Netgear WNR1000 v3

NOTE: While below versions will load to WNR1000v3, unless it is a custom image compiled withiout LuCI and with size reduced to under 3Mb you will brick WNR1000v3. The image will flash, and the router will be recoverable; however it will not function. LuCI will crash on startup (not enough memory), ssh attempts will cause it to reboot, and flashing firmware will become problematic as there wont be enough free space to load it. See instructions for recovering without serial below. The only version that will load onto WNR1000v3 are the LEDE builds. For example 17.0.1; however, due to lack of flash and memory the router may be unstable. And it wont have enough space to load a different build. You will have to follow recovery steps below to flash another firmware. Furthermore, as of September 2021, there is no custom firmware for WNR1000v3 that support WiFi. This is due to lack of drivers. Only Netgear's official firmware supports WiFi.

→ Install OpenWrt (generic explanation)

Attach 3,3V Serial UART Adapter to J3 on the PCB. Pin 6=GND, Pin 2=RXD, Pin 5=TXD. J3 Connector is not soldered in by default. Standard UART speed 115200 Baud.

Immediatly after Power-On, send Ctrl-C serveral times to enter the CFE Boot loader. Enter command “tftpd” into the bootloader.

A default openwrt image produces an error message from the CFE bootloader that the Board ID is U12H139T50_NETGEAR, while the Image ID is U12H139T00_NETGEAR. Copy the standard OpenWrt image to temporary filename “flash0.os” on the PC and change byte with address 0x30 to contain a '5' (Hex 0x35). Then send this file via tftp. The default address of the device is 192.168.1.1. It can be changed with the ifconfig command in CFE like

ifconfig -addr=10.0.0.2 -gw=10.0.0.1 -mask=255.255.255.0 eth0

tftp 192.168.1.1 binary put flash0.os

CFE for WNR1000v3 version: 3.0.6                                                
Build Date: Thu Jan 21 22:38:48 CST 2010                                        
Boot partition size = 131072(0x20000)                                           
Found a 4MB ST compatible serial flash                                          
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.46           
Device eth0:  hwaddr 2C-B0-5D-26-1C-3E, ipaddr 192.168.1.1, mask 255.255.255.0  
        gateway not set, nameserver not set                                     
CFE> ^C                                                                         
CFE> ^C                                                                         
CFE> ^C                                                                         
CFE> tftpd                                                                      
Start TFTP server                                                               
Reading :: Done. 2822202 bytes read                                             
Programming...done. 2822202 bytes written                                       
Write len/chksum offset @ 0x003A7FF8...done.                                    
Decompressing...done                                                            

The device enabled the network on IP 192.168.1.1 during boot for a very short time like 2 Seconds. Recovery is possible if WNR1000v3 is pingable at boot.

If you are already on LEDE build skip Skip to step 4. Otherwise start at Step 1.

  *  Step 1. Download lede-17.01.0-r3205-59508e3-brcm47xx-mips74k-netgear-wnr1000-v3-squashfs.chk
  *  Step 2. Download nmrpflash from https://github.com/jclehner/nmrpflash and Npcap dependency
  *  Step 3. Do not follow the instructions for nmrpflash, and instead do the following

          nmrpflash -L And note the interface (static ip you set for example 192.168.1.10)
    	  nmrpflash -i <interface> -f lede-17.01.0-r3205-59508e3-brcm47xx-mips74k-netgear-wnr1000-v3-squashfs.chk
    	  Press the recessed reset button and hold it down while powering on the router. Keep holding reset button until nmrpflash finds the router. Release the reset button.
    	  at this point nmrpflash will likely fail. Simply run the command again (immediately). It should find it again and succeed. Can take several attempts (see log below).
    
  *  Step 4. Router should now have OpenWRT 17.01.0 and you should be able to access LEDE GUI. However there is still not enough space to load any OpenWRT firmware or stock firmware.
  *  Step 5. Repeat step 3 but instead of OpenWRT firmware use stock firmware from NETGEAR's website.
  *  Step 6. The router should now boot into Netgear GUI.
  *  Step 7. To ensure things are clean perform firmware update to the same firmware through Netgear's GUI.
  *  Step 8. Preform Configuration Reset through the Netgear GUI.
  *  Step 9. Router should be fully recovered.

NOTE: If you skip going back to a LEDE build and try to recover from a LuCI version of OpenWRT your stock GUI will not have any text. You need to go back to LEDE build and then return to stock from there.

Log from nmrpflash:

>nmrpflash.exe -L
net10  169.254.63.7     dc:41:a9:..... (Wi-Fi)
net13  172.164.183.253   18:c0:4d:..... (Ethernet)

>nmrpflash.exe -i net13 -f WNR1000v3-V1.0.2.78_60.0.96NA.chk
Waiting for Ethernet connection.
Advertising NMRP server on net13 ... \
Received configuration request from 10:0d:7f:91:bc:74.
Sending configuration: 10.164.183.252/24.
Timeout while waiting for TFTP_UL_REQ.  <--- failure described in Step 3

>nmrpflash.exe -i net13 -f WNR1000v3-V1.0.2.78_60.0.96NA.chk
Advertising NMRP server on net13 ... \
Received TFTP_UL_REQ while waiting for CONF_REQ!
Received upload request without filename.
Uploading WNR1000v3-V1.0.2.78_60.0.96NA.chk ... OK (3776570 b)
Waiting for remote to respond.
Received keep-alive request (3).
Remote finished. Closing connection.
Reboot your device now. <--- Recommended to give the router at least 1 minute to finish flashing before rebooting it.

Release version : Netgear Wireless Router WNR1000v3
                  U12H13900/V1.0.2.28/52.0.60
           Time : Dec  1 2010 20:31:53
    CFE version : 3.0.6

Linux version 2.4.20 (zacker@svn) (gcc version 3.2.3 with Broadcom modifications) #1 Wed Dec 1 20:25:58 CST 2010

# cat /proc/cpuinfo
system type             : Broadcom BCM5356 chip rev 1
processor               : 0
cpu model               :  V4.9
BogoMIPS                : 166.29
wait instruction        : no
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : no
hardware watchpoint     : yes
VCED exceptions         : not available
VCEI exceptions         : not available
unaligned_instructions  : 0
System clocks
        (cpu/mem/si/xtal)       : 333/166/83/25 Mhz.
dcache hits             : 2147483648
dcache misses           : 3216862704
icache hits             : 2147483648
icache misses           : 3740752895
instructions            : 2147483648

# cat /proc/meminfo
        total:    used:    free:  shared: buffers:  cached:
Mem:  14716928 14331904   385024        0  1589248  5386240
Swap:        0        0        0
MemTotal:        14372 kB
MemFree:           376 kB
MemShared:           0 kB
Buffers:          1552 kB
Cached:           5260 kB
SwapCached:          0 kB
Active:           4508 kB
Inactive:         4756 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:        14372 kB
LowFree:           376 kB
SwapTotal:           0 kB
SwapFree:            0 kB

# ps x
  PID  Uid     Stat Command
    1 0         S    init noinitrd 
    2 0         S    [keventd]
    3 0         S    [ksoftirqd_CPU0]
    4 0         S    [kswapd]
    5 0         S    [bdflush]
    6 0         S    [kupdated]
    8 0         S    [mtdblockd]
   53 0         S    upnp -D -W vlan1 
   56 0         S    /bin/eapd 
   58 0         S    nas 
   62 0         S    /bin/wps_monitor 
   96 0         S    dnsRedirectReplyd 
   98 0         S    swresetd 
  103 0         S    httpd 
  104 0         S    dnsmasq -h -n -c 0 -N -i br0 -r /tmp/resolv.conf -u root 
  108 0         S    udhcpd /tmp/udhcpd.conf 
  109 0         S    ddnsd & 
  118 0         S    heartbeat 
  125 0         S    wlanconfigd 
  126 0         S    pot run 
  137 0         S    upnpd 
  138 0         S    /usr/sbin/email 
  142 0         S    /usr/sbin/acl_logd 
  143 0         S    udhcpc -i vlan1 -p /var/run/udhcpc0.pid -s /tmp/udhcpc -H 
  146 0         S    lld2d br0 
  151 0         S    wpsd 
  166 0         R    telnetd 
  169 0         S    /bin/sh 
  177 0         R    ps x 

How to add tags