RT-N16 Bricked

[splfriends]

Hi Guys,

Need help in recovering my RT-N16, its bricked by power fluctuations I believe. Could not enter into rescue mode. Completed 30-30-30 procedure. Only power LED glows, wifi LED glows for some seconds while try to enter rescue mode. I've only serial access to router (TTL - USB adapter). Following is current scenario.While try to enter Recover mode, LED blinks SLOWLY, but TFTP server fails to load.
If I try normal boot following errors are shown during booting.

Loader:raw Filesys:tftp Devnull) File:: Optionsnull)
Loading: TFTP Server.
Failed.
Could not load :: Error
Loader:raw Filesys:raw Dev:flash0.os File: Optionsnull)
Loading: .. 5100 bytes read
Entry at 0x80001000
Starting program at 0x80001000
start_kernel
Linux version 2.6.22.19 (root@asus) (gcc version 4.2.4) #1 Fri Jan 9 00:48:28 EST 2015
CPU revision is: 00019740
Determined physical RAM map:
memory: 07fff000 @ 00000000 (usable)
Built 1 zonelists. Total pages: 32512
Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 512 (order: 9, 2048 bytes)
CPU: BCM4716 rev 1 pkg 10 at 480 MHz
Using 240.000 MHz high precision timer.
console [ttyS0] enabled
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 126136k/131068k available (2535k kernel code, 4780k reserved, 504k data, 164k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
PCI: Using membase 8000000
PCI: Initializing host
PCI: Reset RC
PCI: no core
PCI: Fixing up bus 0
PCI/PCIe coreunit 0 is set to bus 1.
PCI: Fixing up bridge
PCI: Fixing up bridge
PCI: Enabling device 0000:01:00.1 (0004 -> 0006)
PCI: Fixing up bus 1
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
io scheduler noop registered (default)
HDLC line discipline: version $Revision: 4.8 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0xb8000300 (irq =

is a 16550A
PPP generic driver version 2.4.2
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V0.18.3
PPTP driver version 0.8.5
Physically mapped flash: Found 1 x16 devices at 0x0 in 8-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
Physically mapped flash: CFI does not contain boot bank location. Assuming top.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Flash device: 0x2000000 at 0x1c000000
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "pmon"
0x00040000-0x01fe0000 : "linux"
0x001723e8-0x01ae0000 : "rootfs"
0x01fe0000-0x02000000 : "nvram"
0x01ae0000-0x01fe0000 : "jffs2"
Found an serial flash with 0 0KB blocks; total size 0MB
sflash: found no supported devices
dev_nvram_init: _nvram_init
_nvram_init: allocat header: 2281406464, size= 32768
sdhci: Secure Digital Host Controller Interface driver
sdhci: Copyright(c) Pierre Ossman
u32 classifier
OLD policer on
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1024 buckets, 8192 max)
ipt_time loading
ip_tables: (C) 2000-2006 Netfilter Core Team
net/ipv4/netfilter/tomato_ct.c [Jan 9 2015 00:48:26]
ipt_account 0.1.21 : Piotr Gasidlo <quaker@barbara.eu.org>, http://code.google.com/p/ipt-account/
NET: Registered protocol family 1
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 164k freed
Warning: unable to open an initial console.
set_action 0
firmwastart_lan: setting up the bridge br0
vlan1: cmd=14: Operation not supported
_ifconfig: name=vlan1 flags=1043 IFUP addr=(null) netmask=(null)
start_lan: setting MAC of br0 bridge to 10:BF:48:xx:xx:xx (edited)
eth1: cmd=14: No such device
_ifconfig: name=eth1 flags=1043 IFUP addr=(null) netmask=(null)
eth1: No such device
_ifconfig: name=br0 flags=1043 IFUP addr=192.168.1.1 netmask=255.255.255.0
_ifconfig: name=lo flags=1043 IFUP addr=127.0.0.1 netmask=255.0.0.0
route_manip: cmd=ADD name=lo addr=127.0.0.0 netmask=255.0.0.0 gateway=0.0.0.0 metric=0
update_lan_state(lan_, 2, 0)
hotplug net INTERFACE=br0 ACTION=add
stop_nat_rules: apply the redirect_rules!
[1 init:start_dnsmasq +12] begin
[1 init:stop_dnsmasq +12] begin
[1 init:stop_dnsmasq +12] end
[1 init:start_dnsmasq +12] end
start_lan 1781
start_services 3371
# wanduck: nvram changed: Don't enable the USB line!
# wanduck: nvram changed: x_Setting=1, link_modem=0.
# wanduck: Got LAN(-1) information:

# Enable direct rule
[1 init:start_dnsmasq +12] begin
[1 init:stop_dnsmasq +12] begin
killall_tk: waiting name=dnsmasq n=9
[1 init:stop_dnsmasq +12] end
[1 init:start_dnsmasq +13] end
start_lan_port(0) 1
decomp: fname=/var/lib/misc/rstats-speed.gz
TZ watchdog
decomp: gzip -dc /var/lib/misc/rstats-speed.gz > /var/tmp/rstats-uncomp != 0
start_pptpd: getpid= 1
load: speed_count = 0
load: read source= save_path=
load_history: fname=/var/lib/misc/rstats-history.gz
decomp: fname=/var/lib/misc/rstats-history.gz
decomp: gzip -dc /var/lib/misc/rstats-history.gz > /var/tmp/rstats-uncomp != 0
decomp: fname=/var/lib/misc/rstats-history.gz
decomp: gzip -dc /var/lib/misc/rstats-history.gz > /var/tmp/rstats-uncomp != 0
load_history: load failed
disk_monitor: starting...
disk_monitor: day=1, week=6, time=0:0.
disk_monitor: decide if scan the target...
disk_monitor: 0: wait_second=86400...
disk_monitor: 1: wait_second=86400...
disk_monitor: wait_second=86400...
disk_monitor: Pause...

start_samba: cmd=smbpasswd "admin" "admin".
vlan1: cmd=14: Operation not supported
eth1: cmd=14: No such device
start_wan: start_wan_if(0)!
[1 init:start_wan_if +15] unit=0.
update_wan_state(wan0_, 0, 0)
convert_wan_nvram(wan0_)
update_wan_state(wan0_, 1, 0)
_ifconfig: name=eth0 flags=1043 IFUP addr=(null) netmask=(null)
start_auth:: done
start_wan_if(): End.
udhcpc_wan:: deconfig
_ifconfig: name=eth0 flags=1043 IFUP addr=0.0.0.0 netmask=(null)
wan_down(eth0)
wan_down(eth0): .
stop_auth:: done
route_manip: cmd=DEL name=eth0 addr=0.0.0.0 netmask=0.0.0.0 gateway=(null) metric=0
update_wan_state(wan0_, 3, 0)
update_wan_state(wan0_, 4, 3)
udhcpc:: deconfig done
No switch interface!!!
wl: wl driver adapter not found
No wireless eth1 interface!!!:
[1 init:init_main +16] main loop signal/state=14
[1 init:init_main +16] main loop signal/state=14
U2EC starting ...

I can access CFE, following provided CFE details. Need help in activating interfaces so that I can flash an initial DD-WRT image(.TRX). CFE allows limited commands. I'm not sure how to activate interface from there.

CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: ¤T 5¤ë 27 16:47:24 CST 2009 (root@localhost.localdomain)
Copyright (C) 2000-2008 Broadcom Corporation.
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
CPU type 0x19740: 480MHz
Tot mem: 131072 KBytes
CFE mem: 0x80700000 - 0x8079B310 (635664)
Data: 0x80731B30 - 0x80734880 (11600)
BSS: 0x80734880 - 0x80735310 (2704)
Heap: 0x80735310 - 0x80799310 (409600)
Stack: 0x80799310 - 0x8079B310 (8192)
Text: 0x80700000 - 0x80731B30 (203568)

CFE> ls
Invalid command: "ls"
Available commands: et, nvram, reboot, flash, batch, go, boot, load, save, ping, arp, ifconfig, help

Not sure about NVRAM, though I can set some parameters, tested it reflected in next booting. I'm not expert in Linux, though could run some commands if guided. Requesting your help in recovering the RT-N16.

 

[splfriends]

Hello Guys, need your help in recovering my router. Thanks

 

[Internet Man]

I tried to help a friend recover their RT-N16 in a similar state a few years ago and could not get it working and he had to replace the device. Upgrading to AC is worth spending the money for though.

 

[splfriends]

Thanks for your suggestion. Do you mean even JTAG can not be useful to recover?

 

[Prowler_gr]

Start from here:
https://wiki.openwrt.org/doc/techref/bootloader/cfe

 

[Pierino]

I recovered an rt-n16 using jtag but it was years ago. When it was worth it. Now, it’s just not economically feasible.
Google dd-wrt rt-n16 jtag.

 

[splfriends]

@Prowler_gr
Thanks for suggestions, but from CFE I'm not able activate interface. As this is old CFE ver. 1.0.37, there are not much of commands available. I believe the NVRAM has been corrupted.

@Pierino
For me JTAG is less than 1/20 of a new RT-N 16 / 66. Thats why I'm still looking for JTAG solution. Only I want ensure the hardware is not damaged, else even JTAG won't be helpful.

 

[Sanna1967]

Completed 30-30-30 procedure

If you are using AsusWrt firmware or Rmerlin, this procedure is useless , this is for Tomato or DD-wrt fw
Try this :
https://www.asus.com/support/FAQ/1000814/
and the tool is here : ( same tool for all models ) :
http://dlcdnet.asus.com/pub/ASUS/wireless/RT-AC3200/Rescue_2000.zip

To clear nvram : Turn on the router with the WPS button pressed, wait 15 secs(leds will flash rapidly), then release WPS button.Wait 2 min and reconfig.

 

[splfriends]

I'm using AsusWrt. only power LED responds.
WPS button could not help, power LED does blink fast.
With RESET button, It does not stay in recovery mode. The power LED blinks slowly till the time RESET is pressed.
I did erase NVRAM in CFE mode that did not help.

Edit:
I've had tried asus discovery rescue tools, did not help

 

[Pierino]

What country do you live in? Curious why you would even consider buying a new rt-n16 in 2018.
I’ve got a Netgear r7000 I can’t get $50 for.

 

[splfriends]

RT-N16/66 almost at same price @180-190$. while JTAG is less than 10$ in India. Also Netgear R7000 @150$.

 

[splfriends]

Requesting someone to please share a stable copy of RT-N16 NVRAM after removing his device specific parameters like MAC address.

 

[splfriends]

Finally some development. I was able to flash DD-WRT TRX from USB
Wifi LED glows, though WiFi yet, no Ethernet either.
Interfaces does not exist error
I'll try upgrade to a later version to see if that helps.
Any help in identifying why Ethernet fails would be very much helpful