch connector.
4-pin JST-PH with 2 mm pin spacing
(instead of the normal wider 2.54mm / 1/10 inch pitch connector)

https://www.google.com/search?q=4-pin+JST-PH+with+2+mm+pin+spacing

Dantes · February 6, 2025, 8:09am

That means its UTF-8, and I do not think that is supported under FATxx. Lets speculate:

there might be multiple strings and you need to find the correct one.
this could be slackspace, you might want to wipe it.
you are using ExFAT and not FATxx.

That was someone else, but I have 3:

replace the connectors
solder directly to board
use some aluminum foil

Yes my Indian friend, that's why when you have this is working you help a friend or two and split the difference

deepakvinod · February 6, 2025, 4:58pm

Hey everyone,

Got it fixed finally! Got 2.54mm female to 2.0mm female pitch connector and set the correct bootcmd in uboot with the USB recovery! Things have been solid so far.

TLDR; Messed up bootcmd + mystery issue? Fix over serial in uboot:

set openwrtboot 'setenv bootargs console=ttyMSM0,115200n8 ubi.mtd=rootfs rootfstype=squashfs rootwait; ubi part fs; ubi read 0x44000000 kernel; bootm 0x44000000#config@rt5010w-d350-rev0'
set openwrtusb 'usb start && fatload usb 0:1 0x44000000 openwrt-qualcommax-ipq807x-dynalink_dl-wrx36-initramfs-uImage.itb && bootm 0x44000000'
set bootcmd 'run openwrtusb; run openwrtboot'
savenv
exit

The postmortem of my mishap:

******* check firmware img *****
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=1", size 97 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 776, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 14/5, WL threshold: 4096, image sequence number: 435064730
ubi0: available PEBs: 0, total reserved PEBs: 776, PEBs reserved for bad PEB handling: 40
Read 2048 bytes from volume kernel to 44000000
NOT unsigned kernel FW header
NOT signed kernel FW header
******* FAILED *****
******* check firmware_1 img *****
ubi0: detaching mtd1
ubi0: mtd1 is detached
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=0", size 97 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 776, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 4/1, WL threshold: 4096, image sequence number: 505081240
ubi0: available PEBs: 0, total reserved PEBs: 776, PEBs reserved for bad PEB handling: 40
Read 2048 bytes from volume kernel to 44000000
NOT unsigned kernel FW header
NOT signed kernel FW header
******* FAILED *****

Net:   MAC0 addr:f4:52:46:8:df:bd
PHY ID1: 0x4d
PHY ID2: 0xd0b1
PHY ID1: 0x4d
PHY ID2: 0xd101
EDMA ver 1 hw init
Num rings - TxDesc:1 (0-0) TxCmpl:1 (7-7)
RxDesc:1 (15-15) RxFill:1 (7-7)
ipq807x_edma_alloc_rings: successfull
ipq807x_edma_setup_ring_resources: successfull
ipq807x_edma_configure_rings: successfull
ipq807x_edma_hw_init: successfull
eth0

Net:   MAC0 addr:f4:52:46:8:df:bd
PHY ID1: 0x4d
PHY ID2: 0xd101
EDMA ver 1 hw init
Num rings - TxDesc:1 (0-0) TxCmpl:1 (7-7)
RxDesc:1 (15-15) RxFill:1 (7-7)
ipq807x_edma_alloc_rings: successfull
ipq807x_edma_setup_ring_resources: successfull
ipq807x_edma_configure_rings: successfull
ipq807x_edma_hw_init: successfull
, eth0
Warning: eth0 MAC addresses don't match:
Address in SROM is         f4:52:46:08:df:bd
Address in environment is  f4:52:46:08:df:be

IPQ807x# printenv
baudrate=115200
bootargs=ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs uboot-version=0.0.2-1-80112-CS rootwait
bootcmd=usb start && fatload usb 0:1 0x44000000 openwrt-qualcommax-ipq807x-dynalink_dl-wrx36-initramfs-uImage.itb && bootm 0x44000000; bootipq
bootdelay=2
bootloader_version=0.0.2-1-80112-CS
eth1addr=f4:52:46:8:df:be
eth2addr=f4:52:46:8:df:be
eth3addr=f4:52:46:8:df:be
eth4addr=f4:52:46:8:df:be
ethact=eth0
ethaddr=f4:52:46:8:df:bd
fdt_high=0x4A400000
fdtcontroladdr=4a971540
flash_type=2
fsbootargs=ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs
machid=8850105
mtddevname=fs_1
mtddevnum=0
mtdids=nand0=nand0
mtdparts=mtdparts=nand0:0x6100000@0x7a00000(fs),0x6100000@0x1000000(fs_1),
oobd=2025-02-01T19:03:34Z
openwrtboot=setenv bootargs console=ttyMSM0,115200n8 ubi.mtd=rootfs rootfstype=squashfs rootwait; ubi part fs; ubi read 0x44000000 kernel; bootm 0x44000000#config@rt5010w-d350-rev0
partition=nand0,0
soc_version_major=2
soc_version_minor=0
stderr=serial@78B3000
stdin=serial@78B3000
stdout=serial@78B3000
uboot-version=uboot-version="0.0.2-1-80112-CS"

Environment size: 1148/262140 bytes

Interestingly it seems that the newline character wasn't bungled up in the bootcmd!

I wonder why USB recovery did not work at the end of the day, as I even tried with the initial drive and partitioning used for the install. After setting the new bootcmd using openwrt usb, USB recovery does work and so does tftp. Curious that neither did before.

I ended up buying this instead as it was only $2 more on amazon and figured might as well go for broke.

https://www.amazon.com/dp/B077X99KX1

From what I understand the dots are just hex encodings not associated with an ASCII character? My assumption was that the allocation table might store the file name in its format, not necessarily as a contiguous string.
I was definitely not using exFAT I tried FAT32, FAT16, ext2, ext4 and UFS after a full wipe/overwrite with zeros.
I did get the name to work on FAT16/32 and verified it on a different computer, even though it turned out to be unneeded.
For anyone else thinking of doing this, full wipe + a really small partition (I did 64mb) is the way to go. Otherwise you end up having to crawl through old trash logs and a bunch of other junk.

He he That would be the case if I were in India. Or I would have probably hacked together something simple with Adruino or ESP32 or just soldered it. Sadly I don't have my kit or lab where I am living right now.

Thank you @Dantes and @hnyman for all your help!

Dantes · February 6, 2025, 5:21pm

That's awesome

hnyman · February 6, 2025, 6:46pm

Great that you got it fixed.

As I said initially, it was also good that you saved the console log of the original actions, so that the mistake was rather easy to spot. Without that it would have been much guessing and uncertainty.

Actually, the u-boot in DL-WRX36 has proved to be really picky about the USB stick. So, even better advice may be to use a really old small (1 GB or so) simple USB stick without any partitioning, just the original FAT32 for the whole drive.

deepakvinod · February 6, 2025, 8:42pm

Thank you! Definitely! I am glad that I used tmux and set histsize to 10000 in my bashrc. Gives me peace of mind.

Made me also feel like I should have gone with my initial plan of having all the commands to be typed on a text file before starting. Dumb mistake.

That makes sense. I went with the smallest I had lying around which was 8G. I wish I had a smaller one around.

What is surprising is that once I fixed the bootcmd, the same uboot did boot from the USB.

system · February 16, 2025, 8:42pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.