Need assistance with recovering a ZBT-WG3526

I purchased a used ZBT-WG3526 recently and since it was already running OpenWRT Breaker Barrier, and was listed as being supported on the latest version of LEDE (17.01.4) I figured it was safe to just do a firmware upgrade through Luci to 17.01.4. Unfortunately it never came back after the firmware update attempt. Rebooting leaves it unresponsive. I found about the recovery mode(hold the reset button while powering on), and attempted to upload the firmware that way, but the download gets to 3% and then the web page goes unavailable.

I've tried the latest sysupgrade.bin for LEDE as well as an older OpenWRT, without success.
I also confirmed the Sha256 sum on the LEDE sysupgrade.bin file just to be sure.

Suggestions on next steps appreciated.


Do you have the 16MB flash or 32MB flash variant of the WG3526?

There are no markings on the outside that say whether it is 16MB or 32MB. On the board it says ZBT-WG3526-SATA_V01.
There is a memory chip beside the heatsink(for the CPU) that is a NANYA NT5CB256M16CP-D1, but I think that is the RAM (4Gbit or 512MB?)
I have a photo of the board if that will help.

Seeing that there are two versions of the WG3526 in the ToH, my first thought is: Maybe you have a 32MB device (=snapshot support) and you flashed the 16MB firmware image (=17.01.4 support).

To replace any guesswork by knowledge, it would be a good idea to what's really inside, especially the flash chip. The NANYA chip you mentioned is indeed RAM.

And while you are looking at it, search for a serial port (most likely 4pins or holes in a row) and get the bootlog.

What is "latest"? 17.01.4 or snapshot?

Here's a photo of the board: It looks like there is a serial port just above and to the right of the MAC address stickers.

Re "latest", I tried the 17.01.4 version of the 16M image.
I also just tried the snapshot of the 32M image. Same result.

Is this your router?

The pic of the board looks identical.

It certainly looks identical for a 16M flash and a 32M flash.

@jgdempsey What is the model number on the winbond chip?

More info...

Yes,except that it only has 4 antennas, not 6, but I think the missing two are the 3G antennas.

It's a 25Q128FVSG, which is a 128M bit, so it's 16M bytes..

Cool got it.

OK, now that we have figured out that it is in fact a ZBT-WG3526 16M, the next step would be to get the serial up and running and see what it spits out.

BTW: When updating from OpenWrt to LEDE 17.01.4: Did you check the "keep settings" checkbox or did you uncheck it?

Re the "keep settings" question.. I don't recall.. I may not have unchecked it.

I have most of the pieces to connect to the serial port, but I'll have to shop for a DB9 connector to connect to the usb - serial cable..

This is a good one to have on hand...

VCP drivers for the CP210x ...

Thanks for pointing this out.. I didn't realize that I would need a level converter (TTL to RS232). You saved me from frying something..

Would this do the job? (something I can by locally tomorrow)

Or Maybe this one is better: because it will work with Windows 10 (not that I need it now, but may later)

Looks like both would work...don't use the red wire (VCC - 5.5v).

OK.. I've got a USB > TTL cable, and got the header installed on the board. I've played around with the speeds, but I'm not getting anything back from the unit besides a few dots.. If I send a "reset port" from the terminal program, I get a dot back from the router (and RX flashes)..
I've also tried monitoring it while attempting a recovery but nothing is output to the terminal..