[SOLVED] Asus RT-N16 Bricked because unplug during flashing

[clickbait1]

UPDATE:
This problem is solved. Solution in post #25

### original post below ###

Hi,

First of all I already scoured the internet regarding this problem. Many have the same problem but none posted any solution.

tl;dr version:
- Asus RT-N16 can't enter recovery
- no power light (it stays off, never lights up)
- power supply and capacitor presumably okay

Longer version:
So I was trying to flash tomato following this guide. It kept failing. But I was persistent, I reflashed to stock Asus FW (v1.0.23) with "Asus Firmware Restoration" tool, updated to stock FW v3 from GUI, then flashed tomato with the Firmware Restoration tool.

Normally after successful flash with the Firmware Restoration tool, it shows "router is rebooting" or something like that. But after flashing tomato, it doesnt reboot and it shows failure to find router (or something along those line). I thought since the tool is basically tftp, I waited 5-15 minutes for it to finish flashing, even though the message says otherwise. I did the whole process several times, no avail.

At one point I got tired, and accidentally without waiting 5-15 minutes I unplugged the power right after Firmware Restoration tool says it finished "flashing" tomato (with the failure to find router message).

After that I can no longer access the Asus recovery. There's no power light. Tried 30/30/30 reset, nada, njet. Left it overnight then tried to get into the recovery mode, still doesn't work. No telnet, no ping, nothing.

In case of power failure, I opened the case and capacitor looks fine, i.e. no bulging.

Anyone got any clue?

Can this thing be revived using serial recovery? I'm ordering USB to TTL cable I hope it will work. Please share your experience.

And I'm not sure if following info would help: I was previously on DD-WRT build 18000+ (K26), then tried to update to K3x build 22000+. Worked good until I tried to update to build 27000+. So I flashed it back to stock and start with Tomato I described above.

Cheers.

 

[mstombs]

Capacitors do not always bulge, they can just dry out, also do try another external PSU, they also contain capacitors.
There is misinformation on the internet re RT-N16 buttons - it doesn't have a reset, they are labelled RESTORE and WPS, also some reports refere to a CFE Web console, that may not be available with your CFE.
The output from a serial console may be useful - but you really need to have a known working connection before the problem ISTR my RT-N16 already have a 4 pin connector.

 

[clickbait1]

Capacitors do not always bulge, they can just dry out, also do try another external PSU, they also contain capacitors.

My LAN lights are fine, though. All light up the first moment power is up, and the connected port stays on. If capacitor is busted, wouldn't all lights be off? I've read some symptoms of busted capacitor, not happening with mine I guess.

There is misinformation on the internet re RT-N16 buttons - it doesn't have a reset, they are labelled RESTORE and WPS, ...

I am aware of the button labeling, I did 30/30/30 reset with WPS button and it worked many times before this happens.

...also some reports refere to a CFE Web console, that may not be available with your CFE.

I'm not sure what you're saying here..

By the way, can CFE be erased/damaged due to failure in flashing firmware?

The output from a serial console may be useful - but you really need to have a known working connection before the problem ISTR my RT-N16 already have a 4 pin connector.

When the serial adapter arrives in the next few days I will know about this.

 

[slobodan]

The good news: you cannot brick a RT-N16 through flashing unless you purposefully mess with the CFE.

My trick for getting recovery mode: power off router, press the reset button with a pen and keep pressing, power router on (but keep pressing), wait 10 seconds, also press WPS button (but keep pressing reset), wait 10 seconds, release reset (but keep pressing WPS), when the power light blinks slowly you may release WPS button. ping 192.168.1.1 should reply with TTL 100, which means router is waiting for TFTP flash.

 

[clickbait1]

The good news: you cannot brick a RT-N16 through flashing unless you purposefully mess with the CFE.

That is good to hear. I suppose when I get my serial cable, I should also not touch the CFE?

My trick for getting recovery mode: power off router, press the reset button with a pen and keep pressing, power router on (but keep pressing), also press WPS button (but keep pressing reset), wait 10 seconds, release reset (but keep pressing WPS), when the power light blinks slowly you may release WPS button. ping 192.168.1.1 should reply with TTL 64, which means router is waiting for TFTP flash.

This doesn't work. Power light stays off all the time. Do you plug the power and press WPS simultaneously?

I tried this with all LAN unplugged though, does it make any difference?

 

[bbsc]

I was trying to flash tomato following this guide

Have you flashed R1 or R2 version?

 

[clickbait1]

Have you flashed R1 or R2 version?

I suppose R2? ...MIPSR2-114-AIO...

I can still enter recovery mode even after it finished "flashing" (then I waited 5-10 mins). Did this several times. Once I unplug it without waiting 5-10 mins, can't enter recovery mode anymore, power light stays off.

 

[bbsc]

R2 is the right one.
Try to clear nvram (unplug power, hold WPS, plug power and wait holding WPS for 5+ sec).
Then try to enter recovery mode and flash any proper firmware.

 

[mstombs]

My LAN lights are fine, though. All light up the first moment power is up, and the connected port stays on. If capacitor is busted, wouldn't all lights be off? I've read some symptoms of busted capacitor, not happening with mine I guess.

Usual mode of failure with capacitors and power supply is random crashes, more frequent when router hot under a lot of load. Next failure mode is a reboot loop - router crashes during boot - but this mode can be seen by leds cycling. Any crash due to hardware fault could lead to NVRAM corruption.

I am aware of the button labeling, I did 30/30/30 reset with WPS button and it worked many times before this happens.

See http://www.snbforums.com/threads/30-30-30-resets-voodoo-or-real.26534/

Asus have a robust recovery philosophy permitting nvram clear or forcing a recovery mode which works with a software utility (tftp). This is probably the reason they don't have a button labelled 'reset'!

See http://www.shcherbyna.com/?p=1403 especially incorrect references to 'reset' and the comments with workarounds. Asus tool uses low level comms, easily broken by OS upgrades firewall/anti-virus etc, some guides recommend using a specific small dd-wrt firmware, recent Asus firmwares are huge.

Some Asus/Broadcom routers run a miniweb server in recovery mode, which allows nvram reset or firmware reload via a web screen. I don't think the N-16 does, or maybe there are different versions of the CFE around.

By the way, can CFE be erased/damaged due to failure in flashing firmware?

Never say never, but most unlikely, but if you force in an incorrect firmware (mipsR1 instead of R2 for example) who knows what that might do when it crashes? Many N-16 problems caused by NVRAM problems, the CFE only supports 32kB NVRAM, which is easy to fill. Tomato abandoned attempts to work with a larger firmware allocation, dd-wrt still trying but didn't work reliably when I last tried. See also

http://www.linksysinfo.org/index.php?threads/asus-rt-n16-bricked-using-60k-nvram-version.37025/

I have seen reports where JTAG required for recovery, but usually due to folk attempting to overclock etc. I bought a cheap bricked one to experiment with - but didn't need JTAG, recovered using Asus tool and static IP etc.

When the serial adapter arrives in the next few days I will know about this.

Good luck

 

[clickbait1]

R2 is the right one.
Try to clear nvram (unplug power, hold WPS, plug power and wait holding WPS for 5+ sec).
Then try to enter recovery mode and flash any proper firmware.

I did that, nothing happens.. Usually the power light blinks rapidly upon plugging power, but this one stays off during the whole clearing nvram process.

 

[clickbait1]

Usual mode of failure with capacitors and power supply is random crashes, more frequent when router hot under a lot of load. Next failure mode is a reboot loop - router crashes during boot - but this mode can be seen by leds cycling. Any crash due to hardware fault could lead to NVRAM corruption.

Good to know this, thanks. But I don't think I see these symptoms on my router.

See http://www.snbforums.com/threads/30-30-30-resets-voodoo-or-real.26534/

From your reply in that thread I think it's also possible that what I did (unplug when flashing process is building nvram) made the nvram corrupted. No nvram --> no reset/recovery. Unfortunately there's no clear info on how reset/recovery is handled in RT-N16 (or is it?)

Asus have a robust recovery philosophy permitting nvram clear or forcing a recovery mode which works with a software utility (tftp). This is probably the reason they don't have a button labelled 'reset'!

See http://www.shcherbyna.com/?p=1403 especially incorrect references to 'reset' and the comments with workarounds. Asus tool uses low level comms, easily broken by OS upgrades firewall/anti-virus etc, some guides recommend using a specific small dd-wrt firmware, recent Asus firmwares are huge.

I was also referring to that page for the whole process of restoring stock FW. But now that I can't enter recovery mode, my last options are only serial or JTAG recovery. Or is there any other method that doesn't involve serial/jtag?

Some Asus/Broadcom routers run a miniweb server in recovery mode, which allows nvram reset or firmware reload via a web screen. I don't think the N-16 does, or maybe there are different versions of the CFE around.

I also think the same.

Never say never, but most unlikely, but if you force in an incorrect firmware (mipsR1 instead of R2 for example) who knows what that might do when it crashes? Many N-16 problems caused by NVRAM problems, the CFE only supports 32kB NVRAM, which is easy to fill. Tomato abandoned attempts to work with a larger firmware allocation, dd-wrt still trying but didn't work reliably when I last tried. See also

http://www.linksysinfo.org/index.php?threads/asus-rt-n16-bricked-using-60k-nvram-version.37025/

I have seen reports where JTAG required for recovery, but usually due to folk attempting to overclock etc. I bought a cheap bricked one to experiment with - but didn't need JTAG, recovered using Asus tool and static IP etc.

For my case, I think I will do the following (References: this, this, this):
1. plug ethernet to port 1
2. set static IP 192.168.1.2/24
3. get TFTP client ready pointing to 192.168.1.1 with compatible DD-WRT mini
4. connect serial cable, only TX, RX, and GND, leave VCC unplugged.
5. configure PuTTY for serial connection
6. connect power to router
7. from serial terminal: "nvram erase"
8. from serial terminal, start tftp daemon with: "flash -noheader : flash1.trx"
9. start tftp update from point 3
10. wait 5-15 minutes
11. unplug power then plug it back
12. Asus recovery is active
13. ???
14. Profit

Point 8 is not clear: "flash1.trx", is it something we provide or is it just to define filename for the incoming tftp transfer?

From the recovery sequences above, is there anything you would do differently?

Good luck

Thanks!

 

[mstombs]

As I'm sure you know it must be a 3.3V serial cable. If a USB one you have to get the right drivers installed, and check PC end is working in loopback with TX connected to RX (I recommend through a 1k resistor, but ...). You have to get baud rate correct, but should get garbage if wrong. ISTR dd-wrt always go for highest standard speed 115200bps, but I don't remember CFE default. If CFE outputs something then hangs you may have to use CTRL-C to get the CFE prompt before step 7. I do not recognize step 8, if router at CFE prompt you should be able to connect using Asus tools from windows PC, I am sure I have used tftp from Linux to just send the new firmware.

Asus did release partial CFE sources for the N16, which were even compilable, but did not appear to be the sources for the production model, and I wasn't going to experiment without known working JTAG!

 

[clickbait1]

As I'm sure you know it must be a 3.3V serial cable. If a USB one you have to get the right drivers installed, and check PC end is working in loopback with TX connected to RX (I recommend through a 1k resistor, but ...). You have to get baud rate correct, but should get garbage if wrong. ISTR dd-wrt always go for highest standard speed 115200bps, but I don't remember CFE default. If CFE outputs something then hangs you may have to use CTRL-C to get the CFE prompt before step 7. I do not recognize step 8, if router at CFE prompt you should be able to connect using asus tools from windows PC, I am sure I have used tftp from Linux to just send the new firmware.

Asus did release partial CFE sources for the N16, which were even compilable, but did not appear to be the sources for the production model, and I wasn't going to experiment with working JTAG!

Hi,

I just got the serial cable earlier today. Tried the suggested settings (baud 115200 bps, 8n1, no handshake/flow control), I see nothing in my serial console. Isn't there supposed to be something showing up or is it normal that it is blank?

I have the PL2303HX chip on the adapter, with 3.3V signaling. Connected only the Tx, Rx and GND to the board. Tried different baud settings, also with Tx Rx flipped, nothing.

As your suggestion I tried shorting the Tx and Rx of my serial cable, I receive the same data I transmit. So I assume serial cable is fine.

Everytime I plug the power, all LAN lights are on for few moment then only the connected one that stays on. Power light and WiFi light is off all the time.

Do you think my bootloader / CFE is busted?

 

[bbsc]

Do you think my bootloader / CFE is busted?

There're three leds on usually if CFE is broken.
No power light usually means hardware problems, i.e. power problems.

PL2303HX must be Ok, I've restored RT-N16 once via such kind of cable once (by clearing nvram).
It was after flashing RT-N16 with RT-N66U firmware.

 

[mstombs]

Sorry to hear, definitely could be hardware failure, slight possibility still nvram corrupt repairable only by JTAG see for example description of problem here
http://www.dd-wrt.com/phpBB2/viewtopic.php?p=652841#652841
finally solved here
http://www.dd-wrt.com/phpBB2/viewtopic.php?p=655860#655860

 

[clickbait1]

There're three leds on usually if CFE is broken.
No power light usually means hardware problems, i.e. power problems.

PL2303HX must be Ok, I've restored RT-N16 once via such kind of cable once (by clearing nvram).
It was after flashing RT-N16 with RT-N66U firmware.

I have no power light, but the LAN lights are fine. This happens right after I did power cycle too early. Could this be power supply issue?

Sorry to hear, definitely could be hardware failure, slight possibility still nvram corrupt repairable only by JTAG see for example description of problem here
http://www.dd-wrt.com/phpBB2/viewtopic.php?p=652841#652841
finally solved here
http://www.dd-wrt.com/phpBB2/viewtopic.php?p=655860#655860

Thanks for the link. Now for my last attempt I'm gonna try JTAG with Raspberry Pi or Arduino I have laying around in my uni. Buying USB JTAG device is not really worth it as it cost almost as much as the router (second hand) :/

 

[bbsc]

I have no power light, but the LAN lights are fine.

All light up the first moment power is up, and the connected port stays on.

I'm 90% sure it's power problem.
Try to replace the capacitor, it's not expensive and not difficult.

 

[clickbait1]

I'm 90% sure it's power problem.
Try to replace the capacitor, it's not expensive and not difficult.

Thanks for the hint. I will try replacing the capacitor.

 

[mstombs]

...Thanks for the link. Now for my last attempt I'm gonna try JTAG with Raspberry Pi or Arduino I have laying around in my uni. Buying USB JTAG device is not really worth it as it cost almost as much as the router (second hand) :/

Trouble with Arduino and RPi is that the router specific software tools can't be used - another success story here, and a definite nvram clkfreq cause

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=167165&postdays=0&postorder=asc&start=15

I've only ever used a poor-mans parallel port plus resistor JTAG cable on other routers, usually from Linux because I could compile the older opensource versions of tjtag, the later versions of tjtag do not have public source code, leaving others to discover some Broadcom custom LV mode switches.

OpenOCD can be used on the Raspberry PI and apparently can be used with RT-N16 and N66 (I recall the latter needs an extra resistor)
http://sourceforge.net/p/openocd/ma.../20131230192130.48983242CC@openocd.zylin.com/
https://github.com/synthetos/PiOCD/wiki/Using-a-Raspberry-Pi-as-a-JTAG-Dongle

For a one-off exercise on an N16 consider just soldering in a few solid copper cat5 cables rather than a whole connector, clearing solder from ground plane holes is tricky. Cut the cables off when finished!

 

[bbsc]

clearing solder from ground plane holes is tricky

A soldering iron (massive enough and hot enough) in one hand and a wooden toothpick or a sharpened match in the other hand will do the job.
A sharp eye and a steady hand are required too.