Reply

Netgear R8500v1 Brick Recovery getting checksum error

ibwebb86
Aspirant

Netgear R8500v1 Brick Recovery getting checksum error

Hello Community, 

 

Picked up a Bricked R8500v1 off ebay that I've been working on for awhile. I was able to follow other posts and get the original firmware working, but with a twist. 

 

So instructions here (https://community.netgear.com/t5/Nighthawk-WiFi-Routers/R8500-bricked/td-p/1183741) almost worked for me. After I did the final 3 reboots and waited over 5 mintues nothing came up. 

 

I then started playing around with the CFE help just to see what options I had. I ran a boot or batch I can't remember exactly (boot r85.chk) followed by go and the firmware came up. 

 

I was able to access 192.168.1.1 from my computer and get inside the GUI. Thought everything was good to go. Then after unplugging my serial cable and getting it put back together, the next boot went right back into the loop. It was as if the file wasn't perminatly writting to the flash. No not unplugging it isn't an option Smiley Wink !

 

So researching some more post, I start learning how to use the flash command in the CFE. I tried flashing base firmware, Kong's DD-WRT file (saw posts about the nvram settings getting adjusted) nothing works. Everything looks like it takes, but when the router goes to boot-up, it gives the invalid checksum error. 

 

Back to researching once again, and I see posts about the TFTP software not transfering the file right. They even go as far as to blame the OS. So I have tried Windows 10, Windows 7, Ubuntu, and my MAC. (To be fair and in full disclosure Ubuntu and Windows 7 were on my MAC's Parallels VM software, but the Windows 10 is a stand alone machine) 

 

As for TFTP software I used the Windows 10 CMD (admin mode which I've had the most sucess with. Used it to get the firmware running with batch or boot command), TFTP32D, Pumpkin, and for Ubuntu I'm using a xinetd service. 

sudo apt-get install xinetd tftpd tftp

 

So while trying to continue my research I notice a lot of this stuff is getting pretty old. I was hoping for some help or maybe somewhere I can referance how to fix this. I haven't really been able to find any good documentation, just going off what I see in posts. 

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 1 of 15
JamesGL
Master

Re: Netgear R8500v1 Brick Recovery getting checksum error

Message 2 of 15
ibwebb86
Aspirant

Re: Netgear R8500v1 Brick Recovery getting checksum error

I have used the tftp2 program, but can't say I've followed this order of operations yet. I do always have a question about the instructions. When they mention steps to turn the router off...

Turn router OFF for 10 seconds.
Hold down the reset button on the back of router with a paper clip.
Power ON the router while holding down the reset button.

Are they wanting me to unplug the router from the power source or use the power switch? Also if you've seen this sucessful; what operating system did you get it to work with? Not implying its need for me to use the same OS. Just curious is all.
Message 3 of 15
ibwebb86
Aspirant

Re: Netgear R8500v1 Brick Recovery getting checksum error

Thank you for the reply James. I haven't gotten a chance to try these steps exactly yet. I will tonight after work. I just wanted to post something really quick. Researching I noticed a lot of people have been looking for documentation on CFE (Common Firmware Environment). I found this while researching and wanted to share this link with some good info. 

 

https://wiki.openwrt.org/doc/techref/bootloader/cfe 

Message 4 of 15
ibwebb86
Aspirant

Re: Netgear R8500v1 Brick Recovery getting checksum error

Just going to write this out. Tell me if I missed anything or if you would like clarification on how I completed a step.

 

First I downloaded TFTP2

Next I download and un-zipped the original firmware for the R8500 to get R8500-V1.0.0.28_1.0.15.chk

Then I set my LAN connection going to Port 3 on the R8500 to a static IP of 192.168.1.10

Followed by running the TFTP2 program, selecting the original firmware, typing password for the password, and setting the server to 192.168.1.1

 

Once I got to step 10 I couldn't follow the exact instructions anymore. I have seen a blue lights, orange lights, and white lights from this router, but I have never seen green. I followed the instructions perfectly.

 

I do understand the task; its trying to get it into TFTP recovery mode. I will say once I let got of the reset button the orange light started giving a steady flash. I know this to be recovery mode from past attempts. Knowing that I just continued as if the light had flashed green.

 

So next step was to hit upgrade. 3 tries and it was unable to get a response from the server. I checked wireshark. It sent 4 write requests to the R8500 with no response, so I hooked my serial cable back up and went to Putty.

 

Oppps, not going to re-write this because someone might have the same problem. After confirming through Putty it was in TFTP mode but not responding. I remembered I had a previous issues like this. I found out it was my computer's ARP table storing the 192.168.1.1 address for a different MAC.

I ran this in command prompt as administrator “ arp -d 192.168.1.1 “ no quotes of course.

 

Then I tried again leaving the serial port on so I can see what it does.

I received and I/O error using TFTP2.

 

“Taken from Putty”

                Start TFTP server

                Reading :: Failed.: I/O error

                Reading ::

 

As mentioned I had this problem before. Maybe it’s a Windows 10 issue I can try again later with Windows 7 VM, but when researching it was suggested to try the windows TFTP using cmd. (needs to be turned on under windows and features)

 

I opened my cmd window as admin again. I tpyed “cd ..” until I was at the C: directory. (two times for me)

I then moved my firmware file to my C: drive not placing it in any subfolders. “These are pretty close to the instructions listed on – (https://community.netgear.com/t5/Nighthawk-WiFi-Routers/R8500-bricked/td-p/1183741) in my first post. I didn't however, rename the file because I wanted it the way netgear had it originally.

 

Then I typed " tftp -i 192.168.1.1 PUT R8500-V1.0.0.28_1.0.15.chk "

 

 

From CMD:

                C:\>tftp -i 192.168.1.1 PUT R8500-V1.0.0.28_1.0.15.chk

                Transfer successful: 28123194 bytes in 100 second(s), 281231 bytes/s

 

From Putty:

                Reading :: Done. 28123194 bytes read

                Programming...done. 28123194 bytes written

                Skip writing CHK checksum for nflash.  (Any idea why it would skip this?)

                Digital core power voltage set to 1.05V

                Decompressing...done

                Digital core power voltage set to 1.05V

 

So this time it’s not giving the checksum error, however it is in a bootloop. Looks like the firmware tries to start up…

               

               Checking crc...Loader:raw Filesys:raw Dev:nflash0.os File: OptionsSmiley Sadnull)

               Loading: ..... 5461920 bytes read

               Entry at 0x00008000

               Closing network.

               Starting program at 0x00008000

 

But then gets errors and goes into a boot loop….

 

                insmod: dpsta.ko: no module by that name found

 

                [   15.040000] Kernel panic - not syncing: Fatal exception

                [   15.050000] [<c0058464>] (unwind_backtrace+0x0/0xe4) from [<c03dd6a0>] (panic+0x68/0x194)

                [   15.060000] [<c03dd6a0>] (panic+0x68/0x194) from [<c0055568>] (die+0x194/0x1dc)

                [   15.060000] [<c0055568>] (die+0x194/0x1dc) from [<c00597d0>] (__do_kernel_fault+0x64/0x84)

                [   15.070000] [<c00597d0>] (__do_kernel_fault+0x64/0x84) from [<c00599b4>] (do_page_fault+0x1c4/0x1d8)

                [   15.080000] [<c00599b4>] (do_page_fault+0x1c4/0x1d8) from [<c00513c0>] (do_DataAbort+0x30/0x98)

                [   15.090000] [<c00513c0>] (do_DataAbort+0x30/0x98) from [<c04c8f4c>] (__dabt_svc+0x4c/0x60)       

 

Then finally goes to..

 

                [   15.330000] NVRAM LOG 16384 18297 34681

                [   15.530000] Rebooting in 3 seconds..Digital core power voltage set to 1.05V

 

Something else I noticed when going over the Putty session I'm curious about. I noticed it says hwrev=MP2. Is this telling me this is a version 2 R8500? (I've only been using v1 firmware) I didn’t see a version number next to the model number on the casing so I assumed it was version 1. I was also under the impression v2 has a blue light going accross it on the top. I do not have that extra blue light. Then again I did buy this bricked from a stranger on Ebay because I wanted a challenge.

 

               Reading board data...

               hwtype=R8500<,hwrev=MP2

 

Also not sure where it’s getting this MAC address..

               MAC address of 1st STA connected: B8-6C-E8-11-E5-3A <- not my computer or router MAC

 

The router’s MAC addres is 10Smiley Very HappyA:43:B9:47:60 and my computer connected to the LAN ends in 44-D4. I also read posts saying something about the NVRAM settings getting changed from 3rd party firmware. I checked and I saw that mystery MAC address when I did "nvram show" in CFE.

 

                1:macaddr=10Smiley Very HappyA:43:B9:47:5F

                access_mac_record=B8-6C-E8-11-E5-3A

 

So not a checksum error did show this time, but still in a boot loop. Again I can get anything you need Putty Session text, Wireshark capture of the TFTP put. NVRAM settings. Just ask. Be happy to take screenshots to confrim program settings like the TFTP2 and Putty. 

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 5 of 15
ibwebb86
Aspirant

Re: Netgear R8500v1 Brick Recovery getting checksum error

Just from other research I have also tried going the other direction to get firmware. (Having the router request it from the computer)

 

From CFE I earsed NVRAM first thing

 

              " nvram erase "

 

 Once the nvram is cleared I then attempt to flash my firmware. I have tried so many veriations of the flash options. This was my first time trying the offset. 

 

               flash -forceflash -noheader -writechksum -offset=0x80000 192.168.1.10:R8500-V1.0.0.28_1.0.15.chk nflash0.os

I got

               CFE> flash -forceflash -offset=0x80000 192.168.1.10:R8500-V1.0.0.28_1.0.15.chk nflash0.os

               Reading 192.168.1.10:R8500-V1.0.0.28_1.0.15.chk: Done. 28123194 bytes read

               Programming...done. 28123194 bytes written

 

Then it just sat at the CFE prompt. I powered down the router for 10 seconds, then with paperclip inserted started it back up. Waited for it to go through 3 reboots, then I let it go. The next boot cycle it went directly into TFTP recovery mode with checksum invalid error I originally posted.

 

               Device eth0:  hwaddr 10-DA-43-B9-47-60, ipaddr 192.168.1.1, mask 255.255.255.0

        gateway not set, nameserver not set

               Checking crc...Boot program checksum is invalid

               Device eth0 has been deactivated.

               Device eth0:  hwaddr 10-DA-43-B9-47-60, ipaddr 192.168.1.1, mask 255.255.255.0

        gateway not set, nameserver not set

               Start TFTP server

               Reading ::

 

If I use the Windows 10 cmd prompt again to PUT the firmware via tftp, it does the same thing as my above reply.

 

 

Bootcode Boot partition size = 524288(0x80000)

Message 6 of 15
JamesGL
Master

Re: Netgear R8500v1 Brick Recovery getting checksum error

Hi ibwebb86,


When setting a static IP address on the computer, can you still ping the default gateway? If not, which means the router is no longer reachable. You may need to contact support for replacement.

Message 7 of 15
ibwebb86
Aspirant

Re: Netgear R8500v1 Brick Recovery getting checksum error

Sir do you work for Netgear? I am going to guess and say YES since you have obviously failed to read anything I've posted. 

 

If you had read it, you would know I am able to not only able to PING, but sucessfully transfer the file via TFTP. The problem is the file doesn't seem to properly write to flash.

 

You would have also picked up that I got this router off Ebay, and highly doubt Support would help me.

 

I was merly reaching out to the community to see if anyone has any tricks I haven't tried yet.

 

If you aren't going to take the time to read, don't reply.  

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 8 of 15
doitwisely
Aspirant

Re: Netgear R8500v1 Brick Recovery getting checksum error

Any luck on the bootloop issue? I am having the same exact problem as you?

Message 9 of 15
firnam
Aspirant

Re: Netgear R8500v1 Brick Recovery getting checksum error

I bought a used R8500 with a boot loop problem.
Can anyone technically savvy share R8500 nvram contents? Without your WiFi key and MAC address of course.

The Printed Circuit Board has an ID: U12H335T20_NETGEAR. Anyone familiar with this?
But CFE command "nvram get board_id" shows U12H334T00_NETGEAR

"nvram show" lists a wireless key that's different from one on bottom label. Some other parameters are blank
Maybe previous owner corrupted its nvram and NAND flash?
Also -Netgear WiFi key and MAC address does not match what's on bottom cover. Could previous owner have returned this jacked up router to a store after swapping covers with another R8500?

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 10 of 15
firnam
Aspirant

Re: Netgear R8500v1 Brick Recovery getting checksum error

I found a working "nvram show" dump on DD-WRT site. No need to respond to my nvram request. Thanks to anyone who may have been prepping to do so.

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 11 of 15
michaelkm8
Aspirant

Re: Netgear R8500v1 Brick Recovery getting checksum error

Hey did you ever figure out what the problem is?  I'm having the exact same issue and can't figure it out.  It's missing something, but I haven't been able to find out any other options for loading any missing files or load an exe file or somthing.

Message 12 of 15
michaelkm8
Aspirant

Re: Netgear R8500v1 Brick Recovery getting checksum error

I actually found a workaround that allowed me to download firmware and get online with the router. I still have some issues, but if you look at my post it will get the router online.

Message 13 of 15
michaelkm8
Aspirant

Re: Netgear R8500v1 Brick Recovery getting checksum error

I found a workaround to get the router online.  Look at my post for the partial fix.

Message 14 of 15
m0h1t
Aspirant

Re: Netgear R8500v1 Brick Recovery getting checksum error

how did you eventually fix the issue? I can't figure the solution from your posts. Did the force flash method work?

I have r6300v2 on which I can only run the stock firmware or OpenWRT(which is no good), everytime I try to flash a custom firmware(DD WRT, Tomato, Merlin) it wouldn't flash completely via TFTP. I'd get a Reading Error I/O.

 

Maybe the offset or forceflash flags could help. I can't find any documentation on it

Message 15 of 15
Top Contributors
Discussion stats
  • 14 replies
  • 8267 views
  • 0 kudos
  • 6 in conversation
Announcements