I am hoping you guys can let me know if my WRT54GS v4.0 is salvageable from brick land.

I purchased the router only 2 weeks ago and immediately installed OpenWRT  -  openwrt-wrt54gs_v4-squashfs.bin

Everything was going fine until I had troubles NATing to an internal FTP server.     Rather then deal with the head-aches of the /etc/firewall.user file, I decided to forgo openWRT and try hyperWRT instead.   I knew taking the easy way out would cause me problems!

At this point I ran the following to begin the update.   Please note that I did not run boot_wait=on in my NVRAM settings before doing this.

> wget http://www.example.org/hyperWRT.bin
> dd bs=32 skip=1 if=hyperWRT.bin of=hyperWRT.trx
> mtd -e linux -r write hyperWRT.trx linux

Upon rebooting, my power light was flashing repeatedly and would not respond to my pings.   My router was bricked.

After following these instructions to short ping 15-16 I was able to revive my router to at least respond to my ping.

http://www.linksysinfo.org/modules.php? … amp;pid=33

The instructions told me to power-cycle my Linksys to TFTP the HyperWRT.bin file to it.   This failed repeadely with a Invalid Password error.   So I tried the latest linksys.bin file.   

> TFTP -i 192.168.1.1 PUT WRT54GSV4_1.05.2_US_code.bin
> Error on server: Invalid Password!!

I also tried the Linksys-Setup-Wizard 2.0 which is similair to the earlier Auto Update Utilities from Linksys.    This also failed givig me the error message:   Invalid Password.

ftp://ftp.linksys.com/pub/network/WPS54 … rd-2.0.zip

I believe I am receiving the invalid password because my NVRAM is not giving me the time to flash it.  This is probably happening because I have never set my boot-wait to ON.   

Can someone tell me if I am screwed?

(Last edited by 5t3v3 on 3 Feb 2006, 03:49)

Power cycling undoes the pin short method. You should have just tftp'd after getting a ping response. The instructions were for using the boot_wait method.

- DL

Thanks for the response dl.    Yes, I tried the TFTP right after the pin shorting.    This game me the error:

> Error on server: Invalid Password!!

So I power cycled and again received the same error.

I’ve shorted pin 15-16 multiple times but was still unable to apply the firmare.

Is this because I have not set my boot-wait to on?    If my boot-wait in NVRAM is currently set to off,  am I bricked for life?

Btw, in case someone is reading this who has done the same thing I have,    there is discussion about shorting out pin 5-6 instead of 15-16 on WRT54GS v4.0 routers.    I tried this but found it didn’t result in anything.     Pin 15-16 always allowed me to receive at least a ping from the router.

Did you try it with the windows-upgrade-tool ("Upgrade Firmware Version 1.255"-tftp-tool) and password "admin".
I had similar problems and was able to flash firmware "WRT54GSV4_1.05.2_US_code.bin".
A Ping to 192.168.1.1 should work (after shorting pins 15 to 16) before you try to transfer the image.

What are pins 15 and 16?  Which WRTxxx devices does this apply to, or more precisely, which flash chips does this apply to?  I have the datasheets for most Intel flash devices and am curious.

Have a look at the following link which helped me solving my problem: http://voidmain.is-a-geek.net:81/redhat … vival.html

Thanks, but that doesn't answer my question.  Void Main's page doesn't say exactly what flash device is in his WRT54G v1.1, and the inksysinfo autopsy page doesn't say either.  He says the same technique works for WRT54G v1.0 and 2.0, but the linksysinfo page says those models have different flash devices.  Unless the pinouts are the same for all 3 flash chips I find it hard to believe.  They might be the same, I'm not saying it's impossible, but I'd want to know for sure before trying it.  Knowing the flash device part number would let me cross-reference the pins.

I guess I should ask him   Glad you got yours working again.

Folks,

I don't know if this will help at all, but I got my router (WRT54GL v 1.1) unbricked by doing the following:

1.  Open the case
2.  Short contacts 35 and 36 - this got my ping replys back
3.  Short contacts 15 and 16 - this got my tftp response back
4.  TFTP the original firmware back on.
5.  After the tftp load, power cycle.
6.  Log in via www management page

I know there is no documentation out there about pins 35 and 36 working to unbrick a unit but nothing else worked for me to actually get a response back on the unit.  I shorted pin 15 and 16 all day long with no response and getting no closer to solving my problem until I accidentally shorted the opposite side of the corresponding pins on the chip.  Oh, I did this with the power on as well.  It would not work otherwise.

I hope this helps.

Ok I had to reigster on this forum because there are so many people in this situation and I really thought I had no chance.  I have the wrt54g v8 and was able to get a bricked unit (one that had no ping at all and a dim power light) and made it work.

Steps:
set a static address to whatever subnet your router was on before it got bricked.  Default is 192.168.1.1 but mine was 192.168.141.1 - So I set my static address on my laptop to 192.168.141.2 but could have choosed a range of numbers becides .2
Now hold a constant ping to your router.  IF your router was 141.1 like mine you would type: ping -t 192.168.141.1
Now open up your router by flipping it over and using your thumbs to push the blue part off.  There are no screws so it should just pop off.
Remove the main board from the other piece of plastic an put it in your lap (like i have it in the picture).
Connect your ethernet wire from your router to your computer and make sure you started that constant ping because that is what will tell you when you have shorted the right jumpers.
Now plug your router in and look at the picture I took.  Right where I am pointing there is a chip that has pins on it.  I dont know which pins I connected but it was somewhere in the middle 1/3rd area.  I tried 5 times over and over - took a break - went back at it again ... till I found out which pins made my ping start up.  Once I found that I was able to force it to ping (you have to keep the paperclip or small screwdriver on the pins for it to keep pinging).  Then i launched a pre-setup tftp string that I had waiting in another command window.
Well I just wanted to post this because some people were saying that 80% of the people ruin their units doing this ..etc etc etc ... well I missed the pins and was trying all kinds of pins ...and it worked for me.

The goal is to get a ping and tftp the .bin flash while the router has a ping.  Then when its done w/ the tftp you reboot and your done.

http://www.detailedhosting.com/users/wrt54g/wrt54g.jpg

all those posts saying how this can not be done on newer models ....well ... I did it on the v8 - I wish I knew the pins but I got flustered after a while and started touching a bunch of the middle pins in groups of 3 at one point.  Maybe I got lucky and didnt fry the unit doing that but the amount of pin combos i tried ...it cant be that easy to fry it.  Just use a small screwdriver that cant fit over more then a few pins.  I would assume that the more pins you grounded out at the same time the more of a chance you would fry it.  I am a network admin and not in any way a technology guy who is into messing with boards - but i had to try this because doing a hard reset 10 times did not do anything - the unit was truely bricked.

(Last edited by jwaggz82 on 9 Jul 2008, 15:05)

Hello everyone,
I have WR841 Router, and meanwhile I updating the firmware the electricity got cut off and then when I accessed the RS232 with the cable it booted, I tried to write a flash on the address of the firmware but ever since it didn’t boot and I bought a WR1043 instead and I tried to write a firmware on the WR841 flash but I don’t know exactly its address, and this is what I got:
erase 0xbf020000 +7c0000
tftpboot 0x81000000 code.bin
cp.b 0x81000000 0xbf020000 0x7c0000
So I thought of doing this, while it was working or on function, I dispatched the flash for the WR1043 and I’ve installed it on the WR841, I managed to write the WR841 and the file on the flash (wr841n_en_3_4_5_up_boot(090226) but it doesn’t boot because I wrote it on the wrong address, the file includes the boot sector (U-BOOT 1.1.4 feb 6 2009). So on what kind of address do I have to write it, can anyone help me out?