Orbi RBR50 seems stuck in boot loop

[nanojohn]

Thanks, but I alerady tried all the information in those links. My problem is that the CFE command does NOT come up when connected via serial port. It just keeps auto-restarting on loop without breaking at all for interaction

---

@FURRYe38 wrote:

Might see if any thing here helps:

https://www.snbforums.com/threads/custom-firmware-build-for-orbi-rbk50-rbk53-rbr50-rbs50-v-9-2-5-1-1...
https://community.netgear.com/t5/Orbi/Is-my-13-month-old-RBR50-bricked/td-p/2009904/jump-to/first-un...

---

[Rufus1010]

Hello, how did you get connected to the router via the terminal and the USB / pins ??

via windows ?? or MAC ?? 

as i have the same problem and bought the serial to USB but cannot get any contact via TeraTerm a windows terminal program i installed.

any help is much appriciated here.

[pbarham]

---

@Rufus1010 wrote:

Hello, how did you get connected to the router via the terminal and the USB / pins ??

via windows ?? or MAC ?? 

as i have the same problem and bought the serial to USB but cannot get any contact via TeraTerm a windows terminal program i installed.

any help is much appriciated here.

---

I was using a Macbook Air

It was a long time ago now, but I think I followed the instructions on this page: https://pbxbook.com/other/mac-tty.html 

For the physical serial port connection I used this https://www.snbforums.com/attachments/orbi-serial-port-pdf.23898/

If you're not seeing any console output then I'd recommend double checking which header pins on the motherboard you connected the serial line to.  The instructions are very easy to get wrong because there are some other pins close by and the orientation of the motherboard is unclear.   I got mine back to front the first time I tried this!  

[elzilcho]

do you have a list of commands or instructions on how to do this on windows 10? I have an orbi rbr50 that just has a white solid light and will not do anything. I bought the serial to usb adapter and have a terminal open just dont know what to do next. 

[iScream]

I gave up. I threw the damn thing to the trash and switched to Linksys. Never using another Netgear device again.

[elzilcho]

i bought a new orbi. Just wanted to learn how to do something new and see what could be done.

[fel0ncod3]

I purchased the serial cable as well and am able to plug into the Orbi via serial cable.

How did you get access to the console? Did you use Terminal or command prompt? Curious what commands you used.

Thnx!!

[rayted-r]

You guys really need to look up a guide for serial flashing. You don't just buy a usb-ttl serial cable and then figure out what to do. dd-wrt and openwrt usually have guides for when these things happen because they happen very frequently in the firmware flashing arena.

basically,

#1 install the right drivers for the usb-ttl, usually a "prolific pl2303" chip, so you want those drivers. newer drivers 2018+ will read cheap ones as fakes, but older drivers like older than 2017 should recognize it right. then set the rate to 115200 in device manager instead of the regular 9600

#2 download an interfacer like putty so you can interact with the serial console. both the serial and ethernet cable must be plugged in, so there are 2 cables interacting with the orbi. make sure you don't plug into the 3.3v on the serial or else you get the magic smoke. set the ip on network settings to 192.168.1.1 on gateway, 255.255.255.0 on subnet, 192.168.1.10 as the adapter's/yours. on putty, find the serial setting and turn the flow control to off and rate to 115200, and whatever com it says (copy the settings from device manager), then in the connection type click serial, host as 192.168.1.1 on port 69 (because netgear does port 69 on orbis for whatever reason)

#3 click open to show the interface and then power on the orbi. if nothing shows up, you prob need to switch tx and rx pins. you likely need a multimeter to know 1. which is ground first before 2. knowing what hot/3.3v is so you don't plug anything into that one. if you do it correctly, it should shove a whole lot of info on the console. to stop it all push ctrl c or any other button I think.  type in "help" to show all the options, but you very likely only need "fw_recovery" and a tftp program to send firmware into it. If none of that works and the u-boot is corrupted, then all this effort was wasted and you likely need another rbr50/rbr40 with a good uboot to extract from and reflash. Unfortunately netgear does not provide bootloader download, nor does anyone else on the internet. At least, not yet.

That's probably most of it and you can probably find other missing info from the other serial unbricking guides. If you bought one off ebay just to try it, you're really gambling. Just like my dumb dumb butt. So far, I have had a 70% success rate with the other 30% being bad uboot.

[bonro001]

Excellent post!  

Where I get stuck is in the serial interface the boot loader will ask to press any key.  Have tried several emulators, both on windows and OSX, can never press a key.  Using N81 No flow at the proper speed.  Feel like because I get to the prompt I can probably interrupt is if I could just press a key!!  

Any ideas?

-So Close

[xray2]

I assume if you have a bad uboot there is no reviving and it looks something like this...

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00110
S - IMAGE_VARIANT_STRING=DAAAANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000023
S - Reset status Config, 0x00000033
S - Core 0 Frequency, 0 MHz
B - 261 - PBL, Start
B - 1339 - bootable_media_detect_entry, Start
B - 85322 - bootable_media_detect_success, Start
B - 85336 - elf_loader_entry, Start
B - 189543 - auth_hash_seg_entry, Start
B - 191694 - auth_hash_seg_exit, Start
B - 363688 - elf_segs_hash_verify_entry, Start
B - 478097 - PBL, End
B - 478121 - SBL1, Start
B - 570161 - pm_device_init, Start
D - 9 - pm_device_init, Delta
B - 571663 - boot_flash_init, Start
D - 669980 - boot_flash_init, Delta
B - 1245990 - boot_config_data_table_init, Start
D - 104462 - boot_config_data_table_init, Delta - (419 Bytes)
B - 1353044 - clock_init, Start
D - 7544 - clock_init, Delta
B - 1364019 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B - 1367425 - sbl1_ddr_set_params, Start
B - 1372517 - cpr_init, Start
D - 2 - cpr_init, Delta
B - 1376900 - Pre_DDR_clock_init, Start
D - 4 - Pre_DDR_clock_init, Delta
D - 13171 - sbl1_ddr_set_params, Delta
B - 1390196 - pm_driver_init, Start
D - 2 - pm_driver_init, Delta
B - 1461441 - sbl1_wait_for_ddr_training, Start
D - 27 - sbl1_wait_for_ddr_training, Delta
B - 1477620 - Image Load, Start
D - 912517 - QSEE Image Loaded, Delta - (262104 Bytes)
B - 2390564 - Image Load, Start
D - 899 - SEC Image Loaded, Delta - (0 Bytes)
B - 2400397 - Image Load, Start
D - 185410 - APPSBL Image Loaded, Delta - (414279 Bytes)
B - 2586233 - QSEE Execution, Start
D - 60 - QSEE Execution, Delta
B - 2592430 - SBL1, End
D - 2116421 - SBL1, Delta
S - Flash Throughput, 549 KB/s (676978 Bytes, 1231023 us)
S - DDR Frequency, 672 MHz
B - 2605318 - Boot error ocuured!. Error code: 3027

Thanks