Re: Memory mod on Dlink DIR-825

hi,vavasik, why my dir-825 flash  3700's u-boot, can't detect wifi.
i install ath9k drivers.

this drivers work fine on the d-link u-boot.

DDNAS Trac site: trac.rtnas.com    It is Marvell 88F6710 (Armada370+ 88E6171R). sale: $69.99
DDNAS info site: www.rtnas.com

27 (edited by vavasik 2010-10-21 05:39:34)

Re: Memory mod on Dlink DIR-825

linuxpro wrote:

hi,vavasik, why my dir-825 flash  3700's u-boot, can't detect wifi.
i install ath9k drivers.

this drivers work fine on the d-link u-boot.

As you can see in boot log present "BOARD IS NOT CALIBRATED"
and belov in boot log you will find two uknown pci-devices, this are wi-fi modules

You need restore caldata partition, this topic was described in forum on wndr3700, or you can programm full flash bin file
from links above with caldata patrition.

You already  find solution for RAM problem or stay on 64M?

Re: Memory mod on Dlink DIR-825

thanks vavasik.

i want flash back d-link u-boot.


no,i must buy other memory.

DDNAS Trac site: trac.rtnas.com    It is Marvell 88F6710 (Armada370+ 88E6171R). sale: $69.99
DDNAS info site: www.rtnas.com

Re: Memory mod on Dlink DIR-825

Hi vavasik

Now i have the output from the serial working on my dir-825
But not the input.
Do you know if the serial input is working with dlink u-boot?
Or i need to replace the bootloader?

DWL-2100AP Ramponis Homepage
http://xoomer.alice.it/ramponis/

Re: Memory mod on Dlink DIR-825

ramponis wrote:

Hi vavasik

Now i have the output from the serial working on my dir-825
But not the input.
Do you know if the serial input is working with dlink u-boot?
Or i need to replace the bootloader?

Hi, you need replace bootloader, because in dlink uboot console input was disabled

Re: Memory mod on Dlink DIR-825

ok, thank you vavasik

DWL-2100AP Ramponis Homepage
http://xoomer.alice.it/ramponis/

Re: Memory mod on Dlink DIR-825

Did anyone test a 16mb flash on this board like S25FL128P?
i don't know if this u-boot suppot 16mb read and write
i followed vavasik's instruction and it's works great for me
thank you vavasik

Re: Memory mod on Dlink DIR-825

Hi Vavasik,

I just finish reading your description on the DIR-825 Memory Mod. It is a very impressive job. Congratulations. I am sure you are a very clever man!

Since I am a “not so gifted” technician I was wondering that maybe a guy like you or even other talented forum member could give me some directions in order to solve my problem.

I enjoy dealing with hardware and make experiments with alternative firmware. That is why some months ago I accidently erased all the FLASH MEMORY content of my D-LINK DIR-825.

I was facing some stability problems with DD-WRT firmware that I had just installed into my router, so I concluded that erase the NVRAM could be a good idea to carry on my tests. As I just said, my intention was to use the “erase nvram” command, but I don’t know what happened to my sick head and I gave the “erase flash” command instead.

In other words, just to make it clear: I HAVE DELETED all the FLASH MEMORY CONTENT and now the equipment does not have a boot loader; recovery screen or anything else that would be used to revive it.

All the equipment does now is to light the power on led.

I imagine that I need an IMAGE OF A FLASH CONTENT of a DIR 825 revision B router (my model) and then try to record it again into my router using an external memory recorder.

Do you think such recovery is possible?

PLEASE! ANY IDEA WOULD BE DEEPLY APPRECIATED!

Thank you very much in advance and best regards from Brazil

Mario Duarte
mario@clifton.com.br

Re: Memory mod on Dlink DIR-825

mrduarte wrote:

Hi Vavasik,

.....
In other words, just to make it clear: I HAVE DELETED all the FLASH MEMORY CONTENT and now the equipment does not have a boot loader; recovery screen or anything else that would be used to revive it.

All the equipment does now is to light the power on led.

I imagine that I need an IMAGE OF A FLASH CONTENT of a DIR 825 revision B router (my model) and then try to record it again into my router using an external memory recorder.

Do you think such recovery is possible?

PLEASE! ANY IDEA WOULD BE DEEPLY APPRECIATED!

Thank you very much in advance and best regards from Brazil

Mario Duarte
mario@clifton.com.br

Hello, Yes it's possible to recover firmware.
Please read post https://forum.openwrt.org/viewtopic.php?pid=118886#p118886
Here was described procedure of programming flash chip via simple selfmade LPT cable.
Full flash image here: http://www.megaupload.com/?d=F631CEH8

Re: Memory mod on Dlink DIR-825

Hi Vavasik,

With apologies for the delay, thank you very much for your precious reply.

Just today I could manage to put all the stuff together in order to follow your instructions.

I made a cable just like yours to record the flash memory of my router, and apparently it is working fine.

I will make some attempts now and I let you know tomorrow about the results.

Once again, thank you very much!

Regards from Brazil,

Mário

36 (edited by mrduarte 2011-01-03 14:04:25)

Re: Memory mod on Dlink DIR-825

Guys,

I think it worth the reading:


Objective:
To recover a DIR-825 B1 Router whose flash memory content was totally erased.


Thanks to VAVASIK I could fix my router!


A few months ago I posted in this forum:



Hi Guys,

By accident I have just erased all the FLASH MEMORY content of my D-LINK DIR-825. My intention was to erase the nvram, but I don’t know what happened to my sick head and I give the “erase flash” command instead.

Now I am afraid I turned my router into an expensive paper weight.

I am begging your help guys.

Is it possible to load again the content I have deleted? If such thing is possible, someone could please give me some directions?

Thank you very much in advance and best regards from Brazil

And I also have posted similar message at DD-WRT Forum



Posted: Wed Aug 18, 2010 6:54 pm    Post subject: D-LINK DIR-825 - FLASH MEMORY ERASED BY ACCIDENT     
Hi Guys,

By accident I have just erased all the FLASH MEMORY content of my D-LINK DIR-825. My intention was to use the “erase nvram” command, but I don’t know what happened to my sick head and I give the “erase flash” command instead.

Now I am afraid I turned my router into an expensive paper weight.

I am begging your help guys.

Is it possible to load again the content I have deleted? If such thing is possible, someone could please give me some directions?

Thank you very much in advance and best regards from Brazil


PS: Guys, just to make it clear: I HAVE DELETED all the FLASH MEMORY CONTENT and now the equipment does not have a boot loader; recovery screen or anything else that would be used to revive it.

All the equipment does now is to light the power on led.

I imagine that I need an IMAGE OF A FLASH CONTENT of a DIR 825 revision B router (my model) and then try to record it again into my router using an external memory recorder.

PLEASE GUYS! ANY IDEA WOULD BE DEEPLY APPRECIATED!

?
When I accidentally erased all the flash memory content I was trying to fix an annoying problem that I also reported on DD-WRT forum:



Posted: Sun Jun 13, 2010 7:42 pm    Post subject: D-LINK DIR-825 - Very very slow GUI     
Hi Guys

I am trying to install DD-WRT on my brand new D-LINK DIR-825 V. B1 router but I am facing difficulties related to an INCREDIBLE VERY SLOW WEB INTERFACE.

The navigation is virtually impossible, since sometimes a simple page change from SETUP to WIRELESS (for example) takes 5 minutes or more. As I have no knowledge to do all the settings through prompt commands, I am bagging for some help.

This is not my first DD-WRT install. In fact I have flashed around a dozen units for my friends and for myself, and I always achieve success.

Let me describe what I did:

• I have flashed the unit about ten times and always the installations seemed to finish well.

• I did a hard reset before and after some of attempts

• I have installed DD-WRT from D-LINK regular GUI as well from D-LINK emergency recovery field (after a 45s reset)

• I have erased the NVRAM content (using erase nvram command)

• I have tried do install using different laptops, with different Ethernet cables, with different web browsers.

• I have tried everything I could find in several posts.

The result is always the same: A very slow responsive GUI.

As you guys can see, I really have tried to do my homework, but I could not succeed.

Any tip or word of wisdom will be deeply appreciated.

Since I had no answers to my pray I continued digging until the day I found here, at OpenWRT forum a nice guy from Ukraine. VAVASIK have shown me how to fix my router.

In the next paragraphs I describe the steps that I followed to fix my router. The essence is totally extracted from VAVASIK posts, but I have edited some points to reflect my particular case.

The full originals by VAVASIK can be found at:

http://forum.ixbt.com/topic.cgi?id=14:49819

Or

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=78553&highlight=

Or

https://forum.openwrt.org/viewtopic.php?id=26416



STEPS

1 - Open the Router’s case


2 - Find an IC SPI Flash SPANSION S25FL064A (Package SO3 016 wide), it is located on the backside of the router PCB.

There are some variations regarding the IC used by D-LINK. In my particular case, the IC is from a different player. It is a ST Microelectronics chip labeled 5P64V6P 7B469 VS, but the pin outs are exactly the same.


3 - To record to flash chip it is necessary to build a simple cable that is connected in one side, to PARALEL PORT of your computer, and on other side you have to SOLDERING THE WIRES DIRECTLY INTO IC PINS.

Don’t worry! It is a piece of cake to do that!

DB25 # PIN--------------------RESISTOR--------------------FLASH IC # PIN

        7 ----------------------------[150?] ----------------------------- 7
       10 ---------------------------[150?]------------------------------ 8
        8 ----------------------------[150?]----------------------------- 16
        9 ----------------------------[150?]----------------------------- 15
       18 ---------------------------------------------------------------- 10 GND     (or "GND" on JTAG pads)

|------------- {recommended cable length = 120 mm} ---------------|


It is also necessary to provide some external power supply (during the flashing process the router’s power adapter connector should be NOT INSERTED). So, in my case I decided to use a simple 3 x AAA 1.2 Volt Ni-MH battery holder that I assembled together with the cable itself.

Since the batteries are placed in a serial arrange, the final voltage of the set is 3.6 Volt.



FLASH IC # PIN----------------------------BATTERY ARRAY--------------------------FLASH IC # PIN

          10 ----------------[ - 1.2 Volt +]----[ - 1.2 Volt +]----[ - 1.2 Volt +]--------------- 2




4 – It is always nice be capable of follow the boot process through serial console. In order to achieve that it is recommended to install some connections pins into the empty board holes related to JP1 connector. You can use the pins from old computer parts.

DIR 825 SERIAL PINOUTS (connector JP1) is:

PIN 1    ->    3.3V     (Pin 1 is the one close to a small push button and a LED indicator)
PIN 2    ->     RX
PIN 3    ->     TX
PIN 4    ->     GND



5 - Use a TTL to RS-232 cable to connect to serial console. A good, easy and cheap option is to buy a USB to Phone cable like the model CA-42. Here in Brazil this cable can be found for about US$ 3.00.

Since you have the cable all you have to do is to cut off the Phone connector side and to identify the GROUND; TX and RX wires. It is quite easy and the web is plenty of guides that teach how to do that.

Use a terminal emulator software (I like PuTTY) configured as follow:

Speed (baud)        115200
Data Bits               8
Stop Bits               1
Parity                   None
Flow Control         XON / XOFF



6 – Now that the LPT ADAPTER is done and its wires are soldering to the chip, you have to connect the other side to LPT interface of your computer and also to connect the 3,6V external battery array. You must see the light of some LEDs on board.


7 – So, if everything is done properly, download the software SPIPGMW at the following address:

http://rayer.ic.cz/programm/programm.htm#SPIPGM

Run it in a DOS session. It is good use the key “i” in order to check if the chip is correctly identified.

SPIPGMW.EXE /i

Program should show:

SPI connected to LPT port at I / O base address: 378h, SCK pulse width: t 0us FlashROM JEDEC ID, type: 010216h Spansion S25FL064A (8MB)

In my particular case, the software shows the ST Microelectronics chip id.

If you see “unknown chip” there is a problem with LPT cable connection, check connections and try again.


8 - Download and save the appropriated image toDIR-825. In my particular case, I installed the original boot loader and the DD-WRT build 15962


9 - Before flashing the image it is necessary to allow recording in chip with the key “u”
SPIPGMW.EXE /u


10 – Prior to recording it is good to make a cleanup. Erase chip with the key “e”
SPIPGMW.EXE /e


11 – Now it is time to program chip with key “p”
SPIPGMW.EXE /p file_name


12 - Dump chip content to a file with key file “d”
SPIPGMW.EXE /d filename_1


13 - Check the success of recording operation by comparing recorded file and recently dumped file
fc / b filename_1 filename_2.

Files must have exactly the same content.


14 - Disconnect LPT cable and external power supply, try to boot. Look at the serial console terminal program and follow the boot process. Luckily everything will work fine.




Well, that’s all guys!

I hope this article can help anybody that is facing similar problems!

Some Photos

http://img189.imageshack.us/img189/134/recoveringadir825flashc.jpg

http://img251.imageshack.us/img251/134/recoveringadir825flashc.jpg

http://img833.imageshack.us/img833/134/recoveringadir825flashc.jpg

http://img708.imageshack.us/img708/134/recoveringadir825flashc.jpg

http://img267.imageshack.us/img267/134/recoveringadir825flashc.jpg

http://img267.imageshack.us/img267/8935/recoveringadir825flashco.jpg

http://img209.imageshack.us/img209/134/recoveringadir825flashc.jpg

http://img513.imageshack.us/img513/134/recoveringadir825flashc.jpg

http://img171.imageshack.us/img171/134/recoveringadir825flashc.jpg

http://img403.imageshack.us/img403/134/recoveringadir825flashc.jpg

http://img593.imageshack.us/img593/134/recoveringadir825flashc.jpg

http://img522.imageshack.us/img522/134/recoveringadir825flashc.jpg

Re: Memory mod on Dlink DIR-825

Hey vavasik,

first thank you very much for your great tutorial and this great mod.

I added one of your photos to the wiki and added this mod there too.

Can you please read if i posted everything right in the wiki? You will find it here:

http://wiki.openwrt.org/toh/d-link/dir-825#mb.ram.mod

Hope this is OK.

Re: Memory mod on Dlink DIR-825

Hi Bad Joker, recently I read your post in wiki, all correct. Thank you!

Re: Memory mod on Dlink DIR-825

Hi Vavasik, thanks for your great ram upgrade howto! Unfortunately all files you've posted are no longer avaliable.
It would be great if you could reupload them; although I fear they will quickly be deleted again.
Maybe you can post a link to the (original) WNDR3700 u-boot (or did you read it from the device's flash yourself?).
And what about the caldata partition? I suppose you would need the one from the DIR-825, not the WNDR3700, right (it's called art there, but I suppose it's the same thing)?

Another thing I noticed is the different flash mem layouts of the two devices - is that going to be a problem? I mean, if you use the 3700's u-boot on the DIR-825, which memory layout will be used? -- I guess what I'm saying is, how can the whole thing work when the bootloader from the WNDR3700 expects art/caldata at 0x7f0000 when in fact it is at 0x660000?

WNDR3700U:
0x000000000000-0x000000050000 : "u-boot"
0x000000050000-0x000000070000 : "u-boot-env"
0x000000070000-0x000000170000 : "kernel"
0x000000170000-0x0000007f0000 : "rootfs"
0x0000007f0000-0x000000800000 : "art"

DIR-825:
0x000000000000-0x000000040000 : "uboot"
0x000000040000-0x000000050000 : "config"
0x000000050000-0x000000150000 : "kernel"
0x000000150000-0x000000660000 : "rootfs"
0x000000660000-0x000000670000 : "caldata"
0x000000670000-0x000000800000 : "unknown"

Re: Memory mod on Dlink DIR-825

Hey guys,

i'm afraid, i grilled something on my WNDR3700 router ;-)
Desoldered old ram, soldered Samsung K4H511638B-TCB3 onto it (used ones) and after that i got this on serial console:

 U-Boot 1.1.4DNI1.6 (May 22 2009 - 16:37:44)

WNDR3700U (ar7100) U-boot 0.0.12
DRAM:  b8050000: 0xc0140180


U-Boot 1.1.4DNI1.6 (May 22 2009 - 16:37:44)

WNDR3700U (ar7100) U-boot 0.0.12
DRAM:  b8050000: 0xc0140180

All the time repeating... Resoldered back the old RAM chips and stil the same...
Anybody an idea where to start? All RAM chips grilled from desoldering? Or corupted flash? In this case i would have to follow the procedure with LPT-Cable. I don't know what the output means for the system... If it hangs due to bad ram or due to no instructions how to continue, for example checking the ram..

Re: Memory mod on Dlink DIR-825

wimsop wrote:

Hi Vavasik, thanks for your great ram upgrade howto! Unfortunately all files you've posted are no longer avaliable.
It would be great if you could reupload them; although I fear they will quickly be deleted again.
Maybe you can post a link to the (original) WNDR3700 u-boot (or did you read it from the device's flash yourself?).
And what about the caldata partition? I suppose you would need the one from the DIR-825, not the WNDR3700, right (it's called art there, but I suppose it's the same thing)?

Another thing I noticed is the different flash mem layouts of the two devices - is that going to be a problem? I mean, if you use the 3700's u-boot on the DIR-825, which memory layout will be used? -- I guess what I'm saying is, how can the whole thing work when the bootloader from the WNDR3700 expects art/caldata at 0x7f0000 when in fact it is at 0x660000?

WNDR3700U:
0x000000000000-0x000000050000 : "u-boot"
0x000000050000-0x000000070000 : "u-boot-env"
0x000000070000-0x000000170000 : "kernel"
0x000000170000-0x0000007f0000 : "rootfs"
0x0000007f0000-0x000000800000 : "art"

DIR-825:
0x000000000000-0x000000040000 : "uboot"
0x000000040000-0x000000050000 : "config"
0x000000050000-0x000000150000 : "kernel"
0x000000150000-0x000000660000 : "rootfs"
0x000000660000-0x000000670000 : "caldata"
0x000000670000-0x000000800000 : "unknown"

Hello! Here is a link for full flash image http://www.megaupload.com/?d=WCWBB9NU
About memory layout questions, image used original WNDR3700 flash memory layout,  U-boot and caldata partitions are original from WNDR3700

Re: Memory mod on Dlink DIR-825

mag81 wrote:

Hey guys,

i'm afraid, i grilled something on my WNDR3700 router ;-)
Desoldered old ram, soldered Samsung K4H511638B-TCB3 onto it (used ones) and after that i got this on serial console:

 U-Boot 1.1.4DNI1.6 (May 22 2009 - 16:37:44)

WNDR3700U (ar7100) U-boot 0.0.12
DRAM:  b8050000: 0xc0140180


U-Boot 1.1.4DNI1.6 (May 22 2009 - 16:37:44)

WNDR3700U (ar7100) U-boot 0.0.12
DRAM:  b8050000: 0xc0140180

All the time repeating... Resoldered back the old RAM chips and stil the same...
Anybody an idea where to start? All RAM chips grilled from desoldering? Or corupted flash? In this case i would have to follow the procedure with LPT-Cable. I don't know what the output means for the system... If it hangs due to bad ram or due to no instructions how to continue, for example checking the ram..

Hello. I Think you have a flash problem, you can check this through write and reading twice flash memory and compares files. If you use for chip programming simple LPT and resistors adapter its quite possible to have unstable programming process. You can try to make cables in adapter more shorter. Memory chips are very hard to destroy. Other its maybe a problems with soldering pads.

Re: Memory mod on Dlink DIR-825

Guys, megaupload and so on are all crap!
Can't you use dropbox or so?

vavasik: thanks for the information.. i hope it's corrupted flash, as i have checked all connections (took me several hours)..
But for the moment i need an uboot file and no clue where to find it..  also the one from here: http://wiki.openwrt.org/toh/netgear/wndr3700#u-boot.mods

Re: Memory mod on Dlink DIR-825

vavasik wrote:

Hello! Here is a link for full flash image http://www.megaupload.com/?d=WCWBB9NU

Thanks a lot, much appreciated!

About memory layout questions, image used original WNDR3700 flash memory layout,  U-boot and caldata partitions are original from WNDR3700

Are you sure? I've taken a look at the image and most of it seems to be from an original (v1) device with firmware V1.0.4.68. But what's bothering me are the bootargs your image's uboot uses:

rootfstype=jffs2
init=/sbin/init
mtdparts=ar7100-nor0:256k(uboot),128k(env),6144k(rootfs),64k(caldata),1024k(uImage)

I don't understand how that can work. The rootfs should be squashfs and the layout should be different as well.
According to boot logs I found from other WNDR3700s they use the following (which seems a lot more logical to me)

rootfstype=squashfs
init=/etc/preinit
mtdparts=ar7100-nor0:320k(uboot),128k(env),7296k(rootfs),64k(config),64k(config_bak),64k(pot),64k(traffic_meter),128k(language),64k(caldata),7471040@458816(mount_fs)

Re: Memory mod on Dlink DIR-825

wimsop wrote:
vavasik wrote:

Hello! Here is a link for full flash image http://www.megaupload.com/?d=WCWBB9NU

Thanks a lot, much appreciated!

About memory layout questions, image used original WNDR3700 flash memory layout,  U-boot and caldata partitions are original from WNDR3700

Are you sure? I've taken a look at the image and most of it seems to be from an original (v1) device with firmware V1.0.4.68. But what's bothering me are the bootargs your image's uboot uses:

rootfstype=jffs2
init=/sbin/init
mtdparts=ar7100-nor0:256k(uboot),128k(env),6144k(rootfs),64k(caldata),1024k(uImage)

I don't understand how that can work. The rootfs should be squashfs and the layout should be different as well.
According to boot logs I found from other WNDR3700s they use the following (which seems a lot more logical to me)

rootfstype=squashfs
init=/etc/preinit
mtdparts=ar7100-nor0:320k(uboot),128k(env),7296k(rootfs),64k(config),64k(config_bak),64k(pot),64k(traffic_meter),128k(language),64k(caldata),7471040@458816(mount_fs)

I post my DMESG log to your PM. May be it help you.

Re: Memory mod on Dlink DIR-825

Hi Guys,

as you all are hardware hacking the dir-825.... i bricked mine. Probably used a wrong powersupply or something...
Could one of you guys tell me the type of U41 on the back of the print? It's the smallest chip on the back.
Mine went so hot i can't tell the type anymore.....
And could someone please measure the exact output of the original powersupply?

You would make my day!!

Regards,

Peter

Re: Memory mod on Dlink DIR-825

ego2006 wrote:

Hi Guys,

as you all are hardware hacking the dir-825.... i bricked mine. Probably used a wrong powersupply or something...
Could one of you guys tell me the type of U41 on the back of the print? It's the smallest chip on the back.
Mine went so hot i can't tell the type anymore.....
And could someone please measure the exact output of the original powersupply?

You would make my day!!

Regards,

Peter

Hello, I look in my router on this chip, it marked as Z1020AI it seems to be an AOZ1021AI.

Regards Vavasik

Re: Memory mod on Dlink DIR-825

Hi Vavasik,

thanks! Now the only thing i have to do is lay a hand on one..... :-)

Regards, Peter

49 (edited by qdrddr 2012-03-11 07:23:16)

Re: Memory mod on Dlink DIR-825

Hi.
I erased all the FLASH MEMORY content of my D-LINK DIR-615.
I'm trying to program DIR-615 by mrduarte's guid https://forum.openwrt.org/viewtopic.php?pid=124228#p124228

Where should I place external power supply for D-LINK DIR-615 (not DIR-825).
Thanks.

50 (edited by Lennong 2012-05-04 17:46:54)

Re: Memory mod on Dlink DIR-825

vavasik wrote:
xiaoxiaoca wrote:

Will you pls give a detail tutorial with pics when you are free,
that be greatly appreciated by all the dir-825 users.

WELCOME

Sorry for my bad English ;-(

Objective: Increase the amount of RAM from 64 MB to 128 MB by soldering memory chips in a router.
Reason: I'm using a router as a small NAS server with P2P download/upload station. I have internet connection at my home via twisted pair with static addressing at 100 Mbps rate.
Router was flashed under OpenWRT, installed Transmission Daemon, Samba 3.
At speeds under 100Mbit and 64MB of RAM on the router speed of download/upload of Transmission varies from 512K to 4MB, and I can see that the router does not have enough memory and it starts to swap to an USB stick which mounted as swap partition.

Attention: If you want this mod you necessary open a router that has a loss of warranty!
If you want make this mod yourself you must have good soldering skills!
Whatever you do with the router, YOU DO AT YOUR OWN RISK!


This article - a compilation of my posts from the IXBT forum (http://forum.ixbt.com/topic.cgi?id=14:49819) with some modifications.

Main steps:
1. Flashing full flash from a router Netgear WNDR3700 to a DIR-825 Rev:B2. Because standard DIR-825 U-boot can’t load Linux kernel of the firmware and abort firmware loading process without any error messages when 128MB RAM installed.
2. Soldering ICs.

Flashing
Re-flash I performed by the method of direct programming SPI Flash via LPT port.

Steps:
1. Disassemble router

2. Install and solder in the empty holes JP1 connector pins for Serial console (you can use the pins from the old motherboard, etc.), in order to monitor the boot process after flashing full flash.
Pinout connector JP1 is: PIN1-> 3.3V; PIN2-> RX; PIN3-> TX; PIN4-> GND.

3. Use a serial cable on MAX232 to connect to serial console, or another cable which can be made from old cable for mobile phone, I used a USB cable from an old mobile phone Siemens M55 assembled on the PL-2303 chip.
4. Check the work of serial console. Connect cable to your PC and router and run terminal client, I used PuTTy http://www.chiark.greenend.org.uk/~sgtatham/putty/ 
COM port settings: 115200/8/1/0/none

After turning on the router with connected serial cable you should see a messages in terminal client during boot the router like this:

U-Boot 1.1.4 (Apr September 2009 - 12:01:01)

AP94 (ar7100) U-boot 0.0.12
HTTP-UID AP94: DRAM: b8050000: 0xc0140180
64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 214k for U-Boot at: 83fc8000
Reserving 192k for malloc () at: 83f98000
********

If you do not see these messages, then something is wrong with your cable, port, etc .... locate the errors and correct it.

5. Find a IC  SPI Flash Spansion S25FL064A (Package SO3 016 wide), it is located on the backside of the router PCB.
Datasheet for flash chip here: http://www.spansion.com/Support/Datasheets/S25FL064A_00_C4_e.pdf

6. You can use various ways to flashing SPI chip, I use self-made simple LPT adapter.
Make adapter for LPT port, the circuit here http://rayer.ic.cz/elektro/spipgm.htm , but these article for another type of chip (thanks for the links user lprot from IXBT forum).
In our case, pins connections are follows:
DB25 # PIN         IC S25FL064A # PIN
7 -----------[ 150R ]----------- 7
10--------- [150R ]----------- 8
8 -----------[ 150R ]---------- 16
9 -----------[ 150R ]---------- 15
18----------- ----------------- 10 GND or "GND" on JTAG pads.

I used a ribbon cable with stranded wire from the old 40 pin ATA cable, alternating signal wires with the ground for better noise immunity and DB25 connector from standard LPT cable.
It should be noted that the cable should be as short as possible, I got about 10-12 cm
Photos of the cable: http://images.4m.net.ua/images/86098268307367770773.jpg

7. Connection to the flash chip:
If there is no external power supply for +3,3 V then necessary carefully lift the IC’s pins listed above over PCB.
WARNING: Beware of lifting the pins of flash IC, they are very fragile and are more likely to snap off at the body.

In order not to break off IC’s pins, I made an external power supply for +3,3 V, using the integrated voltage regulator for +3,3 V from the old motherboard and power supply from the external HDD with +5V and +12V. «+3,3V» power supply should be connected to the pin “2” of IC S25FL064A. Perhaps you can use two large size batteries type «D» 1,5V instead of the power supply, but with the batteries I have not tried ...

9. Connect the LPT adapter to the chip and computer and connect +3,3V external power supply, or batteries you must see light of some LEDs on the board.
10. So, if everything is done properly download the program software from the link http://rayer.ic.cz/programm/programm.htm#SPIPGM

Run DOS session, I use a FAR manager under Win XP SP3 and try determine the chip with the key “i”
SPIPGMW.EXE /i

Program should show:
SPI connected to LPT port at I / O base address: 378h, SCK pulse width: t 0us FlashROM JEDEC ID, type: 010216h Spansion S25FL064A (8MB)

If you see “unknown chip” there is a problem with LPT cable connection, check connections and try again.

Dump content of the chip twice in to files and compare it between each other.
(for example: fc / b test_1 test_2) if no differences, then you can read/write the chip’s content without errors. If you see differences then shorten the LPT cable.

11. Download and save the full flash Netgear WNDR3700 from here: http://upload.com.ua/get/901949950/128M-dir-825-to-N ... gear-WNDR3700.zip
or http://rapidshare.com/files/423899949/128M-dir-825-Netgear-WNDR3700-caldata.rar
This is a firmware with bootloader from Netgear WNDR3700 with default password.
12. Before flashing the firmware allow record in chip with the key “u”
SPIPGMW.EXE /u
13. Erase chip with the key “e”
SPIPGMW.EXE /e
14. Program chip with key “p”
SPIPGMW.EXE /p file_name
15. Dump chip content to a file with key file “d”
SPIPGMW.EXE /d filename_1
16. Check the programming, by comparing recorded file and recently dumped file
fc / b filename_1 filename_2.
Files must be equal.
17. Disconnect LPT cable and external power supply, try to boot. Look at the serial console terminal program you will see a standard boot log of Netgear WNDR3700

(Below is the log with the already soldered 128MB memory)

U-Boot 1.1.4DNI1.6 (May 22 2009 - 16:37:44)

WNDR3700U (ar7100) U-boot 0.0.12
DRAM: b8050000: 0xc0140180
128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 315k for U-Boot at: 87fb0000
Reserving 192k for malloc () at: 87f80000
Reserving 44 Bytes for Board Info at: 87f7ffd4
Reserving 36 Bytes for Global Data at: 87f7ffb0
Reserving 128k for boot params () at: 87f5ffb0
Stack Pointer at: 87f5ff98
Now running in RAM - U-Boot at: 87fb0000
id read 0x100000ff
flash size 8MB, sector count = 128
Flash: 8 MB
*** Warning - bad CRC, using default environment

In: serial
Out: serial
Err: serial
Net: ag7100_enet_initialize ...
CHH: mac: 0 if: 2
CHH: mac: verify: 0 if: 00,000,002
: Cfg1 0xf cfg2 0x7014
eth0: c0: 3f: 0e: 7f: 26:1 f
eth0 up
CHH: mac: 1 if: 1
CHH: mac: verify: 1 if: 00,000,001
: Cfg1 0xf cfg2 0x7014
eth1: c0: 3f: 0e: 7f: 26:20
eth1 up
eth0, eth1
Trying eth0
: Unit 0 phy is up ... RGMii 1000Mbps full duplex
# 259: ag7100_set_mac_from_link
: Pll reg 0x18050010: 0x11110000
: Cfg_1: 0x1ff0000
: Cfg_2: 0x3ff
: Cfg_3: 0x8001ff
: Cfg_4: 0xffff
: Cfg_5: 0xfffef
: Done cfg2 0x7215 ifctl 0x40605060 miictrl 0x22

Client starts ... [Listening] for ADVERTISE ... TTT
Retry count exceeded; boot the image as usual

nmrp server is stopped or failed!
Hit any key to stop autoboot: 1 0
   Verifying Checksum ... OK
# # # SQUASHFS loading 'image / uImage' to 0x80800000
# # # SQUASHFS load complete: 886690 bytes loaded to 0x80800000
# # Booting image at 80800000 ...
   Image Name: MIPS OpenWrt Linux-2.6.32.16
   Created: 2010-08-25 22:27:19 UTC
   Image Type: MIPS Linux Kernel Image (lzma compressed)
   Data Size: 886626 Bytes = 865.8 kB
   Load Address: 80060000
   Entry Point: 80060000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
# # Transferring control to Linux (at address 80060000) ...
# # Giving linux memsize in bytes, 134217728

At this stage we have received from the WNDR3700 Netgear instead of DIR-825.

Then you can start resoldering memory chips if you have a good soldering skills:

In the DIR-825 rev.: B2 uses two DDR chips in TSOP 66 with 16Mx16 organization for a total of 64MB, MOSEL VITELIC V58C2256164SC15 Datasheet for them here: http://pdf1.alldatasheet.net/datasheet-pdf/view/2414/MOSEL/V58C2256164S.html

Original memory chip on the PCB DIR-825
http://images.4m.net.ua/images/40186886087248680668.jpg

I used for mod chips from the Samsung DDR SO-DIMM 512MB with 32Mx16 organization IC type K4H511638D-UCB3 photo: http://images.4m.net.ua/images/43227162731589091754.jpg

Possible to use chips from other manufacturers only organization must be 32Mx16, chips with another organization, such as 64Mx8 not suitable.

If both chips normally resolder the router must wake up as the Netgear WNDR3700 with 128MB of memory, You need only install OpenWRT in order to use all 128MB.
TIP: Firmware from Netgear cannot use 128MB, just only 64M.

Does anybody still have the full flash Netgear WNDR3700 that Vavasik posted? I'm about to do the mod and need the firmware..and the links are dead.

DIR-825.b2 @ 840MHz (16/128MB) : PC Engines Alix6e2 : WR703N (8/64MB) : MR11U (8/64MB) : WR512-3GN (128MB)