Microsoft MN700 hack project

[roylund]

I'm glad I found this site. I dug and old MN-700 out of the garage dusted it off, installed the 12 pin header, built the jtag, and downloaded all necessary files. Unfortunately I don't know much about linux. I have Redhat on a dual boot laptop and Ubuntu in a recycled desktop but have spent little time using them. I use the syntax posted in the forum for creating the cfe file using nvserial but I keep coming up with command not found. I have all three files in the \home\ranylun directory I use root login in a terminal window, change to the driectory where the files are. I set the nvserial properties to executable. I'd like to learn what I'm doing wrong but if someone could also create the cfe file for me I would appreciate it.

Here are the contents of my mn700.txt file with my mac adress embedded.

# Microsoft MN700 board

boardtype=bcm94710ap
boardnum=mn700

# 4710 CPU clock frequency in Mhz
# Only valid value is 125, anything else defaults to 100Mhz
clkfreq=125

# 4710 SDRAM controller parameters
sdram_init=0x0419
sdram_config=0x0000
sdram_refresh=0x8040

# 4710 MAC and PHY parameters
et0macaddr=00:0D:3A:72:B6:F4
et0phyaddr=30
et0mdcport=0
et1macaddr=00:0D:3A:72:B6:F4
et1phyaddr=5
et1mdcport=1

# PMON variables
dl_ram_addr=a0001000
os_ram_addr=80001000
os_flash_addr=bfc40000
lan_ipaddr=192.168.1.1
lan_netmask=255.255.255.0
scratch=a0180000
boot_wait=on
watchdog=3000
hardware_version=WL500-02-02-01-00
regulation_domain=0X30DE

All help appreciated.

Thanks,
Roy
royan@spamcop.net

+=+=+=+=+=+
| UPDATE |
+=+=+=+=+=+

I have made progress (for those who may have similar difficulty.) I downloaded Knoppix and ran it from CD. The nvserial runs but the file system is read-only so the cfe.bin that is generated doesn't write to disk. When I try to change permissions for the folder I get a response that I don't have sufficient privilege and I can't log in as root because I don't know what password to use. I think I'm close to getting this licked but work gets in the way.

+=+=+=+=+=+
| UPDATE |
+=+=+=+=+=+

Issue solved!! For the benefite of others, I clicked the K in lower left (start equiv of Win), clicked KNOPPIX, clicked ROOT SHELL, typed psswd, typed a random password, hit enter, typed the password again, hit enter and password entered successfully. Typed exit.

Right clicked the drive icon on the desktop and from the menu clicked on change read/write mode. When asked if sure I want to changed partition to write I clicked yes.

Went to the directory containing the files, opened terminal window, executed nvserial -i mn700.bin -o cfe.bin mn700.txt and in a short time the command prompt returned and ls showed the cfe.bin in the directory (around 256 K in size). Since I'm self directing the process I hope it went correctly and will flash.

+=+=+=+=+=+
| UPDATE |
+=+=+=+=+=+

I had a little difficulty with the flash. I used the windows version so I had to move all files to a directory I created in the root of C: drive so it would be asy to run dos in a command window. I started by using the command

wrtjtag -backup:cfe

It would properly i.d. the processor but would freeze after processor reset. After a couple of tries I decided to try

wrtjtag -backup:cfe /noreset

voila....the backup process started scrolling down my screen. After quite awhile it finished and I had the original microsoft cfe backed up on my drive.

I turned the router off and on and then did the flash

wrtjtag -flash:cfe /noreset

The flash started scrolling down my screen and about a half hour later that completed normally (it seems, I hope).
After power cycling the router the power LED alternately blinks yellow-green-yellow-green.....

I'm ready for the firmware upload and at this point I have a question if anyone if reading this.

WHAT IS MY BEST CHOICE (STABILITY VS. FEATURES)? Is Oleg's 1.9.2.7-6b best or should I go older or newer. Hope someone's reading this.

Thanks,
Roy

[roylund]

I have successfully completed upgrading the firmware of the MN-700 using DD-WRT SVN 3953. I see that Firmware v1.9.2.7 CR4 from this site offers basic functionality for the MN-700. At this time I am only needing bridge or repeater capability. Can someone tell me if there are any firmware revisions from this site that are particularly good on the MN-700 or any that I should avoid? Thanks in advance, Roy

[DarenM]

**Update**

I figured out that the reason I was having such a hard time finding the Asus Restoration Utiliy is because it's not listed as that on the Asus site. It's listed as Asus Wireless Utility or something and that contains the Firmware Restoration Utility. I did use that to upload my new firmware which I got at the link below. Found at DD-WRT.

http://www.dd-wrt.com/wiki/index.php/MN-700

Be sure to read carefully if you go there to download the firmware. Only 2 versions are supposedly working with the MN-700. The link I provided gives a link to the svn that supports the MN-700.

Also make a note that the Asus Firmware Restoration Utility by default only sees .trx and .img files but it does not see .bin files which is what the
dd-wrt firmware is. So you will need to click the little drop down menu and select "All files"

They also provide links to the asus stock firmware, Olegs firmware, and OpenWRT firmware all of these are supposed to work with the MN-700.

With the DD-WRT firmware with DHCP enabled I have problems, just like I did with the original mn-700 firmware. It seems that it has problems assigning new addresses, and clearing the ones that havn't been used. I set it to only allow 3 dhcp clients so that I could have 3 computers get connected. This was after I had left my house and gone somewhere else with the router. It still had my computer name and address from my home listed in the DHCP clients table and I think thats why it would only allow me to configure two at my second location. It was kinda annoying. So I allowed for more clients and it solved my problem temporarily until a few restarts later with the pc's and I was back to not being able to recieve an address. This was the same issue I had with the original firmware so I was kinda angry.

I decided to use static IP's, and I prefer it actually...I did this same setup with the original firmware and it would only allow for one computer at a time. Weird huh? But it worked nicely with the dd-wrt firmware. Also note that the dd-wrt has some problems when trying to log into the router, perhaps this could be a security feature the dd-wrt guys setup but the router seems to not allow any http logins after 2 or 3 within less than a few minutes.

Has anyone had any success with DHCP with other firmwares?

Also dd-wrt has a TON of options.

**End Update**



Hey roylund,

I'm glad to see someone is involved in this around the same time as I am. I was beginning to feel alone and it seemed like I had missed the flashing thing for this router by a couple years.

I think your problem with the error "command not found" with nvserial may have been because you didn't type "./nvserial" or did you?

I'm glad to see you got things working.

After many many hours I have successfully flashed the firmware with the Windows WRT/JTAG Program made by HairyDairyMaid.

(making notes)
Here is the link where I downloaded the Windows version:

http://www.ranvik.net/prosjekter-pri...5B1%5D.99beta/

The file is named WRTJTAG.exe

I made sure to read the README.txt
I put the io.dll file into 3 places but I think it only need to be in the root folder that I made where I put the exe. The other places I put it were in my system and system32 folder.

I also placed my cfe.bin file into the folder I created that contained the io.dll and wrtjtag.exe.

I too made my cfe.bin in linux. I used Ubuntu 7.10 to do it. I had a few of the same problems I saw on this forum. Just to note them here they are:

When using nvserial be sure to put ./ in front of it. That is a period then a slash. And also like you mentioned roylund it needs to be made as an executable. For other reading you can acconplish this by right clicking on the file and go to permissions, then check the box. If you are using command line then you may want to read the man pages for chmod.

Also Make sure nvserial is in the same folder as the stuff for your boot loader.


Some other things that were pretty tough I thought was the whole JTAG connector thing. I will post my pictures and all the next time I post when I have unhooked my connector.

I used two diagrams. this one:

http://www.liamm.com/images/wrt_jtag.png

and this one:

http://scatcat.fhsu.edu/~cmhansen/diag.jpg

I liked the first one cause it showed both rows to the JTAG when representing the device and it had the square around pin 1 which helped reassure me I had it right.

The second link has the numbers for the pins.
I used a db25 connector I took off of some old school device I had in my garage. I would have an old parallel cable but this device I had made it much easier on it.

Also for people reading make a note that the jtag on the mn-700 zigzag in their count. So where it says 1 and 2 you need to remember 3 is next to 1 and 5 is next to 3 and so on. (i'm assuming this is the case with most devices?)

When I used the linux version of the wrt54g program I kept hanging after the processor message. I let it hang for about 13 hours the first time then 3 or so the second time. During these hours I began reading this forum and scouring the internet only to find out that many others had the same problem. For some reason the windows version did not have any problem.

But I completely redid my jtag also...so I dunno. However i never recieved any chip id error with the linux version or windows version unless I was unplugged or my jtag had come undone.

This was very helpful in troubleshooting:

CHIP ID: 00000000000001100000000001111111 (0006007F) = link (to long kabel max 20cm long kabel!!)
CHIP ID: 11111111111111111111111111111111 (FFFFFFFF) = no power no link
CHIP ID: 00010100011100010010000101111111 (1471217F) = you done it
CHIP ID: 00000000000000000000000000000000 (00000000) = you have got one ore more ins worng

Although I don't think the chip id for "you done it" is how the one for the mn-700 will be.
Mine was 0471017F.

The link for the chip id's and other info is here:

http://www.ranvik.net/prosjekter-pri...T_IF_ERROR.txt

I followed this link for the beginning of the project until I became stumpped. It's not a great how to for begineers and I think it was intended for an audience that has done some flashing before. After reading many of the comments on that page I began to wonder if the person who posted the how to actually performed the flash. If you read carefully through the posts it's odd.

http://www.liamm.com/tech/hacking-the-microsoft-mn-700/

I got my bootloader from there. Or accually from Oleg cause the link there is for Oleg's site I think. Which I think eventually led me here.

Now after I flashed it using that bootloader I'm wondering what to do? I'm done with JTAG right? I'm afraid to unhook it if I need it again cause it's very delicate.

Do i just ftp into it? Where do I obtain the Asus firmware restoraion file? This link http://www.asus.com.tw/pub/ASUS/wire...3/Eng_1380.zip is broken.

I'm stuck at the moment. But the hardest part is out of the way right!!?!??

[roylund]

Hey Daren, good to hear from someone. You touched on some good points and issues I faced along the way. It seems the DD-WRT firmware is generally geared to the WRT54G series of Linksys routers so I suspect the Oleg firmware is focused more on the Asus routers and should be better for the MN-700. I hope someone who has tried a few versions, or perhaps Oleg, picks up on this thread and can recommend something that is fairly stable and will exploit most of the capabilities of the MN-700. My next project is a WRT54G-TM that I just got.

Regards,
Roy

[Duri]

hello guys,

I'd like to bother you here as i can see here is some life (unlike on others threads). I see you are having a interesting discussion here and i believe that some of you are keen enough to help me.

I want to de-brick a WL550gE box with jtag cable (i have tried almost everything) but I don't know where to find correct pinout for this box.

here is original link for my problem http://wl500g.info/showthread.php?t=12483

i have done some soldering (just guessing pins) but with no success yet.

please reply there if you have some advice.

sorry for bothering once again...

[ggoldfingerd]

I can't connect and flash the cfe file using windows or linux. I keep receiving CHIP ID: 11111111111111111111111111111111 (FFFFFFFF) = no power no link. I built my jtag connector, but something must not be right. I know the cable and headers are soldered correctly. I used a DVOM and check for opens, shorts, and to make sure they went to the correct pins. When ground pin 13, the CHIP ID changes to 0x00000..... I bypassed the resistor on pin 13 also to check, but it had no effect.

I have only tried two different pc's, so maybe its the computers. One is really old, can barely run linux (couldnt even make the wrt54g file) and the other is newer and is running vista.

Thanks,
Jeremiah

Does any have troubles in cold boot with the mn700? Sometimes the power light wont come on and I have to keep resetting the power until it works. This has happened for years. Maybe this problem is affecting my flashing ability.

[ggoldfingerd]

I still have had no luck with my router. I know for sure my cable is correct. I will try more pc's, but it may be my router. I traced the lines to the broadcom chip, no opens or anything. I cant see the solder points on the chip, so idk.

[youyou]

Consults a question with the fellow friends，I have the MN700. And three days ago succeed flash DD-WRT system. This morning has turned off several MN700 power sources, presents the breakdown, the phenomenon is often bright for the yellow, PING does not pass router. I have made “wrtjtag-modified.exe - flash:cfe /noreset” again, demonstrates normally.
After the installment completes, with the line connection computer and the MN-700 random LAN mouth, for the MN-700 power failure, then holds down the Reset button not to put, puts through the power, about 10 to 20 seconds later, the MN-700 power source lamp does not present between the orange color and the green glitters. Please ask how to solve this problem, was the router is bad?

[brettwal]

It's nice to finally find an active discussion on this topic. Here is my status thus far.

I have successfullt JTAG'ed my mn700. I can write to it but, I think my cfe.bin is bad. I cannot get the router into restoration mode afterwards. I cannot get nvserial to run in linux. My MAC is 00:0D:3A:6D:08:60

Can some please create and email (or post) a cfe.bin with this MAC ? Or even give some instruction on how to get nvserial running under Ubuntu 7.10 ?

Thanks in advance.

[Thembones]

Hi guys , just wondering if anyone who has the router and jtag working can make a wholeflash backup and mail it to me ,I had the router working with no problems but when trying another firmware I erased the wholeflash.bin,I would highly appreciate that,thanks.

[brettwal]

I managed to get nvserial to work in Ubuntu and I created a cfe.bin with my MAC address. However, when I try to flash it using the JTAG GUI, it always hangs at 4%. I try to flash from DOS using wrtjtag-modified and it hangs in various spots. I can sucessfully flash the microsoft boot image, but it is only 95K and does me no good. I have tried erasing several times and reflashing the cfe.bin but it always hangs. My JTAG cable is correct and is 6 inches long.

Anyone have any ideas or pointers?

[ericj]

I managed to get nvserial to work in Ubuntu and I created a cfe.bin with my MAC address. However, when I try to flash it using the JTAG GUI, it always hangs at 4%. I try to flash from DOS using wrtjtag-modified and it hangs in various spots. I can sucessfully flash the microsoft boot image, but it is only 95K and does me no good. I have tried erasing several times and reflashing the cfe.bin but it always hangs. My JTAG cable is correct and is 6 inches long.

Anyone have any ideas or pointers?

Try a different computer maybe? Or perhaps changing the operating mode of the parallel port in bios - generally you can specify epp, ecp, or normal. sometimes there's a ps/2 style mode as well.

I'm flashing my 2nd mn-700 today and i'm amazed at how hard it is this time because my first time around was really fairly straightforward and easy. I don't remember which version of wrt54g i used on linux when i did my first one, and the cable i used is long, long gone. But i know i used linux.

Built a new cable, and spent hours trying different versions of wrt54g and different command-line arguments.

Basically it would either not start at all or it would die at 3% or 4%.

In order to get it to die at 4% i had to specify /nobreak.

specifying /nodma would always result in a non-starter - which makes no sense, it's supposed to be slower but less trouble-prone.

wrtjtag-modified.exe seems to be working from a different (but mostly identical) laptop under XP. It's very, very slow, so i suppose it could still fail on me.

Edit: the wrtjtag-modified that's attached to a post several pages previous in this thread was ultimately successful. It ran through without stopping, so i did a backup of what I'd just written, used 'comp' to compare it with the cfe.bin i'd written, and found that there was a single-bit error. Erased the cfe a couple more times, wrote it again, and the 2nd time the backup matched what was supposed to be written, so now I'm finally done jtagging my 2nd mn700. Just wanted to reiterate to people: this process can get hinky, so always read back what you wrote via jtag and compare it to the original to see if the write was really successful and uncorrupted. Sometimes something goes wrong.

[brettwal]

I never could get the JTAG GUI to get past 4%. I used wrtjtag-modified and managed to get my cfe.bin on it. I can even get the alternating green/amber LED but, I cannot access it via IP (The ASUS utility cannot find the device). I got several errors on the load, I have to use the /noreset switch to even come close. I suspected noise on the JTAG cable so I added some ferite to it and that helped a great deal but, I still can't access it. I may try cutting down the cable length some more. (It is already under 8 inches). I can't get wrt54g to run from my Ubuntu box either. It says /dev/parport0 does not exist. I think it is listed as a different device name.

[youyou]

I lost the R6 carelessly, so the MN-700 ROUTER could not work.

please could you tell me which model of the R6 in the chart shows .

[ericj]

I never could get the JTAG GUI to get past 4%. I used wrtjtag-modified and managed to get my cfe.bin on it. I can even get the alternating green/amber LED but, I cannot access it via IP (The ASUS utility cannot find the device). I got several errors on the load, I have to use the /noreset switch to even come close.

It looks like /noreset is required for this board, so just use it. I also recommend that you just go ahead and keep using wrtjtag-modified.exe as well.

Make sure that the flash was completely successful by running "wrtjtag-modified -backup:cfe /noreset" and running "comp" to compare CFE.BIN with the file output by the backup process. 'comp' is an interactive program - it'll just ask you which two files you want to compare. There should be no differences. If there is a difference, run "wrtjtag-modified -erase:cfe /noreset" a few times, then flash the cfe again.

I'd recommend clicking the upload button on the firmware restoration app right before plugging in the power on the router.

Also, don't do this while connected to your whole network. Just run one ethernet cable from the computer running the firmware restoration app to the router.

Make sure your computer's address is in the 192.168.1.x address range.

Make sure that firewall software isn't blocking the firmware restoration utility.