Orbi WiFi 7 RBE973
Reply

Re: R8500 bricked

raven_au
Virtuoso

Re: R8500 bricked

Hi,

 

I'm a little confused reading this thread.

Questions have been asked and not answered.

The process that's needed has not been defined.

 

Leading to a whole host of wasted time.

 

But I think the aim here is to connect a USB-TTL serial cable to an R8500 and upload a fresh copy of the firmware, nothing more!

 

To do that you need to break the procedure into steps.

 

The first step is to choose a terminal emulation program and understand how it needs to be configured, connect the USB-TTL cable and work out what USB port the router is connected to, which can be a bit difficult.

 

You need to get a CFE prompt within you serial communications program first, whithout that you cannot proceed!

 

On windows the emulator program is often PuTTY (or similar).

You must select a connection type that is a plain hardwired terminal.

There must be no dail or any other script executed to establish communication.

You must get this setup right first.

 

Typically the communication parameters are 128k, 8, n, 1 (ie. 8 bit words, no parity, 1 stop bit and the baud rate might be different but can be varied to establish communications).

 

You need a USB-TTL serial cable and you need to connect three wires of it to the serial header on the mother board.

Connect only the corresponding transmit, receive and ground of the TTL cable to the corresponding pins on the router mother board.

I see from pictures the pins on the router header are labled R T G V, in that order with router mother board facing you and the header on the edge closest to you.

I assume R = receive, T = transmit and G = ground, match them up, connect them and plug the USB end into a USB port on your computer.

I have always been a bit confused whether it's R <-> R, T <-> T or R <-> T and T <-> R (strickly speaking it should be T(ransmit) connects to R(ecieve) and R(ecieve) connects to T(ransmit)), but that can be worked out by exchanging the R with the T on the router mother board and retrying.

 

There are only three things that need to be identified here, the USB port that the cable is using on the computer, the speed the CFE communicates at (maybe 128k as above, start with that), and whether transmit and receive need to be exchanged on the router mother board.

 

If there is no dialer or other script issuing output to the port you have chosen you should not see continous garbage on the screen, make "certain" nothing is sending anything to the communication port before continuing.

 

Having said that somethimes you will see some garbage on the screen, and occassionally it will continue, but if pressing the enter key a couple of times results in more garbage or nothing at all then, assuming the emulator is correctly setup for a hardwired serial connection, you need to try another combination of the three variables.

 

Start by exchanging the transmit and receive wires, if that doesn't work, change them back and try again with a different USB port selected in the emulator program until you get a CFE prompt.

 

There is no point in doing anything else until you get a CFE prompt, don't waste you time!

 

Notice I didn't talk about changing the baud rate becuase it's least likely to be the problem with the communication but, sometimes, might need to be changed.

If you do, reduce it by half on each try, ie. 128k -> 64k -> 32k -> 16k. Once you get down below 16k the only other likely rate to try is 9600 and it's also unlikley to be 16k.

 

Ian

Message 26 of 121
raven_au
Virtuoso

Re: R8500 bricked


@raven_au wrote:

Having said that somethimes you will see some garbage on the screen, and occassionally it will continue, but if pressing the enter key a couple of times results in more garbage or nothing at all then, assuming the emulator is correctly setup for a hardwired serial connection, you need to try another combination of the three variables.

 



 

Actually just pressing the enter key might not be quite right.

I can't remember now what I had to do to get to the CFE on the R8000, maybe I did need to press ctrl+c a number of times, as described in the linked R8000 serial howto earlier.

 

In any case, when the communication setup is right you should see english text on the screen after powering on the router and no garbage (perhaps a little at the very start).

 

Maybe power off, wait several seconds then power on should be the communication test procedure.

 

Then once you see the english text after power on repeat the power off then power on and use ctrl+c to get the CFE prompt. I'm pretty sure the oppertunity for the ctrl+c escape will not last very long so it needs to be done repeatedly until you get a prompt. If you don't get a prompt and you see the router starting to boot up you've probably missed the oppertunity, try again. You also need to be able to tell the difference between the CFE startup and the router startup. Hopefully, once you get the communication right, it will be fairly obvious.

 

Ian

Message 27 of 121
peter11742
Luminary

Re: R8500 bricked

Thank you.

Very good answer.

I used a meter and I found the T terminal is a ground to the the chassy.

I used the blk wire the rest G V are used for communication T and R.

I like the procedure you are explain very well the steps.

I will follow them and see the results.

Best regards.

peter11742

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 28 of 121
peter11742
Luminary

Re: R8500 bricked

I remeasured the pins with a meter this morning.

G = Ground.

I veryfied the gound we must look the pins from the front of the unit.

Original I measured from the back this was my mistake.

I still have difficulties but I will work them out.

Peter11742

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 29 of 121
peter11742
Luminary

Re: R8500 bricked

Ok some progress.

First the pins #1 R gets the green wire, pin #2 gets the whit wire, pin#3 gets the blk wire.

I start seen information with putty it repeats the procedure continuesly checking CRC.

Now how to stop it or what should I see.

The final is to load the fress firmware for the router.

peter11742

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 30 of 121
peter11742
Luminary

Re: R8500 bricked

Hi All.

The yellow light means no boot the router is not working.

Other news.

I made the putty to work .

Connections for the serial pins:    Serial plug J4  Pin #1 gets green wire Pin#2 gets the white wire Pin #3 gets the black wire.

No connection for red wire do not use it.

Now on serial communication I see good letters but the unit repeats checking CRC loop.

I can stope it by contron c but it gived me double letters in the commands is anything else we can do.

I see the light comming to fix the unit.

peter11742

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 31 of 121
peter11742
Luminary

Re: R8500 bricked

Hi.

Amber light on R8500 router is bad news is bricked.

CFE is a command that putty gives you as a prompt and is called CFE.

Google never gives a software answer fot this CFE acronim.

If you have it let me know how to find it.

peter11742

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 32 of 121
peter11742
Luminary

Re: R8500 bricked

Hi.

I finally have a working unit.

My mistake was I did not see the J4 letters in front of it.

Today I use a good light and I read all the information on J4.

It has the letters R T G V 1 2 3 4 pins.

With a meter I verified the ground is pin #3 with a letter G that gets the blk wire. The letter R it gets the green wire and the letter T gets the white wire.

Now I have the proper english letters.

I get a loop checking CRC I can stop it with cntr C.

I go to my cat 5 connectoion I send the firmware it still times out.

Any help here whow to proceed.

Thanks.

peter11742

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 33 of 121
TheEther
Guru

Re: R8500 bricked

The instructions are in the link I provided you early on.  Here is the direct link.

Message 34 of 121
peter11742
Luminary

Re: R8500 bricked

Hi

These  were the best instructions that I had for long time.

Thank you.

After I got CFE I typed TFTPD in the putty menue.

Then CMD   tftp -i 192.168.1.1 PUT C:\ R8500.chk

I see a yellow light LED #1 on off continues.

I did it twice and I get time out.

If this is the only procedure I will do a few times more maybe I will be lucky.

Best regards.

peter11742

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 35 of 121
TheEther
Guru

Re: R8500 bricked

Did you configure your computer with a static IP address of 192.168.1.2?

Message 36 of 121
peter11742
Luminary

Re: R8500 bricked

Hi.

No I did not yet but I will try in a few minutes and then I will post my finding.

I used 192.168.1.1.

Thank you.

peter11742

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 37 of 121
peter11742
Luminary

Re: R8500 bricked

Hi.

I just did the same procedure this time I tried 192.168.1.2

I have to inform you that the router has 2 IP addresses 54.218.118.186  54.200.99.0

The IP was detected by GINIE.

The unit failed again timed out 2 times.

I hope we will fix it I will try any thing until I will see the green light.

Thank you

peter11742

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 38 of 121
TheEther
Guru

Re: R8500 bricked

I'm sorry, but sometimes it's not clear what you are doing.  When you said you tried 192.168.1.2, what did you mean?

 

It sounds like you tried something like tftp -i 192.168.1.2 PUT C:\ R8500.chk.  That's not what I meant.

 

What I meant what for you to set the IP address on your computer to 192.168.1.2.  Please go and change your computer's IP address to 192.168.1.2.

 

Anyway, let's try a few last things.

 

  1. Perform a 30/30/30 factory reset.  The following may be physically difficult to do with two hands.  You may need someone to assist you.  
    With the router powered on.  Push and hold the physical reset button on the router for 30 seconds.  While continuing to hold the button in, remove the power and wait 30 seconds.  Finally, while still holding the reset button, restore power and wait 30 seconds.  The reset button should be pushed in for the entire 90 seconds.  
  2. Power off the router.
  3. Open two Command Prompts.  In one of them, prepare the command, tftp -i 192.168.1.1 PUT C:\ R8500.chk, but do not start it.
  4. In the second Command Prompt, start the following command, ping 192.168.1.1 -n 10000.  The router is still off, so the first initial pings will fail.
  5. Start up the serial connection on KiTTY or PuTTY.
  6. Power on the router and hit Ctrl-C to get to the CFE prompt.
  7. The pings you started in step 4 may start to succeed here or after step 8.  This is a good sign that the router is listening to 192.168.1.1.
  8. Type tftpd.
  9. Immediately, start the tftp.

Good luck.

Message 39 of 121
peter11742
Luminary

Re: R8500 bricked

My answer to the question is     cmd> tftp -i 192.168.1.2 put c:\ r8500.chk

Now I will start the second procedure.

I wll update here today.

Thanks.

peter11742

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 40 of 121
peter11742
Luminary

Re: R8500 bricked

Thank you.

The procedure 30/30/30 worked I received Transfer successful 30K in 26 seconds.

The board is out in my desk I will reinstall it and see if I get the green led.

The motherboard is installet. I still can ping to 192.168.1.1.

But now I see an orange led flashing.

Is the same problem or a different one.

peter11742

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 41 of 121
TheEther
Guru

Re: R8500 bricked

I hope you miswrote.  The firmware file is roughly 30M, not 30K.  

 

Anyway, try one more factory reset.

 

Alternatively, Ctrl-C at the CFE and type nvram erase.  Then power cycle.

Message 42 of 121
peter11742
Luminary

Re: R8500 bricked

I have some observations experamenting with the r8500.

I get script transfered in deferent times 60 to 106 sec this means we do not load the main booting rom because of the time differences. 

When I did the 30/30/30 start up the unit came back with the red blinking led after the fix. Before I had a solid yellow.

I tried many more times and I found the software after reboot takes out the IP address 192.168.1.1 and we do not know  the new ip and beacause of this the tftp file loading is timing out.

I hope it is me only and no other people have this issue.

In my field we can not have a cat scanner down for more than 4 hours we learned to have dvd's of all the working eproms.

Why the engeneers do not find a similar method that will make life easy and will make netgear a better company.

Let us hope we will continue with a new method after all engineers always are looking for new solutions.

best regards.

peter11742

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 43 of 121
raven_au
Virtuoso

Re: R8500 bricked

@@peter11742, you made so much progress but it seems you are still having problems.

 

But first I think a couple of things need clarification.

 

The CFE is the router boot loader, it is a small sub-system that is responsible for loading the firmware image from persistent storage on the router and starting the router running using the firmware image. It has a number of commands which I'm not familiar with because I have only used it to load a firmware image so it can write it to the router permanant storage.

 

The CFE bootloader is the one used by most, if not all, Negear domestic routers, there are others.

 

Now that's pretty much what you need to do here to becuase what you descibed about the CRC failure sounds to me like the firmware was (is perhaps still) corrupt and must be replaced with a valid image. It is possible the permanent storage is faulty (but I hope not) and the image is not being written correctly.

 

One of the things that puzzles me is why you didn't observe the router boot after successfully having the CFE write a the new copy of the firmware to it.

That would have alerted you to what's happening.

 

Another thing I was wondering about is why you removed the motherboard (it sounds like you did) when probably the best thing to do would have been to leave it in place and connect the USB-TTL cable in oder to monitor the router boot process after replacing the firmware and it sounds like you still need to do that.

 

One thing I have found useful is get a pack of female <-> femaile fly leads from an electronics shop (hopefully with leads with matching colours to the ones you are using) and connect them to the router board in place and have them hanging out so you can connect the USB-TTL device whenever you wish, eventually you might choose to take them off not while your debugiing the device of course.

 

I understand the R8500 has tiny cooling perforations so you probably wouldn't be able to do as I suggest without making a small hole in the router case and you might not want to do that either, anyway ...

 

Please do not use Genie for anything when working at this level, as we can see it gives nonsense information, the IP addresses you mention for example.

 

The IP addresses you mentioned above are publicly routeable addresses and will never be used for the IP address of a domestic router and you are unlikely to use publically routable address in your home network either unless you have an assigned block of public IP addresses. The only publically routable address that is used on a domestic routers is one that is assigned to the WAN interface of the router by an ISP gateway when connecting to the internet.

 

In a domestic environment addresses from private IP address ranges are always used for routers, certainly with those sold at retail outlets.

You can read about the designated private IP address ranges in RFC 1918, a Goggle search for rfc1918 should give a link to the document at ietf.org.

 

One private IP address range is the B class network 192.168 and Netgear routers mostly use the 192.168.1 subnet of that network.

Essentially giving an address range of 192.168.1.1-254, 0 and 255 being reverved for this device (0, haha, whatever this device means) and the network broadcast address (255).

 

Also, a gateway for a network is often given the address 1, so we see Netgear routers default to an address of 192.168.1.1. Clearly you must not have duplicate addresses on the network so you must pick another address for your computer when trying to communicate with the router. I won't go into DHCP becuase the subject here is dealing with getting the router to boot up cleanly and DHCP won't be running on the router until that is acheived.

 

Next your reference to "script" has confused me more than once already but I think you are actually refering to the firmware and that's unexpected.

The firmware file (I think you named it R8500.chk) is binary, it's not a script, it contains (mostly and usually) an operating system kernel and a root file system image.

It's the job of the CFE to write the appropriate parts of the firmware file to the correct sections of persistent storage so the router can use it as its operating system.

There is no script is involved here.

 

So where to go from here?

 

You have already worked out how to communicate with the CFE and to run the tftpd server in the CFE to receive firmware so you have what you need to evaluate the state of the router.

 

I recommend:

1) setup up so you can easily connect the USB-TTL cable.

2) observe what is going on with the router in PuTTY (or whatever your using), both for firmware upload and the boot up of the router.

3) make you evaluation of what problems may exist from 2) above.

 

The thing is if the firmware upload didn't work properly for some reason there should be a message from the tftpd server on the PuTTY screen saying that and if the upload is successful there should be a message saying something to that effect as well, probably saying something about writing the image to permanent storage or the like.

 

So you should know when you have a properly written image and you should be able to observe the router boot into the newly loaded firmare image by observing the output in the PuTTY screen.

 

One thing to you must be sure of though is that the firmware image you have is in fact for the R8500 and that the image is in fact not corrupt.

About all you can do for this is to ensure you have downloaded the correct image from Netgear and, since these are in zip files, if there is no error when extracting the contents of the zip it should be ok. Netgear don't provide checksums for their images unfortunately.

 

Give it a try anyway, see how you go.

 

Ian

Message 44 of 121
peter11742
Luminary

Re: R8500 bricked

Hi. Lan.

Thank you it is a perfect message.

First to monitor the USB cable I use Prolific PL-2303 and it tells me the presense of the cable.

My laptop has an IP: 192.168.1.2 on tcp/IPv4.

My netgear image is good i have 2 of them the same. The R8500.chk is the same with R8500-v1.0.2.80_1.0.71.chk both 29.465 kb.

I so far had good luck with the routr's IP address now is good all the times the last 30/30/30 did it.

Next I will run the software and mark all the interesting locations so we can find how is the system performing.

I will sent a new email as soon I can set up my system as we prefair it closed and the usb cable comming out from the bottom.

The pins are connected and they are in good shape.

Pin #1 green, Pin #2 white, Pin #3 black, Pin #4 red, not connected and taped.

Best regards.

peter11742

 

 

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 45 of 121
peter11742
Luminary

Re: R8500 bricked

Yes it is 29.495 KB or 29.495 M.

It was a mistke.

peter11742

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 46 of 121
peter11742
Luminary

Re: R8500 bricked

Hi All.

I have found that this router has a big issue.

I get a solid orange color for the power led.

Putty is working but every time resets the router so the software reloads again, it is a loop cycle.

I lost the main IP 192.168.1.1

Sofar I did not play for a while and when I started I new I had  trouble.

I did 4 times the 30/30/30 it did not work no IP address no ping.

Houston we have a problem.

What will be the next test, this unit needs the main softwere to be reinstalled and is impossible to reload it.

I see now we have 3 botons in the front is any combenation to force it so we can load the software.

Putty fails after crc all the settings that the software sets and reads back are not excecutable.

Best regards.

Peter11742

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 47 of 121
peter11742
Luminary

Re: R8500 bricked

HI All.

Now I know I have a router that reboots on it's own every 3 minutes.

I diid a good job loading the software.

I hope we have a cure for this.

peter11742

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 48 of 121
raven_au
Virtuoso

Re: R8500 bricked

I don't think that doing the 30/30/30 reset is useful here.

 

I don't think the reset button will do anything until the OS kernel is loaded and listening to button presses.

In any case when working at the CFE level to load the firmware to persistent storage and trying to establish if it has been saved properly it isn't needed.

And that is really what needs to be established at this point before moving on, nothing more.

 

Having said that though I don't know enough about the CFE to say for sure that it doesn't listen for reset button presses and what that will do, so perhaps someone else can answer that.

 

The lights on the router aren't really useful at this level either, all you have to work with at this point is the output you see in the PuTTY screen.

That will be present regardless of IP address or anything else as long as the CFE itself is not faulty which is unliklely (but possible I guess).

 

It sounds like you can easily attach the USB-TTL cable to observe the boot output so what does this show?

I don't use PuTTY so I don't know if it's possible but capturing the boot up output and posting it should give information about what is actually happening, we still don't know exactly what the problem is or at what stage of the boot it's occuring.

 

How did you establish the firmware image was written to persistent storage successfully?

You don't say whether you have observered the CFE transition to loading the kernel and initiating the boot of the router or whether the CFE is issuing a CRC error trying to read the persistent storage and never starting the boot. If it's a CRC error it could be either the saved firmware image or the settings held in the persistent NVRAM storage.

Without that information it's not possible to work out what the problem is.

 

The proplem could be faulty persistent storage and if it is and the CFE can't save a good copy of the firmware it's game over.

The problem could also be faulty persistent NVRAM storage where the router settings are stored but that is usually corrupted settings rather than faulty devices.

As was mentioned before erasing the NVRAM usually fixes that.

 

But we can't know without a boot trace from PuTTY as I desribed above and it might not even be clear then, at least there will be something to work with though.

 

Ian

Message 49 of 121
peter11742
Luminary

Re: R8500 bricked

Lan.

Thank you.

Now the unit goes in a loop and the Putty is not stopping with control C 10 of them.

I think the software is corrupt and the memory storage in the nvram is good.

I need a better software to stop the sequence and try to load one more time the R5800 firmware.

I cannot see the ping on the router's IP address Now i use win 10 and a good laptop.

Let us asume the software is bad in nvram how should I try to load it again.

Also let me know if there is better software than PUTTY.

I also have a different software KiTTY in there I see an option to send a script and when I load the R8500 firmware it goes but I do not know if writes on the nvran.

As far the PuTTY gives the same loop messages it sets an input and receives a bad output all of them are the same.

I did not see any message from the PuTTY after I input the command control c the CFE had no indication on any function was blank.

Best regards

peter11742

 

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 50 of 121
Top Contributors
Discussion stats
  • 120 replies
  • 28925 views
  • 3 kudos
  • 12 in conversation
Announcements

Orbi WiFi 7