Rbr50v2 Conversion

[Tonot1]

Latest firmware can be found on Github: https://github.com/Ton-O/RBR50V2_TO_RBS50/releases
Just click on the version you need below:
- V2.7.5.6 for Netgear's firmware
- V9.2.5.2.39SF-HW for Voxel's firmware.
Then download the associated asset (IMG-file) that shows up.

As mentioned many times in this thread: you can simply update through GUI to these firmwares when you are on stock Netgear firmware; if you're already on Voxel, you need to use the TFTP-approach.

As always a warning:
Use these releases at your own risk; they work well in my situation, but I cannot guarantee it will work your situation. The risk of bricking your device is always there, don't blame me!!!

 

[bangorbob]

Tonot1, thank you so much adding this latest firmware version for us, hopefully this will sort my RBR50 out again and I can resuse it as a satellite, very much appreciated.

Bob

 

[Tonot1]

Tonot1, thank you so much adding this latest firmware version for us, hopefully this will sort my RBR50 out again and I can resuse it as a satellite, very much appreciated.

Bob

You're welcome!
Please report the result when done, so that others are informed.

 

[bangorbob]

You're welcome!
Please report the result when done, so that others are informed.

I'm not sure about the process again, I've downloaded your file which is a bin file but to upload it manually via the web interface I think it needs to be an image file or have I missed something again.

Sorry if I'm being stupid

 

[Tonot1]

No, you're not stupid...
Unless the GUI checks the extension, it should work.

 

[bangorbob]

No, you're not stupid...
Unless the GUI checks the extension, it should work.

 

[bangorbob]

This is what I get when I try to upload it, sorry.

 

[Tonot1]

No problem,I renamed the file to *.img; it's on github .Note that this is the same file, just with another name (you can rename it yourself, or download the renamed one).
Sorry, I've been doing the updates most of the time with tftp, not through the GUI; otherwise I would have noticed this myself.

 

[bangorbob]

Big Thank You Tonot1, everything worked and I now have another satellite working again, many thanks for looking in on the forum again.

Bob

 

[MR2MK1SC]

Just tried the update via the GUI on an RBS50v2 running the previous mod'ed 2.7.5.4 firmware and got the following...

Any ideas?

 

[Tonot1]

Just tried the update via the GUI on an RBS50v2 running the previous mod'ed 2.7.5.4 firmware and got the following...

Any ideas?
Let me check, I'll come back to you today or tomorrow....

 

[Tonot1]

Just tried the update via the GUI on an RBS50v2 running the previous mod'ed 2.7.5.4 firmware and got the following...

Any ideas?

When doing my initial "testing and delivery of the hackedf firmware", I just used the new firmware-versions and updated them by GUI, BUT the device was still a ROUTER (not hacked)...

Okay, did some limited checking...
The impression I'm getting from these limited tests is that the "hacked firmware" cannot be updated by whatever firmware (hacked or original) through the GUI.... I may be wrong, but that's the first thing I noticed. I did my first tests with an RBR50 with an older hacked firmware and tried what youy did: it did not work...
I then tried ithe same with an older hacked firmware and got the some result.
To me that indicates that the hacked fiermware cannot be updated through GUI.

But, you can update through the TFTP-process. This involves to setupp a computer in your network with static IP-ddress and a TFTP-server, then either:
1) reboot you RBK50 (to become a satellite by this process) and rapidly try to put the new hacked firmware towards the 192.168.1.1 address of your RBK50 (ethernet cable in WAN-port!!)
2) get a serial connection with that RBK50, hold the reset, waiting for "FACTORY MODE".... AND KEEP the reset pushed.... after 5 seconds or so, the RBK50 will then switch and await a TFTP-put (similar as above).
The second option requires connecting 3 pins in the ORBI to a serial converter to USB, but is much more reliable then the first one.
There is also a third option that you can try, based on nr 2, but wiothout need to apply a serial connector:
3) execute nr 2 but KEEP pressing the reset button for at least a entire minute... This will give the same result as nr 2, but without any visual indication. Please note that pressing the reset button an incorrect time MAY cause problems when factory resetting (pressing reset more than 30 seconds, but not more than 34 seconds) Voxel firmware.
The Voxel firmware EXPLICITLY tells you not to factory reset the device. Pressing reset between 30 to 35 seconds may invoke a factory reset.

Maybe I'll do some more investigating, but that may take more than a couple of hours. For now, I'll await any response from you or others before diving into thsi any further.

 

[MR2MK1SC]

Did the update via the TFTP-process and it works like a charm.

Thank you! Thank you! Thank you!

 

[Tonot1]

When doing my initial "testing and delivery of the hackedf firmware", I just used the new firmware-versions and updated them by GUI, BUT the device was still a ROUTER (not hacked)...

Okay, did some limited checking...
The impression I'm getting from these limited tests is that the "hacked firmware" cannot be updated by whatever firmware (hacked or original) through the GUI.... I may be wrong, but that's the first thing I noticed. I did my first tests with an RBR50 with an older hacked firmware and tried what youy did: it did not work...
I then tried ithe same with an older hacked firmware and got the some result.
To me that indicates that the hacked fiermware cannot be updated through GUI.

But, you can update through the TFTP-process. This involves to setupp a computer in your network with static IP-ddress and a TFTP-server, then either:
1) reboot you RBK50 (to become a satellite by this process) and rapidly try to put the new hacked firmware towards the 192.168.1.1 address of your RBK50 (ethernet cable in WAN-port!!)
2) get a serial connection with that RBK50, hold the reset, waiting for "FACTORY MODE".... AND KEEP the reset pushed.... after 5 seconds or so, the RBK50 will then switch and await a TFTP-put (similar as above).
The second option requires connecting 3 pins in the ORBI to a serial converter to USB, but is much more reliable then the first one.
There is also a third option that you can try, based on nr 2, but wiothout need to apply a serial connector:
3) execute nr 2 but KEEP pressing the reset button for at least a entire minute... This will give the same result as nr 2, but without any visual indication. Please note that pressing the reset button an incorrect time MAY cause problems when factory resetting (pressing reset more than 30 seconds, but not more than 34 seconds) Voxel firmware.
The Voxel firmware EXPLICITLY tells you not to factory reset the device. Pressing reset between 30 to 35 seconds may invoke a factory reset.

Maybe I'll do some more investigating, but that may take more than a couple of hours. For now, I'll await any response from you or others before diving into thsi any further.

I've done some more testing....
Updates via GUI will ONLY be accepted when the firmware is actually for an RBS50... Hacked RBS50 firmware is always identified as an RBR50 (done deliberately), so ti will NOT pass the firmware check.
This applies to both Netgear as Voxel firmware.....
Sorry, once you "tricked" your RBR50 into an RBS50, you cannot upgrade to other firmware via GUI, BUT TFTP WILL work....

And YES, all of your settings will remain intact when doing an upgrade via TFTP

 

[Tonot1]

Perhaps a small summary for those who aren't yet upo to speed about the details for converting RBR50's to RBS50's.
Netgear started out with the RBR50 a long while ago, then came with the RB50V2.....
Why?

The original RBR50 (also called the RBR50V1) was quite easily converted to an RBS50:

1. Either use telnet or serial converter to get connected to a shell on the RBR50.
   1. Tip: update (downgrade in essence) the RBR50 to an older firmware, like the well-known 2.5.1.6, so that you can enable telnet again.
2. The ORBI router and Satellite are nearly the same (and use in essence the same firmware too, I guess). So we need to trick the RBR50 to think it's an RBS50. To do so:
   1. Enter this command: cd /sbin; artmtd -r board_data; artmtd -r board_model_id
   2. Make a note of the outcome. It should be something like 1101 and RBR50. RBR50 speaks for iotself, 1101 is the secret code for a router.
   3. Now change both values: RBR50 will bncome RBS50 and the code 1101 (or whatever code you noted down above) will be incremented by 1: 1101 will become 1102.
   4. Make the changes with these command:
      1. artmtd -w board_data 1102
      2. artmtd -w board_model_id RBS50
   5. Check to see if your changes have persisted, so check again with rthe command above (artmtd -r board_data; artmtd -r board_model_id)
   6. You should see the values you entered just ago (1102 and RBS50).
   7. reboot by entering the command reboot
3. Wait.... wait.... wait..... wait..... This will take over 5 to 10 minutes.... The "Satellite" will come back alive with the same SSID and KEYS as before. You can now ad it to your own RBR50 router noprmally.
4. The nice thing of this V1 is that you can update the Satellite normally to all types of Satellite firmware you like. Automatic update will work as well, no problems.

Netgear probably found out that the V1 was too simple to convert, so they started to deliver the V2 of RBR50. Both the router and satellites were still nearly identical looking at the hardware and also share the same firmware (Is my assumption). Yet they use different hardware and a more advanced way of checking whether the device is a router or satellite: during startup, the firmware checks some hardware defined values to see if it is a satellite. After that check, it just different parts of the firmware depending on the outcomwe of that check. Hence the solution used for V1 did not work anymore.....

Smarter people than me found a way to trick the firmware again; although it requires a bit more effort AND you're at risk to semi-brick the converted RBR50 when updating to stock firmware.
How does the trick work?

1. Obtain the Router firmware (RBK50)
2. Unpack the firmware using firmware-mod-kit
3. Make a small change to 1 program in the firmware at the part where it checks the hardware-code; simply always return "RBS50" in that check.
4. Repack the firmware
5. Identify the new image as valid for RBR50 (after all, when starting up, the hardware-ID is still an RBR50) and generate a new checksum (see dni_util to do so).
6. This firmware can be applied through the GUI when the router has not been updated to a Satellite (since it's hardware is identified as an RBR50, which matches the ID in the hacked firmware). Once you converted it to to a Satellite the device now acts as an RBS50, so the GUI checks any new firmware to see whether it indeed is an RBS50. Prevent automatic updates, because that will result in a semi-bricked RBS50 (not sure why, yet); it has something to do with missing GUI-settings in Satellite where rotuer needs these).
7. You can safely update a converted (RBS50 (a tricked RBR50) through TFTP....

Please note that I used a couple of times the verb "semi-bricked"...... Although you'll always run the risk something goes wrong during update, in many occasions you can use TFTP to revive the device again.... Obviously, I cannot give any guarantees on a proper conversion, yet I've made conversions from both V1 and V2 routers to Satellite and back (both Netgear and voxel firmware).