Netgear WNR2000v1 flash full dump

sadang · March 6, 2020, 5:06pm

Hi,

Yesterday I totally silenced my old router trying to install openwrt following Radengr method. Perhaps I did something wrong, but after reboot and pushing enter key the router became completely dead even if the power supply was still connected. It closed serial connection, telnet connection and all the LED lights went off.

Now, I'm asking for a full flash dump for this router (NETGEAR WNR2000v1) cause I want to write it directly to flash memory. Or perhaps another bootloader compatible with this router.

Thanks,
Danut

sadang · April 3, 2020, 5:56pm

I finally managed to fix this router following the same method of Radengr just now I create the entire flash memory image using a hexeditor and adding one by one all required partitions, part of them as suggested by Radengr and the other part copied from my own broken flash dump.

Now the router is full functional and I'll test it in the next days. Bellow are the steps that I followed to fix it:

I loaded the flash partitions using a hex editor as follows:
--- 0x000000000000-0x000000040000 - u-boot (206KB) from here - https://fuhry.com/b/wnr2000/u-boot.bin
--- 0x000000040000-0x000000050000 - u-boot-env (64KB) from here - https://fuhry.com/b/wnr2000/ubootenv-stockpartitions.img
--- 0x000000050000-0x000000230000 - rootfs (2MB) from here - http://downloads.openwrt.org/backfire/10.03.1/ar71xx/openwrt-ar71xx-ap81-rootfs-squashfs.bin
--- 0x000000230000-0x000000290000 - rootfs_data (384KB) - copied from the original flash memory dump
--- 0x000000290000-0x0000002a0000 - user-config (64KB) - left blank
--- 0x0000002a0000-0x0000003c0000 - uImage (873KB) from here - http://downloads.openwrt.org/backfire/10.03.1/ar71xx/openwrt-ar71xx-uImage-lzma.bin
--- 0x0000003c0000-0x0000003e0000 - language_table (128KB) - left blank
--- 0x0000003e0000-0x0000003f0000 - rootfs_checksum (64KB) - left blank
--- 0x0000003f0000-0x000000400000 - art (64KB) - copied from the original flash memory dump
I saved the file
I uploaded the file to the flash memory of the router using the CH341a USB interface modified for 3.3V
I monitored with putty on the serial interface and saved the session log

For those who are interested I can provide the flash image of 4MB. On the other hand I'm still waiting for a dump of the original flash or at least for the first two partitions, u-boot and u-boot-env.

mk24 · April 3, 2020, 8:30pm

I have a couple of those in a hacked condition. I swapped in an 8MB flash chip and 64MB RAM chip and run WRT160NL builds on them. I'm not sure exactly what I did for the bootloader. The WRT160NL has a much more conventional partitioning scheme. The original scheme of the WNR2000 wastes a lot of space in the 4MB chip, which combined with it being a 4MB chip makes it completely unsuitable for a modern build. And of course you want a modern build. You're not seriously going to run Backfire?

sadang · April 3, 2020, 8:50pm

Would be great if you can send me at least one dump even swapped to 8MB. I think I can edit it in a hexeditor and extract original partition content. The original version of u-boot in my router flash was U-Boot 1.1.4.16-g04e9b8bf (May 14 2008 - 17:04:28).

Regarding the WRT160NL and Backfire I'm afraid I'm too new to these things and don't know so much. However I'm open to learn if it's worth it.

mk24 · April 3, 2020, 9:25pm

When you have an 8 MB flash chip ready (such as ST25P64V6P) I can send you what I'm using for bootloader and help with further instructions.

sadang · April 4, 2020, 6:10am

Unfortunately I'll not change the actual flash of 4MB with one of 8MB, cause I use this router board only for educational purposes, to learn a bit about router's firmware, if I still managed to destroy the original firmware without making a backup in advance.

Thanks for the suggestion, I will continue to look for solutions for 4MB, and if I find the original dump I will load it here with the MAC deleted from the ART partition.

sadang · April 5, 2020, 4:22pm

Hello all again,

After two days of work I managed to install and make tests for six OpenWrt versions as follow:

OpenWrt Backfire 10.03.1
OpenWrt Lede v.16
OpenWrt Lede v.17
OpenWrt v.18.06.8
OpenWrt v.19.07.0
OpenWrt v.19.07.2

These are partial not complete tests, but I'm happy that they all works on both ethernet and wireless interfaces. Bellow are documented each step I follow for each version in part:

1 - OpenWrt Backfire 10.03.1

-- for this version I already explained what I did

---#---#---#---

2 - OpenWrt Lede v.16

-- I downloaded the files sqfs_works.bin and uImage_works.bin from here - https://drive.google.com/drive/folders/0B8bRJIYStpVlZG13NEoyNGQ3a3M?usp=sharing
-- I renamed them as lede_16_rootfs.bin and lede_16_uImage.bin
-- I placed them in folder Test for Tftpd64 and opened a serial connection
-- I followed these steps:

Tell u-boot that we have a tftp server on 192.168.1.10

-- setenv serverip 192.168.1.10

Tell u-boot that the router should take the address 192.168.1.1

-- setenv ipaddr 192.168.1.1

Erase the region from 0x050000-0x3f0000

-- erase 0xbf050000 +0x3A0000

Load lede_16_rootfs.bin on TFTP server, and put it to memory address 0x81000000

-- tftpboot 0x81000000 lede_16_rootfs.bin

U-boot will tell you the length of sqfs.bin in hex, let's say ZZZZZZ

Copy bit by bit 0xZZZZZZ bytes from offset 0x050000

-- cp.b 0x81000000 0xbf050000 0xZZZZZZ

Same to the lede_16_uImage.bin, write it right next to lede_16_rootfs.bin

Again, 0xYYYYYY is the length that tftpboot reports

-- tftpboot 0x81000000 lede_16_uImage.bin
-- cp.b 0x81000000 0xbf2b0000 0xYYYYYY

We need to tell the kernel what board it is booting into, and where to find the partitions

-- setenv bootargs "board=WNR2000 console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,3712k(firmware),64k(art)ro rootfstype=squashfs,jffs2 noinitrd"

Tell u-boot where to find the uImage

-- setenv bootcmd "bootm 0xbf2b0000"

Tell u-boot to save parameters to the u-boot-env partitions

-- saveenv

Reset the board

-- reset

---#---#---#---

3 - OpenWrt Lede v.17

-- I downloaded the file https://archive.openwrt.org/releases/17.01.7/targets/ar71xx/generic/lede-17.01.7-ar71xx-generic-wnr2000-rootfs-squashfs.bin
-- I downloaded the file https://archive.openwrt.org/releases/17.01.7/targets/ar71xx/generic/lede-17.01.7-ar71xx-generic-uImage-lzma.bin
-- I renamed them as lede_17_rootfs.bin and lede_17_uImage.bin
-- I placed them in folder Test for Tftpd64 and opened a serial connection
-- I followed these steps:

Tell u-boot that we have a tftp server on 192.168.1.10

-- setenv serverip 192.168.1.10

Tell u-boot that the router should take the address 192.168.1.1

-- setenv ipaddr 192.168.1.1

Erase the region from 0x050000-0x3f0000

-- erase 0xbf050000 +0x3A0000

Load lede_17_rootfs.bin on TFTP server, and put it to memory address 0x81000000

-- tftpboot 0x81000000 lede_17_rootfs.bin

U-boot will tell you the length of lede_17_rootfs.bin in hex, let's say ZZZZZZ

Copy bit by bit 0xZZZZZZ bytes from offset 0x050000

-- cp.b 0x81000000 0xbf050000 0xZZZZZZ

Same to the lede_17_uImage.bin, write it right next to lede_17_rootfs.bin

Again, 0xYYYYYY is the length that tftpboot reports

-- tftpboot 0x81000000 lede_17_uImage.bin
-- cp.b 0x81000000 0xbf2b0000 0xYYYYYY

We need to tell the kernel what board it is booting into, and where to find the partitions

-- setenv bootargs "board=WNR2000 console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,3712k(firmware),64k(art)ro rootfstype=squashfs,jffs2 noinitrd"

Tell u-boot where to find the uImage

--- setenv bootcmd "bootm 0xbf2b0000"

Tell u-boot to save parameters to the u-boot-env partitions

-- saveenv

Reset the board

-- reset

---#---#---#---

4 - OpenWrt v.18.06.8

-- I downloaded the file https://downloads.openwrt.org/releases/18.06.8/targets/ar71xx/tiny/openwrt-18.06.8-ar71xx-tiny-wnr2000-rootfs-squashfs.bin
-- I downloaded the file https://downloads.openwrt.org/releases/18.06.8/targets/ar71xx/tiny/openwrt-18.06.8-ar71xx-tiny-uImage-lzma.bin
-- I renamed them as openwrt_18068_rootfs.bin and openwrt_18068_uImage.bin
-- I placed them in folder Test for Tftpd64 and opened a serial connection
-- I followed these steps:

Tell u-boot that we have a tftp server on 192.168.1.10

-- setenv serverip 192.168.1.10

Tell u-boot that the router should take the address 192.168.1.1

-- setenv ipaddr 192.168.1.1

Erase the region from 0x050000-0x3f0000

-- erase 0xbf050000 +0x3A0000

Load openwrt_18068_rootfs.bin on TFTP server, and put it to memory address 0x81000000

-- tftpboot 0x81000000 openwrt_18068_rootfs.bin

U-boot will tell you the length of openwrt_18068_rootfs.bin in hex, let's say ZZZZZZ

Copy bit by bit 0xZZZZZZ bytes from offset 0x050000

-- cp.b 0x81000000 0xbf050000 0xZZZZZZ

Same to the openwrt_18068_uImage.bin, write it right next to openwrt_18068_rootfs.bin

Again, 0xYYYYYY is the length that tftpboot reports

-- tftpboot 0x81000000 openwrt_18068_uImage.bin
-- cp.b 0x81000000 0xbf2a0000 0xYYYYYY

We need to tell the kernel what board it is booting into, and where to find the partitions

-- setenv bootargs "board=WNR2000 console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,3712k(firmware),64k(art)ro rootfstype=squashfs,jffs2 noinitrd"

Tell u-boot where to find the uImage

-- setenv bootcmd "bootm 0xbf2a0000"

Tell u-boot to save parameters to the u-boot-env partitions

-- saveenv

Reset the board

-- reset

---#---#---#---

5 - OpenWrt v.19.07.0

-- I downloaded the file https://downloads.openwrt.org/releases/19.07.0/targets/ar71xx/tiny/openwrt-19.07.0-ar71xx-tiny-wnr2000-rootfs-squashfs.bin
-- I downloaded the file https://downloads.openwrt.org/releases/19.07.0/targets/ar71xx/tiny/openwrt-19.07.0-ar71xx-tiny-uImage-lzma.bin
-- I renamed them as openwrt_19070_rootfs.bin and openwrt_19070_uImage.bin
-- I placed them in folder Test for Tftpd64 and opened a serial connection
-- the openwrt_19070_uImage.bin file is large and overwrites the art partition, which is why I put it from the address 0x000000290000 instead of 0x0000002a0000
-- I followed these steps:

Tell u-boot that we have a tftp server on 192.168.1.10

-- setenv serverip 192.168.1.10

Tell u-boot that the router should take the address 192.168.1.1

-- setenv ipaddr 192.168.1.1

Erase the region from 0x050000-0x3f0000

-- erase 0xbf050000 +0x3A0000

Load openwrt_19070_rootfs.bin on TFTP server, and put it to memory address 0x81000000

-- tftpboot 0x81000000 openwrt_19070_rootfs.bin

U-boot will tell you the length of openwrt_19070_rootfs.bin in hex, let's say ZZZZZZ

Copy bit by bit 0xZZZZZZ bytes from offset 0x050000

-- cp.b 0x81000000 0xbf050000 0xZZZZZZ

Same to the openwrt_19070_uImage.bin, write it right next to openwrt_19070_rootfs.bin

Again, 0xYYYYYY is the length that tftpboot reports

-- tftpboot 0x81000000 openwrt_19070_uImage.bin
-- cp.b 0x81000000 0xbf290000 0xYYYYYY

We need to tell the kernel what board it is booting into, and where to find the partitions

-- setenv bootargs "board=WNR2000 console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,3712k(firmware),64k(art)ro rootfstype=squashfs,jffs2 noinitrd"

Tell u-boot where to find the uImage

-- setenv bootcmd "bootm 0xbf290000"

Tell u-boot to save parameters to the u-boot-env partitions

-- saveenv

Reset the board

-- reset

---#---#---#---

6 - OpenWrt v.19.07.2

-- I downloaded the file https://downloads.openwrt.org/releases/19.07.2/targets/ar71xx/tiny/openwrt-19.07.2-ar71xx-tiny-wnr2000-rootfs-squashfs.bin
-- I downloaded the file https://downloads.openwrt.org/releases/19.07.2/targets/ar71xx/tiny/openwrt-19.07.2-ar71xx-tiny-uImage-lzma.bin
-- I renamed them as openwrt_19072_rootfs.bin and openwrt_19072_uImage.bin
-- I placed them in folder Test for Tftpd64 and opened a serial connection
-- the openwrt_19072_uImage.bin file is large and overwrites the art partition, which is why I put it from the address 0x000000290000 instead of 0x0000002a0000
-- I followed these steps:

Tell u-boot that we have a tftp server on 192.168.1.10

-- setenv serverip 192.168.1.10

Tell u-boot that the router should take the address 192.168.1.1

-- setenv ipaddr 192.168.1.1

Erase the region from 0x050000-0x3f0000

-- erase 0xbf050000 +0x3A0000

Load openwrt_19072_rootfs.bin on TFTP server, and put it to memory address 0x81000000

-- tftpboot 0x81000000 openwrt_19072_rootfs.bin

U-boot will tell you the length of openwrt_19072_rootfs.bin in hex, let's say ZZZZZZ

Copy bit by bit 0xZZZZZZ bytes from offset 0x050000

-- cp.b 0x81000000 0xbf050000 0xZZZZZZ

Same to the openwrt_19072_uImage.bin, write it right next to openwrt_19072_rootfs.bin

Again, 0xYYYYYY is the length that tftpboot reports

-- tftpboot 0x81000000 openwrt_19072_uImage.bin
-- cp.b 0x81000000 0xbf290000 0xYYYYYY

We need to tell the kernel what board it is booting into, and where to find the partitions

-- setenv bootargs "board=WNR2000 console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,3712k(firmware),64k(art)ro rootfstype=squashfs,jffs2 noinitrd"

Tell u-boot where to find the uImage

-- setenv bootcmd "bootm 0xbf290000"

Tell u-boot to save parameters to the u-boot-env partitions

-- saveenv

Reset the board

-- reset

---#---#---#---

For those who have a flash programmer here are the flash dump for all six versions:
-- wnr2000v1_6dumps.zip

All my work would not have been possible without the work already done by Fuhry, Radengr and the team of OpenWrt.

Thank you all.

tmomas · April 14, 2020, 9:10am

A post was split to a new topic: WNR2001 v1 settings lost

sadang · April 14, 2020, 10:27am

Hi dettlee,

As I said these are partial tests not complete. Right now I tested again and onyl Backfire and LEDEv16 keeps user settings. For the other I'll have to test them more deeply but I'm afraid the main problem is the lack of space in flash memory and the only solution is to compile a reduced version. I'll be back in about one week with a final answer.

Regards,
Danut

dettlee · April 17, 2020, 10:26am

thanks, tried to flash backfire 10.03.1, error with this message

Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

LEDEv16 works fine but have no wireless menu

sadang · April 17, 2020, 6:41pm

Hi dettlee,

This errors happen because you have the old bootargs variable. I'll put here a new method for Backfire 10.03.1.

On the other hand, I want to say that I've compiled till now at least 10 different versions of openwrt and for some I managed to get good results while for the others I did not succeed. I'll be back with detailed results in few days.

Here are the steps for Backfire 10.03.1:

-- I downloaded the file (2048KB) http://downloads.openwrt.org/backfire/10.03.1/ar71xx/openwrt-ar71xx-ap81-rootfs-squashfs.bin
-- I downloaded the file (873KB) http://downloads.openwrt.org/backfire/10.03.1/ar71xx/openwrt-ar71xx-uImage-lzma.bin
-- I renamed them as backfire_10031_rootfs.bin and backfire_10031_uImage.bin
-- I placed them in folder Test for Tftpd64 and opened a serial connection
-- I followed these steps:
Tell u-boot that we have a tftp server on 192.168.1.10
-- setenv serverip 192.168.1.10

Tell u-boot that the router should take the address 192.168.1.1
-- setenv ipaddr 192.168.1.1

Erase the region from 0x050000-0x3f0000
-- erase 0xbf050000 +0x3A0000

Load backfire_10031_rootfs.bin from TFTP server, and put it to memory address 0x81000000
-- tftpboot 0x81000000 backfire_10031_rootfs.bin
U-boot will tell you the length of backfire_10031_rootfs.bin in hex, let's say ZZZZZZ
Copy bit by bit 0xZZZZZZ bytes from offset 0x050000
-- cp.b 0x81000000 0xbf050000 0xZZZZZZ

Same to the backfire_10031_uImage.bin, write it right next to backfire_10031_rootfs.bin
Again, 0xYYYYYY is the length that tftpboot reports
-- tftpboot 0x81000000 backfire_10031_uImage.bin
-- cp.b 0x81000000 0xbf2a0000 0xYYYYYY

We need to tell the kernel what board it is booting into, and where to find the partitions
-- setenv bootargs "board=WNR2000 console=ttyS0,115200 mtdparts=ar7100-nor0:256k(u-boot),64k(u-boot-env),2304k(rootfs),64k(user-config),1152k(uImage),128k(language_table),64k(rootfs_checksum),64k(ART)"

Tell u-boot where to find the uImage
--- setenv bootcmd "bootm 0xbf2a0000"

Tell u-boot to save parameters to the u-boot-env partitions
-- saveenv

Reset the board
-- reset

dettlee · April 18, 2020, 10:25am

great,
i can see bigger section in 0xbf2a0000. setenv is different,
And there is no wireless interface in Network menu.

uci show wireless
root@OpenWrt:/# uci show wireless
root@OpenWrt:/#
show nothing
this same as LEDEv16 ( no wireless )

thank you

sadang · April 18, 2020, 11:18am

Nope, the wireless is there and is working fine. I even moved the kernel to 0xbf2f0000 to get more free space. Here is the proof.

dettlee · April 18, 2020, 12:34pm

Appreciate your help, i m sure that wireless menu/interface use to be there.

I found that it did not initiate as there is an error

Blockquote
[ 16.195164] PPP generic driver version 2.4.2
[ 16.209697] NET: Registered protocol family 24
[ 16.339437] ath: phy0: Bad EEPROM checksum 0x0
[ 16.343924] ath: phy0: Unable to initialize hardware; initialization status: -22
[ 16.351381] ath9k ath9k: failed to initialize device
[ 16.356430] ath9k: probe of ath9k failed with error -22

sadang · April 18, 2020, 1:09pm

The reality is I'm new to linux and to all these stuffs related to router firmware, compiling and so on. But look, here is my putty log and I can tell you the router is working on the wireless. I place some new screen capture to confirm it works fine. And at last these are the openwrt original files not my own compiled files.

U-Boot 1.1.4.15 (Jan 13 2011 - 13:00:15)

AP81 (ar7100) U-boot
sri
32 MB
Top of RAM usable for U-Boot at: 82000000
Reserving 244k for U-Boot at: 81fc0000
Reserving 192k for malloc() at: 81f90000
Reserving 44 Bytes for Board Info at: 81f8ffd4
Reserving 36 Bytes for Global Data at: 81f8ffb0
Reserving 128k for boot params() at: 81f6ffb0
Stack Pointer at: 81f6ff98
Now running in RAM - U-Boot at: 81fc0000
id read 0x100000ff
flash size 4MB, sector count = 64
Flash: 4MB
In:    serial
Out:   serial
Err:   serial
Net:   ag7100_enet_initialize...
Fetching MAC Address from 0x81fea700
: cfg1 0xf cfg2 0x7114
eth0: 00:1f:33:f4:7a:34
dup 1 speed 100
eth0 up
eth0
### main_loop entered: bootdelay=4

### main_loop: bootcmd="bootm 0xbf2f0000"
Hit any key to stop autoboot:  0

 Client starts...[Listening] for ADVERTISE...checksum bad

 nmrp server is stopped or failed !
## Booting image at bf2f0000 ...
   Image Name:   MIPS OpenWrt Linux-2.6.32.27
   Created:      2011-12-21   1:02:01 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    894152 Bytes = 873.2 kB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ...OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 33554432

Starting kernel ...

Linux version 2.6.32.27 (jow@nd-build-02.linux-appliance.net) (gcc version 4.3.3 (GCC) ) #5 Wed Dec 21 01:59:33 CET 2011
bootconsole [early0] enabled
CPU revision is: 00019374 (MIPS 24Kc)
Atheros AR9132 rev 1, CPU:400.000 MHz, AHB:200.000 MHz, DDR:400.000 MHz
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: rootfstype=squashfs,yaffs,jffs2 noinitrd console=ttyS0,115200 board=WNR2000 console=ttyS0,115200 mtdparts=ar7100-nor0:256k(u-boot),64k(u-boot-env),2304k(rootfs),64k(user-config),1152k(uImage),128k(language_table),64k(rootfs_checksum),64k(ART) mem=32M
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 29276k/32768k available (2126k kernel code, 3492k reserved, 423k data, 152k init, 0k highmem)
SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:56
Calibrating delay loop... 266.24 BogoMIPS (lpj=1331200)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
MIPS: machine is NETGEAR WNR2000
bio: create slab <bio-0> at 0
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.
yaffs Dec 10 2011 18:14:12 Installing.
msgmni has been set to 57
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
Atheros AR71xx SPI Controller driver version 0.2.4
m25p80 spi0.0: s25sl032a (4096 Kbytes)
Searching for RedBoot partition table in spi0.0 at offset 0x3e0000
Searching for RedBoot partition table in spi0.0 at offset 0x3f0000
No RedBoot partition table detected in spi0.0
spi0.0: no WRT160NL signature found
Creating 8 MTD partitions on "spi0.0":
0x000000000000-0x000000040000 : "u-boot"
0x000000040000-0x000000050000 : "u-boot-env"
0x000000050000-0x000000290000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=230000, len=60000
0x000000230000-0x000000290000 : "rootfs_data"
0x000000290000-0x0000002a0000 : "user-config"
0x0000002a0000-0x0000003c0000 : "uImage"
0x0000003c0000-0x0000003e0000 : "language_table"
0x0000003e0000-0x0000003f0000 : "rootfs_checksum"
0x0000003f0000-0x000000400000 : "art"
ag71xx_mdio: probed
eth0: Atheros AG71xx at 0xb9000000, irq 4
eth1: Atheros AG71xx at 0xba000000, irq 5
Atheros AR71xx hardware watchdog driver version 0.1.0
TCP westwood registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 152k freed
Please be patient, while OpenWrt loads ...
input: gpio-buttons as /devices/platform/gpio-buttons/input/input0
Button Hotplug driver version 0.3.1
eth0: link up (100Mbps/Full duplex)
- preinit -
Registered led device: wnr2000:green:power
Registered led device: wnr2000:amber:power
Registered led device: wnr2000:green:wps
Registered led device: wnr2000:blue:wlan
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
switching to jffs2
mini_fo: using base directory: /
mini_fo: using storage directory: /overlay
- init -
eth0: link down

Please press Enter to activate this console. ar71xx: pll_reg 0xb8050014: 0x13000a44
eth0: link up (100Mbps/Full duplex)
device eth0 entered promiscuous mode
br-lan: port 1(eth0) entering forwarding state
Compat-wireless backport release: compat-wireless-2011-11-08-1-g4ab9b62
Backport based on wireless-testing.git master-2011-11-15
cfg80211: Calling CRDA to update world regulatory domain
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: World regulatory domain updated:
cfg80211:     (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
cfg80211:     (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
ath: EEPROM regdomain: 0x0
ath: EEPROM indicates default country code should be used
ath: doing EEPROM country->regdmn map search
ath: country maps to regdmn code: 0x3a
ath: Country alpha2 being used: US
ath: Regpair used: 0x3a
ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
ieee80211 phy0: Atheros AR9100 MAC/BB Rev:7 AR2133 RF Rev:a1 mem=0xb80c0000, irq=2
cfg80211: Calling CRDA for country: US
cfg80211: Regulatory domain changed to country: US
cfg80211:     (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
cfg80211:     (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2700 mBm)
cfg80211:     (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 1700 mBm)
cfg80211:     (5250000 KHz - 5330000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (5490000 KHz - 5600000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (5650000 KHz - 5710000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:     (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 3000 mBm)
PPP generic driver version 2.4.2
ip_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 24
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
nf_conntrack version 0.5.0 (459 buckets, 1836 max)
CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
device wlan0 entered promiscuous mode
br-lan: port 2(wlan0) entering forwarding state
device wlan0 left promiscuous mode
br-lan: port 2(wlan0) entering disabled state
device wlan0 entered promiscuous mode
br-lan: port 2(wlan0) entering forwarding state
ar71xx-wdt: enabling watchdog timer



BusyBox v1.15.3 (2011-11-24 00:44:20 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 Backfire (10.03.1, r29592) ------------------------
  * 1/3 shot Kahlua    In a shot glass, layer Kahlua
  * 1/3 shot Bailey's  on the bottom, then Bailey's,
  * 1/3 shot Vodka     then Vodka.
 ---------------------------------------------------
root@OpenWrt-test:/# free
              total         used         free       shared      buffers
  Mem:        29428        16460        12968            0         1780
 Swap:            0            0            0
Total:        29428        16460        12968
root@OpenWrt-test:/#

mk24 · April 18, 2020, 1:40pm

"Bad EEPROM checksum" means that the wifi driver cannot run because the ART partition is corrupted. Restore the ART partition and wireless should work again.

dettlee · April 19, 2020, 7:38am

Restore the ART partition and wireless should work again.
Great when i have this router is already bricked, so i have no backup at all.

Found sadang post, thanks again for sharing the backup.
need to change the mac addr

sadang · April 19, 2020, 9:39pm

Here is the solution: - ART partition for Netgear WNR2000v1

tmomas · April 29, 2020, 9:39pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.