Linksys WRT350N V1router

Linksys WRT350N V1 Router.V2 does not have EJTAG and cannot be JTAGed
This router use 12 pin EJTAG port. For USBJTAG NT, connect the first 12 pins.
The CPU of the board uses BCM47XX. The tool to debug the CPU is EJTAG (DMA).

Picture showing the board with JTAG connected.
Close look of the JTAG
Flash 8MB 28F640J3
Firmware 8MB $9C000000-$9C7FFFFF

 Here is a good source to find how to open the box.
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=10835

Definition Commands (usbjtag NT 0.08 and up):
TWRT54G8M.xml

Backup firmware
getram cfe
getram kernel
getram nvram
getram cfe
save 9c000000 800000
(Note, I recommend you do cmpram after getram. eg.
getram cfe
cmpram cfe
This is because the watchdog might cause the getram to get the wrong data).

Drbrick the device. (Must use 0.08 and up. This is used when detect give you 0xffff,0xffff or 0x0000,0x0000 as flash type
detect
Use this xml def.
TWRTDebrick.xml

tap c
tap a ffffffff
(You should now see "DEBUG ON" on the lower right coner).
detect (You should now see the flash type. If not start over again.
ldram cfe
erase cfe
sprogram cfe
Now select back the original xml.Use normal programming for kernel and nvram.

Lasted Updated:December 31 2016

Vists since Jan 4,2009