Carousel is a LIE!

NWR04B: Back from the dead!

05 Feb 2005

Welp, thanks to a suggestion from Mike and Varu,I managed to rescuscitate the dead NWR04B router. It had gone silent and unreponsive -- no web server, no response to pings -- after applying the firmware on the Network Everywhere FTP site. (Some upgrade!)

Today, I picked up some header pins at the closest thing to a local electronics store. After a bit of work -- getting the solder out of header pins is tricky -- I got them attached, and sure enough the serial port worked fine. It was stuck at the bootloader menu, with this message:

Verifying product code...FAIL
* WARNING *
Need to reprogram the flash.

That reminded me of the bit on this page on the Linksys WAP-11. Apparently, firmware for other products using the same hardware would work much better than the Linksys firmware. To prevent this sort of thing, the bootloader was changed to check for a product code, to make sure it wasn't another company's firmware. Almost makes me wonder if that's what happened with the NE firmware. Pretty huge screwup, though...

So I tried uploading the Runtop firmware to the router via Xmodem...and it worked! I got the usual command line back, and everything seemed fine. I didn't try the web pages yet, but I don't expect any surprises there. I've checked the Runtop firmware with splitgzip, and it has the same kind of embedded Gzip archive the NE firmware does. It'll be interesting to compare the rest of it.

I've also tried fooling around with the rmem (read memory) command, and I think this might be promising. You can run "rmem 0 400", and it'll print out 0x400 bytes of memory, nicely formatted, starting at address 0. 0x400 seems to be the biggest chunk it'll print, but you can incrmement it and keep going. (Managed to crash it, too, by running "rmem 99900000 400"...the command line was completely unresponsive, and one of the LEDs on the front started flashing rapidly. Fortunately, the reset button set everything right.)

I'm thinking that this might be a way of reading out (what I hope will be) the bootloader code, and thus maybe getting the checksum code out of there somehow. I should be able to hack together an Expect script that'll cycle through the memory, capture the formatted output to a file, then turn that into a copy of the memory suitable for passing to a disassembler. And if that works, maybe we can look at overwriting flash with the wmem command...

Tags:

9 Comments

From: varu
11-February-2005-19:13:42

The NE firmware on their site is actually older than the one that came with the router. The one on the router was 1.03, the one on their site is 1.02. When asked why they did this, I could decipher this from the unintelligible hindu-english the NE rep was feeding me: they did it cause there were stability issues with the newer one. Well, I went to 1.03, and there was no improvement whatsoever, no noticeable changes. The WR1133 firmware works fine though, I can finally use this router as my main router, without using my BEFSR41 to bridge the whole thing. There is just one question I have: how exactly did you hook the serial port up to the router? Care to provide some diagrams? I've had some experience with JTAGging before, but I just need to know what pin on the board goes with what pin on the DB9, and if there's any other extra chips needed, or anything of that sort. I found something on the wiki, but it doesn't exactly say which pin goes to which, or what's needed for a good connection. Of course, I'm no Linux/disassembly/ARM expert, but I AM quite curious what's going on in this thing, and if I can somehow get behind how it does some things, and maybe work from there. Very interesting work and conclusions drawn nonetheless, .

From: Saint Aardvark
12-February-2005-14:21:59

Hi Varu -- I'll have to put up something better. In the meantime, see the diagram here, and use this picture as a reference. Pin 3 on the NWR is UDO0, pin 5 is ground, pin 7 is UDI0, and pin 6 is +3.3V (VCC on the HRI diagram). You need to clean out the holes on the NWR (ie, melt the solder and use a solder sucker to remove it), then put in header pins so you can hook up your circuit. I really do need to put up better instructions, because I certainly had no idea how to do it before I got a lot of help from my coworkers. Thanks kindly for the compliments!

From: Mark
14-May-2005-07:48:05

splitgzip has a new location, cause i moved to wordpress. The new URL is http://www.monolith81.de/router/splitgzip.pl

From: the life of a sysadmin » NWR04B: Not so easy
18-February-2005-05:49:19

[...] February 2005 The continuing saga of the NWR04b, um, continues. As I mentioned, I was looking at using the rmem command on the NWR firmware to read out memory [...]

From: Peter
18-June-2005-20:37:15

Hi, I noticed that my original firmware is 1.18.0001, and I wondered what the consensus was now on the best working firmware...

From: the life of a sysadmin » NWR04B: Checksum for original firmware
21-February-2005-16:05:02

[...] …..Y..|[.. …| So this works for the NE firmware. However, loading this has caused problems before, so I’m reluctant to use it as a basis for uploading new fir [...]

From: GradStudent
26-May-2006-05:52:33

Hey Saint:

So I had 2 of these old Network Everywhere units. I successfully "upgraded" one to the Runtop firmware with the blue web menus, and it is working fine with a friend - she says its been stable for months now. The functionality is a bit less - you can't turn off the wireless, for example, but those are minor things.

Last night I tried to load the Runtop firmware on my unit. Maybe I was a bit rusty over the months, but I used the revive.htm page (never could get the /livetodie.htm page), and pointed to the file called SPWR1133-3190-NB1F.img an option 3 (runtime) and applied the change. Blinking lights and reset ensued, but still got the old NE pages. This was also after a manual reset, and leaving the unit unplugged for an hour. Tried the suggestion of resetting while powering on - nada. Tried reflashing it a few times, and even from the NE page - it asks for a password of some sort that I don't know, and its not admin.

Anyhow, after the third time, well, the power and WLAN lights stay on and the link lights just flash every few seconds. No web pages, no connection. I think I pooched the unit. At some point I will need to crack the unit open and solder in a 4-pin header per your instructions and photo. Uh... do you have some more detailed instructions on how to revive the unit if/when I get that stuff connected? How did you solder in the pins - what kind of connector did you buy? (got pics? maybe some newbie directions or a link to a step by step of how to use xmodem to link and update over a serial connection?) I'll re-read all the info on the site of course.

Thanks,

The Ruiner

I'll

From: Grad Student
29-September-2005-15:10:56

I have one of these NWR04B wireless routers - also from the notorious Staples Boxing Day '04 for $18.88 sale. Mine locked up every couple of days, and I just wrote it off as one of those 'you get what you pay for' lessons - figured maybe I got a dud.

A friend with the same unit asked me about hers locking up too, so I thought I would look it up. (I took mine out of service, and since my house is wired, I use an ancient heavy-duty Nortel/Bay Networks Instant Internet unit - its huge, but reliable.) I came across this website, and although alot of the resetting and code writing stuff is way beyond me, the advice and comments on experiences and success stories is great.

A really naive question and a comment:

1) Comment: Just an observation - the little sticker on the bottom of the Network Everywhere box and on the case of the unit itself actually has 'WR1133' printed on it. That jives with what I read about workable firmware upgrades on this site.

2) Question: Sorry to seem like a total newb on this - I was able to locate the SPWR1133-3190-NB1F.img file on the website http://www.runtop.com.tw/DC/Firmware/20041115/?S=A. Uh, what do I do with it now - I'm not sure how to extract the .img file - I tried opening it with MagicISO and it said it was not a valid file. I thought this router was looking for a .dlf file to do the firmware upgrade. Can somebody spell out what I need to do here to upgrade my firmware to that WR1133 file I downloaded?

Thanks - great reading and picture links too. I won't even begin to ask how you guys took these units apart if the screws aren't under the rubber feet.

Student-Guy in Ottawa, Canada
Sept 2005

From: Saint Aardvark
29-September-2005-18:31:47

Not familiar with MagicISO, but you should be able to just upload the
.img file to the router using the web interface. If the router likes
the image (ie, if it passes some pretty basic checks) it'll install it;
if not, it'll complain and stick with the current image. (Note that
the checks I'm talking about are *not* anything like "Will this work
better?" but more "Did this get corrupted during the download?")

See http://saintaardvarkthecarpeted.com/nwr04b/ for comments on
different firmware images, and
http://saintaardvarkthecarpeted.com/nwr04b/RuntopFirmware.html for
comments on the Runtop firmware in particular..

> Thanks - great reading and picture links too. I won't even begin to
> ask how you guys took these units apart if the screws aren't under the
> rubber feet.

Not that hard...underneath a sticker beneath the ethernet interfaces at
the back, there's a single screw. Poke the sticker away, take out the
screw, and the two metal parts of the case separate with a bit of
persuasion: the underneath/front bit goes forward, the top/back bit
goes back.

Thanks for dropping by!

Add a comment:

Name and email required; email is not displayed.

Name (required)
Email (required)
Website
The site is named after Saint ________ the Carpeted: (required)
Comment

Related Posts