Netgear WNR3500 v2

Wikidevi Notes
Manuf. by Foxconn / Hon Hai / Ambit

Links of Interest

 * Netgear WNR3500 v2.0 Brick
 * Netgear WNR3500 v2.0
 * DD-WRT for Netgear WNR3500v2 ?
 * Netgear WNR3500V2 - rollback to original FW
 * Netgear 3500 v2 died after firmware upgrade
 * WNR3500v2 stuck in waiting for tftp mode (Solved)

Flashing DD-WRT

 * 1) Hard Reset/30-30-30
 * 2) Configurge PC for a static ip of 192.168.1.10
 * 3) Make sure nothing else but power and PC is hooked to router
 * 4) Load dd-wrt.v24-18946_NEWD-2_K2.6_mini-WNR3500v2.chk
 * 5) Wait 5 Minutes
 * 6) Browse to 192.168.1.1, make sure you get the change password page
 * 7) Hard Reset/30-30-30
 * 8) Browse to 192.168.1.1, change name and password, configure.

Reverting to OEM Firmware from DD-WRT
No GUI Revert yet, see serial recovery for reversion.

JTAG Pinouts
J14  nTRST  1o o2	 GND TDI  3o o4	 GND TDO  5o o6	 GND TMS  7o o8	 GND TCK  9o o10	 GND nSRST 11o o12  N/C Using Universal JTAG Adapter  white 1o o2	 black red 3o o4	 GND blue 5o o6	 GND green 7o o8	 GND yellow 9o o10  GND orange 11o o12 N/C Using TUMPA  TUMPA N/C 1o o2  N/C nTRST 3o o4  GND TDI 5o o6  GND TMS 7o o8  GND TCK 9o o10 GND N/C 11o o12 GND TDO 13o o14 GND nSRST 15o o16 GND N/C 17o o18 GND N/C 19o o20 GND

Using the ribbon cable provided Black to your choice of pins 2,4,6,8,10 on router and your choice of pins 4,6,8,10,12,14,16,18,20 on TUMPA for GND White to pin 1 on router and pin 3 on TUMPA for nTRST Grey to pin 3 on router and pin 5 on TUMPA for TDI Purple to pin 7 on router and pin 7 on TUMPA for TMS Blue to pin 9 0n router and pin 9 on TUMPA for TCK Green to pin 5 on router and pin 13 on TUMPA for TDO Yellow to pin 11 on router and pin 15 on TUMPA for nSRST

DD-WRT JTAG Recovery for Universal JTAG Adapter
Confirmed Working with North American Unit and Firmware
 * 1) Power Cycle,
 * 2) Power Cycle,
 * 3) Power Cycle,
 * 4) Power Cycle,
 * 5) The last step will backup the board data to "custom.bin, Using a Hex editer, check to make sure all the data looks similar to board_data.bin or post it to your thread in the dd-wrt forums and somebody can check it for you.
 * 6) If it is similar, change "U12H127T70_NETGEAR" to "U12H127T00_NETGEAR". The mac address starts at Hex address 40 in the middle pane, make sure it's correct. The Serial number starts at Dec address 76 in the right pane, make sure it's correct. The Security Pin starts at Dec address 108 in the right pane, make sure it's correct. The actual board data starts at Dec address 256 in the right pane, make sure it matches board_data.bin. If it looks all messed up then start fresh with board_data.bin and make all the changes ti it. When done "save as" "custom.bin" without the quotes. Makes sure it's in the same folder as TJTAG.
 * 7) Now do the same with the cfe128, mac sure mac address match(although not as important with the cfe). Check to see if is similar to cfe128.bin. If not or it's just totally messed up use the reference cfe128.bin. Just edit it to match the information from your router.
 * 8) Power Cycle,
 * 9) Power Cycle,
 * 10) Have TFTP.exe ready in WindowsXP, with WNR3500v2-V1.2.2.28_25.0.85NA.chk from that zip file. Configure your computer with a static ip address of 192.168.1.10 . Connect the router to the pc via network cable. Power on the router when it signals a connection click upgrade.

Serial Pinouts
JP1  VCC 1 o RX 2 o N/C 3 o N/C 4 o  TX 5 o GND 6 o

DD-WRT Serial Recovery

 * 1) Once you hooked up and getting data in putting/Hyper terminal and have a static ip on you pc of 192.168.1.10, Power cycle the router. Imediatly start rapid firing CTRL+C until it breaks into the CFE.
 * 2) Get TFTP ready with the OEM firmware.
 * 3) Type , then click upgrade on the TFTP window.
 * 4) Give it about 5 min to bootup and settle, then goto 192.168.1.1

DD-WRT vlan Info

 * DD-WRT:VLAN Support Testing Needed

Pictures
Netgear Images

Flash partitions
 dev: size     erasesize name mtd0: 00040000 00010000 "pmon" mtd1: 00750000 00010000 "linux" mtd2: 005dc000 00010000 "rootfs" mtd3: 00080000 00010000 "jffs2" mtd4: 00010000 00010000 "nvram" mtd5: 00010000 00010000 "board_data"