Netgear WNR2000v1 flash full dump

Hello all again,

After two days of work I managed to install and make tests for six OpenWrt versions as follow:

  • OpenWrt Backfire 10.03.1
  • OpenWrt Lede v.16
  • OpenWrt Lede v.17
  • OpenWrt v.18.06.8
  • OpenWrt v.19.07.0
  • OpenWrt v.19.07.2

These are partial not complete tests, but I'm happy that they all works on both ethernet and wireless interfaces. Bellow are documented each step I follow for each version in part:

1 - OpenWrt Backfire 10.03.1

-- for this version I already explained what I did

---#---#---#---

2 - OpenWrt Lede v.16

-- I downloaded the files sqfs_works.bin and uImage_works.bin from here - https://drive.google.com/drive/folders/0B8bRJIYStpVlZG13NEoyNGQ3a3M?usp=sharing
-- I renamed them as lede_16_rootfs.bin and lede_16_uImage.bin
-- I placed them in folder Test for Tftpd64 and opened a serial connection
-- I followed these steps:

Tell u-boot that we have a tftp server on 192.168.1.10

-- setenv serverip 192.168.1.10

Tell u-boot that the router should take the address 192.168.1.1

-- setenv ipaddr 192.168.1.1

Erase the region from 0x050000-0x3f0000

-- erase 0xbf050000 +0x3A0000

Load lede_16_rootfs.bin on TFTP server, and put it to memory address 0x81000000

-- tftpboot 0x81000000 lede_16_rootfs.bin

U-boot will tell you the length of sqfs.bin in hex, let's say ZZZZZZ

Copy bit by bit 0xZZZZZZ bytes from offset 0x050000

-- cp.b 0x81000000 0xbf050000 0xZZZZZZ

Same to the lede_16_uImage.bin, write it right next to lede_16_rootfs.bin

Again, 0xYYYYYY is the length that tftpboot reports

-- tftpboot 0x81000000 lede_16_uImage.bin
-- cp.b 0x81000000 0xbf2b0000 0xYYYYYY

We need to tell the kernel what board it is booting into, and where to find the partitions

-- setenv bootargs "board=WNR2000 console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,3712k(firmware),64k(art)ro rootfstype=squashfs,jffs2 noinitrd"

Tell u-boot where to find the uImage

-- setenv bootcmd "bootm 0xbf2b0000"

Tell u-boot to save parameters to the u-boot-env partitions

-- saveenv

Reset the board

-- reset

---#---#---#---

3 - OpenWrt Lede v.17

-- I downloaded the file https://archive.openwrt.org/releases/17.01.7/targets/ar71xx/generic/lede-17.01.7-ar71xx-generic-wnr2000-rootfs-squashfs.bin
-- I downloaded the file https://archive.openwrt.org/releases/17.01.7/targets/ar71xx/generic/lede-17.01.7-ar71xx-generic-uImage-lzma.bin
-- I renamed them as lede_17_rootfs.bin and lede_17_uImage.bin
-- I placed them in folder Test for Tftpd64 and opened a serial connection
-- I followed these steps:

Tell u-boot that we have a tftp server on 192.168.1.10

-- setenv serverip 192.168.1.10

Tell u-boot that the router should take the address 192.168.1.1

-- setenv ipaddr 192.168.1.1

Erase the region from 0x050000-0x3f0000

-- erase 0xbf050000 +0x3A0000

Load lede_17_rootfs.bin on TFTP server, and put it to memory address 0x81000000

-- tftpboot 0x81000000 lede_17_rootfs.bin

U-boot will tell you the length of lede_17_rootfs.bin in hex, let's say ZZZZZZ

Copy bit by bit 0xZZZZZZ bytes from offset 0x050000

-- cp.b 0x81000000 0xbf050000 0xZZZZZZ

Same to the lede_17_uImage.bin, write it right next to lede_17_rootfs.bin

Again, 0xYYYYYY is the length that tftpboot reports

-- tftpboot 0x81000000 lede_17_uImage.bin
-- cp.b 0x81000000 0xbf2b0000 0xYYYYYY

We need to tell the kernel what board it is booting into, and where to find the partitions

-- setenv bootargs "board=WNR2000 console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,3712k(firmware),64k(art)ro rootfstype=squashfs,jffs2 noinitrd"

Tell u-boot where to find the uImage

--- setenv bootcmd "bootm 0xbf2b0000"

Tell u-boot to save parameters to the u-boot-env partitions

-- saveenv

Reset the board

-- reset


---#---#---#---

4 - OpenWrt v.18.06.8

-- I downloaded the file https://downloads.openwrt.org/releases/18.06.8/targets/ar71xx/tiny/openwrt-18.06.8-ar71xx-tiny-wnr2000-rootfs-squashfs.bin
-- I downloaded the file https://downloads.openwrt.org/releases/18.06.8/targets/ar71xx/tiny/openwrt-18.06.8-ar71xx-tiny-uImage-lzma.bin
-- I renamed them as openwrt_18068_rootfs.bin and openwrt_18068_uImage.bin
-- I placed them in folder Test for Tftpd64 and opened a serial connection
-- I followed these steps:

Tell u-boot that we have a tftp server on 192.168.1.10

-- setenv serverip 192.168.1.10

Tell u-boot that the router should take the address 192.168.1.1

-- setenv ipaddr 192.168.1.1

Erase the region from 0x050000-0x3f0000

-- erase 0xbf050000 +0x3A0000

Load openwrt_18068_rootfs.bin on TFTP server, and put it to memory address 0x81000000

-- tftpboot 0x81000000 openwrt_18068_rootfs.bin

U-boot will tell you the length of openwrt_18068_rootfs.bin in hex, let's say ZZZZZZ

Copy bit by bit 0xZZZZZZ bytes from offset 0x050000

-- cp.b 0x81000000 0xbf050000 0xZZZZZZ

Same to the openwrt_18068_uImage.bin, write it right next to openwrt_18068_rootfs.bin

Again, 0xYYYYYY is the length that tftpboot reports

-- tftpboot 0x81000000 openwrt_18068_uImage.bin
-- cp.b 0x81000000 0xbf2a0000 0xYYYYYY

We need to tell the kernel what board it is booting into, and where to find the partitions

-- setenv bootargs "board=WNR2000 console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,3712k(firmware),64k(art)ro rootfstype=squashfs,jffs2 noinitrd"

Tell u-boot where to find the uImage

-- setenv bootcmd "bootm 0xbf2a0000"

Tell u-boot to save parameters to the u-boot-env partitions

-- saveenv

Reset the board

-- reset


---#---#---#---

5 - OpenWrt v.19.07.0

-- I downloaded the file https://downloads.openwrt.org/releases/19.07.0/targets/ar71xx/tiny/openwrt-19.07.0-ar71xx-tiny-wnr2000-rootfs-squashfs.bin
-- I downloaded the file https://downloads.openwrt.org/releases/19.07.0/targets/ar71xx/tiny/openwrt-19.07.0-ar71xx-tiny-uImage-lzma.bin
-- I renamed them as openwrt_19070_rootfs.bin and openwrt_19070_uImage.bin
-- I placed them in folder Test for Tftpd64 and opened a serial connection
-- the openwrt_19070_uImage.bin file is large and overwrites the art partition, which is why I put it from the address 0x000000290000 instead of 0x0000002a0000
-- I followed these steps:

Tell u-boot that we have a tftp server on 192.168.1.10

-- setenv serverip 192.168.1.10

Tell u-boot that the router should take the address 192.168.1.1

-- setenv ipaddr 192.168.1.1

Erase the region from 0x050000-0x3f0000

-- erase 0xbf050000 +0x3A0000

Load openwrt_19070_rootfs.bin on TFTP server, and put it to memory address 0x81000000

-- tftpboot 0x81000000 openwrt_19070_rootfs.bin

U-boot will tell you the length of openwrt_19070_rootfs.bin in hex, let's say ZZZZZZ

Copy bit by bit 0xZZZZZZ bytes from offset 0x050000

-- cp.b 0x81000000 0xbf050000 0xZZZZZZ

Same to the openwrt_19070_uImage.bin, write it right next to openwrt_19070_rootfs.bin

Again, 0xYYYYYY is the length that tftpboot reports

-- tftpboot 0x81000000 openwrt_19070_uImage.bin
-- cp.b 0x81000000 0xbf290000 0xYYYYYY

We need to tell the kernel what board it is booting into, and where to find the partitions

-- setenv bootargs "board=WNR2000 console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,3712k(firmware),64k(art)ro rootfstype=squashfs,jffs2 noinitrd"

Tell u-boot where to find the uImage

-- setenv bootcmd "bootm 0xbf290000"

Tell u-boot to save parameters to the u-boot-env partitions

-- saveenv

Reset the board

-- reset


---#---#---#---

6 - OpenWrt v.19.07.2

-- I downloaded the file https://downloads.openwrt.org/releases/19.07.2/targets/ar71xx/tiny/openwrt-19.07.2-ar71xx-tiny-wnr2000-rootfs-squashfs.bin
-- I downloaded the file https://downloads.openwrt.org/releases/19.07.2/targets/ar71xx/tiny/openwrt-19.07.2-ar71xx-tiny-uImage-lzma.bin
-- I renamed them as openwrt_19072_rootfs.bin and openwrt_19072_uImage.bin
-- I placed them in folder Test for Tftpd64 and opened a serial connection
-- the openwrt_19072_uImage.bin file is large and overwrites the art partition, which is why I put it from the address 0x000000290000 instead of 0x0000002a0000
-- I followed these steps:

Tell u-boot that we have a tftp server on 192.168.1.10

-- setenv serverip 192.168.1.10

Tell u-boot that the router should take the address 192.168.1.1

-- setenv ipaddr 192.168.1.1

Erase the region from 0x050000-0x3f0000

-- erase 0xbf050000 +0x3A0000

Load openwrt_19072_rootfs.bin on TFTP server, and put it to memory address 0x81000000

-- tftpboot 0x81000000 openwrt_19072_rootfs.bin

U-boot will tell you the length of openwrt_19072_rootfs.bin in hex, let's say ZZZZZZ

Copy bit by bit 0xZZZZZZ bytes from offset 0x050000

-- cp.b 0x81000000 0xbf050000 0xZZZZZZ

Same to the openwrt_19072_uImage.bin, write it right next to openwrt_19072_rootfs.bin

Again, 0xYYYYYY is the length that tftpboot reports

-- tftpboot 0x81000000 openwrt_19072_uImage.bin
-- cp.b 0x81000000 0xbf290000 0xYYYYYY

We need to tell the kernel what board it is booting into, and where to find the partitions

-- setenv bootargs "board=WNR2000 console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,3712k(firmware),64k(art)ro rootfstype=squashfs,jffs2 noinitrd"

Tell u-boot where to find the uImage

-- setenv bootcmd "bootm 0xbf290000"

Tell u-boot to save parameters to the u-boot-env partitions

-- saveenv

Reset the board

-- reset


---#---#---#---

For those who have a flash programmer here are the flash dump for all six versions:
-- wnr2000v1_6dumps.zip

All my work would not have been possible without the work already done by Fuhry, Radengr and the team of OpenWrt.

Thank you all.