Hello everybody.
I recently firmware updated my Kimax U35WF router from lede-17.01.4-ramips-mt7620-u35wf-v1, looking for some new functionality to the device, but fell into the same hole as some reports about losing access to the device, even in wired mode. Searching the forums around, I managed to restore the user and password, but the login through the web interface makes me fall into "nothing", a blank screen. I did the necessary procedures to enter "failsafe" mode, but now another problem has arisen: the router does not have a WPS button. Using the "tcpdump" command, I can see when the router asks for a button to be pressed to enter the "failsafe" mode and then I get stuck. My question is whether there is a way to send a WPS button press signal via terminal for two seconds to establish the connection.
What about the reset button (located near the antenna)... usually pressing that repeatedly during the early phase of boot up should trigger failsafe mode (don't forget that you will need to be connected via ethernet and have your computer set to a static IP since DHCP does not run in failsafe mode; ssh is also required since LuCI will not be running, either).
If you have ssh access (again), just sysupgrade OpenWrt again (same version or newer, not keeping settings).
Yes, I did these steps and I can listen to the router, but pressing the reset button repeatedly, even in the initial boot phase, does not send any response in failsafe mode.
I can access login prompt on SSH command but no username/password is accepted.
Did you set your Ethernet interface on the computer to a static ip in the 192.168.1.0/24 subnet (any host address between 2-254) with a /24 subnet?
Did you try a persistent ping of 192.168.1.1 as you booted the device and pressed the reset button?
This is the behavior with persistent ping, without any change when reset is pressed:
From 192.168.1.2 icmp_seq=330 Destination host unreachable
From 192.168.1.2 icmp_seq=331 Destination host unreachable
------------------ Before quick flashing LED: ------------
64 bytes of 192.168.1.1: icmp_seq=332 ttl=64 time=1561 ms
64 bytes of 192.168.1.1: icmp_seq=333 ttl=64 time=513 ms
64 bytes of 192.168.1.1: icmp_seq=334 ttl=64 time=0.227 ms
64 bytes of 192.168.1.1: icmp_seq=335 ttl=64 time=0.221 ms
64 bytes of 192.168.1.1: icmp_seq=336 ttl=64 time=0.233 ms
64 bytes of 192.168.1.1: icmp_seq=337 ttl=64 time=0.222 ms
64 bytes of 192.168.1.1: icmp_seq=338 ttl=64 time=0.257 ms
64 bytes of 192.168.1.1: icmp_seq=339 ttl=64 time=0.234 ms
64 bytes of 192.168.1.1: icmp_seq=340 ttl=64 time=0.229 ms
64 bytes of 192.168.1.1: icmp_seq=341 ttl=64 time=0.231 ms
-------- After quick flashing LED and always on: ---------
From 192.168.1.2 icmp_seq=372 Destination host unreachable
From 192.168.1.2 icmp_seq=373 Destination host unreachable
From 192.168.1.2 icmp_seq=374 Destination host unreachable
Are you pressing the reset button after it has booted, or is this right after you apply power?
I'll give it a try if the options don't help me, but I have to open the router one more time because the PCB design doesn't look like this one.
I test it both ways, but this behavior happens just by turning on the router.
test this
login : root
password : (nothing)
I can't access webpage login that way. SSH and Telnet don't work either.
The serial is surely on the second card !!!
I was never interested in this area, but I'm ready to change my mind about it.
My questions are do I have anything else to look out for besides soldering TX->RX, RX->TX and setting the communication speed with the device. Another question is what would be the appropriate firmware to make this flashing.
Yes TX->RX & RX->TX
Speed is if i remember 57600 for U-boot
115200 after boot with OpenWrt
Thanks to all for your help. I tried to do the soldering but I think I just messed up the PCB. 
It is better to send the device for recycling. Even so, it was nice to have learned new things.