AC-RT87U does not turn on, only the POWER LED is on

[melandr]

Good afternoon
Please help, the router does not turn on. When power is applied, the POWER LED lights up and the LAN2 LAN3 LAN4 WAN LEDs light up briefly. The router does not go into recovery mode. I opened the case, connected the USB-UART adapter to the J3 pin. If the GND contact is connected when the router is turned on, then the POWER LED does not light up, but the WPS1 LAN3 LAN2 LEDs light up strongly and WAN1WAN2 LAN4 slightly weaker. Below are screenshots of Putty, first there is garbage, and then it displays some boot information. But information is displayed only if the GND contact is connected after the router is turned on.
But I don't know what to do next.

 

[AndreiV]

Power supply capacitors probably died.
That router is old, end of life , so not worth wasting too much time on.

 

[melandr]

The thing is, it didn't last long. Perhaps he was somewhere before that. But in the place that I know about, he worked for half a year at most. And the capacitors in the power supply on the router board itself? Or in a remote power supply? From it, the output goes 19V, and the voltage does not seem to sag.

 

[Tech9]

Look for blown step-down power converters inside. Repair not worth it much though for EoL router with no more firmware support.

 

[melandr]

Is there any information about what output should be from these step-down power converters. I counted 5 converters on FR9618. Should they have the same output?

 

[Tech9]

I counted 5 converters on FR9618

I never had one of those routers in hand, there is no schematics online and this DC/DC converter is 4.5-23V input to 1-20V output adjustable. You have to look for obvious signs of damage, something heating up too much, something unusually cold, reverse engineer whatever feels wrong.

 

[melandr]

The chip marked SH1 heats up the most. I found 5 FR9618 converters on the board. The output from them is 5V and 3.3V. There are also LR1108 and LD1117 with an output voltage of 2.5V and 1.25V. I can make a circuit with input and output voltage according to the converters, but there is nothing to compare with. I measured the capacitance of the capacitors at the input, everything is within the marking.

 

[melandr]

I would like to summarize the information, maybe someone will tell you. Knowledgeable people say that the bootloader (firmware) in the NAND Flash of the Spansion s34ml01g100tf100 router is damaged. It needs to be flashed. As far as I understand, there are two options for nand firmware. Solder and flash through the programmer. True, the programmer stands like a bomber not shot down. The second option is firmware through the JTAG processor. Here, too, you need a jtag debugger that supports work with the Broadcom BCM4709A0 processor. I looked at Ali, j-link, in principle, costs sane money. But the question is whether it supports this processor. And the second point is what software to use with the debugger. They use Openocd to debug other processors, but it is not clear if it supports working with BCM4709A0. Also another question, for example, if you find who has a programmer for nand, what needs to be flashed. Will the firmware intended for downloading via tftp or the web interface be suitable for flashing through the programmer? In short, there are more questions than answers. Perhaps someone will be able to supplement my information in order to get the process off the ground...
PS: It turned out how to see such a debug output at startup

though I did not understand how I managed to get such a debug output. It didn't work before...
PS: The debug output stops at the line "Starting program at 0x00008000"
What does this mean? Can someone tell me if you unsolder the memory chip and find who can flash this memory than to flash it? The debug log shows that the tftp server does not start. Firmware available in trx format without bootloader. From what address to sew it, if by a programmer? Is it possible to find the firmware in bin with the bootloader?
PS1: another question, one of the available jtag debuggers on Ali is J-LINK. And although they write that it supports a large number of SoCs, I did not see official support for BCM4709 in the J-Link documentation. What debugger can and should be used?