Trying To Recover My Dead Ax92u

[stalq]

So my router died all of a sudden, well actually it would fail (Only Power & 2.5Ghz Led would be on) then sometimes if left unplugged it would turn on fully functioning until its restarts then die again! This has been happening for a month now. So I decided to check what was happening via a serial connection, now I don't have much knowledge about these things, I had a serial USB adaptor lying around so I thought why not.

Apologies, as I was not able to save some logs as I have no idea how to, I will try my best to explain: (Does putty save logs anywhere?)

1. When the device would fail to work I saw the terminal throwing errors like CRC Uncorrectable Error, Can not read ~some hex code~, In my understanding, it was failing to read from the NAND flash,
-- Prior, I had done many firmware upgrades, the reason being the newer updates would break something so I had to revert back to FW 9177 every time. I noticed it would never fully reset some of my old info would show up in logs, I tried all the methods listed. Even when connected to PC via ethernet the connection name showed is what I set a year ago, sometimes after an upgrade, the connection name would change to my latest wifi SSID and then back to the old one, so some of my settings were still there causing corruption perhaps?

2. In the CFE mode none of the commands I found on the internet worked, typing NVRAM, flash, and show would say an invalid command. The commands I could use were of b,w,f,i, and r where f was I thing to flash via TFTP. how is this possible? I found no clue about this on the internet. Could those be locked in this CFE version or was this due to corrupt NVRAM/nand?

3. Using any reset method would never work even when the router was functioning, only the web reset worked, when I do the WPS method the router would turn off like it's mentioned but when back on nothing resets, the rest button worked though.

4. Now the real problem, while in miniCFE web server I selected the 9177 FW and selected to erase misc partition 2, after this the device opens up with a constant light on LAN no power light or anything, just the LAN led, I can't even get into CFE mode now. Did I wipe out my CFE partition?

Here is what the serial terminal throws:

BTRM
V1.6
CPU0
L1CD
MMUI
MMU7
DATA
ZBBS
MAIN
OTP?
OTPP
USBT
NAND
IMG?
FAIL
----

I am willing to perform all sorts of experiments on it! I also have a jtag cable and programmer if that can work! Just need guidance. Experts out there what should be my next step? Can I flash the CFE partition again and how? I totally belive it was a software issue as the router would turn back on if left for a day or continually pressed on/off. I just could not do anything in the CFE as none of the commands on the internet including this forum worked.

I have seen many experts here on this forum I guess if you all pitch in I might be able to save this device and it could serve as a guide for someone having the same problem. I saw posts on the forum with my exact issue in different models but they all RMA'd or classified their devices as dead, I went a step ahead and made it work! maybe there is a chance.

Sorry for the long post, and yes I tried all the resets listed in this forum Nuclear rests etc, my power adapter in fine, the place where the router was kept has sufficient cooling so it never overheated!

 

[Tech9]

I don't think the problem is in software. Most likely just another RoHS solder victim.

 

[stalq]

I don't think the problem is in software. Most likely just another RoHS solder victim.

You mean some component steered off it's contact? The reason I say its software because I flashed dozens of times and it never used to fully reset, somehow nvram reset never worked for me, so it kept retaining info after every flash until it got corrupted! The serial log showed some of the band blocks where unreadable, then I carelessly went ahead and formated CFE partition so the device now wont boot.

as I mentioned there was no nvram command in my cfe prompt, could be a reason?

 

[Tech9]

Hardware fault. Look for a new router on better price around holidays.

 

[stalq]

Hardware fault. Look for a new router on better price around holidays.

Ahh damn, i really wanted to have a learning experience tinkering it but seems like there is no info related to this device on the internet,

Where I live this modem costs $400+ on sales and is very rare, we only have shirtty routers in the country lol, if I import i have to pay a 150% duty.
My only option is to buy one from amazon and send it to a relative in the US and wait for them to come which wont happen until next year.

Please do suggest me a comparable router.

 

[stalq]

Is it possible to flash the cfe via JTAG from another device, I do have the mac addresses of this device

 

[L&LD]

Have you tried a new known/good power supply for the unit?

 

[smoovie2003]

NAND IMG? FAIL

Hello, Im experiencing a similar problem, my RT-AX92U is in a boot loop, I can flash it by Asus rescue but after reboot it comes back the same, 5GHZ1 led is on and power on led flashes every 15 seconds or so. I have used a TTL Serial interface to get the logs, and comparing to my log, yours says NAND IMG? FAIL, while on mine is NAND IMG? IMGL. I do get a great load of "Uncorrectable ECC Error: intr 0x70, addr=0x00010000, blk=0," so I think something is wrong with the data either in CRE or the other partitions. I think we could try to flash the Macronix MX30LF2G18AC NAND using external programmer, but we need to find a good donor who can give us the full dump. I'll try to open a separate thread on my problem, just wanted to point out that in my logs the NAND IMG? is IMGL while yours says FAIL. Could be a clue. Hope you find a solution to your problem, which could in turn help me solve mine Regards.

 

[stalq]

Have you tried a new known/good power supply for the unit?

Yup the first thing I tried was using a different adaptor, I did mention that my power adaptor is fine, tested via multimeter

 

[stalq]

Hello, Im experiencing a similar problem, my RT-AX92U is in a boot loop, I can flash it by Asus rescue but after reboot it comes back the same, 5GHZ1 led is on and power on led flashes every 15 seconds or so. I have used a TTL Serial interface to get the logs, and comparing to my log, yours says NAND IMG? FAIL, while on mine is NAND IMG? IMGL. I do get a great load of "Uncorrectable ECC Error: intr 0x70, addr=0x00010000, blk=0," so I think something is wrong with the data either in CRE or the other partitions. I think we could try to flash the Macronix MX30LF2G18AC NAND using external programmer, but we need to find a good donor who can give us the full dump. I'll try to open a separate thread on my problem, just wanted to point out that in my logs the NAND IMG? is IMGL while yours says FAIL. Could be a clue. Hope you find a solution to your problem, which could in turn help me solve mine Regards.

That was the same situation my router was in before I erased the CFE partition! Turning on, the Lan light would come on for 1 sec then the power led would turn on, after 3 secs the 2.4Ghz would light constantly with no pings or activity to the router!

Have you tried to go in CFE mode by constantly pressing CTRL+C in the serial console just when you turn on the router? do so and try typing nvram erase then type reboot, this is what I found on the internet it can possibly fix the situation, my trouble was in my CFE mode the nvram command was invalid, all the commands I found on the internet for CFE were invalid for this particular router, I did find a CFE commands guide for this particular BCM chip, I can send it to you if you need it. Try using CFE to tftp a firmware into the router and see if that helps. and do not erase misc partitions 1, 2, and 3, the misc partition 1 is nvram maybe I am not sure where I cross-referenced it to be the nvram, so don't take a risk to erase any misc partition, until an expert pitch in this thread. I belive my cfe was erased when I erased misc partitions 2 and 3.

Also if you can, then please send me the bin file/image of your CFE! That's the one I erased. so I can at least boot the router.

 

[smoovie2003]

Yes, I actually did, and the commands brough be help do not mention the nvram erase one. There is an option to completely erase the nand w - "Write the whole image start from beginning of the flash". Tried to tftp, flashes correctly then the same problem returns. I guess its a different partition that got screwed. I dont know which one is the CFE partition, but judging by the logs, they display this structure:

0x000000620000-0x000005800000 : "rootfs"
0x000005d20000-0x00000af00000 : "rootfs_update"
0x00000f700000-0x00000ff00000 : "data"
0x000000000000-0x000000100000 : "nvram"
0x000000100000-0x000005800000 : "image"
0x000005800000-0x00000af00000 : "image_update"
0x000000100000-0x000000600000 : "bootfs"
0x000005800000-0x000005d00000 : "bootfs_update"
0x00000f600000-0x00000f700000 : "misc3"
0x00000b700000-0x00000f600000 : "misc2"
0x00000af00000-0x00000b700000 : "misc1"

I watched the logs when updating flash by tfpt and noticed it started writing from 0x000005800000-0x00000af00000 : "image_update", I guess my problem is on a different partition. Which one is the CFE?

Ill try to dump it by bytes using "db", but I guess it should be parsed before turning it into a bin file.

 

[Tech9]

Ahh damn, i really wanted to have a learning experience

You have no patience, young padawan.

When the symptom is intermittent operation around room temperature first I would heat up the entire PCB to about 50C and try to power it on. If unsuccessful, I would freeze it in a bag and try again. From experience there is a good chance it will boot normally cold or hot. Right now the router is in unknown state and it makes it hard to impossible to diagnose the main issue. There is no schematics online for Asus routers and you have to follow the clues. Identify visually the components, look for reference design. Almost everything is close to the reference design. If you have patience and time, you can reverse engineer the entire PCB piece by piece. Once you know the hardware is okay, only then you work on the software.

 

[L&LD]

@stalq, note that a multimeter doesn't test a power supply properly. You need a device that tests it under (variable/full) load.

 

[stalq]

Yes, I actually did, and the commands brough be help do not mention the nvram erase one. There is an option to completely erase the nand w - "Write the whole image start from beginning of the flash". Tried to tftp, flashes correctly then the same problem returns. I guess its a different partition that got screwed. I dont know which one is the CFE partition, but judging by the logs, they display this structure:

0x000000620000-0x000005800000 : "rootfs"
0x000005d20000-0x00000af00000 : "rootfs_update"
0x00000f700000-0x00000ff00000 : "data"
0x000000000000-0x000000100000 : "nvram"
0x000000100000-0x000005800000 : "image"
0x000005800000-0x00000af00000 : "image_update"
0x000000100000-0x000000600000 : "bootfs"
0x000005800000-0x000005d00000 : "bootfs_update"
0x00000f600000-0x00000f700000 : "misc3"
0x00000b700000-0x00000f600000 : "misc2"
0x00000af00000-0x00000b700000 : "misc1"

I watched the logs when updating flash by tfpt and noticed it started writing from 0x000005800000-0x00000af00000 : "image_update", I guess my problem is on a different partition. Which one is the CFE?

Ill try to dump it by bytes using "db", but I guess it should be parsed before turning it into a bin file.

Strange that 99% of the internet is filled with CFE commands like NVRAM reset and flash commands, while our unit does not recognize any of them, I have attached a command help guide for our CFE if it helps, or if anyone can pitch in on how to access/clear the NVRAM using these commands.

I believe the CFE would be in either of the misc or boot partitions since misc partitions are the ones I cleaned.

PS. I am in no way an expert in coding or electronics, but I have a general Idea and a thirst for learning so I find things out as I go.

 

[stalq]

You have no patience, young padawan.

When the symptom is intermittent operation around room temperature first I would heat up the entire PCB to about 50C and try to power it on. If unsuccessful, I would freeze it in a bag and try again. From experience there is a good chance it will boot normally cold or hot. Right now the router is in unknown state and it makes it hard to impossible to diagnose the main issue. There is no schematics online for Asus routers and you have to follow the clues. Identify visually the components, look for reference design. Almost everything is close to the reference design. If you have patience and time, you can reverse engineer the entire PCB piece by piece. Once you know the hardware is okay, only then you work on the software.

hahah you are right, I need to stop jumping around

Interesting, I never thought about heating or freezing, (took notes). Currently, the situation of the device is, it is not booting at all because ofcourse I erased the CFE partition, first I need to put that back in then I will be able back to the situation where it would boot, I could access CFE and upload firmware, but the router won't start. Your heating tip gave me an idea, I have a friend with a re-balling station, and I am 100% sure its big enough to house this circuit, so I will give him a visit.

But know this I am not giving up on fixing this haha, too many similar problems on the internet and no one even hinted at solving it, but at least if I am not able to, I will have some clues along the way that can help someone in the future,

So please grant us your divine enlightenment from time to time

and apologies for the delay in response I was out on a business trip! Luckily, found a dirt cheap AmpliFi HD there for around $30, the ring light does not work but the unit looks fresh, worked on the first boot, and I can assure you it has a better range than the Asus one, but 0 features, none at all. I miss my Asus now.

 

[stalq]

@stalq, note that a multimeter doesn't test a power supply properly. You need a device that tests it under (variable/full) load.

Yes makes sense, I did try another power brick to see if it boots but that is when it was in CFE mode, then I just used the old one for the rest of the time, alright then this is the first thing I will do after flashing the CFE, thanks