The PCB is a bit redesigned. Most noticeable points are the presence of an actual power button (top left in photos), and that J10 is labeled (anyway, I've not been able to get anything from there neither with 115200 8N1 nor with other speeds). There is also a plastic sheet covering the bottom of the PCB, maybe to help heat dissipation.
Not so noticeable is the fact that the LED corresponding to port1 is doubled, being similar to the power led. Also the wireless seems different, as chip is labelled as AR9223-AC1A.
Tftp upload of firmware seems not straightforward. According to information found on the linksys forums, requires the “password enabled” tftp utility from linksys.
See this page for details and pictures of the WAG160Nv2.
LEDs & Buttons
Opening the case
Remove the four screws on the base of the case. The case is then secured by one small and one large gray clip (from rear to front) on each side of the case. At the front of the case, there are two large black clips.
Prise the top of the router from the bottom using a small screwdriver - I found this easier by starting at the front. It's not a nice process!
Even if all of the gray clips are broken or removed, the case is perfectly adequately sealed using only the front black clips and the four screws. This also makes the case far easier to open. I found this easiest to do by working around the case from the back with a medium-sized screwdriver, being careful not to be upsetting the antennas and wires which are located around the edges of the case. Once the top has been removed, using pliers, the broken or remaining gray clips can be tidied up by twisting off what remains of them.
Top of PCB
Bottom of PCB (JTAG encircled)
Serial console can be attached to J10 which is located at the bottom right of the board (when looking at the unit from the front). On my unit; the J10 label was obscured by a sticky pad.
Serial Port (J10)
There is no connector soldered to the board. If you want to add one, it needs to be of pitch 2.5mm.
The settings for the serial console are “115200 bauds, 8 bits, no parity, 1 stop bit (115200 8N1)”, with hardware and software flow control both disabled.
NOTE: You cannot plug directly those pins to your pc serial port. You need a RS232-TTL level adapter (or just set the jumper on your USB→Serial-converter to 3.3V if it provides that option). See Serial Console
To activate the flash mode you need to stop the boot. You have two solutions :
1. Staple method
When you power the modem, you have 1s to activate the Recovery Mode. The trick is to rub a stapple or a wire between the pin 4 (in red) and the pin 1 (in orange) while booting. Do not solder anything, the goal is not to generate a clean signal but to generate noise !
The easiest way is to hold the stapple between pin 1 and 4 (do not shortcut pin 1 and 3) and to rub it slightly when it boots. It should activate the recovery mode almost everytime. If it doesn't work you can also rub the stapple between pin 4 (in red) and pin 3 (+3.3V, next to pin 4).
If you succeed, the power LED goes off and the Ethernet LED should be blinking. If the power LED is still on 5s after you plugged the router, it failed. Just unplug the modem and try again. If the ethernet light is off verify you plugged the ethernet cable properly.
2. Serial port method
You can also solder a LVTTL adapter to the board to use the serial port.
You can use minicom, putty or hyperterminal for this part.
You need to connect with the following parameters: 115200 bauds, 8 bits, no parity, 1 stop bit (115200 8N1), with hardware and software flow control both disabled.
Plug the modem, when the following message is displayed:
*** Press any key to stop auto run (1 seconds) ***
Push any key. It will stop the boot.
Then you have two methods to flash the firmware:
Flashing the firmware
To flash the firmware you can use the CFE Web Interface (easier). If you used the staple method this is the only solution. If you are connected to serial, you can also use a TFTP server.
1. CFE Web Interface
Assign 192.168.1.2 to your computer with a subnet mask of 255.255.255.0.
Go to 192.168.1.1 with your browser and upload the firmware through the “Update Software” web interface.
The router will reboot by itself after 30s and you're done.
2. TFTP Method: (only if you used serial connection)
Setup a tftpd server e.g.
sudo apt-get install tftpd-hpa tftp
make sure it works by putting some file in /var/lib/tftpboot e.g.
sudo sh -c 'echo "hello" > /var/lib/tftpboot/test'
if you get sth. like
Received 7 bytes in 0.0 seconds
Copy your downloaded/built openwrt image to to /var/lib/tftpboot.
File name needs to be bcm963xx_fs_kernel because that's what the wag160n CFE expects.
Connect to your router with an ethernet cable.
Assign 192.168.1.100 to your computer with a subnet mask of 255.255.255.0 - because that's what the wag160n will try pull the boot image from (192.168.1.100 as gateway).
If you followed the activated the flash mode by serial port, the following message should be displayed in your terminal:
Make sure again that your router is a WAG160N V1
The flash should begin:
Loading 192.168.1.100:bcm963xx_fs_kernel ...
Finished loading 2752516 bytes
Flashing root file system and kernel at 0xbfc10000: ............................
*** Image flash done *** !
JTAG Port (J1)
CFE version 1.0.37-5.4 for BCM96358 (32bit,SP,BE)
Build Date: å›› 1æœˆ 10 19:25:21 CST 2008 (root@9DavidZhang2)
Copyright (C) 2000-2005 Broadcom Corporation.
Boot Address 0xbfc00000
Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB
CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz
Total memory: 33554432 bytes (32MB)
Total memory used by CFE: 0x80401000 - 0x80528800 (1210368)
Initialized Data: 0x8041E550 - 0x8041FF60 (6672)
BSS Area: 0x8041FF60 - 0x80426800 (26784)
Local Heap: 0x80426800 - 0x80526800 (1048576)
Stack Area: 0x80526800 - 0x80528800 (8192)
Text (code) segment: 0x80401000 - 0x8041E544 (120132)
Boot area (physical): 0x00529000 - 0x00569000
Relocation Factor: I:00000000 - D:00000000
Board IP address : 192.168.1.1
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id Name : 96358GW
Psi size in KB : 24
Number of MAC Addresses (1-32) : 10
Base MAC Address : 00:1d:7e:b3:9b:52
Ethernet PHY Type : Internal
Memory size in MB : 32
CMT Thread Number : 0
*** Press any key to stop auto run (1 seconds) ***
Before flashing OpenWrt make sure to backup “ath_data” (/dev/mtdblock4). It's calibration data for wireless device. You have to include this data into OpenWrt, and modify ath9k driver to read it durning device initialisation.
Normally the dd command would be used for copying such data; however the Linksys provided OS does not include this command. Using the cp command would result in just the inode information being copied, so instead use the cat command - placing the result within the /tmp directory which is a writable part of the filesystem,
cat /dev/mtdblock4 > /tmp/ath_data
You then need to get this image off the router. As there is no ftp client installed; use the in-built web server. As you can't write to the directory currently used by the http server, let's just hijack the daemon for a short while,
toh/linksys/wag160n.txt · Last modified: 2019/09/04 17:35 by tmomas