Help to restore the Asus wireless router rt-ac66u

[acer76]

Hi.
One day the router died, just stopped is included in the web access and its functionality
Did the reset
1) nvram from page disaster recovery.
2) 30/30/30
3) 15 sec the reset button and wps
4) with the serial port nvram erase.
No reset.
Recovery via asus Firmware Restoration utility and the firmware from the official site does not provide any progress
Firmware is poured and the logs CFE->

Spoiler: log

Reading :: TFTP Server.
- last blk -
Done. 26554368 bytes read
Download of 0x1953000 bytes completed
Write kernel and filesystem binary to FLASH
Programming...copysize=26554368, amtcopy=26554368
done. 26554368 bytes written
Programming...copysize=26554368, amtcopy=26554368
done. 26554368 bytes written

▒Decompressing...done!!


CFE version 6.30.39.29 (r338244) based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: 一 10月 15 10:41:41 CST 2012 (yau@wireless-pub2)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found an ST compatible serial flash with 32 64KB blocks; total size 2MB
Found a AMD NAND flash with 2048B pages or 128KB blocks; total size 128MB
bcm_robo_enable_switch: EEE is disabled
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.30.39.29 (r338244)
CPU type 0x19749: 600MHz
Tot mem: 131072 KBytes

CFE mem: 0x80700000 - 0x8094EDE0 (2420192)
Data: 0x80738B70 - 0x8073BE10 (12960)
BSS: 0x8073BE10 - 0x8074CDE0 (69584)
Heap: 0x8074CDE0 - 0x8094CDE0 (2097152)
Stack: 0x8094CDE0 - 0x8094EDE0 (8192)
Text: 0x80700000 - 0x80738B70 (232304)

Device eth0: hwaddr 08-60-6E-BD-FD-A8, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Null Rescue Flag.
boot the image...
Boot program checksum is invalid
Boot program checksum is invalid
Check 2 trx result: -34, -34
Hello!! Enter Rescue Mode: (Check error)

Utility tftp.exe get the following:
CFE> nvram erase
*** command status = 0
CFE> reboot▒Decompressing...done
CFE version 6.30.39.29 (r338244) based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: 一 10月 15 10:41:41 CST 2012 (yau@wireless-pub2)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found an ST compatible serial flash with 32 64KB blocks; total size 2MB
Found a AMD NAND flash with 2048B pages or 128KB blocks; total size 128MB
bcm_robo_enable_switch: EEE is disabled
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.30.39.29 (r338244)
CPU type 0x19749: 600MHz
Tot mem: 131072 KBytes

CFE mem: 0x80700000 - 0x8094EDE0 (2420192)
Data: 0x80738B70 - 0x8073BE10 (12960)
BSS: 0x8073BE10 - 0x8074CDE0 (69584)
Heap: 0x8074CDE0 - 0x8094CDE0 (2097152)
Stack: 0x8094CDE0 - 0x8094EDE0 (8192)
Text: 0x80700000 - 0x80738B70 (232304)

Committing NVRAM...done
Device eth0: hwaddr 08-60-6E-BD-FD-A8, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Null Rescue Flag.
boot the image...
Boot program checksum is invalid
Boot program checksum is invalid
Check 2 trx result: -34, -34
Hello!! Enter Rescue Mode: (Check error)

Reading :: TFTP Server.
break! no netctx or timer expired !
break! no netctx or timer expired !
break!! reach max retry!!
Failed.: I/O error
.......
......
Code: 24c60008 24630001 24020004 <9462fffa> 00001021 03e00008 00000000 000310c0 00481021
Kernel panic - not syncing: Fatal exception in interrupt
Rebooting in 3 seconds..Decompressing...done


CFE version 6.30.39.29 (r338244) based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: 一 10月 15 10:41:41 CST 2012 (yau@wireless-pub2)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found an ST compatible serial flash with 32 64KB blocks; total size 2MB
Found a AMD NAND flash with 2048B pages or 128KB blocks; total size 128MB
bcm_robo_enable_switch: EEE is disabled
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.30.39.29 (r338244)
CPU type 0x19749: 600MHz
Tot mem: 131072 KBytes

CFE mem: 0x80700000 - 0x8094EDE0 (2420192)
Data: 0x80738B70 - 0x8073BE10 (12960)
BSS: 0x8073BE10 - 0x8074CDE0 (69584)
Heap: 0x8074CDE0 - 0x8094CDE0 (2097152)
Stack: 0x8094CDE0 - 0x8094EDE0 (8192)
Text: 0x80700000 - 0x80738B70 (232304)

Device eth0: hwaddr 08-60-6E-BD-FD-A8, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Null Rescue Flag.
boot the image...
Boot program checksum is invalid
Boot program checksum is invalid
Check 2 trx result: -34, -34
Hello!! Enter Rescue Mode: (Check error)

Or with firmware

Spoiler: log

dd-wrt.v24-20453_NEWD-2_K2.6_mini_RT-N66U.trx

to

dd-wrt.v24-25697_NEWD-2_K2.6_mini_RT-N66U.trx
Get the next log

Device eth0: hwaddr 08-60-6E-BD-FD-A8, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Null Rescue Flag.
Hello!! Enter Rescue Mode: (by Force)

Reading :: TFTP Server.
Failed.: Timeout occured
Reading :: TFTP Server.
Failed.: Timeout occured
Reading :: TFTP Server.
- last blk -
Done. 3543040 bytes read
Download of 0x361000 bytes completed
Write kernel and filesystem binary to FLASH
Programming...copysize=3543040, amtcopy=3543040
done. 3543040 bytes written
Programming...copysize=3543040, amtcopy=3543040
done. 3543040 bytes written

or

CFE version 6.30.39.29 (r338244) based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: 一 10月 15 10:41:41 CST 2012 (yau@wireless-pub2)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found an ST compatible serial flash with 32 64KB blocks; total size 2MB
Found a AMD NAND flash with 2048B pages or 128KB blocks; total size 128MB
bcm_robo_enable_switch: EEE is disabled
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.30.39.29 (r338244)
CPU type 0x19749: 600MHz
Tot mem: 131072 KBytes

CFE mem: 0x80700000 - 0x8094EDE0 (2420192)
Data: 0x80738B70 - 0x8073BE10 (12960)
BSS: 0x8073BE10 - 0x8074CDE0 (69584)
Heap: 0x8074CDE0 - 0x8094CDE0 (2097152)
Stack: 0x8094CDE0 - 0x8094EDE0 (8192)
Text: 0x80700000 - 0x80738B70 (232304)

Device eth0: hwaddr 08-60-6E-BD-FD-A8, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Null Rescue Flag.
boot the image...
Check 2 trx result: 0, 0
go load
Loader:raw Filesys:tftp Dev:eth0 File:: Optionsnull)
Loading: TFTP Server.
Failed.
Could not load :: Timeout occured
Loader:raw Filesys:raw Dev:nflash0.os File: Optionsnull)
Loading: .. 3916 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000

At this stage hangs, left it for an hour to two hours and at night.
There was no reaction.

The only firmware that works is poured and 10-15 minutes tomato117-VPN-64K.trx
After a restart, and if you look at the logs CFE, firmware re-installed

Information about the router:



Device eth0: hwaddr 08-60-6E-BD-FD-A8, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Null Rescue Flag.
Hello!! Enter Rescue Mode: (by Force)

Reading :: TFTP Server.
Failed.: Timeout occured
Reading :: TFTP Server.
Failed.: Timeout occured
Reading :: TFTP Server.
Failed.: Interrupted
CFE> help
Available commands:

show devices Display information about the installed devices.
show clocks Show current values of the clocks.
nvram NVRAM utility.
reboot Reboot.
flash Update a flash memory device
batch Load a batch file into memory and execute it
go Verify and boot OS image.
boot Load an executable file into memory and execute it
load Load an executable file into memory without executing it
save Save a region of memory to a remote file via TFTP
ping Ping a remote IP host.
arp Display or modify the ARP Table
ifconfig Configure the Ethernet interface
help Obtain help for CFE commands

For more information about a command, enter 'help command-name'
*** command status = 0
CFE> show devices
Device Name Description
------------------- ---------------------------------------------------------
uart0 NS16550 UART at 0x18000300
uart1 NS16550 UART at 0x18000400
flash0 ST Serial flash size 2048KB
flash0.boot ST Serial flash offset 00000000 size 256KB
flash0.trx ST Serial flash offset 00040000 size 1KB
flash0.os ST Serial flash offset 0004001C size 1728KB
flash0.nvram ST Serial flash offset 001F0000 size 64KB
flash1.boot ST Serial flash offset 00000000 size 256KB
flash1.trx ST Serial flash offset 00040000 size 1728KB
flash1.nvram ST Serial flash offset 001F0000 size 64KB
nflash0.trx Unknown type 146 NAND flash offset 00000000 size 1KB
nflash0.os Unknown type 146 NAND flash offset 0000001C size 131072KB
nflash1.trx Unknown type 146 NAND flash offset 00000000 size 32768KB
nflash1.brcmnand Unknown type 146 NAND flash offset 02000000 size 98304KB
nflash2.prefix Unknown type 146 NAND flash offset 00000000 size 65536KB
nflash2.trx Unknown type 146 NAND flash offset 04000000 size 32768KB
eth0 Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller
*** command status = 0
CFE>


Have exactly the same router, checked the power supply is in order.
Please answer the following questions:
1) do I Need to flash the CFE?
2) What firmware to flash to return to stock?
3) a similar work router is it possible to remove the firmware dump and pour it in?
4)For 2 weeks weight Internet browsing, no answers found. On the website dd-wrt a lot of similar situations but they did not help me

I hope for your help
Thank you!
Sorry for my English

 

[bbsc]

1. Generally no, if you did not touch it. CFE is located in physically other chip (SPI) in RT-AC66U.
2. Any stock firmware. "nvram erase" and "tftp put ..." must do the job, I think. I'd use Merlin 378.56_2.
3. No need. Even if the CFE is broken.

 

[acer76]

1. Generally no, if you did not touch it. CFE is located in physically other chip (SPI) in RT-AC66U.
2. Any stock firmware. "nvram erase" and "tftp put ..." must do the job, I think. I'd use Merlin 378.56_2.
3. No need. Even if the CFE is broken.

Send via standard tftp
TFTP -i 192.168.1.1 PUT RT-AC66U_378.56_2.trx

The processstarts successfullyandthenhangsas you can seein the logs

Spoiler: log

Failed.: Interrupted
CFE> nvram erase
*** command status = 0
CFE> reboot▒Decompressing...done


CFE version 6.30.39.29 (r338244) based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: 一 10月 15 10:41:41 CST 2012 (yau@wireless-pub2)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found an ST compatible serial flash with 32 64KB blocks; total size 2MB
Found a AMD NAND flash with 2048B pages or 128KB blocks; total size 128MB
bcm_robo_enable_switch: EEE is disabled
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.30.39.29 (r338244)
CPU type 0x19749: 600MHz
Tot mem: 131072 KBytes

CFE mem: 0x80700000 - 0x8094EDE0 (2420192)
Data: 0x80738B70 - 0x8073BE10 (12960)
BSS: 0x8073BE10 - 0x8074CDE0 (69584)
Heap: 0x8074CDE0 - 0x8094CDE0 (2097152)
Stack: 0x8094CDE0 - 0x8094EDE0 (8192)
Text: 0x80700000 - 0x80738B70 (232304)

Committing NVRAM...done
Device eth0: hwaddr 08-60-6E-BD-FD-A8, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Null Rescue Flag.
boot the image...
Boot program checksum is invalid
Boot program checksum is invalid
Check 2 trx result: -34, -34
Hello!! Enter Rescue Mode: (Check error)

Reading :: TFTP Server.
- last blk -
Done. 23138304 bytes read
Download of 0x1611000 bytes completed
Write kernel and filesystem binary to FLASH
Programming...copysize=23138304, amtcopy=23138304
done. 23138304 bytes written
Programming...copysize=23138304, amtcopy=23138304
done. 23138304 bytes written

NoCFEis nottouched. Somy boot loaderall right?
What are the other options?

 

[acer76]

Withthe help of the programtftp.exealsohangsbut thenotherlogs

Spoiler: log

Reading :: TFTP Server.
break! no netctx or timer expired !
break!! reach max retry!!
Failed.: I/O error
Loader:raw Filesys:raw Dev:nflash0.os File: Optionsnull)
Loading: ...... 3482556 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
start_kernel
Linux version 2.6.22.19 (root@asus) (gcc version 4.2.3) #1 Mon Nov 2 09:59:58 ES T 2015
CPU revision is: 00019749
Found an ST compatible serial flash with 32 64KB blocks; total size 2MB
Determined physical RAM map:
memory: 07fff000 @ 00000000 (usable)
memory: 08000000 @ 87fff000 (usable)
Built 1 zonelists. Total pages: 585216
Kernel command line: root=/dev/mtdblock3 console=ttyS0,115200 init=/sbin/preinit
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 2048 (order: 11, 8192 bytes)
CPU: BCM5300 rev 1 pkg 0 at 600 MHz
Using 300.000 MHz high precision timer.
console [ttyS0] enabled
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 238352k/131068k available (2667k kernel code, 22808k reserved, 532k data , 200k init, 131072k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
PCI: Initializing host
PCI: Reset RC
PCI: Initializing host
PCI: Reset RC
PCI: Fixing up bus 0
PCI/PCIe coreunit 0 is set to bus 1.
PCI: Fixing up bridge
PCI: Fixing up bridge
PCI: Enabling device 0000:01:00.1 (0004 -> 0006)
PCI: Fixing up bus 1
PCI/PCIe coreunit 1 is set to bus 2.
PCI: Fixing up bridge
PCI: Fixing up bridge
PCI: Enabling device 0000:02:00.1 (0004 -> 0006)
PCI: Fixing up bus 2
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 4096 (order: 2, 16384 bytes)
TCP established hash table entries: 16384 (order: 5, 131072 bytes)
TCP bind hash table entries: 16384 (order: 4, 65536 bytes)
TCP: Hash tables configured (established 16384 bind 16384)
TCP reno registered
highmem bounce pool size: 64 pages
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
io scheduler noop registered (default)
HDLC line discipline: version $Revision: 4.8 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 8) is a 16550A
serial8250: ttyS1 at MMIO 0x0 (irq = 8) is a 16550A
PPP generic driver version 2.4.2
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V0.18.3
PPTP driver version 0.8.5
pflash: found no supported devices
Boot partition size = 262144(0x40000)
Creating 2 MTD partitions on "sflash":
0x00000000-0x00040000 : "pmon"
0x001f0000-0x00200000 : "nvram"
Found a Zentel NAND flash with 2048B pages or 128KB blocks; total size 128MB
lookup_nflash_rootfs_offset: offset = 0x0
nflash: squash filesystem with lzma found at block 9
Creating 2 MTD partitions on "nflash":
0x00000000-0x02000000 : "linux"
0x0013d26c-0x02000000 : "rootfs"
NAND device: Manufacturer ID: 0x92, Chip ID: 0xf1 (Zentel NAND 128MiB 3,3V 8-bit )
Creating 3 MTD partitions on "brcmnand":
0x00000000-0x02000000 : "trx"
0x02000000-0x04000000 : "jffs2"
0x04000000-0x07f00000 : "brcmnand"
dev_nvram_init: _nvram_init
sdhci: Secure Digital Host Controller Interface driver
sdhci: Copyright(c) Pierre Ossman
u32 classifier
OLD policer on
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (2048 buckets, 16384 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
net/ipv4/netfilter/tomato_ct.c [Nov 2 2015 09:59:57]
ipt_account 0.1.21 : Piotr Gasidlo <quaker@barbara.eu.org>, http://code.google.c om/p/ipt-account/
NET: Registered protocol family 1
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 200k freed
Warning: unable to open an initial console.
Failed to execute /sbin/preinit. Attempting defaults...
SQUASHFS error: Unable to read page, block aa7631, size 5688
SQUASHFS error: Unable to read page, block aa7631, size 5688
SQUASHFS error: Unable to read page, block aa7631, size 5688
SQUASHFS error: Unable to read page, block aa7631, size 5688
SQUASHFS error: Unable to read page, block aa7631, size 5688
SQUASHFS error: Unable to read page, block aa7631, size 5688
SQUASHFS error: Unable to read page, block aa7631, size 5688
SQUASHFS error: Unable to read page, block aa7631, size 5688
SQUASHFS error: Unable to read page, block aa7631, size 5688
SQUASHFS error: Unable to read page, block aa7631, size 5688
SQUASHFS error: Unable to read page, block aa7631, size 5688
SQUASHFS error: Unable to read page, block aa7631, size 5688
SQUASHFS error: Unable to read page, block aa7631, size 5688
SQUASHFS error: Unable to read page, block aa7631, size 5688

 

[bbsc]

Try to reflash it in rescue mode via tftp:
1. Power off.
2. Power on when holding WPS and wait for power led blinking. It will erase nvram and put the router into rescue mode.
3. Flash it via ethernet with "tftp put ...".
4. Wait 10 min. or so and then reboot.

 

[acer76]

Try to reflash it in rescue mode via tftp:
1. Power off.
2. Power on when holding WPS and wait for power led blinking. It will erase nvram and put the router into rescue mode.
3. Flash it via ethernet with "tftp put ...".
4. Wait 10 min. or so and then reboot.

The resultis exactly the sameasin the previous post
Reading :: TFTP Server.
- last blk -
Done. 23138304 bytes read
Download of 0x1611000 bytes completed
Write kernel and filesystem binary to FLASH
Programming...copysize=23138304, amtcopy=23138304
done. 23138304 bytes written
Programming...copysize=23138304, amtcopy=23138304
done. 23138304 bytes written

 

[bbsc]

Looks like some IO error during flashing process or flash device does not operate properly.
Or the flash is not erased before programming....

I'd try another LAN port.
After that I'd check the voltages on DC-DC converters on PCB.

But it's only my opinion.

 

[acer76]

Looks like some IO error during flashing process or flash device does not operate properly.
Or the flash is not erased before programming....

I'd try another LAN port.
After that I'd check the voltages on DC-DC converters on PCB.

But it's only my opinion.

All these attemptshave already been made, but nothing helps. I thinkIwould have to driveto the service center,hope itwill help.
In any case,thank youfor the advice