Microsoft MN700 hack project

[ggoldfingerd]

I can't connect and flash the cfe file using windows or linux. I keep receiving CHIP ID: 11111111111111111111111111111111 (FFFFFFFF) = no power no link. I built my jtag connector, but something must not be right. I know the cable and headers are soldered correctly. I used a DVOM and check for opens, shorts, and to make sure they went to the correct pins. When ground pin 13, the CHIP ID changes to 0x00000..... I bypassed the resistor on pin 13 also to check, but it had no effect.

I have only tried two different pc's, so maybe its the computers. One is really old, can barely run linux (couldnt even make the wrt54g file) and the other is newer and is running vista.

Thanks,
Jeremiah

Does any have troubles in cold boot with the mn700? Sometimes the power light wont come on and I have to keep resetting the power until it works. This has happened for years. Maybe this problem is affecting my flashing ability.

[ggoldfingerd]

I still have had no luck with my router. I know for sure my cable is correct. I will try more pc's, but it may be my router. I traced the lines to the broadcom chip, no opens or anything. I cant see the solder points on the chip, so idk.

[youyou]

Consults a question with the fellow friends，I have the MN700. And three days ago succeed flash DD-WRT system. This morning has turned off several MN700 power sources, presents the breakdown, the phenomenon is often bright for the yellow, PING does not pass router. I have made “wrtjtag-modified.exe - flash:cfe /noreset” again, demonstrates normally.
After the installment completes, with the line connection computer and the MN-700 random LAN mouth, for the MN-700 power failure, then holds down the Reset button not to put, puts through the power, about 10 to 20 seconds later, the MN-700 power source lamp does not present between the orange color and the green glitters. Please ask how to solve this problem, was the router is bad?

[brettwal]

It's nice to finally find an active discussion on this topic. Here is my status thus far.

I have successfullt JTAG'ed my mn700. I can write to it but, I think my cfe.bin is bad. I cannot get the router into restoration mode afterwards. I cannot get nvserial to run in linux. My MAC is 00:0D:3A:6D:08:60

Can some please create and email (or post) a cfe.bin with this MAC ? Or even give some instruction on how to get nvserial running under Ubuntu 7.10 ?

Thanks in advance.

[Thembones]

Hi guys , just wondering if anyone who has the router and jtag working can make a wholeflash backup and mail it to me ,I had the router working with no problems but when trying another firmware I erased the wholeflash.bin,I would highly appreciate that,thanks.

[brettwal]

I managed to get nvserial to work in Ubuntu and I created a cfe.bin with my MAC address. However, when I try to flash it using the JTAG GUI, it always hangs at 4%. I try to flash from DOS using wrtjtag-modified and it hangs in various spots. I can sucessfully flash the microsoft boot image, but it is only 95K and does me no good. I have tried erasing several times and reflashing the cfe.bin but it always hangs. My JTAG cable is correct and is 6 inches long.

Anyone have any ideas or pointers?

[ericj]

I managed to get nvserial to work in Ubuntu and I created a cfe.bin with my MAC address. However, when I try to flash it using the JTAG GUI, it always hangs at 4%. I try to flash from DOS using wrtjtag-modified and it hangs in various spots. I can sucessfully flash the microsoft boot image, but it is only 95K and does me no good. I have tried erasing several times and reflashing the cfe.bin but it always hangs. My JTAG cable is correct and is 6 inches long.

Anyone have any ideas or pointers?

Try a different computer maybe? Or perhaps changing the operating mode of the parallel port in bios - generally you can specify epp, ecp, or normal. sometimes there's a ps/2 style mode as well.

I'm flashing my 2nd mn-700 today and i'm amazed at how hard it is this time because my first time around was really fairly straightforward and easy. I don't remember which version of wrt54g i used on linux when i did my first one, and the cable i used is long, long gone. But i know i used linux.

Built a new cable, and spent hours trying different versions of wrt54g and different command-line arguments.

Basically it would either not start at all or it would die at 3% or 4%.

In order to get it to die at 4% i had to specify /nobreak.

specifying /nodma would always result in a non-starter - which makes no sense, it's supposed to be slower but less trouble-prone.

wrtjtag-modified.exe seems to be working from a different (but mostly identical) laptop under XP. It's very, very slow, so i suppose it could still fail on me.

Edit: the wrtjtag-modified that's attached to a post several pages previous in this thread was ultimately successful. It ran through without stopping, so i did a backup of what I'd just written, used 'comp' to compare it with the cfe.bin i'd written, and found that there was a single-bit error. Erased the cfe a couple more times, wrote it again, and the 2nd time the backup matched what was supposed to be written, so now I'm finally done jtagging my 2nd mn700. Just wanted to reiterate to people: this process can get hinky, so always read back what you wrote via jtag and compare it to the original to see if the write was really successful and uncorrupted. Sometimes something goes wrong.

[brettwal]

I never could get the JTAG GUI to get past 4%. I used wrtjtag-modified and managed to get my cfe.bin on it. I can even get the alternating green/amber LED but, I cannot access it via IP (The ASUS utility cannot find the device). I got several errors on the load, I have to use the /noreset switch to even come close. I suspected noise on the JTAG cable so I added some ferite to it and that helped a great deal but, I still can't access it. I may try cutting down the cable length some more. (It is already under 8 inches). I can't get wrt54g to run from my Ubuntu box either. It says /dev/parport0 does not exist. I think it is listed as a different device name.

[youyou]

I lost the R6 carelessly, so the MN-700 ROUTER could not work.

please could you tell me which model of the R6 in the chart shows .

[ericj]

I never could get the JTAG GUI to get past 4%. I used wrtjtag-modified and managed to get my cfe.bin on it. I can even get the alternating green/amber LED but, I cannot access it via IP (The ASUS utility cannot find the device). I got several errors on the load, I have to use the /noreset switch to even come close.

It looks like /noreset is required for this board, so just use it. I also recommend that you just go ahead and keep using wrtjtag-modified.exe as well.

Make sure that the flash was completely successful by running "wrtjtag-modified -backup:cfe /noreset" and running "comp" to compare CFE.BIN with the file output by the backup process. 'comp' is an interactive program - it'll just ask you which two files you want to compare. There should be no differences. If there is a difference, run "wrtjtag-modified -erase:cfe /noreset" a few times, then flash the cfe again.

I'd recommend clicking the upload button on the firmware restoration app right before plugging in the power on the router.

Also, don't do this while connected to your whole network. Just run one ethernet cable from the computer running the firmware restoration app to the router.

Make sure your computer's address is in the 192.168.1.x address range.

Make sure that firewall software isn't blocking the firmware restoration utility.

[ericj]

I lost the R6 carelessly, so the MN-700 ROUTER could not work.

please could you tell me which model of the R6 in the chart shows .

Looks like 850 ohms.

You don't necessarily need a surface mount part there, either. You could get a 1/4 or 1/8 watt axial part and solder it from the small pad to the left of it in that picture to the big huge ground plane to the right of it. Just use a razor blade to scrape away the green mask and swab the copper lightly with a good flux, and pre-tin it with solder before tacking down the resistor.

[thenamelessthin]

Hi all! I have build a JTAG cable and I test it with a multimeter. It look good. When I try to jtag the routeur I got FFFFFFFFFFFF error.. I have try with the Windows JTAG soft (with GUI) I'm on XP and I disable the antivirus. And I have try on the différent PC.

Any Idea?

[leperkuan]

I'm just starting to attempt this modification and im just a little worried, ive started to solder my jtag cable and from what i see on the diagram, 17-25(pc) are ground wires and can be placed on any 2,4,6,10,12 (jtag) ??? the way i have done it was
(25-2) (24-4) (23-6) (22-8) (21-10)
does this sound correct?

Also does anyone know if Radioshack carries the 12 pin header male and female, so far ive soldered straight into the router.... which i see may cause problems down the line in case i need to restore or something of that sort i would have to re solder..

closest thing i have done to this is put a mod chip into an xbox and flash it and my first go i bricked an xbox motherboard so im taking this project in stride.

once i get this connector finished i will be back in the forums because alot of these tutorials i have seen leave you to figure out some small items

[smeyer56]

I am having problems getting nvserial to run on Ubuntu. Is it possible to take someone else's CFE.bin and just edit the MAC address?

[smeyer56]

I finally got nvserial to work! It took a lot of time and multiple tries but it works!