Microsoft MN700 hack project

[nike]

Update.. I have finally manage to flash the CFE file. But now the Power LED stays Amber.. I can't get into recovery mode.. I have reflashed the CFE a couple of times already. no luck.. Did I brick this router???

**update** Got it working finally. I just keep reflashing the CFE and after like 10+ times the alternate power led starting to blink..! yay!! Thanks guys!

[asciiliu]

Thx for Oleg!!!
The CFE.bin provided by him work perfect!!!
Not all the computer's printer port works.
I've tried 4 computer. Only the old one works.
The dell and Hp won't work.
Backup the data b4 flash.
Because one of my computer can flash up to 4% then hang.
Then I used another compter to flash the backup and re-do again!!

I don't know why I can't gen my CFE.bin using nvserial.
Can I use Hexedit to edit another CFE.bin to my own MAC's CFE.bin??
Any chech-sum on it??

Any Linux system to use??

Thx!!!

Thx for Oleg!!

:-)

[link___666]

Could Someone Help Me.

I'll try to flash my MN700 Router with the Jtag connector.

Download the MN700 Boot loader from Oleg here : http://wl500g.dyndns.org/mn700/mn700.zip


I'll Patch it with My MAC adresse replacing in mn700.txt

00:0D:3A:28C:6E like this


And when I try flashing with wrt54g the process stop at 4%.

I'll try under linux and under windows with wrt54g-modifed, this is the same.

Can someone post me a CFE.BIN patched with my MAC adresse Please.

perhaps i'll have the wrong.

Now My power led Router is out.

Can someone help me please ^^ thanks in advance

[hexec]

I had the same problem so I did a whole flash erase 2 times. Then loaded cfe and it took it all the way through. Read it back and it was exactly the same.

I still have bootloader issue since I didn't build the cfe with a linux box (that I don't have). I did it in a hex editor. But, I don't think I did it correctly. Can someone post a cfe.bin file that I can use to compare with mine?

thanks oled...ygpm

[hexec]

I spent the last couple hours trying to load a bootloader again. the process locked up on me again at 38%. So I tried erasing a few times and now it always locks up at 4% (at exactly the same address) every time. After messing around I noticed that the large capacitor below the jtag pins is bulging. It does measure 3.3v but I would bet that this cap is leaky. I'm going to replace it before doing anything else.

edit:
Working with asus fw and with dd-wrt

[TenF00T]

I don't know what to try anymore. I have no problem flashing the cfe except that I have to use the /noreset option. I have compared both files the only difference is there are a bunch of extra FFFFF at the end of the file I created with nvserial which I guess is just to fill any empty space on the chip. I have tried erasing the nvram and still no go. I have no lights when I restart the router except for 1 light that identifies where my ethernet cable is plugged in. Does anyone have any idea? Oh I did erase the kernel before I flashed the cfe I don't know if that is my problem. Can anyone create the cfe.bin for me just in case i'm doing something wrong? 00:0D:3A:28:C7:E4

Here is what I used with nvserial within Damn Small Linux

# Microsoft MN700 board

boardtype=bcm94710ap
boardnum=mn700

# 4710 CPU clock frequency in Mhz
# Only valid value is 125, anything else defaults to 100Mhz
clkfreq=125

# 4710 SDRAM controller parameters
sdram_init=0x0419
sdram_config=0x0000
sdram_refresh=0x8040

# 4710 MAC and PHY parameters
et0macaddr=00:0D:3A:28:C7:E4
et0phyaddr=30
et0mdcport=0
et1macaddr=00:0D:3A:28:C7:E4
et1phyaddr=5
et1mdcport=1

# PMON variables
dl_ram_addr=a0001000
os_ram_addr=80001000
os_flash_addr=bfc40000
lan_ipaddr=192.168.1.1
lan_netmask=255.255.255.0
scratch=a0180000
boot_wait=on
watchdog=3000
hardware_version=WL500-02-02-01-00
regulation_domain=0X30DE


Hope someone is still watching this thread


---------------------
UPDATE
---------------------

Oleg sent me new cfe.bin. Worked flawlessly.
Thank you

[Oleg]

Try this: http://wl500g.dyndns.org/mn700/000D3A28C7E4.zip

[TenF00T]

Try this: http://wl500g.dyndns.org/mn700/000D3A28C7E4.zip

Thank you very much your cfe file worked on the first try.

[Thembones]

Hi there !
I followed the instructions on the forum and succesfully flashed the bootloader , then loaded the oleg´s firmware, but here comes the creepy part , I wanted to try the openwrt firmare ,so I messed up and flashed the cfe ,but when reaching 80 % it failed ,so i had the worst idea , I did a wholeflash erase , so I ruined all .Now I wonder if any of you can mail me the wholeflash.bin file to start over again.
Thanks!!!!

[malau]

Hello,
i tryed to flash my MN-700 but i still got an error with the wrtjtag.
Error: CHIP ID: 11111111111111111111111111111111 (FFFFFFFF)

It seems the the cable or the connection is bad but i build the cable 3times and testet the connections of the jtag on the board.
On page 8 of this tread "hsddlawley" wrote he has the same problem with flashing this unit, but finally he got it to work.
I read his posts but i do not understand what he has done to got it work.
So please can someone give me a hint?

[JustMe]

Hi all,

I just fhashed my MN700 with a cbe.bin I created. Everything looks fine since after I reboot the router the power light keeps alternating green/amber.
When I try to use the Asus upload utility the lamp goes to a steady green but the utility says it cann't find any device and fails to upload the new firmware.
Does anyone has any suggestion of what could be going wrong?
BTW, I cann't ping my router neither. I tryed ping 192.168.1.1.

My MN700.txt I used to create the cfe.bin is:

# Microsoft MN700 board

boardtype=bcm94710ap
boardnum=mn700

# 4710 CPU clock frequency in Mhz
# Only valid value is 125, anything else defaults to 100Mhz
clkfreq=125

# 4710 SDRAM controller parameters
sdram_init=0x0419
sdram_config=0x0000
sdram_refresh=0x8040

# 4710 MAC and PHY parameters
et0macaddr=00:0D:3A:2C:F8:0C
et0phyaddr=30
et0mdcport=0
et1macaddr=00:0D:3A:2C:F8:0D
et1phyaddr=5
et1mdcport=1

# PMON variables
dl_ram_addr=a0001000
os_ram_addr=80001000
os_flash_addr=bfc40000
lan_ipaddr=192.168.1.1
lan_netmask=255.255.255.0
scratch=a0180000
boot_wait=on
watchdog=3000
hardware_version=WL500-02-02-01-00
regulation_domain=0X30DE

Thanks for any help!

[malau]

I think i found my problem.
I desoldered the cap near the jtag-connector because it's seems to be damaged. And really it was. So i soldered a new one.
Now i started a new run. I used wrtjtag 4.8 with -probeonly and he found the chip.
Now i started to make a backup of the cfe, but wrtjag hangs. So i tried the v.99 beta for WindowsXP and really it starts creating the backup. After that i flashed the cfe.bin i found in this tread, because i have no linux at this time. Finally i flashed the cfe succesfull and whit the Asus-tool i installed the newes Asus-firmware.
Later at home i will try to flash my one cfe.bin

But in the moment i'm still happy...

[Thembones]

could anoyone backup the wholeflash.bin and mail it to me? I´m stucked here since I haven´t got it , thanks a lot!!! my mail is thembones2002@hotmail.com

[malau]

Hi all,


My MN700.txt I used to create the cfe.bin is:

# 4710 MAC and PHY parameters
et0macaddr=00:0D:3A:2C:F8:0C
et0phyaddr=30
et0mdcport=0
et1macaddr=00:0D:3A:2C:F8:0D
et1phyaddr=5
et1mdcport=1

You have to change the mac.
et0macaddr and et1macaddr must be the same.

[leitec]

I just got a MN700. It works normally with the standard firmware, but I bought it with the intention of flashing some Linux-based firmware. I've tried all day to get this thing going, but I always get:

CHIP ID: 00000100011100010000000101111111 (0471017F)
*** Unrecognized Chip ***
*** This is not a Broadcom BCM47XX chip ***

I've tried Linux and Windows, two computers, various versions of the jtag utilities, etc. It returns the correct ID the second time, but not the first. Hence it misses the 4702 detection code. Forcing it past that just makes it hang later on.

At first I soldered on headers and used the same cable I used to rescue my WAP54G, which has the same pinout as the WRT54G's JTAG. I used pin 6 for ground. Fearing my headers or the pin selection for ground were wrong, I took them off and resoldered directly onto the board using pin 2 for ground. I still get the same result.

Before soldering directly I had tried to use the cable with my WAP54G again and it worked perfectly. So I'm quite sure the resistors (100 ohm) are fine.

Any ideas?

Thanks!