Netgear WNR1000 v3

→ Install OpenWrt (generic explanation)

Attach 3,3V Serial UART Adapter to J3 on the PCB. Pin 6=GND, Pin 2=RXD, Pin 5=TXD. J3 Connector is not soldered in by default. Standard UART speed 115200 Baud.

Immediatly after Power-On, send Ctrl-C serveral times to enter the CFE Boot loader. Enter command “tftpd” into the bootloader.

A default openwrt image produces an error message from the CFE bootloader that the Board ID is U12H139T50_NETGEAR, while the Image ID is U12H139T00_NETGEAR. Copy the standard OpenWrt image to temporary filename “flash0.os” on the PC and change byte with address 0x30 to contain a '5' (Hex 0x35). Then send this file via tftp. The default address of the device is 192.168.1.1. It can be changed with the ifconfig command in CFE like

ifconfig -addr=10.0.0.2 -gw=10.0.0.1 -mask=255.255.255.0 eth0

tftp 192.168.1.1 binary put flash0.os

CFE for WNR1000v3 version: 3.0.6                                                
Build Date: Thu Jan 21 22:38:48 CST 2010                                        
Boot partition size = 131072(0x20000)                                           
Found a 4MB ST compatible serial flash                                          
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.46           
Device eth0:  hwaddr 2C-B0-5D-26-1C-3E, ipaddr 192.168.1.1, mask 255.255.255.0  
        gateway not set, nameserver not set                                     
CFE> ^C                                                                         
CFE> ^C                                                                         
CFE> ^C                                                                         
CFE> tftpd                                                                      
Start TFTP server                                                               
Reading :: Done. 2822202 bytes read                                             
Programming...done. 2822202 bytes written                                       
Write len/chksum offset @ 0x003A7FF8...done.                                    
Decompressing...done                                                            

The device enabled the network on IP 192.168.1.1 during boot for a very short time like 2 Seconds. It does not seem to be possible to send a TFTP image in that time. https://github.com/jclehner/nmrpflash might be a solution (untested).

Release version : Netgear Wireless Router WNR1000v3
                  U12H13900/V1.0.2.28/52.0.60
           Time : Dec  1 2010 20:31:53
    CFE version : 3.0.6

Linux version 2.4.20 (zacker@svn) (gcc version 3.2.3 with Broadcom modifications) #1 Wed Dec 1 20:25:58 CST 2010

# cat /proc/cpuinfo
system type             : Broadcom BCM5356 chip rev 1
processor               : 0
cpu model               :  V4.9
BogoMIPS                : 166.29
wait instruction        : no
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : no
hardware watchpoint     : yes
VCED exceptions         : not available
VCEI exceptions         : not available
unaligned_instructions  : 0
System clocks
        (cpu/mem/si/xtal)       : 333/166/83/25 Mhz.
dcache hits             : 2147483648
dcache misses           : 3216862704
icache hits             : 2147483648
icache misses           : 3740752895
instructions            : 2147483648

# cat /proc/meminfo
        total:    used:    free:  shared: buffers:  cached:
Mem:  14716928 14331904   385024        0  1589248  5386240
Swap:        0        0        0
MemTotal:        14372 kB
MemFree:           376 kB
MemShared:           0 kB
Buffers:          1552 kB
Cached:           5260 kB
SwapCached:          0 kB
Active:           4508 kB
Inactive:         4756 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:        14372 kB
LowFree:           376 kB
SwapTotal:           0 kB
SwapFree:            0 kB

# ps x
  PID  Uid     Stat Command
    1 0         S    init noinitrd 
    2 0         S    [keventd]
    3 0         S    [ksoftirqd_CPU0]
    4 0         S    [kswapd]
    5 0         S    [bdflush]
    6 0         S    [kupdated]
    8 0         S    [mtdblockd]
   53 0         S    upnp -D -W vlan1 
   56 0         S    /bin/eapd 
   58 0         S    nas 
   62 0         S    /bin/wps_monitor 
   96 0         S    dnsRedirectReplyd 
   98 0         S    swresetd 
  103 0         S    httpd 
  104 0         S    dnsmasq -h -n -c 0 -N -i br0 -r /tmp/resolv.conf -u root 
  108 0         S    udhcpd /tmp/udhcpd.conf 
  109 0         S    ddnsd & 
  118 0         S    heartbeat 
  125 0         S    wlanconfigd 
  126 0         S    pot run 
  137 0         S    upnpd 
  138 0         S    /usr/sbin/email 
  142 0         S    /usr/sbin/acl_logd 
  143 0         S    udhcpc -i vlan1 -p /var/run/udhcpc0.pid -s /tmp/udhcpc -H 
  146 0         S    lld2d br0 
  151 0         S    wpsd 
  166 0         R    telnetd 
  169 0         S    /bin/sh 
  177 0         R    ps x 

How to add tags