Netgear WNR834Bv2

multiple revisions of this device, use caution

bgn (N300)
RangeMax NEXT Wireless-N Router
Support	Support page
Wikipedia	Netgear
InfoDepot Wiki	Netgear WNR834B v2.0
WikiDevi.wi-cat.ru	Netgear WNR834Bv2
3rd Party Firmware
dd-wrt	Supported
OpenWrt	Was Supported
Tomato any flavor	Incompatible
Gargoyle	Status Unknown
Platform
Brand • Model • Rev	Netgear WNR834B v2
FCC ID	PY307100061
IC ID	4054A-0710061
Type	wireless router
CPU1	Broadcom BCM4704
CPU1 Type	BMIPS3300
CPU1 Speed	264 MHz
Flash1 Chip	Macronix MX29LV320CBTC-90G
Flash1 Size	4 MiB4,194,304 B <br />32,768 Kib <br />4,096 KiB <br />32 Mib <br />0.00391 GiB <br />
RAM1 Size	16 MiB16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br />
RAM1 Chip	Samsung K4S641632K-UC75 x 2
ETH chip1	Broadcom BCM4704
Switch	Broadcom BCM5325F
Ethernet Port Count	1-WAN 4-100MbE-LAN
Wired Standard	IEEE 802.3/3u
802dot11 OUI: 00:1B:2F (5 E, 9 W), 00:1E:2A (9 E, 12 W), 00:1F:33 (8 E, 12 W), 00:22:3F (10 E, 12 W), 00:24:B2 (14 E, 16 W) Ethernet OUI: 00:1B:2F (5 E, 9 W), 00:1E:2A (9 E, 12 W), 00:1F:33 (8 E, 12 W), 00:22:3F (10 E, 12 W), 00:24:B2 (14 E, 16 W)
Stock bootloader	CFE 1.0.37 BCM947XX
Stock FW OS	Linux 2.4.20
Expansion IF types	none specified
Power	12 VDC, 1 A
Connector type	barrel
Serial Port (UART)	yes, internal, 6-pin header, unpopulated, 3.3V TTL, (115200 8N1), JP1
JTAG Port	yes, internal, 10-pin header, unpopulated, J12
Additional chips 2.4GHz Power Amplifier IC;Skyworks;SE2528L;;2;
Other
Default SSID: NETGEAR (43 addl. devices) Default IP address: 192.168.1.1 the IP 192.168.1.1 is used by 1323 additional devices of which 107 are Netgear devices Default login user: admin Default login password: password admin:password credentials used by 425 additional devices of which 306 are Netgear devices
Manuf/OEM/ODM	Foxconn U12H081
3rd Party Firmware Support	DD-WRT • (List) , OpenWrt (Was)
Retail
FCC approval date	04 June 2007
UPC	606449041415 (UPC DB, On eBay)
ASIN	B000FFRZ1W
Country of manuf	China
Radio 1
Chip1	Broadcom BCM4321
Chip2	Broadcom BCM2055
Wireless interface OUI	00:1B:2F, 00:1E:2A, 00:1F:33, 00:22:3F, 00:24:B2
Antenna Connector Type	U.FL
MIMO status	2x2:2
Wireless Standard	IEEE 802.11b/g/n
802.11n	up to 300 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
WiFi Operating Frequency	2.4 GHz
Radio cor_rev	11
CPU1 brand Radio1 chip1 brand Radio1 chip2 brand Netgear WNR834A Intel Atheros Atheros Netgear WNR834Bv1 Broadcom Broadcom Broadcom Netgear WNR834Bv2 Broadcom Broadcom Broadcom Netgear WNR834M Marvell Marvell Marvell

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.

For a list of all currently documented Netgear device with specifications, see Netgear.

• 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = N300 class

Overview

"U12H081", "REV. 3 GP", and "800063" is silkscreened on one production model WN834Bv2.

Links of Interest

Wikis

• On OpenWrt Wiki

Forums

• Part numbers noted the DD-WRT forums

Flashing

Flashing dd-wrt

(See Important Notes below before attempting to flash)

Do not use bin/chk files from the router database older than svn12188. Currently, they are bricking routers. Once this problem is sorted out, this message will be removed. Also you might want a build higher than 12533 because the root-exploit (milw0rm) on older versions. Sparkie Updated by redhawk0 This file worked perfectly with my router: dd-wrt.v24-15508_NEWD_openvpn_jffs_small.bin - Tmittelstaedt This file bricked my router, while earlier versions seem to work: dd-wrt.v24-13577_NEWD_openvpn_jffs_small.bin - deadlyninja

On the DDWRT Forum
Support started version: v24 build 5966 20070222
Current supported version: ?

• • This router does not have VLAN support, similar to the WRT610N.**

The Netgear WNR834Bv2 is now fully supported as of 3rd July 2008. Thanks to Eko, Brainslayer, etc. for their superb work in getting this router supported.

These (slightly modified) instructions were first posted by sparkie here. Read that complete thread for the hairy details on getting this device fully supported, if you are so interested or suffer from insomnia.

Step 1: Download the mini version of DD-WRT version 24, build 12548, new driver in the dot CHK format here.

Step 2: Flash the firmware to your router using Netgear's factory firmware standard web interface. Note that to successfully flash this device, you may need to use IE or Firefox 3 or higher. sparkie has reported in the thread linked above that Firefox 2 will not work with the Netgear factory web upgrade page to flash this device.

Step 3: If the mini build is insufficient for your needs, you may download your preferred flash BIN file from here. Then flash up the new .BIN file using the DD-WRT web interface from the Administration tab, then the Firmware Upgrades tab.

Important Notes (Please read these in full before attempting to flash):

• DO NOT ATTEMPT TO FLASH ANY BUILDS EARLIER THAN 9856 DATED 3RD JULY 2008, or you risk bricking your router. Some of the v24 release candidate 7s worked with minor bugs. But the first final v24 bricked the router for some users as a result of a problem with JFFS.

• TFTP flashing only works when the router detects a bad flash and puts itself in diagnostic mode. This can be seen by a flashing green power light, and also a ping trace will show response immediately after powerup with TTL=100. Proper flashes will stop replying to pings after about 15 seconds, then will reply with TTL=64. Diag mode will stay at TTL=100. Diag mode can be forced by opening the router and shorting pins 16 and 17 on the MX flash chip during powerup. Some suggest you try the pin short first, other suggest JTAG. Both have their pros and cons.

• TTL=100 3~6 times means your router is bricked. No amount of uploading an image via tftp at the proper time will work. It will require a pin short, or jtag to fix. It is futile to try and achieve perfect timing to upload an image in this mode.

• NEWD = New Drivers; VINT = Vintage Drivers. Use only NEWD firmwares with this router. VINT builds are for much older routers.

• DO NOT INSTALL the generic broadcom dd-wrt.v24_std_generic.bin file (2.4 SP1). It will likely brick your router.

• If your router is stuck in 'tftp only' mode (characterized by a constant TTL=100 ping response), you can rescue it by TFTPing the original Netgear firmware less the header file located here, which will flash your router back to Netgear's stock 1.0.22 North America firmware. This file is called wnr834bv2_1_0_22_na.bin

• For routers will a more recent flash, you will need the 2.1.13 version of the flashes 2.1.13_NA / 2.1.13_WW

• Your router has only 4 MB of Flash RAM. Do not attempt to flash the MEGA version of DD-WRT to this device.

DOUBLE SUPER DUPER Extremely Important Note:

According to Eko, the NVRAM of this router has an additional partition on it which contains your router's serial number, MAC address, and board code. DD-WRT builds prior to 9856 would overwrite this section of NVRAM, if the user enabled JFFS. Builds 9856 and higher include support for turning JFFS on with this model router. In the event that you accidentally erase this part of the NVRAM, you can only recover your router by flashing it via JTAG.

This also implies that if you want to use the OpenVPN version, you'll want one with an openvpn_jffs_small suffix like THIS one (current as of 15/5/2009).

Flashing OpenWrt

On the OpenWrt ToH (techdata entry)
On the OpenWrt Wiki
OpenWrt Target: bcm47xx
OpenWrt Subtarget: legacy
OpenWrt Package architecture: mipsel_mips32
Support started version: 12.09
Current supported version: 22.03.7

Please insert instructions here

Upgrading

Updating DD-WRT

If dd-wrt is already on the router follow these instructions. If stock firmware is on the router follow the flashing instructions.

1. Check for recommended builds here first.
2. Set your computer to a static IP of 192.168.1.7. (or to whatever subnet the router is on) Disable all firewalls and security. Disable wireless on your computer and only have the router connected to the flashing computer by the ethernet cable between the two.
3. Hard reset or 30/30/30 (If the router supports it, if not, reset to defults in the GUI) prior to flashing. Wait. Check for password page on re-login and change password.
4. Flash firmware. You can use the webgui except if you have a belkin router. (For belkin use tftp.exe to flash)
5. Wait...at least three minutes. Lights should return to normal. See important2, below. Failing to wait is how most people brick their routers.
6. Do a power cycle of the router. (Unplug the cord, count to 30 and plug it back in.)
7. Wait for the lights to return to normal usually about 2 minutes.
8. Hard reset or 30/30/30 again (If the router supports it, if not, reset to defults in the GUI). Wait. Check for the password page and re-login to change the password. Then you can reconfigure your settings manually.
9. Once configured set your computer back to autoIP and autoDNS.
   

Important1: This Hard reset or 30/30/30 works fine for Asus router, but you do have to power cycle after the reset.

Important2: After you flash the firmware, and before you do the hard reset, the router will be building some nvram settings. YOU MUST WAIT FOR THIS TO FINISH PRIOR TO DOING ANYTHING WITH THE ROUTER INCLUDING A HARD RESET. Usually, you can tell when this process is completed by the WAN light coming on, but it does take several minutes. Go have a beer. There are starting to be more and more people who BRICK their routers by not waiting until the nvram is rebuilt, PRIOR to doing a hard reset. YOU NEED TO WAIT!

JTAG-Serial Info

JTAG

JTAG Pinouts

J12 Pin 1 connected to JP1 pin 1 via 100 ohm resistor. 

J12 Pin 3 --100r--> TDI (Pin 2 of parallel port) 
J12 Pin 5 --100r--> to TD0 (Pin 13 of parallel port) 
J12 Pin 7 --100r--> to TMS (Pin 4 of parallel port) 
J12 Pin 9 --100r--> to TCK (Pin 3 of parallel port) 
J12 Pin 10 -------> to GND (Pin 20&25 of parallel port)

• Functional NVRAM backup is here.
• Functional CFE backup is here.
• Functional Custom backup is here. (REQUIRES MODIFICATION OF MAC ADDRESS)
• Tornado's JTAG v2.1.4 is here.

JTAG Recovery

One of the best threads that has been found for debricking the WNR834Bv2.

The fastest way to recover a bricked WNR834Bv2 is to wipe the kernel portion of the flash, and reflash the custom section.

• 1. Download one of the binpacks WNR834Bv2 World Wide. WNR834Bv2 North America, and the custom.bin
• 2. JTAG the router
• 3. Erase the kernel portion of the flash
• 4. Reflash the 'custom' section of the flash (hex edit the custom.bin and put your own MAC address in at offset 40~45!)
• 4a. flash parameters: -flash:custom /window:1fc00000 /start:1ffe0000 /length:10000
• 5. Power cycle the router and the router will respond with a constant ttl=100 ping response
• 6. TFTP a dot CHK file appropriate to your router (NA or WW)
• 6a. You will know that the transfer was completed and the flash process is working when router power light blinks amber on and off once per second. After a few minutes, the router will begin to respond with a ttl=64 ping and will be functional again.

RECOVERY PROCESS VIA PIN SHORT

• Pin Locations.
• Short pins 16 & 17
• Power up router
• Open two command prompt/console windows
• Start a ping of the router, it should respond with TTL=100
• Initiate TFTP upload of a .chk file (DD-WRT or one of the stock Netgear ones)
• Immediately remove the short
• You will know that the transfer was completed and the flash process is working when router power light blinks amber on and off once per second. After a few minutes, the router will begin to respond with a ttl=64 ping and will be functional again. (Yes, it actually does take 2~3 minutes)

Serial

Serial Pinouts

This is a common Netgear / Foxconn pinout..

 1         JP1
(3.3v) (RxD) (NC)  (NC)  (TxD)  (GND)

Info derived from

boot log

Decompressing..........done Decompressing..........done CFE version 1.0.37 for BCM947XX (32bit,SP,LE) Build Date: Thu May 3 14:43:11 CST 2007 Copyright (C) 2000,2001,2002,2003 Broadcom Corporation. Initializing Arena Initializing Devices. Boot partition size = 131072(0x20000) et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.80.53.0 et1: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.80.53.0 CPU type 0x29006: 264MHz Total memory: 16384 KBytes Device eth0: hwaddr 00-24-B2-00-89-60, ipaddr 192.168.1.1, mask 255.255.255.0 gateway not set, nameserver not set CPU revision is: 00029006 Primary instruction cache 16kb, linesize 16 bytes (2 ways) Primary data cache 16kb, linesize 16 bytes (2 ways) Linux version 2.4.20 (aspen@coolteam.cs) (gcc version 3.2.3 with Broadcom modifications) #2 Thu Mar 27 15:12:04 CST 2008 Setting the PFC to its default value Determined physical RAM map: memory: 01000000 @ 00000000 (usable) On node 0 totalpages: 4096 zone(0): 4096 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200 CPU: BCM4704 rev 9 at 264 MHz Calibrating delay loop... 263.78 BogoMIPS Memory: 14360k/16384k available (1361k kernel code, 2024k reserved, 108k data, 56k init, 0k highmem) Dentry cache hash table entries: 2048 (order: 2, 16384 bytes) Inode cache hash table entries: 1024 (order: 1, 8192 bytes) Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) Checking for 'wait' instruction... unavailable. POSIX conformance testing by UNIFIX PCI: Initializing host PCI: Enabling CardBus PCI: Fixing up bus 0 PCI: Fixing up bridge PCI: Fixing up bus 1 Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au) devfs: boot_options: 0x1 Squashfs 2.2-r2 (released 2005/09/08) (C) 2002-2005 Phillip Lougher Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled ttyS00 at 0xb8000300 (irq = 3) is a 16550A ttyS01 at 0xb8000400 (irq = 0) is a 16550A PPP generic driver version 2.4.2 Amd/Fujitsu Extended Query Table v1.1 at 0x0040 number of CFI chips: 1 Flash device: 0x400000 at 0x1c000000 Physically mapped flash: squashfs filesystem found at block 620 Creating 8 MTD partitions on "Physically mapped flash": 0x00000000-0x00020000 : "boot" 0x00020000-0x003b0000 : "linux" 0x0009b324-0x003b0000 : "rootfs" 0x003b0000-0x003c0000 : "T_Meter1" 0x003c0000-0x003d0000 : "T_Meter2" 0x003d0000-0x003e0000 : "POT" 0x003e0000-0x003f0000 : "board_data" 0x003f0000-0x00400000 : "nvram" NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP, IGMP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 1024 bind 2048) Linux IP multicast router 0.06 plus PIM-SM NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. NET4: Ethernet Bridge 008 for NET4.0 802.1Q VLAN Support v1.7 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> VFS: Mounted root (squashfs filesystem) readonly. Mounted devfs on /dev Freeing unused kernel memory: 56k freed Algorithmics/MIPS FPU Emulator v1.5 Reading board data... WSC UUID: 0x8062e454105b992f3427e1eda53bf588 Using /lib/modules/2.4.20/kernel/drivers/net/et/et.o insmod: bcm57xx.o: no module by that name found Using /lib/modules/2.4.20/kernel/drivers/net/wl/wl.o Hit enter to continue...NVRAM upgrade required. Starting. NVRAM upgrade complete. Reading board data... WSC UUID: 0x8062e454105b992f3427e1eda53bf588 WARNING: console log level set to 1 eth2: Numerical result out of range eth2: Operation not supported eth2: Invalid argument eth2: Invalid argument eth2: Operation not supported eth2: Operation not supported eth2: Invalid argument eth3: No such device ifconfig: Illegal seek eth4: No such device ifconfig: Illegal seek eth2: ignore i/f due to error(s) ********************************************* Wi-Fi Simple Config Application - Intel Corp. Version: Build 1.0.5, November 19 2006 ********************************************* Reading board data... WSC UUID: 0x8062e454105b992f3427e1eda53bf588 Using /lib/modules/2.4.20/kernel/net/ipv4/acos_nat/acos_nat.o Info: No FWPT default policies. info, udhcp server (v0.9.8) started error, unable to parse 'option wins ' error, unable to parse 'option domain ' POT integrity check OK. POT time is up. Initializing stack...button monitor start...! apLockDownLog_init, counttion = 300, duration = 300! OK Now starting stack get mac = 00 24 B2 00 89 60 Start DHCP client daemon info, udhcp client (v0.9.8) started eth1: No such process Hit enter to continue...DEVICE PIN: 75885960 ******* MODE: Access Point ******* DEVICE PIN:75885960 WSC: In unconfiged AP mode, wait for start command.... tlvPtrChar* : func CMasterControl_InitiateRegistration line 656 allocating memory 0x10004100 for 0x100040e8 Waiting for Registrar to connect...

Notes

FAULTY POWER SUPPLY

Many of the factory refurb WNR834B v1 and v2 routers sold in 2008 through frys.com, geeks.com, tigerdirect.com, and woot.com were shipped with a marginal or defective power supply manufactured by DVE. These units are smaller than traditional power supplies, and can be identified by the following information:

P/N: 332-10006-01

MODEL: DSA-12R-12 AUS 120120

The routers will operate perfectly with only 9VDC @ 800mA, but older-style surplus Netgear power supplies that output 12VDC @ 1A are available from AllElectronics.com as DCTX-1216