AC88U bricked (stuck at Starting program at 0x00008000)

[pascalgeraeds]

My Asus AC88U is bricked,
I was able to connect a serial cable to it and could log the boot sequence
it is stuck at "Starting program at 0x00008000"

It does allow upgrading firmware (original Asus, Merlin etc.)
but it does not seem to pass this step.

I can interupt the bootloader: CFE 7.14.131.1608 (r589038)
and erase NVRAM etc.
but still no effect.

I have also tried loading an old version of the (Merlin) firmware (in case of incompatibility with the bootloader).
RT-AC88U_380.57_0.trx (I think it is from late 2015)
but still no effect.

I even tried to load a dd-WRT version.
but this rebooted itself after it started the linux kernel... and never got out of this loop.

I have no clue what to try next: please help / suggestions.

- how can i diagnose whether it is a firmware problem , or hardware ?
- which bootloader belongs to which firmware level ?
- how can i upgrade a bootloader
- if I erase the NVRAM (after or before the FW upgrade) it does not seem to change content when I use NVRAM SHOW to look at it and compare to other logs.... ?

thanks in advance

kind regards Pascal

 

[AndreiV]

Have you tried the ASUS Recovery Tool ?:

https://www.asus.com/uk/support/FAQ/1000814/

 

[pascalgeraeds]

Hi AndreiV,

yes I did.
I can put the AC88U in recovery mode (reset button + poweron = slow flashing powerLED).... I could also see on the serialcable monitor that it is waiting for the TFTP sw transfer.
I could load various AC88Uxxxxxx.trx files to it.
And in the serialcable monitor I could also see that it has received the files (in the same size I send it) and is writting it to flash mem.
So this looks quite what you would expect.

after this I reboot the router (even tried including flashing the nvram : WPS + power on) .

bootloader starts.
loads kernel
---> stuck


----------------- Dump of the serialcable monitor ------------

CFE version 7.14.131.1608 (r589038) based on BBP 1.0.37 for BCM947XX (32bit,SP,)

Build Date: 二 11月 17 16:33:56 CST 2015 (ham@xpdev)
Copyright (C) 2000-2008 Broadcom Corporation.
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
DDR Clock: 800 MHz
Info: DDR frequency set from clkfreq=1400,*800*
et1: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 7.14.131.1608 (r589038)
CPU type 0x0: 1400MHz
Tot mem: 524288 KBytes

CFE mem: 0x00F00000 - 0x017ABEC8 (9092808)
Data: 0x00F5401C - 0x00F549C4 (2472)
BSS: 0x00F549D0 - 0x00FA9EC8 (349432)
Heap: 0x00FA9EC8 - 0x017A9EC8 (8388608)
Stack: 0x017A9EC8 - 0x017ABEC8 (8192)
Text: 0x00F00000 - 0x00F4A1E0 (303584)

rtl8354mb initialized(0)(retry 0)
rtk port_phyEnableAll ok
rtk port_macForceLink_set ext_Port1 ok
get ok, chk 0x1311:1016(0x1016), 0x1305:c010(b4~b7:0x1)
Device eth0: hwaddr 34-97-F6-21-F5-B0, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Null Rescue Flag.
boot the image...
go load
Loader:raw Filesys:tftp Dev:eth0 File:: Optionsnull)
Loading: TFTP Server.
..tftp retry wait 0
Failed.
Could not load :: Timeout occured
Loader:raw Filesys:raw Dev:nflash0.os File: Optionsnull)
Loading: .... 4486208 bytes read
Entry at 0x00008000
Closing network.
Starting program at 0x00008000
--------------------- stops here for ages -----------------

 

[OzarkEdge]

Feels like a hardware/memory issue.

OE

 

[pascalgeraeds]

Hi OzarkEdge,
Thanks for your response
What makes you think so ?
The memory seems to be recognised (at least the full 512MB seems to be there).
Tot mem: 524288 KBytes
kind regards Pascal

 

[OzarkEdge]

Hi OzarkEdge,
Thanks for your response
What makes you think so ?
The memory seems to be recognised (at least the full 512MB seems to be there).
Tot mem: 524288 KBytes
kind regards Pascal

Sorry, just a feeling here in view of your thorough debugging notes... not much thinking to explain it.

OE

 

[pascalgeraeds]

Hi,
does any of you know how to backup a CFE and load it to flash
gr. Pascal

 

[AndreiV]

I'm not sure flashing more things to the router will help.
I would first try power cycling the router, then run the Recovery Tool as per the FAQ instructions.
That tool might run through in minutes or could take a couple of hours.

 

[pascalgeraeds]

Hi AndeiV,

with power cycling the router and run the recovery tool, do you mean:
- Power Off
- reset button + Power On : until powerLED starts flashing slowly.
- setting up my laptop on fixed IP (192.168.1.10) Netmask (255.255.255.0) gateway (192.168.1.1)
- try ping 192.168.1.1 to validate I have an TCP connection
- run recovery tool (MAC OSX version because I have a Mac)
- drag drop the latest firmware (from Asus site) on the recovery tool
- upload (takes about 3-4 minutes to load from 0-100%)
- wait until the recovery tool says you can reboot the router.
- Power down the router
- WPS + Power On : to update the nvram
- Let go of the WPS button to normally boot.

Because this is what I have done a dozen times by now.
because I wanted to check if any other firmware version (older ones) would have a better result because I suspected a conflict with the CFE bootloader.

I also tried manual methods using TFTP in combination with recovery mode.
and TFTP in combination with CFE Flash command.
All seemed to upload as expected but none of them would run the kernel.

Or did I miss a crucial step in the above procedure ?

I have also tried DD-WRT and Merlin in the hope it would get me a bit further however not succesfull.

strange thing : 1 time it seemed to actually load the kernel, but then rebooted suddenly and the second time it was stuck again.

I was NOT able to reproduce this again.

any suggestions ?

kind regards Pascal

 

[pascalgeraeds]

Did any of you ever update a CFE bootloader using FLASH or any other commands available in the CFE :
nvram NVRAM utility.
reboot Reboot.
flash Update a flash memory device
batch Load a batch file into memory and execute it
go Verify and boot OS image.
boot Load an executable file into memory and execute it
load Load an executable file into memory without executing it
save Save a region of memory to a remote file via TFTP
ping Ping a remote IP host.
arp Display or modify the ARP Table
ifconfig Configure the Ethernet interface
show clocks Show current values of the clocks.
show devices Display information about the installed devices.

I have second router AC88U available for extraction of a working CFE.
But do not have a clue how to ... ;-)

I think I have captured a block that includes the CFE.
> cat /dev/mtd0 > ./cfe.original
and pull it to my laptop with
> scp cfe.original geraeds@192.168.69.21:/Users/geraeds

it is 512KB file which is filled with FF for the top 256KB
which seems to be ok (as someone mentioned on a forum).

but this is as far as I can find what to do......

 

[pascalgeraeds]

Hi Guys,
another question, do you know where I could download 3.0.0.4.378.xxx version firmware for AC88U.
It seems that there is a major change to the bootloader from 378 to 380.
Which repartitions the memory differently.
This might be the original cause for bricking the router.
kind regards Pascal

 

[Grisu]

You mean this: https://www.snbforums.com/threads/how-do-i-go-from-merlin-376-47-to-latest-378-xx.25891/
You can use merlin firmware with similar release-date too instead of stock, you have to search for a download, never had an 88U.
But I think 88U has been released after this change, there may never have been a 376 or early 378 firmware.
https://sourceforge.net/projects/asuswrt-merlin/files/RT-AC88U/Release/
Test with oldest 378.57.

Q: Do you have an RT-AC88U or maybe DSL-AC88U which would be a very different hardware!

 

[ka81]

Did you have any success with AC88U brick?

 

[ka81]

My ac88u jost became a brick today. Restoring to latest FW is not helping.

Symphtoms - after switching on the router Power indicator is on for about 2 minutes, the turning off and no responce from router.

 

[diyguy]

I'm having this issue with my AC87u, I was able get an old firmware to load, but the system crashed abd went back to the same condition. Could it be a hardware issue ?