Linksys WRT350N V1router |
Linksys WRT350N V1 Router.V2 does not have EJTAG and cannot be JTAGed
This router use 12 pin EJTAG port. For USBJTAG NT, connect the first 12 pins.
The CPU of the board uses BCM47XX. The tool to debug the CPU is EJTAG (DMA).
Picture showing the board with JTAG connected. |
Close look of the JTAG |
Flash | 8MB | 28F640J3 |
Firmware | 8MB | $9C000000-$9C7FFFFF |
Here is a good source to find how to open the box.
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=10835
Definition | Commands (usbjtag NT 0.08 and up): |
TWRT54G8M.xml |
Backup firmware getram cfe getram kernel getram nvram getram cfe save 9c000000 800000 (Note, I recommend you do cmpram after getram. eg. getram cfe cmpram cfe This is because the watchdog might cause the getram to get the wrong data). Drbrick the device. (Must use 0.08 and up. This is used when detect give you 0xffff,0xffff or 0x0000,0x0000 as flash type detect Use this xml def. TWRTDebrick.xml tap c tap a ffffffff (You should now see "DEBUG ON" on the lower right coner). detect (You should now see the flash type. If not start over again. ldram cfe erase cfe sprogram cfe Now select back the original xml.Use normal programming for kernel and nvram. |