Recovering a severly bricked DG834GT / Adding a serial port

[mrmt32]

If for some reason you are unable to recover your DG834GT using the Netgear recovery tool (see http://www.skyuser.co.uk/forum/extra...-password.html and http://www.skyuser.co.uk/forum/askin...gt-router.html) then there are two other methods to re-flash the router. Unfortunately both methods require some soldering skills.

The first method (and the one covered here) is to add a serial port. This will allow you to access the CFE console (the CFE is a bit of software that runs before the router's main firmware is loaded), from this you can flash new firmware to the router. Adding a serial port also gives you access to the linux command line without having to enable telnet. This method of recovery will work in most cases, it will only fail to work if the CFE has somehow been corrupted. This method can also be done very cheaply (or free if you are able to salvage some of the parts!).

The second method is to add a JTAG port, this allows you to directly write to the router's flash and will work even if the flash (and the CFE) has been completly erased. To use this you would need to buy or make a JTAG interface for your PC (all the cheap ones require a parallel port and take a very long time to flash; as I don't have a parallel port this method wont be covered here).

Disclaimer

Only use this as a last resort! Adding a serial port will definitely void any warranty you have and you might just end up breaking your router further if something goes wrong.

Taking apart the router

The router is held together by 4 screws located under the rubber feet. The feet just unclip (they are not glued down) and can be pulled off easily. Once the screws are taken out the top can be taken off exposing the router's circuit board.

Adding a port to the router

The serial port on the router is located on the bottom left of the board and is labelled 'J503'. You will either need to solder some wires to it or solder a connector. Soldering a connector is preferable as it would allow easy removal of the serial port. I used part of an IC socket as a make-shift connector (which works very well!).

The hardest part of this is removing the solder from the holes, to do this you will probably need to use a solder sucker or wick (there are many guides on the internet showing how to do this, just search for 'desoldering').

Once you have removed the solder you can solder on your connector/wires. This will then connect to the circuit you make in the next step. The board should then look something like this:

Creating the level converter

The serial port on the router uses different voltage levels to a computer serial port so connecting the router directly would at best not work and at worst completely destroy your router. The levels can be converted using a simple circuit based around the MAX3232.

To make this circuit you will need the following parts:

• MAX3232 - You can order a free sample from http://www.maxim-ic.com/samples/
• 5 Capacitors (they need to be greater than 0.1μF)
• Serial port connector/Cable
• PCB / Veroboard / Breadboard
• (Optional) IC Socket

The circuit diagram I used is below:


The values of the capacitors need to be above 0.1μF; I used 1μF electrolytics. These can be salvaged from most electronic devices or bought very cheaply.

The connector labeled 'TTL' in the schematic is where the circuit connects to the router. The pins match up with the router as follows:



Constructing the circuit should give you something like this:


TIP: To make the twisted wires shown in the picture, clamp one end of the wires and place the other end in an electric screwdriver/drill, turning the drill on will twist them together firmly!

For the connector on the router side, I just used another part of an IC socket, the cables could just be pushed in and did not require soldering:

Connecting to the Computer

In order to talk to the router using the serial port you will need some software. PuTTY (PuTTY: a free telnet/ssh client) works well for this and is completely free! Once you have downloaded PuTTY, run it and set it up as shown in the pictures below then click 'Open':


Select serial, type in the name of the COM port, and use 115200 as the speed


On the 'Serial' page select the above settings

After clicking Open you should be greeted by a black screen. Now is the time to plug in the router. Make sure the router is unplugged and connect your circuit to the router and the PC. Now you can plug your router in, with any luck you should get something like the following coming up in PuTTY:

CFE version 1.0.37-5.11 for BCM96348 (32bit,SP,BE)
Build Date: Tue Apr  4 10:20:27 CST 2006 (root@localhost.localdomain)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena.
Initializing Devices.
internal_open
bcm6348enet: init_emac
CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz

Total memory used by CFE:  0x80401000 - 0x8051C940 (1161536)
Initialized Data:          0x80418650 - 0x804192F0 (3232)
BSS Area:                  0x804192F0 - 0x8041A940 (5712)
Local Heap:                0x8041A940 - 0x8051A940 (1048576)
Stack Area:                0x8051A940 - 0x8051C940 (8192)
Text (code) segment:       0x80401000 - 0x80418644 (95812)
Boot area (physical):      0x0051D000 - 0x0055D000
Relocation Factor:         I:00000000 - D:00000000

Board IP address                : 192.168.1.1:ffffff00
Host IP address                 : 192.168.1.100
Gateway IP address              :
Run from flash/host (f/h)       : f
Default host run file name      : vmlinux
Default host flash file name    : bcm963xx_fs_kernel
Boot delay (0-9 seconds)        : 1
Board Id Name                   : 96348GW-10
Psi size in KB                  : 16
Number of MAC Addresses (1-32)  : 2
Base MAC Address                : ---
Ethernet PHY Type               : Internal
Memory size in MB               : 16

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0

If you got something like that then your circuit works! Otherwise check your connections/soldering and try again.

Flashing the Router

Firstly you will need to prepare a firmware image. The image accepted by the CFE is slightly different to a normal image.

If you want to flash the latest sky firmware then you can download the modified image from http://www.ph-mb.com/dg834gt_serial/bcm963xx_fs_kernel. If you want to flash a different image you can use a tool I created to convert a normal image into the correct format. You can find that tool at http://www.ph-mb.com/dg834gt_serial/..._extractor.exe. To use it just browse for the image, select "Kernel + FS" and click extract.

Now we need to temporarily set up a TFTP server for the router to download the firmware from. You can use tftpd32 (TFTP server) to do this.

Before starting the TFTP server you need to temporarily change your computer's LAN IP address to 192.168.1.2 ([Tutorials for Dummies - 27/03/2008] – How to change your LAN IP address? Miyuki’s Random). Once you have done this, start tftpd32, click browse and point it to the folder which contains the bcm963xx_fs_kernel file you either downloaded or created earlier. In the "Server Interface" box make sure that '192.168.1.2' is selected.

We can now move on to actually flashing the router! First connect your router's serial port to your computer as before and open PuTTY (using the settings previously described). Also connect your computer to one of the router's ethernet ports.

Now you need to turn the router on and press a key within 1 second of "*** Press any key to stop auto run (1 seconds) ***" being displayed in PuTTY.
This should give you a "CFE>" prompt.

At the prompt type in "flashimage 192.168.1.2:bcm963xx_fs_kernel" (without quotes) and press enter. With any luck the router will now start flashing the new firmware and show something similar to the following:

Loading 192.168.1.2:bcm963xx_fs_kernel ...
Finished loading 2425091 bytes
..........................

If the firmware flashing is successful you will be greeted by a load of text and finally "Please press Enter to activate this console.". Your router should now work!

Accessing the Linux Console

Pressing enter after the router has fully loaded will give you access to the linux console and give full access to your router.

[joss]

Great post, but, Just bin it and get one of fleabay for a tenner

[mrmt32]

Great post, but, Just bin it and get one of fleabay for a tenner

You could, but where would the fun be in that , anyway if you have the parts already and have the experience to make the circuit it can be a relatively easy and cheap/free fix. I just did it because I wanted to play around with flashing some modified firmwares without risking bricking my router.

[dholdi]

My initial reaction was the same as Joss, but as you say wheres the fun. Excellent post, well written and with good photos. Just the pic for the circuit diagram doesnt seem to be working. May try it myself

[mrmt32]

My initial reaction was the same as Joss, but as you say wheres the fun. Excellent post, well written and with good photos. Just the pic for the circuit diagram doesnt seem to be working. May try it myself

Ah, odd, it was an attachment but it seems to have disappeared. I have re-uploaded it now .

[dholdi]

Yep, thats working fine now.

[chud]

mrmt32, looks like your green 6.3v cap nearest the LAN ports has gone domed and needs replacing! (although it may be the light reflecting)
[the DG834's with TEAPO caps generally fail], that green one and the two 16v 1000uF ones next to each other are generally the ones that fail.

[cjard]

I have a DG834GSPv3 router here that has a custom virgin firmware on it. Virgin seem to have disabled all options to get a different firmware onto it (it doesnt blink power/tick lights alternately: it just blinks tick, it doesnt accept web page firmware upgrades, recovery utility doesnt see it, and it doesnt seem to be running a tftp server) so I was wondering..
If I sent you this router would you be prepared to solder your circuit onto it and try and flash a DGTeam firmware onto it this way? I'll Paypal you some beer money whether you succeed or not..

If you fancy giving it a go, drop me a PM

Cheers
CJ

[Smithy99]

Would it not be simpler/cheaper ans easier to just buy one from e-bay. They go for a few £££'s.

http://cgi.ebay.co.uk/NETGEAR-ROUTER...item20b02aa2e4

3 hours left only £1 bid on it.

[cjard]

Just watch that one turn up and be a Virgin DG834 too but yes, it would be simpler and cheaper to buy another..

..but to quote an earlier post "where would be the fun in that?"

I've given a fiver for a V2 one, but in the interests of having a play, the Virgin V3 one I have here is still offered to anyone who has more time/interest than I and an inclination to beat the claim I've read so many times now "the Virgin ones cannot be reflashed"