Trying to rescue bricked dgn1000 v3:need help

Hardware Questions and Recommendations
1

hello everyone crossposting from reddit openwrt

trying to save a dgn1000v3

see more info here : https://www.reddit.com/r/openwrt/comments/bnrq4c/need_help_bricked_dgn1000v3_pics_logs_inside/

currently have serial access
the out put is

Currently on the serial console i get this output

ROM VER: 1.2.0                                                                  

CFG 04                                                                          

EEPROM Data OK                                                                  

UART

as per people over at reddit i need to find the boot_selN pins ?
would be nice if i could get some suggestion on what else i can try.
thanks.

2

@Reboot, welcome to the community!

This device is not listed in the Table of Hardware - it doesn't appear to be a supported device.

  • What does this mean?
  • Are you talking about this? -

Screenshot%20from%202019-05-13%2012-22-27

3

this->

http://openwrt.org/toh/netgear/dgn1000b

which i also shared on the reddit page ,says

Since this device is Lantiq-based, its [mask ROM can boot a payload over the serial port](

https://openwrt.org/docs/techref/hardware/soc/soc.lantiq#boot

) such as a U-Boot image.

i know its not a supported device ,im just trying to recover/reflash stock firmware

on the serial output i dont get uboot version number i guess uboot is gone/damaged ?

link to the serial log where i mess up the firmware upload ->https://pastebin.com/SQUsq1Zv

i no longer get this on the serial console : U-Boot 1.1.5-2.2 (Sep 25 2009 - 22:20:42)

on boot, the message displayed is:

ROM VER: 1.2.0                                                                  

CFG 04                                                                          

EEPROM Data OK
UART
4

ok so https://openwrt.org/docs/techref/hardware/soc/soc.lantiq has the jtag and spi pins listed for PSB 50601 processor which is the same as mine(dgn1000 v3) how do i flash stock firmware back ?

has anyone done this before ? would jtag be better or an spi flashing

do i have to extract the uboot or firmware from the stock .bin file
what would be the easiest way to do this.

5

Screenshot%20from%202019-05-13%2012-35-37

I'm sorry to inform you; but you've been following instructions that are over 7 years old. That thread also said that there were issues with the flash chip being supported.

Then you should inquire with Netgear. Since we cannot see the bootloader, there's no way to assist with the boot position, layout, etc. You need the information form a working device, or from the OEM.

Does this work for you?

This device isn't supported. Identical CPU doesn't imply support.

:confused:

You may have luck trying to track down the OP in the archived thread you posted on Reddit.

Edit: I also notice the page says that the serial is "unpopulated."

6
  • i'm the original poster in that reddit thread. edit see below
  • i understand its not supported by openwrt , i would consider my post here as a hardware mod/hack .
  • identical cpu means i can use the same pinout for jtag /spi flashing.
  • just trying to save something from the landfill/ learning stuff just in case.

i just reread what i typed above ,please understand i have no intention of being rude,thank you for trying to help me :slight_smile:
oh, and i'm hoping the serial console log before i bricked my device would help for finding offsets and other lowlevel stuff.
edit: oh you mean the archived openwrt forum post OP ,i guess i'll try .

1 Like
7

reply to you're edit: yes i repopulated the serial :slight_smile: headers are connected by me

1 Like
8
  • I'm referring to the OpenWrt archived thread...first post in 2012...last post in 2016
  • Totally understood
  • Yes, but if unpopulated, you have to solder from the CPU!

:+1:

Try changing flow controls?

9

i'll try that and reply back if successful. what i understand is the cpu will go into boot from uart when the flash is corrupt or missing but after boot i get eeprom ok message on the serial console so maybe it wont work without bootsel pin shorting or driving it high, but the jtag spi pinout page i linked above says the cpu (thats in my board) ignores bootsel pin status

10

changing flow control in the serial console is not working.
my theory is that uboot is borked and i should either jtag or spi flash this to get it to work

the firmware file is named: DGN1000v3-V1.0.0.22_0.0.22.img

running binwalk gives:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
192           0xC0            Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 3548940 bytes, 1283 inodes, blocksize: 131072 bytes, created: 2015-04-07 07:20:16
3551424       0x3630C0        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 5398000 bytes

on extracting, i get
1

i still need help on how to go about flashing

11

You will need several things, which you'll likely have to find somewhere outside the OpenWrt project:

  • Lantiq UART loader script
  • U-boot compiled to run from RAM
  • U-boot compiled to install in flash

When the SoC goes into UART mode (either by jumping the resistor, or having it fail to boot normally) use the script to upload the RAM bootloader. The RAM bootloader should then run and you can use commands on its console to upload and install the flash bootloader. Then boot to flash and use the flash bootloader to install the OS image.

1 Like
12

thanks , will try to find them online.
i'm guessing but the u-boot compiled to install in flash ,can i get it from the original firmware image.

i understand there may be other uboot versions and as per the openwrt wiki the original u-boot was buggy/had issues can i use updated an updated uboot (custom compiled for this cpu that i may find on the internet) with the original firmware.

i will update this thread ,with my progress .