How to Unbrick Your Router

If you spend enough time flashing routers and modifying the firmware there come a time when you will brick your router. Something will go wrong and you can no longer use the device. All is not lost though, as there are techniques that can bring your router back to life.

There are two different methods for unbricking a router, ethernet and serial line recovery. They share many things in common but we will look at them on an individual basis.

Ethernet Recovery

This is the first method to try if you have bricked the router. It involves sending commands and data through the network to the router and have it flash itself back to a working state. This can be done if the router software is not totally broken and it is working at least partially.

For best results, you should have only the router connected to your computer and have the computer set to a static IP Address. See Preparing the Computer for information on how to do this.

Start by doing a 30/30/30 reset of the router to clear all memory and try and get the system back to normal. See Preparing the Router for more information on how to do this.

Get an IP Address

The next step is to see if the router is actually on the network. To test this you try to ping it at the IP Address it is set to. By default this address is 192.168.1.1 but you may have changed this during the flash and setup.

To ping the router from your computer go to Start->Run and type in cmd and press Enter. A command line terminal will appear. Type ping 192.168.1.1 or whatever your Ip Address is set to. You should get a response similar to the following.

If you get this then the router is on the network and we can procede to try and unbrick it.

If you get something like this :

then either the router is not working enough to connect to the network or you have the wrong IP Address.

To determine if the IP Address is incorrect we can use a program called IPScan which scans the network looking for active IP Addresses. Put this program into any folder and run it.

Enter a range of IP Addresses where the router may be and click on Start. Here we are scanning from 192.168.1.1 to 192.168.1.100. When scanning is complete it will tell how many devices were active on the network.

Any active IP Addresses will show a blue icon.

If only the router is plugged in to the computer then any active IP Address will be it. Try to ping that address and check the results. If the router response to a ping then you can move on to try and unbrick it.

Failsafe Mode

If you can't find an active IP Address for the router then it is time to try Failsafe mode. Failsafe mode starts OpenWRT in a minimal mode to bypass any problems associated with program add-ons. It also sets the IP Address to 192.168.1.1, regardless of what you may have changed it to previously.

For the TP-Link MR3420, Failsafe is enabled by unplugging the router, plugging it in again and repeatly pressing the QSS button on the front of the router. Continue to click on the QSS button until the SYS light blinks rapidly. The router is now in Failsafe mode. Try to ping the router at 192.168.1.1 and see if you get a reply.

If you can ping the router at 192.168.1.1 you may be able to use putty to access the command line. Using putty is described here. Change the Connection type to Telnet before you attempt to connect to the router. If you can access the command line then type firstboot and press Enter. This may correct problems in the router's file system that are causing trouble. Reboot the router and see what happens.

If that doesn't work use Failsafe and putty once again and type mtd -r erase rootfs_data and press Enter. Reboot once again and see if it works.

Another method is as follows. Use Failsafe and putty to access the command line. Type passwd and press Enter. Enter a password twice when asked to do so. Exit putty. Reboot the router into Failsafe mode again. Use WinSCP to access the router's file system at 192.168.1.1, using root as the user and the password you just entered. Change the folder to /tmp. On your computer, rename the image file to code.bin and then copy it into the router's /tmp folder. Close WinSCP. Use putty to access the command line. Type the following at the command line :

cd /tmp
mtd -e firmware -r write code.bin firmware
reboot

Check to see if the modem is now working.

Hope and Prayer

If you have an IP Address for the router, try to log into the router using the web interface and the IP Address you have. If this works then you can go to System->Backup/Flash Firmware and reflash the router.

If this doesn't work then we move on to other methods.

No IP Address

If you can't get an IP Address for the router you will have to try Serial Line Recovery. This is much more complex and requires some soldering skills.

Using TFTP

When the router software boots up it will, in many cases, look for an image to flash. If this image is presented to it at the correct time it will upload it and then flash the router. The upload method used is TFTP and requires a program on your computer to send the file to the router. A good program is tftp2 and that is what we will use here.

Unplug the router from power as we need to be ready to send the file while the router is booting up. Run tftp.exe and fill in the required information.

Enter the router's IP Address as the Server and the router password as Password. Browse to the image you wish to flash the router with in File. Set the retry value to 20. Click on Upgrade.

Now plug the router back in to power and let it boot up. The tftp program will attempt to send the file to the router at the correct moment during boot up.

Wait for at least 5 minutes before doing anything, unless you receive an error message from tftp. If all went well the router will flash the image and reboot.

If this fails, try booting the router up in Failsafe mode as described above. Use a server address of 192.168.1.1 for this, regardless of the actual IP Address of the router.

Using Wireshark

A program that can help us unbrick the router is Wireshark, a network protocol analyzer. Download and install this program, then run it. It looks at all traffic on the network and shows us what is going on. It can determine if any messages are coming from the router and what IP Address it is looking for.

Unplug the router from power before you start capturing network traffic so you can easily find the information coming from the router.

Click on your Ehternet card to select it and then click on Start. Then plug the power into the router. As the router boots up, network packets will be displayed in Wireshark.

You are looking for messages that say "Who has xxx.xxx.xxx.xxx? Tell yyy.yyy.yyy.yyy". If xxx.xxx.xxx.xxx is not the IP Address of your computer then the router is looking for the wrong IP Address. If you change the static IP Address of your computer to xxx.xxx.xxx.xxx, run Wireshark again and reboot the router you may see a message from the router asking for the file "something.bin". Protocol: TFTP. If so, it is asking for a firmware file to flash the router.

Rename your image file so it is the same as "something.bin" and use tftp to send it to the router when you reboot it. See Using TFTP above for how to do this. Use yyy.yyy.yyy.yyy from the message as the IP Address of the router.

This scenerio does not happen with all routers and does not appear to do so on the MR3420. However, it is worth attempting just in case.

 

Serial Line Recovery

When all the Ethernet methods fail to revive your router, you have to turn to Serial Line Recovery. This is the last resort and requires soldering skills, some electronic parts and a williness to void your warranty by opening the router's case.

The basic scenerio is you attach a serial cable to the circuit board of the router, plug that into your computer and access the U-Boot loader that actually boots up the router. You can then send an image file to the router and have it install it, using the U-Boot command line.

Making the Serial Cable

If your computer had a serial port on it you could just make a cable to attach that to the router. Unfortunately, computers don't come with serial ports any more so we must use something else, like a USB port.

Using a USB port as a serial port is quite easy to do by using a special cable that converts the voltage levels from the USB port to those required by a serial port. The cable is a Nokia CA-42 cable that is available on eBay for $2 to $6, delivered.

If this cable does not come with the driver software you can download it here. Unzip it into a folder and when Windows wants to install a driver for the hardware, direct it to that folder. You may not need to download the drivers as Windows 7 will get it for you automatically. Plug the cable into a USB port and let Windows install the drivers. If it fails then download and install the drivers manually.

For many of the knock-off cables being produced, the drivers don't seem to work for Windows 7. In my case I had to use a computer running Windows XP and the above driver before it installed and worked correctly.

Next we must modify the cable so we can solder it to the router board. Cut off the Nokia "Pop Port" end of the cable, leaving several inches of cable attached to it.

Strip back the insulation and bare the ends of the wires. We must now identify which wire is which. Use a continutity tester to see which color wire is connected to which pin on the "Pop Port".

The pins we are interested in are 6, 7 and 8. Pin 6 connects to the RX pad on the router, pin 7 connects to the TX pad and pin 8 connects to the GND pad. Determine which color wire goes to which pin. In this cable the blue wire went to pin 6, the red wire to pin 7 and the orange wire to pin 8. Remember these colors. The cable is now ready for use.

Connecting the Cable to the Router

The screws that hold the router case together are under the sticky base pads on the bottom of the case. Remove these screws and gently pry the case apart. Remove the circuit board from the case. The serial pads are quite easy to see.

The pinout, from left to right is :

1
2
3
4
TX
RX
GND
VCC

To get the serial connection work reliably, you have to connect a 10k resistor between the TX and the VCC pads. It is easier to work on the bottom of the board, as there are less components in the way.

Connect the wires from the cable to the correct pads on the board. The wire from pin 6 (blue) goes to RX, the wire from pin 7 (red) to TX and the wire from pin 8 (orange) to GND. Use minimal heat to solder the wires and be careful of solder bridges.

Using the Serial Cable

To use the serial cable we must first find out what port the cable was assigned to by Windows. Go to Start->Control Panel->Device Manager for Windows 7 or Start->System->Hardware->Device Manager for Windows XP and expand the Ports section. You will see a USB to Serial entry and a COM number. In my case it was COM3. Remember this port number, as we will need it later.

We will use Hyperterminal to connect to the router via the serial cable. You need to download this if you are using Windows 7. Unzip it into a folder and run it. Hyperterminal is builtin to Windows XP and is available through Start->All Programs->Accessories->Communications.

Unplug the router from the network and unplug the power. Plug the serial cable into the computer and check that the port for it is still the same. Run Hyperterminal.

Make up a name for the connection and click on OK . Next, select the COM port of the USB to Serial adapter.

Click on OK. Then configure the port as follows.

Click on OK. Hyperterminal will now wait for input from the serial cable.

Plug the power back into the router. Information will start to appear in the Hyperterminal window. At one point it will say :

Autoboot in 1 second

Now you must type in tpl to stop the boot process. If you fail to get it in time just unplug the router and start again. You must type fast and it may take a few trys to stop the boot process.

You are now in the U-Boot loader, at its command line.

Flashing From U-Boot

Once you are at the U-Boot loader command line it is possible to upload the firmware to router memory and install it. The memory addresses shown here are for the MR3420 and may be different for other routers. In U-Boot type :

loady 0x81000000

Then in Hyperterminal go to Transfer->Send File. A Save File dialog will appear.

Choose Ymodem as the Protocol and browse to the image file. Click on Send. The image file will be sent to the router. This can take a long time so watch the Hyperterminal window for a response from the router.

When the upload is complete type the following commands at the U-Boot command line.

erase 0x9f020000 +0x3c0000
cp.b 0x81000000 0x9f020000 0x3c0000
bootm 0x9f020000

These commands erase the NVRAM of the router, removing the old image and all its data, then copies the new image into NVRAM and boots the router from the image.

The router has now been flashed and should good to go again.