Bricked AC3200

[invizib]

Hi,

I got my hand on a used AC3200 but I can't get it to work.
Here is the CFE log I get if I connect to the router on serial port:

CFE version 7.14.43.16 (r) based on BBP 1.0.37 for BCM947XX (32bit,SP,)
Build Date: Thu Dec 18 12:49:55 CST 2014 (defjovi@localhost.localdomain)
Copyright (C) 2000-2008 Broadcom Corporation.
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
DDR Clock: 800 MHz
Info: DDR frequency set from clkfreq=1000,*800*
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 7.14.43.16 (r)
CPU type 0x0: 1000MHz
Tot mem: 262144 KBytes
CFE mem: 0x00F00000 - 0x017969E0 (9005536)
Data: 0x00F4F004 - 0x00F4F4E4 (1248)
BSS: 0x00F4F4F0 - 0x00F949E0 (283888)
Heap: 0x00F949E0 - 0x017949E0 (8388608)
Stack: 0x017949E0 - 0x017969E0 (8192)
Text: 0x00F00000 - 0x00F4556C (284012)
Device eth0: hwaddr AC-9E-17-AA-91-40, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Null Rescue Flag.
boot the image...
go load
Loader:raw Filesys:tftp Dev:eth0 File:: Optionsnull)
Loading: TFTP Server.
..tftp retry wait 0
Failed.
Could not load :: Timeout occured
Loader:raw Filesys:raw Dev:nflash0.os File: Optionsnull)
Loading: .... 4304128 bytes read
Entry at 0x00008000
Closing network.
Starting program at 0x00008000


The router hangs there forever.
Anyone has any ideas how I could get it to work again?
I did try every original and custom firmwares but realized that transfert fails at 83% using ASUS Recovery tool if the file is too big.
Maybe something wrong with the memory but I could upload the entire file using tftp.
The error after the reboot is still the same tho.

Thank you!

 

[Pierino]

Stop the boot process by hitting repeatedly control and c as soon as you power it up.
At the cfe prompt type: nvram erase.
At this point you should get ttl=100 from ping response.
Then at the cfe prompt type: flash -noheader : nflash1.trx.
Then use tftpd32 or tftpd64 to upload the firmware.

 

[invizib]

Stop the boot process by hitting repeatedly control and c as soon as you power it up.
At the cfe prompt type: nvram erase.
At this point you should get ttl=100 from ping response.
Then at the cfe prompt type: flash -noheader : nflash1.trx.
Then use tftpd32 or tftpd64 to upload the firmware.

Hi,
this is what I get what I try to flash the firmware:

CFE> nvram erase
*** command status = 0
CFE> nvram commit
*** command status = 0
CFE> flash -noheader : nflash1.trx
Reading ::
TFTP Server.
..tftp retry wait 0
Failed.: Timeout occured
*** command status = -21
CFE> flash -noheader : nflash1.trx
Reading ::
TFTP Server.
..tftp retry wait 0
Failed.: Timeout occured
*** command status = -21
CFE> flash -noheader 192.168.1.10:flash1.trx nflash1.trx
Reading 192.168.1.10:flash1.trx:
TFTP Client.
- last blk -
Done. 40398848 bytes read
Download of 0x2687000 bytes completed
Write kernel and filesystem binary to FLASH
Programming...copysize=40398848, amtcopy=40398848
done. 40398848 bytes written

After that I have a blinking cursor in tera term but I can't send anything to the console.
192.168.1.10:flash1.trx is my PC's set IP with renamed lastest firmware.
Is this a good way to proceed of should it works without tftpserver:filename ?

Should I just wait until I can send commands to the console again or reboot the router manually?

 

[Pierino]

I use tftpd64. I don’t change the name of the file. I just type:
flash -noheader: nflash1.trx and I hit upload on the tftpd64.
Set your nic to 192.168.9.1, 255.255.255.0, 192.168.1.1.

If after typing nvram erase, no need for nvram commit, you aren’t getting ttl=100 responses, you won’t be able to upload the firmware.
Just use stock ASUS firmware.

After it uploads type: go at the cfe prompt.

 

[invizib]

I use tftpd64. I don’t change the name of the file. I just type:
flash -noheader: nflash1.trx and I hit upload on the tftpd64.
Set your nic to 192.168.9.1, 255.255.255.0, 192.168.1.1.

If after typing nvram erase, no need for nvram commit, you aren’t getting ttl=100 responses, you won’t be able to upload the firmware.
Just use stock ASUS firmware.

After it uploads type: go at the cfe prompt.

Hi,

I managed to send to flash command this way but the result is the same.
I can't send any commands after the firmware is uploaded.

Done. 40398848 bytes read
Download of 0x2687000 bytes completed
Write kernel and filesystem binary to FLASH
Programming...copysize=40398848, amtcopy=40398848
done. 40398848 bytes written

Power Led is closed, only Lan1 led flashes when there is activity.
I guess it doesn't looks good for this one.

Thanks!

 

[Pierino]

Hi,

I managed to send to flash command this way but the result is the same.
I can't send any commands after the firmware is uploaded.

Done. 40398848 bytes read
Download of 0x2687000 bytes completed
Write kernel and filesystem binary to FLASH
Programming...copysize=40398848, amtcopy=40398848
done. 40398848 bytes written

Power Led is closed, only Lan1 led flashes when there is activity.
I guess it doesn't looks good for this one.

Thanks!

Did you just try to reboot it?

 

[invizib]

Did you just try to reboot it?

Yes, if I reboot it I get the same as the first post of this thread.

 

[Pierino]

What is the output of: show devices

 

[invizib]

What is the output of: show devices

CFE> show devices
Device Name Description
------------------- ---------------------------------------------------------
uart0 NS16550 UART at 0x18000300
uart1 NS16550 UART at 0x18000400
nflash0 AMD NAND flash size 131072KB
nflash0.boot AMD NAND flash offset 0 size 512KB
nflash0.nvram AMD NAND flash offset 80000 size 1536KB
nflash0.trx AMD NAND flash offset 200000 size 1KB
nflash0.os AMD NAND flash offset 20001C size 129024KB
nflash1.boot AMD NAND flash offset 0 size 512KB
nflash1.nvram AMD NAND flash offset 80000 size 1536KB
nflash1.trx AMD NAND flash offset 200000 size 63488KB
nflash1.brcmnand AMD NAND flash offset 4000000 size 65536KB
eth0 Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller
*** command status = 0

 

[Pierino]

Try: flash -noheader : nflash0.trx.

 

[invizib]

Try: flash -noheader : nflash0.trx.

CFE> flash -noheader : nflash0.trx
Reading ::
TFTP Server.
..tftp retry wait 0
- last blk -
Done. 21970944 bytes read
Download of 0x14f4000 bytes completed
Write kernel and filesystem binary to FLASH
Programming...copysize=21970944, amtcopy=21970944
done. 21970944 bytes written

I had to reboot the router manually here.

go load
Loader:raw Filesys:tftp Dev:eth0 File:: Optionsnull)
Loading: TFTP Server.
..tftp retry wait 0
Failed.
Could not load :: Timeout occured
Loader:raw Filesys:raw Dev:nflash0.os File: Optionsnull)
Loading: .... 4304128 bytes read
Entry at 0x00008000
Closing network.
Starting program at 0x00008000

 

[Pierino]

Only thing I can suggest is try to use alternative firmware. Like dd-wrt. I’m not sure tomato is available for it.

Try this ftp://ftp.dd-wrt.com/betas/2019/09-24-2019-r41117/asus-rt-ac3200/asus_rt-ac3200-firmware.trx