Debrick WNR3500L V1

Installing and Using OpenWrt
1

Hi,

I did update from 25.12.0 to 25.12.2 and the WNR3500L V1 did end up bricked.

I installed tftp on Ubuntu like the how to and the server is running:

portisch@Ubuntu:~$ ps -ef | grep tftp
root     2388472       1  0 16:29 ?        00:00:00 /usr/sbin/in.tftpd --listen --user tftp --address :69 --secure --verbose /srv/tftp
portisch 2388688 2383335  0 16:32 pts/0    00:00:00 grep --color=auto tftp

It works local:

portisch@Ubuntu:~$ tftp localhost -v
Connected to localhost (127.0.0.1), port 69
tftp> get uboot.img
getting from localhost:uboot.img to uboot.img [netascii]
Received 7531076 bytes in 1.9 seconds [31149754 bit/s]

The uboot.img is openwrt-25.12.0-dd2e77efcef8-bcm47xx-mips74k-netgear_wnr3500l-v1-na-squashfs.chk.

ifconfig:

portisch@Ubuntu:~$ ifconfig
enp1s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.2  netmask 255.255.255.0  broadcast 192.168.1.255
        ether 58:47:ca:74:96:aa  txqueuelen 1000  (Ethernet)
        RX packets 949702  bytes 750882301 (750.8 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 903704  bytes 1323228177 (1.3 GB)
        TX errors 0  dropped 12 overruns 0  carrier 0  collisions

But I get only this on router UART when I run:

portisch@Ubuntu:~$ tftp 192.168.1.1
tftp> put uboot.img

CFE for WNR3500L version: v1.0.36
Build Date: Thu Aug  6 15:48:22 CST 2009 
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found a 8MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.28
CPU type 0x19740: 453MHz
Tot mem: 65536 KBytes

Device eth0:  hwaddr 0A-00-00-00-00-00, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Checksum mismatch: 
Image chksum: 0xFFFFFFFF
Calc  chksum: 0x02C0010E
Boot program checksum is invalid
Start TFTP server
Reading :: Done. 7531076 bytes read
Checksum mismatch: 
Image chksum: 0xAE96DA9F
Calc  chksum: 0xDC9F1366
Reading :: Done. 6870767 bytes read
Checksum mismatch: 
Image chksum: 0xA64F04FB
Calc  chksum: 0x5D5F0D7E
Reading ::

Second differnet checksum if from factory image downloaded.

I need to use these chk files or others?

2

Missed the file name detail in https://openwrt.org/toh/netgear/wnr3500l.

3

Assuming you have installed default images, these sizes don't fit what is displayed for 25.12.0 and .2.
To recover, you may try nmrpflash

4

Don’t see it.

What do I miss?

I did run 25.12.0 without any issue.

5

Have you try to TFTP the default 25.12.2 image? This image is smaller.
You can also nmrpflash/TFTP back to Netgear firmware and flash the 25.12.2 default image.
The file you are using sizes 7531076 while default is 7278650. You have extra packages than may oversize the image. Devices has only 8MB.

1 Like
6

Yes, maybe the CRC fails because the end is cut off. Will try with a default, smaller or older image and upgrade later again.

1 Like
7

Nice! Thx!

This helper did work! TFTP was now successfully and the router boot up again!

Ubuntu:

sudo ./nmrpflash -i enp1s0 -f openwrt-25.12.0-dd2e77efcef8-bcm47xx-mips74k-netgear_wnr3500l-v1-na-squashfs.chk
Advertising NMRP server on enp1s0 ... \ 
Received configuration request from 00:ff:ff:ff:ff:ff.
Sending configuration: 10.164.183.253/24.
Received upload request.
Uploading openwrt-25.12.0-dd2e77efcef8-bcm47xx-mips74k-netgear_wnr3500l-v1-na-squashfs.chk ...  OK (7475258 b)
Waiting for remote to respond.
Received keep-alive request (7).  
Remote finished. Closing connection.
Reboot your device now.

Router:

CFE for WNR3500L version: v1.0.36
Build Date: Thu Aug  6 15:48:22 CST 2009 
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found a 8MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.28
CPU type 0x19740: 453MHz
Tot mem: 65536 KBytes

Device eth0:  hwaddr 00-FF-FF-FF-FF-FF, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
CONF-REQ sent...Waiting for CONF-ACK...
Device eth0:  hwaddr 00-FF-FF-FF-FF-FF, ipaddr 10.164.183.253, mask 255.255.255.0
        gateway not set, nameserver not set
TFTP-UL-REQ sent...Waiting for TFTP-WRQ...
Reading :: Done. 7475258 bytes read
Programming...done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 135226 bytes written
done. 7475258 bytes written
Write len/chksum offset @ 0x0074FFF8...done.
Device eth0:  hwaddr 00-FF-FF-FF-FF-FF, ipaddr 10.164.183.253, mask 255.255.255.0
        gateway not set, nameserver not set
CLOSE-REQ sent...Waiting for CLOSE-ACK...
CFE>
1 Like
8

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.