Working on WNR3500L v2?

Actually I could build an image where the kernel starts. Unfortunalty the rootfs is not yet found correctly.

The building script;

#!/bin/sh

gcc TRXUtil.c -o TRXUtil
cat 0 > test.bin ;
cat vmlinux-nodictionary.lzma >> test.bin;
cat root.squashfs >> test.bin;
./TRXUtil test.bin;
mv test.bin.trx test.bin;
./TRXUtil test.bin

0 is in hex:
"48 44 52 30 00 D0 E8 00 53 15 C5 FF 00 00 01 00 1C 00 00 00 B4 30 14 00 00 00 00 00"

Uart output:

CFE for WNR3500Lv2 version: v1.0.9
Build Date: Fri May 6 11:54:17 CST 2011
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
NFLASH Boot partition size = 524288(0x80000)
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.136
CPU type 0x19749: 480MHz
Tot mem: 131072 KBytes

Device eth0:  hwaddr B0-7F-B9-9B-90-42, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Loader:raw Filesys:tftp Dev:eth0 File:192.168.1.2:vmlinuz Options:(null)
Loading: Failed.
Could not load 192.168.1.2:vmlinuz: Timeout occured
Checking crc...done.
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: ....... 3726340 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
[    0.000000] Linux version 4.4.71 (buildbot@builds-02.infra.lede-project.org) (gcc version 5.4.0 (LEDE GCC 5.4.0 r3104-41de9a2) ) #0 Wed Jun 7 19:24:41 2017
[    0.000000] CPU0 revision is: 00019749 (MIPS 74Kc)
[    0.000000] bcm47xx: Using bcma bus
[    0.000000] bcma: bus0: Found chip with id 0x5357, rev 0x02 and package 0x0A
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 07fff000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffefff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffefff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffefff]
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32511
[    0.000000] Kernel command line:  noinitrd console=ttyS0,115200
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 125912K/131068K available (2976K kernel code, 137K rwdata, 368K rodata, 156K init, 294K bss, 5156K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:128
[    0.000000] bcma: bus0: Core 0 found: ChipCommon (manuf 0x4BF, id 0x800, rev 0x26, class 0x0)
[    0.000000] bcma: bus0: Core 1 found: IEEE 802.11 (manuf 0x4BF, id 0x812, rev 0x1C, class 0x0)
[    0.000000] bcma: bus0: Core 2 found: GBit MAC (manuf 0x4BF, id 0x82D, rev 0x03, class 0x0)
[    0.000000] bcma: bus0: Core 3 found: MIPS 74K (manuf 0x4A7, id 0x82C, rev 0x04, class 0x0)
[    0.000000] bcma: bus0: Core 4 found: USB 2.0 Host (manuf 0x4BF, id 0x819, rev 0x05, class 0x0)
[    0.000000] bcma: bus0: Core 5 found: DDR1/DDR2 Memory Controller (manuf 0x4BF, id 0x82E, rev 0x02, class 0x0)
[    0.000000] bcma: bus0: Core 6 found: I2S (manuf 0x4BF, id 0x834, rev 0x02, class 0x0)
[    0.000000] bcma: bus0: Core 7 found: Internal Memory (manuf 0x4BF, id 0x80E, rev 0x0B, class 0x0)
[    0.000000] bcma: bus0: Unsupported ST serial flash (id: 0x0, id2: 0x0)
[    0.000000] bcma: bus0: Early bus registered
[    0.000000] MIPS: machine is Unknown Board
[    0.000000] bcm47xx: Setting up vectored interrupts
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7963585194 ns
[    0.000014] sched_clock: 32 bits at 240MHz, resolution 4ns, wraps every 8947848189ns
[    0.000084] Calibrating delay loop... 239.61 BogoMIPS (lpj=1198080)
[    0.070036] pid_max: default: 32768 minimum: 301
[    0.070277] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.070306] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.074348] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.074401] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.075612] NET: Registered protocol family 16
[    0.076684] Can't analyze schedule() prologue at 80007788
[    0.096882] clocksource: Switched to clocksource MIPS
[    0.099121] NET: Registered protocol family 2
[    0.100821] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.100880] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.100920] TCP: Hash tables configured (established 1024 bind 1024)
[    0.101099] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.101158] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.101625] NET: Registered protocol family 1
[    0.116791] can not parse nvram name sb/1/boardnum(null) with value 3500L got -22
[    0.132850] bcma: bus0: Bus registered
[    0.133982] Crashlog allocated RAM at address 0x3f00000
[    0.164476] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.164509] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.169619] io scheduler noop registered
[    0.169656] io scheduler deadline registered (default)
[    0.170061] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.175046] console [ttyS0] disabled
[    0.195317] serial8250.0: ttyS0 at MMIO 0xb8000300 (irq = 2, base_baud = 1250000) is a U6_16550A
[    0.625646] console [ttyS0] enabled
[    0.630746] bcm47xxnflash: Device not supported
[    0.635365] bcm47xxnflash: Initialization failed: -524
[    0.640721] bcma_nflash: probe of bcma_nflash.0 failed with error -524
[    0.652739] libphy: Fixed MDIO Bus: probed
[    0.657261] bgmac_bcma bcma0:2: Found PHY addr: 30 (NOREGS)
[    0.665449] libphy: bcma_mdio mii bus: probed
[    0.670019] bgmac_bcma bcma0:2: Support for Roboswitch not implemented
[    0.834837] b53_common: found switch: BCM53115, rev 8
[    0.841368] bgmac_bcma: Broadcom 47xx GBit MAC driver loaded
[    0.847797] bcm47xx-wdt bcm47xx-wdt.0: BCM47xx Watchdog Timer enabled (30 seconds)
[    0.857787] NET: Registered protocol family 10
[    0.869119] NET: Registered protocol family 17
[    0.873784] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    0.886681] 8021q: 802.1Q VLAN Support v1.8
[    0.895426] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    0.903127] Please append a correct "root=" boot option; here are the available partitions:
[    0.911660] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    0.921429] Rebooting in 1 seconds..
[    1.923383] bcm47xx: Please stand by while rebooting the system...

This image needs to be flashed from dd-wrt.