Bricked Netgear R8000 Recovery

If you bricked your router from a bad firmware flash or upgrading/downgrading to a different custom firmware build, your router probably got stuck in a boot-loop and you can no longer access it with your web-browser.

Good news – you’re (probably) in luck and can still get it back to working order.

Tools needed
  • R8000 (obviously)
  • Stock firmware for the router (link)
  • Soldering Iron & Solder
  • 18 or 20ga Wire
  • USB-TTL COM Port Adapter (available on Amazon for under $10)
  • Stereo headphone jack (optional, more on this later)

You’ll need to have a little experience with soldering to accomplish this.  If this gives you cause for concern, you should probably stop reading.

Step 1

You’ll need to open up the router, remove the screws from the bottom and the back of the router.  One will be obscured underneath a label on the bottom.

Locate the jumper J252, it may or may not have pins already soldered in place.  This is for serial communications.  I know what you’re thinking, you can probably wire it straight to a DB-9 COM port and be done.  You can’t, it uses voltage level shifting and you’re terminal emulator will just fill the screen with random garbage characters.  The USB-TTL cable looks like this:

Step 2

Once you’ve opened up the router and located the pins, you can attach the leads from the USB cable.

There are four pins, number 1 being located towards the rear of the board.  They are

1 - Not used
2 - Ground
3 - TX (transmit)
4 - RX (receive)

Hopefully your adapter came with a diagram on which color wires do what.   One will be labeled 3 volts or 5 volts, do not use this wire.  You only need ground, TX and RX.

Important: You’re going to swap TX and RX between the cable and the router,  so TTL TX goes to Pin 4 (RX) and TTL RX goes to Pin 3 (TX).

I used a stereo headphone jack wired to the pins, (ground, tip TX, ring RX) and drilled a hole in the back of the router to mount it.  I wired the TTL cable to a 1/8″ headphone plug so I can plug in when needed to access the CFE prompt. I experiment with various firmware, this way if I ever brick it I don’t have to open the router up repeatedly.

Step 3

Once you’ve wired the TTL cable in place, connect it to the PC and use your favorite terminal program (I prefer Putty, it’s free).  Your COM port settings will be 115200 baud, 8,N,1.

Start the session and turn on the router, you should start seeing results immediately.  Start pressing CTRL-C repeatedly to interrupt the boot process.

At this point you’ll want to make sure your ethernet port has a static IP of 192.168.1.10, subnet mask 255.255.255.0 because the router’s DHCP service will not be running.

Once you reach the CFE> prompt, type tftpd and press enter.  This will start the TFTP daemon.  If you’re on Windows 7 or later you can use the built-in TFTP command line program (or download your own).

If you’re using the DOS command-line program, you should be in the same directory as the the firmware you downloaded (link above) and use this command:
tftp -i 192.168.1.1 put R8000-V1.0.3.4_1.1.2.chk

Upload the stock firmware, but make sure you upload in binary mode (thus the -i option above).  Once the firmware is uploaded the terminal window will say that it’s programming, once that’s done the router will reboot and you can access it via your web browser.

Note:  Some firmware versions did not take and I had to try a different version.  You’ll know when you see a failure in the terminal window.  You’ll have to power cycle the router and start over with CTRL-C and starting tftpd again.

I also had varied results with TFTP,  I tried two different GUI based apps, one that was provided by Netgear, neither had worked for me.  Only the Windows command-line program worked.  This can be enabled in “Add/Remove Features” in the Add Features portion of the Windows control panel.

I’ve also successfully done this TFTP procedure on a WRT310Nv1 router, but they sneakily put the serial communication connection under the WAN RJ45 port (you can see it when you peer into the WAN jack).  The good news is there is another set of pads you can solder to on the underside of the board when you open it up – I’ll cover more of that in another post.

 

Facebook Comments