Unbrick hard bricked (no ping) Linksys E3000 via serial connection.

I accidentally flashed the wrong dd-wrt firmware on my Linksys E3000.
This prevented me from recovering with any firmware. I was unable to reset the router, ping the default address, or communicate with it in any way.

To recover I had to initiate a serial connection.

This router, along with others has serial contacts inside, on the bottom of the WAN port.
I tried to make a cable out of a 40 PIN IDE cable that would touch these contacts, but got tired of fiddling with it. Instead I opted to solder directly to the board.

The first step in this process was to open the router. This requires a TORX T-10 Security screwdriver bit. I was able to purchase this for about $8 at my local lowes. It’s the TORX bit with a hole in the center.

Next, I had to pull the plastic chassis off, which was quite difficult. I found it easiest to seperate the pieces from the front.

After the casing was removed, I had to unclip the three antenna wires, and flip the board around. The serial contacts are located on the underside.

After locating the contacts for the serial port, I had to identify which of them needed to be used.
My Serial->USB adapter was a CA-42 Nokia cable that I bought off ebay. There were 3 wires in the cable. Blue (GND), Green (RXD), and White (TXD).

These three wires had to be attached to contacts 5 (GND), 3 (TXD), and 2 (RXD).
Note it’s important that the RXD wire must be attached to the TXD contact, and TXD on the wire to the RXD contact.

Once these wires have been soldered to the appropriate contacts, the serial connection should work.
Connect to it from a terminal using 115200 baud, 8N1 with No Flow Control (hardware or software) and ANSI emulation. I use linux, so I used minicom as a terminal, but you could also use hyperterminal in windows.

Now, plug in the USB end of the cable to your computer, and plug in, and power on the router.
You should see activity in the terminal as the router powers up.

Once you’ve verified that there’s activity, turn off the router and turn it back on. Quickly begin hitting CTRL-C in the terminal until you reach the CFE> prompt.

Once you’ve reached the CFE> prompt the router should be up with networking. At this point you should be plug an ethernet cable into the router and ping 192.168.1.1

First, clear the nvram by typing:

[code]CFE> nvram erase[/code]

Once that has completed, you can begin to send the ORIGINAL linksys firmware to the device.

Using another terminal (or command prompt) prepare the TFTP command to put the firmware on the device.
In linux, I connected to tftp 192.168.1.1, then set the mode to binary, set the timeout to 90 seconds, and entered:

[code]CFE> put <filename>[/code]

.
Don’t execute the put yet, just get it ready.

Back at the CFE> prompt, type:

[code]CFE> flash -ctheader : flash1.trx[/code]

As soon as you execute the flash command, execute the tftp command. This will upload the firmware.

After the firmware is copied to the router, in the CFE prompt, type:

[code]CFE> go[/code]

The router will reboot and load it’s new firmware.

Once it’s done, you’ve got a restored router. Desolder the connections on the board, put it all back together and… good as new.

This entry was posted in Computers and tagged , , , , , .

17 Comments

  1. Ulisses August 3, 2014 at 10:35 pm #

    I Can´t do this work, can´t get CFE>prompt.
    Alea could you help us with your experience using H-TERM on Win 7?
    Send ASCII “3″ via “rsend” and power up the Router. (Ist CRLT-C in ASCII) – Could you explain better?

    Anyone could help us on describing with more details step by step?
    Thanks!
    Ulisses

  2. Alea August 1, 2014 at 7:04 pm #

    It´s work!

    I used Win 7 with H-TERM, TFTP2 and the original Firmware from Linksys

    Send ASCII “3” via “rsend” and power up the Router. (Ist CRLT-C in ASCII)

    if you see CFE> promt, you´r won!

    send: nvram erase

    set IP-Connection on your PC, an connect the router.

    start TFTP2
    IP: 192.168.1.1
    Password: “nothing”
    File: Linksys.bin
    end set “retrys” up to 10.
    start the sending.

    back to Hterm-> send: flash -ctheader : flash1.trx

    The update is running, programming and then you can send “go”

    thas was the way, it works for me on a E2000

    Good Luck

    Alea

  3. Gusano July 20, 2013 at 2:08 pm #

    I did all steps, but my device restarts loading around 60 lines of code in infinite loop, the jtag procedure is the last hope. The storm fry 1 LAN card, 1 telephone power adapter and my E3000 🙁

  4. gabriel June 30, 2013 at 4:43 pm #

    Hello,

    Could you please post step-by-step commands for windows hyper terminal?

    Many thanks in advance!
    g

  5. juanjo March 18, 2013 at 7:05 pm #

    hi, im new here, and i have same problem with a linksys e3000, have ubuntu and minicom but cant find what comands in the program help me monitoring the modem, because the cable connects trougth ttyUSB0 with no response, so if you are so kind give or teach me the comands i´ll thak you.

  6. Muddasir February 24, 2013 at 12:27 pm #

    I am very thanx ful to u if u guide me in windows 8 ..
    Currently i am in trouble due to bricking of my TP LINK WR740N V4..
    Thanx in advance 🙂

  7. Bob June 18, 2012 at 3:48 pm #

    When I start the router I get a string oc “Chinese” characters, not sure could be another oriental language, but I never get the CFE prompt? If it came up in some foreign characters I’m lost. This is a Cisco E3000 with blue LED flashing since I tried to flash with Tomato.

    Also I had to swap the data leads. Used a stadard [I think] serial cable and made an adapter with a DB9 and wires soldered to the board as shown. Just re-learning to deal with Minicom has been interesting!

    Thanks,

    Bob

  8. Niklas May 11, 2012 at 9:42 am #

    Hey I alwas got the same error message:
    CFE> nvram erase
    *** command status = 0
    CFE> flash -ctheader : flash1.trx
    Reading :: Failed.: Timeout occured
    *** command status = -21

    I have started the flash command, then I have tryed to put the firmware with the tftp client up to the router. But I still have the timeout on both of it. -.-

    I can ping the router without any problems.

  9. tcpsyn January 21, 2012 at 1:15 am #

    Just a generic one. $9 or so on ebay.

  10. Brentsky January 18, 2012 at 5:02 am #

    Was the cable used a Genuine Nokia or a off brand basic ?

  11. Luke December 29, 2011 at 9:15 am #

    Got me man, I don’t use windows. Last I knew it was hyperterminal.

  12. Hyung December 28, 2011 at 11:50 pm #

    Ohhhh….. I see Now I kind of know what I’m doing. Currently, I’m using putty config. but on the sessions I can only see default settings. the usb is plugged in.

  13. Hyung December 28, 2011 at 11:41 pm #

    Well…I’m using window 7 and which terminal do I need to use?

  14. tcpsyn December 28, 2011 at 11:07 pm #

    Uh…. minicom? Or hyperterminal?

  15. Hyung December 28, 2011 at 11:03 pm #

    Thank you for your fast reply

    I also have question about my next step. I just soldered the wires and what program do I need to download or what program do I need to run before I plug in my power chord?

  16. tcpsyn December 28, 2011 at 9:58 pm #

    minicom is a terminal emulator for unixes. It’s likely in your distribution’s repositories.
    It’s used to interface with serial devices and modems.

    Hyperterminal is also a terminal emulator that generally comes preinstalled on windows.

  17. Hyung December 28, 2011 at 9:51 pm #

    Hello, I’m hyung

    I’m working on the same exact problem but I’m stuck somehow.

    “Connect to it from a terminal using 115200 baud, 8N1 with No Flow Control (hardware or software) and ANSI emulation. I use linux, so I used minicom as a terminal, but you could also use hyperterminal in windows.”

    I really don’t get this part. I have all the equipment ready but I’m stuck on this step. Do I need to download these or is there any tutorial for these part?

    Thank you

Post a Comment

You must be logged in to post a comment.