Print this Post

Unbrick hard bricked (no ping) Linksys E3000 via serial connection.

I accidentally flashed the wrong dd-wrt firmware on my Linksys E3000.
This prevented me from recovering with any firmware. I was unable to reset the router, ping the default address, or communicate with it in any way.

To recover I had to initiate a serial connection.

This router, along with others has serial contacts inside, on the bottom of the WAN port.
I tried to make a cable out of a 40 PIN IDE cable that would touch these contacts, but got tired of fiddling with it. Instead I opted to solder directly to the board.

The first step in this process was to open the router. This requires a TORX T-10 Security screwdriver bit. I was able to purchase this for about $8 at my local lowes. It’s the TORX bit with a hole in the center.

Next, I had to pull the plastic chassis off, which was quite difficult. I found it easiest to seperate the pieces from the front.

After the casing was removed, I had to unclip the three antenna wires, and flip the board around. The serial contacts are located on the underside.

After locating the contacts for the serial port, I had to identify which of them needed to be used.
My Serial->USB adapter was a CA-42 Nokia cable that I bought off ebay. There were 3 wires in the cable. Blue (GND), Green (RXD), and White (TXD).

These three wires had to be attached to contacts 5 (GND), 3 (TXD), and 2 (RXD).
Note it’s important that the RXD wire must be attached to the TXD contact, and TXD on the wire to the RXD contact.

Once these wires have been soldered to the appropriate contacts, the serial connection should work.
Connect to it from a terminal using 115200 baud, 8N1 with No Flow Control (hardware or software) and ANSI emulation. I use linux, so I used minicom as a terminal, but you could also use hyperterminal in windows.

Now, plug in the USB end of the cable to your computer, and plug in, and power on the router.
You should see activity in the terminal as the router powers up.

Once you’ve verified that there’s activity, turn off the router and turn it back on. Quickly begin hitting CTRL-C in the terminal until you reach the CFE> prompt.

Once you’ve reached the CFE> prompt the router should be up with networking. At this point you should be plug an ethernet cable into the router and ping

First, clear the nvram by typing:

CFE> nvram erase

Once that has completed, you can begin to send the ORIGINAL linksys firmware to the device.

Using another terminal (or command prompt) prepare the TFTP command to put the firmware on the device.
In linux, I connected to tftp, then set the mode to binary, set the timeout to 90 seconds, and entered:

CFE> put <filename>

Don’t execute the put yet, just get it ready.

Back at the CFE> prompt, type:

CFE> flash -ctheader : flash1.trx

As soon as you execute the flash command, execute the tftp command. This will upload the firmware.

After the firmware is copied to the router, in the CFE prompt, type:

CFE> go

The router will reboot and load it’s new firmware.

Once it’s done, you’ve got a restored router. Desolder the connections on the board, put it all back together and… good as new.

Permanent link to this article: http://www.lukemacneil.com/2011/10/02/unbrick-hard-bricked-no-ping-linksys-e3000-via-serial-connection/


Skip to comment form

  1. Ulisses

    I Can´t do this work, can´t get CFE>prompt.
    Alea could you help us with your experience using H-TERM on Win 7?
    Send ASCII “3″ via “rsend” and power up the Router. (Ist CRLT-C in ASCII) – Could you explain better?

    Anyone could help us on describing with more details step by step?

  2. Alea

    It´s work!

    I used Win 7 with H-TERM, TFTP2 and the original Firmware from Linksys

    Send ASCII “3″ via “rsend” and power up the Router. (Ist CRLT-C in ASCII)

    if you see CFE> promt, you´r won!

    send: nvram erase

    set IP-Connection on your PC, an connect the router.

    start TFTP2
    Password: “nothing”
    File: Linksys.bin
    end set “retrys” up to 10.
    start the sending.

    back to Hterm-> send: flash -ctheader : flash1.trx

    The update is running, programming and then you can send “go”

    thas was the way, it works for me on a E2000

    Good Luck


  3. Virgil

    It’s hard to find your blog in google. I found it on 13 spot, you should build
    quality backlinks , it will help you to rank to google
    top 10. I know how to help you, just type in google – k2 seo tips
    and tricks

  4. Gusano

    I did all steps, but my device restarts loading around 60 lines of code in infinite loop, the jtag procedure is the last hope. The storm fry 1 LAN card, 1 telephone power adapter and my E3000 :(

  5. gabriel


    Could you please post step-by-step commands for windows hyper terminal?

    Many thanks in advance!

  6. juanjo

    hi, im new here, and i have same problem with a linksys e3000, have ubuntu and minicom but cant find what comands in the program help me monitoring the modem, because the cable connects trougth ttyUSB0 with no response, so if you are so kind give or teach me the comands i´ll thak you.

  7. Muddasir

    I am very thanx ful to u if u guide me in windows 8 ..
    Currently i am in trouble due to bricking of my TP LINK WR740N V4..
    Thanx in advance :)

  8. Bob

    When I start the router I get a string oc “Chinese” characters, not sure could be another oriental language, but I never get the CFE prompt? If it came up in some foreign characters I’m lost. This is a Cisco E3000 with blue LED flashing since I tried to flash with Tomato.

    Also I had to swap the data leads. Used a stadard [I think] serial cable and made an adapter with a DB9 and wires soldered to the board as shown. Just re-learning to deal with Minicom has been interesting!



  9. Niklas

    Hey I alwas got the same error message:
    CFE> nvram erase
    *** command status = 0
    CFE> flash -ctheader : flash1.trx
    Reading :: Failed.: Timeout occured
    *** command status = -21

    I have started the flash command, then I have tryed to put the firmware with the tftp client up to the router. But I still have the timeout on both of it. -.-

    I can ping the router without any problems.

  10. tcpsyn

    Just a generic one. $9 or so on ebay.

  11. Brentsky

    Was the cable used a Genuine Nokia or a off brand basic ?

  12. Luke

    Got me man, I don’t use windows. Last I knew it was hyperterminal.

  13. Hyung

    Ohhhh….. I see Now I kind of know what I’m doing. Currently, I’m using putty config. but on the sessions I can only see default settings. the usb is plugged in.

  14. Hyung

    Well…I’m using window 7 and which terminal do I need to use?

  15. tcpsyn

    Uh…. minicom? Or hyperterminal?

  16. Hyung

    Thank you for your fast reply

    I also have question about my next step. I just soldered the wires and what program do I need to download or what program do I need to run before I plug in my power chord?

  17. tcpsyn

    minicom is a terminal emulator for unixes. It’s likely in your distribution’s repositories.
    It’s used to interface with serial devices and modems.

    Hyperterminal is also a terminal emulator that generally comes preinstalled on windows.

  18. Hyung

    Hello, I’m hyung

    I’m working on the same exact problem but I’m stuck somehow.

    “Connect to it from a terminal using 115200 baud, 8N1 with No Flow Control (hardware or software) and ANSI emulation. I use linux, so I used minicom as a terminal, but you could also use hyperterminal in windows.”

    I really don’t get this part. I have all the equipment ready but I’m stuck on this step. Do I need to download these or is there any tutorial for these part?

    Thank you

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>