Tutorial ASUS ROUTERS JTAG RECOVERY

[bbsc]

@myvoip07
no success with RMA for half an year?
Or it is another RT-AC66U?

 

[hggomes]

That means CORRUPTED/NO BOOTLOADER.

If its on warranty period then RMA it, else you are forced to program your SPI with your CFE backup.

 

[myvoip07]

@myvoip07
no success with RMA for half an year?
Or it is another RT-AC66U?

another RT-AC66U which is out of warranty

 

[myvoip07]

That means CORRUPTED/NO BOOTLOADER.

If its on warranty period then RMA it, else you are forced to program your SPI with your CFE backup.

no, it is out of warranty. is program spi only option?

 

[bbsc]

no, it is out of warranty. is program spi only option?

It's the only KNOWN and PROVED option.
There's definitely at least one another option used by Asus itself. But it's unknown

You'd better buy a blank SPI chip and begin to search for a person familiar with SPI programming and soldering.

I prefer Winbond, it works now in my RT-AC66U.

 

[stefauresi]

Hi,

I used this http://www.diygadget.com/tiao-usb-multi-protocol-adapter-jtag-spi-i2c-serial.html

the serial port is easily found on the motherboard RT-AC68U

I used Putty for reading the boot CFE

TIAO manual

http://www.tiaowiki.com/w/TIAO_USB_Multi_Protocol_Adapter_User's_Manual

 

[rickdmer]

Another "bricked" RT-AC68U, formerly an AC-1900. I had successfully upgraded the CFE and had Tomato installed. I wasn't impressed by the wireless range and wanted to try out the Asus firmware. I tried flashing the Asus firmware from within Tomato, DD-WRT and the recovery site. Every time I flashed the firmware it said it was successful but upon rebooting it was still on the firmware I started with.

During the flashing trials I noticed that my PC would get a connection during the boot up and then drop it then come back about a minute later. During one of the flashes I tried to go to the web GUI during the first connection and realized it was going to the recovery site. On the last flash attempt I decided to clear the NVRAM when the recovery site was available. The site indicated that the NVRAM clear was successful and it appeared to reboot after that.

Now I can no longer get into the router. I cannot ping the router. I have a static IP of 192.168.1.5 set. I have tried an NVRAM clear by powering on with the WPS button being held in. I have also tried to get into recovery by holding reset button but it doesn't seem to work. The power light stays solid until I have held it for 20 seconds then it starts to flash but very very slow. The light goes off for 15 seconds then it comes on for 15 seconds. The only lights that come on now are the power light and the Ethernet port light that I am connected to.

Is this recoverable with serial, JTAG or some other way? If it requires JTAG or serial is there anything showing how to open this router? I haven't been able to find any screws.

Thanks for any possible help!

Sorry to bump an old thread, but I have this exact same issue. Did you ever figure it out?

 

[hggomes]

Try recovery mode.

 

[hggomes]

RT-AC68U only has one NAND, search for Spansion (S34ML01G100TFI00) written on the chip.

 

[hggomes]

Yes, not all programmers support it, specially the cheap ones.

 

[hggomes]

JTAG ports are there but no software support last time I've seen, i was forced to program the chip.

 

[hggomes]

You need to disolder the chip and send your bootloader backup into it again, then solder it back and upload the FW, if you don't have the know how you better forget about it, it's a complex task for most common users.

The programmer was a chinese (very cheap one) without supporting that chip, but I found a dirty hack way of doing it, can't recall the name of it but I can take a look.

 

[hggomes]

Check the supported device list and look for Spansion S34.

 

[hggomes]

http://www.snbforums.com/threads/how-to-asus-routers-jtag-recovery.19077/page-6#post-273161

 

[Cake]

Expect a long wait on JTAG support, it depends of several factors.

NAND programming is the best way to go ATM, you need to unsolder the NAND chip on your PCB and use a programmer on it (TL866) to upload the CFE, if you have the skills then you will revive it quickly.

Is the NAND chip the spansion one (AC68U)? I do have a TL866 programmer, but not the skills, or equipment to remove that chip. I have a clip where I can read/write the smaller chips (8 pins). To be honest I am not sure where to start. I read the voltage of the serial pins at the top, and I get about 3.3v.. I don't have a jtag or usb/serial adapter. Reading some posts on here, mine is the same as someone else who gets no power led, but the others work with the exception the usb 2.0 is lit. So I assume its the boot loader. I wouldn't mind turning the ac68u into a AP if I can get it running.
Not sure how mine bricked, middle of the night, storm outside...
edit: with the cover off and nothing plugged in LANx4 & WAN led blinks on and goes off and USB2 stays on. I can now see the power and USB3 led is on (with cover off) but very dim. Must be a broken chip then? bin it?

 

[hggomes]

Sorry the delayed answer but lately I barely have time to get here.

Unfortunately your programmer (TL866) does not support Spansion S34 chip natively.

Those LEDs are the same ones when i had my AC68U broken after a bad bootloader flash (power failure), about the "bin it?" question i wouldn't they can add support to Spansion S34 chip later or we can see JTAG software support later also.

 

[Cake]

Thanks hggomes. I will shelf it.

 

[hggomes]

Np, yw.

 

[Hien]

D'oh




I'm in a similar boat. Bad CFE flash (long story). At boot, my AC68U (TM-1900) only has the USB 2.0 light lit. If I plug in an ethernet cable, that lights too.

Am I hosed, or is it worth picking up a serial adapter and rolling the dice to reflash a clean CFE via serial?


Thanks!

I know this post is way back but did you ever resolved the issue? or was the router bricked. I have the same exact problem. thx

 

[hggomes]

Theres no serial connection without a bootloader, the only way is disolder / program it / solder again.