brnboot
- Signed “Broad Net Technology, INC.”.
- Sometimes called AMAZON Loader.
- Uses the file transfer protocol XMODEM for file transfers.
- Has a hidden menu with more options unlocked by entering the character '!'.
Recovery web interface
The brn-boot bootloader features a “secret” recovery web interface on http://192.168.1.1/ or http://192.168.2.1 which can be activated by switching on the device whilst holding the reset button depressed. This recovery mode includes a DHCP server, so you do not have to set a static IP on your computer.
Firmware images seem to be checked for a valid signature before actually flashing them. The signature key depends on the model of the router.
WARNING: Only use this if you know exactly what you are doing or you may brick your device and/or the wifi card!
This web interface is also loaded if the bootloader does not find a valid code image in the code image partition(s) when loading.
This “secret” recovery interface comes with an even more secret page http://192.168.1.1/undoc_upgrade.stm that does not check the firmware images before flashing them, and which even allows to flash the entire flash (including the bootloader). When the flashing is finished, the page may reload and show some garbled crap. Be sure to wait unil the flashing is finished before powercycling the device.
On my IAD 4421 with 8MiB of NOR flash, a “master” flash (reflashing the entire flash, including the bootloader and the ART partition) took about 5 minutes.
More information on the difference between NOR and BRN.
WARNING: Only use this if you know exactly what you are doing or you may brick your device and/or the wifi card!