OpenWrt Forum Archive

Topic: Working on Netgear WNDR3700v5

The content of this topic has been archived between 31 Mar 2018 and 7 May 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

I`m also looking for some news regarding this topic , i have a virgin V5 lying here to be flashed.
So what to do try the LEDE or should i go the trunk openwrt way

balans wrote:

I`m also looking for some news regarding this topic , i have a virgin V5 lying here to be flashed.
So what to do try the LEDE or should i go the trunk openwrt way

I am not allowed to post link here, please remove space in ”ht tp://“

1) Download telnetenable.exe from  ht tp://xdd.co/router/telnetenable.exe
    LEDE firmware from  ht tp://xdd.co/router/lede3700v5.bin
    (Optional) original eeprom from ht tp://xdd.co/router/eeprom-wndr3700v5.bin

2)
Enable telnet on your router
Open a command window

win+r cmd

enter

arp -a
  Internet Address      Physical Address      Type
  192.168.1.1           00-c0-02-12-xx-xx dynamic

Enable telnet on your router

telnetenable.exe 192.168.1.1 00c00212xxxx admin password

the 00c00212xxxx is the mac of your router

telnet 192.168.1.1

you will get the root shell #

Replace the bootloader with my uboot
in the root shell

wget ht tp://xdd.co/router/pb-uboot-wndr3700v5.bin
mtd_write write pb-uboot-wndr3700v5.bin Bootloader

reboot router and hold reset for 10s.
3) Flash new firmware
open your browser and goto 192.168.1.1 and upload the lede3700v5.bin

complete...

optional:
If you have tried the firmware on openwrt.org , you might have to rewrite the eeprom because the rom was build with a wrong firmware size.(which would have overwrited the eeprom)
You may replace it with command in putty

mtd write eeprom_wndr3700v5.bin factory

(Last edited by hikey on 23 Nov 2016, 14:53)

Could we also get links to source code to these u-boot and lede images? After all these are binaries of modified GPL source code...

andrius wrote:

Could we also get links to source code to these u-boot and lede images? After all these are binaries of modified GPL source code...

I am so sorry that I knew little about the GPL license.
I didn't know what I did somehow have against the regulation.

I have deleted all the firmware and uboot on webhost to compliance the regulation.
I believe it should be OK if I use the firmwares I built on my own router only...

hikey wrote:
andrius wrote:

Could we also get links to source code to these u-boot and lede images? After all these are binaries of modified GPL source code...

I am so sorry that I knew little about the GPL license.
I didn't know what I did somehow have against the regulation.

I have deleted all the firmware and uboot on webhost to compliance the regulation.
I believe it should be OK if I use the firmwares I built on my own router only...

But why not put the source somewhere too instead of removing binaries? That way everybody can benefit from your fixes. And both upstream OpenWrt and LEDE might get fixed too.

hikey wrote:
balans wrote:

I`m also looking for some news regarding this topic , i have a virgin V5 lying here to be flashed.
So what to do try the LEDE or should i go the trunk openwrt way

I am not allowed to post link here, please remove space in ”ht tp://“

1) Download telnetenable.exe from  ht tp://xdd.co/router/telnetenable.exe
    LEDE firmware from  ht tp://xdd.co/router/lede3700v5.bin
    (Optional) original eeprom from ht tp://xdd.co/router/eeprom-wndr3700v5.bin

2)
Enable telnet on your router
Open a command window

win+r cmd

enter

arp -a
  Internet Address      Physical Address      Type
  192.168.1.1           00-c0-02-12-xx-xx dynamic

Enable telnet on your router

telnetenable.exe 192.168.1.1 00c00212xxxx admin password

the 00c00212xxxx is the mac of your router

telnet 192.168.1.1

you will get the root shell #

Replace the bootloader with my uboot
in the root shell

wget ht tp://xdd.co/router/pb-uboot-wndr3700v5.bin
mtd_write write pb-uboot-wndr3700v5.bin Bootloader

reboot router and hold reset for 10s.
3) Flash new firmware
open your browser and goto 192.168.1.1 and upload the lede3700v5.bin

complete...

optional:
If you have tried the firmware on openwrt.org , you might have to rewrite the eeprom because the rom was build with a wrong firmware size.(which would have overwrited the eeprom)
You may replace it with command in putty

mtd write eeprom_wndr3700v5.bin factory

I was able to install lede-r2320 firmware, it al worked fine and well, but I need kmod-bridge package in order to get the igmpproxy package. I can't install the kmod-bridge package because the kernel doesn't match. The 2320 has kernel version 4.4.32 and for the package I need kernel version 4.4.35. If you could pls help me with this. It is the last thing I need to take advantage of the firmware. Otherwise my iptv wont work.

Siebevp wrote:

I was able to install lede-r2320 firmware, it al worked fine and well, but I need kmod-bridge package in order to get the igmpproxy package. I can't install the kmod-bridge package because the kernel doesn't match. The 2320 has kernel version 4.4.32 and for the package I need kernel version 4.4.35. If you could pls help me with this. It is the last thing I need to take advantage of the firmware. Otherwise my iptv wont work.

Well, like you said yourself kernel modules have to be compiled at the same time as image. So you can't use hikey's kernel and kernel module packages from LEDE repository. So nothing you can do without the source code... That's one of the reasons why I asked hikey to push source code somewhere... Well, you can still use official LEDE images but keep in mind that your 2.4 GHz wifi won't work due to corrupted factory partition.

(Last edited by andrius on 1 Dec 2016, 16:56)

I've built new firmware for the WNDR3700v5 based on work by andrius and hikey.
However I am currently in China and WITHOUT my WNDR3700v5.

I am looking for someone to verify these fixes before submitting the patch to OpenWrt and LEDE.
It has the boot loader and factory partitions set WRITABLE.

Anyone willing to test? :
Please e-mail ldpinney<AT>yahoo.com

(Last edited by ldpinney on 2 Dec 2016, 05:01)

@hikey Can you please provide the source code?

(Last edited by Er3bus on 13 Dec 2016, 12:28)

With the patch from ldpinney on a fresh build of openwrt master and the conversion tool from francis I was able to build an image which can be uploaded with the stock firmware of the device and it seems to be working. I'm getting into the LUCI configuration console and can configure the device. No further need to open the device and fit a serial console.

The steps have been the following:

  • Configure the openwrt source with menuconfig for the device and enable luci in the configuration

  • Apply the patch from ldpinney for the dts file

  • Build openwrt

  • Convert the resulting sysupdate.bin with the tool from francis

  • Compress the result with the stock zipImage as described by francis

  • Upload the resulting sysupdate.img with the devices stock firmware - be patient here

After reboot I got a fresh openwrt installation on the router

Will test further ...

Regards, thwuensche

thwuensche wrote:

With the patch from ldpinney on a fresh build of openwrt master and the conversion tool from francis I was able to build an image which can be uploaded with the stock firmware of the device and it seems to be working. I'm getting into the LUCI configuration console and can configure the device. No further need to open the device and fit a serial console.

The steps have been the following:

  • Configure the openwrt source with menuconfig for the device and enable luci in the configuration

  • Apply the patch from ldpinney for the dts file

  • Build openwrt

  • Convert the resulting sysupdate.bin with the tool from francis

  • Compress the result with the stock zipImage as described by francis

  • Upload the resulting sysupdate.img with the devices stock firmware - be patient here

After reboot I got a fresh openwrt installation on the router

Will test further ...

Regards, thwuensche

When you do further testing please test 2.4 GHz WiFi. Other people updating from non-stock broken versions can't get WiFi working (even when rewriting factory partition)...

P.S. the patch I sent ldpinney is https://stikonas.eu/files/dts.patch @thwuensche You are using the same patch, aren't you?

(Last edited by andrius on 14 Dec 2016, 00:36)

So ldpinney now created a patch that fixes remaining WiFi issues!

https://patchwork.ozlabs.org/patch/706643/

Both radios should work well with this patch.

Note that you still need to restore your eeprom (factory partition) to a working version as hikey previously said if you tried earlier images. And since eeprom contains your MAC address you might want to change it with hex editor and set your own values. (see earlier posts in this thread for info how to do that)

EDIT: this patch have now been merged into LEDE.

(Last edited by andrius on 20 Dec 2016, 14:39)

This is just great! I just installed OpenWRT on my ZyXEL P-2812HNU-F1 to test the system and now when I am just, you people got it working on the Netgear WNDR3700v5.


I am still a bit fuzzy on the workflow, though. If someone could elaborate on the steps by thwuensche?

The steps have been the following:

  1. Configure the openwrt source with menuconfig for the device and enable luci in the configuration

  2. Apply the patch from ldpinney for the dts file

  3. Build openwrt

  4. Convert the resulting sysupdate.bin with the tool from francis

  5. Compress the result with the stock zipImage as described by francis

  6. Upload the resulting sysupdate.img with the devices stock firmware - be patient here.



OPTIMZED WORKFLOW for LINUX
Replace step 1-3 by (replace xx's by tt's)

wget hxxps://downloads.lede-project.org/snapshots/targets/ramips/mt7621/lede-ramips-mt7621-wndr3700v5-squashfs-sysupgrade.bin

WORKFLOW FOR LINUX

First. So you have to build openwrt from source (replace xx's with tt's):

a. Clone openwrt to your system:

git clone hxxps://github.com/openwrt/openwrt.git
cd openwrt
cat README
./scripts/feeds update -a
./scripts/feeds install -a

b.configure openwrt source:

make menuconfig

c.I selected

Target System (Ralink RT288x/RT3xxx)  
Subtarget (MT7621 based boards)
 > LuCI > 1. Collections <*> luci   

Second.
a. I applied the patch manually replacing the content of /target/linux/ramips/dts/WNDR3700V5.dts by:

/dts-v1/;

#include "mt7621.dtsi"

/ {
    compatible = "mediatek,mt7621-eval-board","ralink,mt7621-soc";
    model = "Netgear WNDR3700v5";

    memory@0 {
        device_type = "memory";
        reg = <0x0 0x8000000>;
    };

    chosen {
        bootargs = "console=ttyS0,57600 maxcpus=2";
    };

    gpio-leds {
        compatible = "gpio-leds";

        wps {
            label = "wndr3700v5:green:wps";
            gpios = <&gpio0 12 1>;
        };

        power {
            label = "wndr3700v5:green:power";
            gpios = <&gpio0 18 1>;
        };
    };

    gpio-keys-polled {
        compatible = "gpio-keys-polled";
        #address-cells = <1>;
        #size-cells = <0>;
        poll-interval = <20>;

        wps {
            label = "wndr3700v5:wps";
            gpios = <&gpio0 7 0>;
            linux,code = <0x211>;
        };

        wifi {
            label = "wndr3700v5:wifi";
            gpios = <&gpio0 8 0>;
            linux,code = <0xf7>;
        };

        reset {
            label = "wndr3700v5:reset";
            gpios = <&gpio0 14 0>;
            linux,code = <0x198>;
        };
    };

    gpio_export {
        compatible = "gpio-export";
        #size-cells = <0>;

        usbpower {
            gpio-export,name = "usbpower";
            gpio-export,output = <1>;
            gpios = <&gpio0 10 1>;
        };
    };
};

&spi0 {
    status = "okay";

    m25p80@0 {
        #address-cells = <1>;
        #size-cells = <1>;
        compatible = "mx25l12805d";
        reg = <0>;
        linux,modalias = "m25p80", "w25q128";
        spi-max-frequency = <10000000>;

        partition@0 {
            label = "u-boot";
            reg = <0x0 0x30000>;
            read-only;
        };

        partition@30000 {
            label = "u-boot-env";
            reg = <0x30000 0x10000>;
            read-only;
        };

        factory: partition@f30000 {
            label = "factory";
            reg = <0xf30000 0x10000>;
            read-only;
        };

        partition@50000 {
            label = "firmware";
            reg = <0x50000 0xee0000>;
        };
    };
};

&pcie {
    status = "okay";

    pcie0 {
        mt76@0,0 {
            reg = <0x0000 0 0 0 0>;
            device_type = "pci";
            mediatek,mtd-eeprom = <&factory 0x8000>;
            mediatek,2ghz = <0>;
        };
    };

    pcie1 {
        mt76@1,0 {
            reg = <0x0000 0 0 0 0>;
            device_type = "pci";
            mediatek,mtd-eeprom = <&factory 0x0000>;
            mediatek,5ghz = <0>;
        };
    };
};

&ethernet {
    mtd-mac-address = <&factory 0x0000000c>;
};

&pinctrl {
    state_default: pinctrl0 {
        gpio {
            ralink,group =  "rgmii2", "mdio", "wdt";
            ralink,function = "gpio";
        };
    };
};

Third.
a.

make

This takes rather long, so I continued on with step 4.

Fourth.
a. Create the tool from Francis. Clone Francis's git repo (Replace xx's with tt's):

git clone hxxps://github.com/Vic063/WNDR3700v5-firmware.git
cd WNDR3700v5-firmware/
g++ WNDR3700v5-Firmware/*.cpp -o WNDR3700v5-Firmware-tool

[b.] Use the tool on the newly generated firmware from step 3. The relevant file was generated in openwrt/bin/ramips, so:

cp ../openwrt/bin/ramips/openwrt-ramips-mt7621-wndr3700v5-squashfs-sysupgrade.bin .
./WNDR3700v5-Firmware-tool openwrt-ramips-mt7621-wndr3700v5-squashfs-sysupgrade.bin

It now asks for a firmware code. I've entered 1.0.0.18 and it generated a new, larger, identically named binary file and renamed the old binary with a suffix '-original'. (Comparing the binary files with the one available from openwrt download, shows that they are all different in size.)

Fifth.
I  downloaded the whole source tarball of v1.0.0.17, that contains the tool zipImage:

wget http://www.downloads.netgear.com/files/GPL/WNDR3700v5_V1.0.0.17_src.tar.gz.zip
unzip WNDR3700v5_V1.0.0.17_src.tar.gz.zip
tar -xvf WNDR3700v5_V1.0.0.17_src.tar.gz
ln -s WNDR3700v5_V1.0.0.17_src/image/tools/src/zipImage/zipImage zipImage-tool
./zipImage-tool openwrt-ramips-mt7621-wndr3700v5-squashfs-sysupgrade.bin 

This resulted in:

$ ./zipImage-tool openwrt-ramips-mt7621-wndr3700v5-squashfs-sysupgrade.bin
  adding: openwrt-ramips-mt7621-wndr3700v5-squashfs-sysupgrade.bin (deflated 30%)
bin file size: <5617184 bytes>
actually read <5617184 bytes>
The first magic sign is found at offset 0x10
The second magic sign is found at offset 0x4f
CheckSum OK: 0x00
Success to build normal img!

A bit worrisome is that it is actually a sysupgrade binary file that fitted through Francis' tool--not the factory.bin! On the other hand, all the LEDE binary files are sysupgrades (and fit through the tool, too).

Sixth
Uploading the created img-file via the http interface as new firmware didn't do anything.

I've zipImage'ed the tooled LEDE binary and uploaded the img-file: Joy!!!

EDIT: 2.4GHz and 5GHz WiFi are working.

(Last edited by Markismus on 11 Jan 2017, 12:05)

andrius wrote:

If anybody else got confused by the picture on the first page, TX and VCC pins seems to be swapped in that picture. Once I plugged them correctly, I was able to input using serial console.


Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you!

So somewhere around rather late in the evening I decided that it would be fun to flash an Openwrt image, since LEDE was bothering me and I just wanted the same distro on both my routers to compare more easily. I forgot to use Francis' tool and I soft bricked it!

No biggie, just tftp a new one...but I couldn't get a positive reponse on 'ping 192.168.1.1' anymore. So I soldered a header and enabled the serial console....and nothing...no input. Took me an hour before I reread the entire thread and finally understood andrius remark! Now I've got:

******************************************                                      
    Uboot StandAlone Entry                                                      
******************************************                                      
0, cmd                                                                          
1, 0x0000000D                                                                   
cmd : 0x0000000D                                                                
                                                                                
                                                                                
Press Ctrl+C to Enter the Main loop...                                          
                                                                                
                                                                                
U-Boot 1.1.3 (Dec 30 2014 - 10:10:36)                                           
SERCOMM # 

Very happy puppy!

ldpinney wrote:

Markismus

Do yourself a favor and replace the bootloader smile

https://github.com/pinney/MT7621-u-boot … _uboot.bin

I'm using this bootloader already but wanted to ask, does it have web recovery? I tried pressing reset for long enough but it didn't boot into web recovery. But then my firmware wasn't bricked, so maybe it doesn't boot to recovery if everything is fine.

It's just that it's quite hard to close the case of this router... Don't want to open it one more time...

Yes it has a web interface :

Option 5

###

U-Boot 1.1.3 (Nov 22 2015 - 11:45:37)

Board: Ralink APSoC DRAM:  448 MB

relocate_code Pointer at: 9bfb4000


Config XHCI 40M PLL

flash manufacture id: ef, device id 40 19

Warning: un-recognized chip ID, please update bootloader!

============================================

Pinney UBoot Version: 1.0

--------------------------------------------

ASIC MT7621A DualCore (MAC to MT7530 Mode)

DRAM_CONF_FROM: Auto-Detection

DRAM_TYPE: DDR3

DRAM bus: 16 bit

Xtal Mode=3 OCP Ratio=1/3

Flash component: SPI Flash

Date:Nov 22 2015  Time:11:45:37

============================================

icache: sets:256, ways:4, linesz:32 ,total:32768

dcache: sets:256, ways:4, linesz:32 ,total:32768

set LAN/WAN WLL


       _               _____         _____
        /              /          )       /          )   ♥
       /              /          /       /_____/       _      _       _
      /              /          /       /              /   /    ) /    )  /__)    /     /
   _/____/ ♠  /_____/   ♣  /              /   /    / /    /  (_       (___/ ♦
                                                                                         /
                                                                              _____/ 
-------------------------------------------------------------------------

             https://github.com/pinney/MT7621-u-boot-mod

-------------------------------------------------------------------------


Please choose the operation:

   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   5: Load system code then write to Flash via Httpd.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.

This is so much fun!

Thanks for the assurances about what bootloader to use. Things were still kind of fuzzy on that subject.

Is the patch for the dts-file pulled into the master branch of OpenWrt, yet? I rather not use both the LEDE and OpenWrt distribution this first week.

(Last edited by Markismus on 12 Jan 2017, 23:48)

So I followed ldpinney's guide

You MUST have a working serial console (UART)

You MUST have a working TFTP server

You MUST have a USB stick...

###

From the SECOMM bootloader :

Press Ctrl+C to Enter the Main loop...

tftp the initramfs and boot it. (the uboot partition is set writable)

tftpboot 0x81000000 openwrt-ramips-mt7621-wndr3700v5-initramfs-kernel.bin

bootm 0x81000000

Place the new bootloader on a USB stick.

Insert the USB Stick and mount it.

mount /dev/sda2 /mnt

root@OpenWrt:/# mtd unlock /dev/mtd0
Unlocking /dev/mtd0 ...

root@OpenWrt:/# mtd write /mnt/mt7621s-uboot.bin /dev/mtd0
Unlocking /dev/mtd0 ...

Writing from /mnt/uboot.bin to /dev/mtd0 ...  

Writing from uboot.bin to /dev/mtd0 ...

reboot

However, I replaced the mt7621s-uboot.bin (from his googledrive 125.5kB) with the one in his link MT7621S_uboot.bin (from his link above (32425 bytes, retrieved with wget)). When I download the file via the github web interface it's 122KB. So obviously wget is not the way to get this file!

Everything went perfectly, except I only had one message "Writing from /mnt/uboot.... to ...." instead of 2. After rebooting nothing happened. After several tries the router seems utterly unresponsive. I see nothing via the serial connection. It turns out that I flashed the  github page!

Is there any way to resuscitate the router? Or did I in fact utterly brick it? Lesson to be learned: to flash your router in a hurry before getting to other things!

For the moment I have started looking into flash memory chip programmers for the Macronix MX25L12835F. Does anyone know what kind of programmers are good or even better a link to a decent one?

(Last edited by Markismus on 19 Jan 2017, 00:08)

Probably fully bricked unless you can desolder and rewrite the chip...

Yes. I an afraid of that, too. sad

Would you be willing to make a backup of the flash memory, so that I can program it with a working image?

Markismus

OK email me and I'll send you a full image.

WNDR3700v5 owner here.    I'm super excited about the work being done.   Does this all mean that an openwrt image will soon appear for this router?

Bringel wrote:

WNDR3700v5 owner here.    I'm super excited about the work being done.   Does this all mean that an openwrt image will soon appear for this router?

I don't think anybody bothered to submit those patches to openwrt, they were only submitted to LEDE. Well, they are mostly identical anyway, so try https://downloads.lede-project.org/rele … pgrade.bin

This is only sysupgrade image. Either you need to flash it with serial cable or follow instructions on this thread that tell how to convert it into factory image.

andrius wrote:
Bringel wrote:

WNDR3700v5 owner here.    I'm super excited about the work being done.   Does this all mean that an openwrt image will soon appear for this router?

I don't think anybody bothered to submit those patches to openwrt, they were only submitted to LEDE. Well, they are mostly identical anyway, so try ....

This is only sysupgrade image. Either you need to flash it with serial cable or follow instructions on this thread that tell how to convert it into factory image.

smile  I just looked up LEDE.  Very cool!   

Thanks for posting the bin file, but I don't want to risk bricking my router.  I'll just wait on an image.   I'm in no rush.   I'll be using it as a client bridge.

Thanks for the info!