MN-700 Bricked

This is JTAG to debrick any JTAG device. Modem, cable boxes, dish boxes routers.
Post Reply
Chap
Junior Member
Posts: 6
Joined: Sun Jan 11, 2009 7:46 pm

MN-700 Bricked

Post by Chap »

I programed the bootloader on a MN-700, everything appeared to go fine but after reboot I can no longer detect the flash.

-detect
IDCODE 0471017F
Broadcom BCM4702
IMPCODE 00800908
EJTAG V1, V2.0
DMA supoorted
Unknown flash type!
Report these two value to http://www.usbjtag.com/vbforum 0040,2000

The flash values change from detect to detect.

I have tried tap c and tap a ffffffff but no success I have even tried to set the flash type using flshset but agian no success. As a last ditch effort I pulled CE# high during the boot, then set debug on and then removed the jumper to CE# but even doing this I was not able to erase the flash or load the backup I had taken.

Is there something else I can try to debrick this router?
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

I had not tested the MN-700 (Mine was badly bricked before use USB JTAG NT). But I would like to use teamviewer to remotely try on your router.
Use tap c and tap a ffffffff should give you DEBUG ON without CE method,
Chap
Junior Member
Posts: 6
Joined: Sun Jan 11, 2009 7:46 pm

Post by Chap »

I was able to revive the router.

Using "tap c" and "tap a ffffffff" the processor would go into Debug Mode but "detect" would not detect the flash property, the wrong flash id was detected and would change from "detect" command to "detect" command.

I found I had to use the above tap commands to put the processor into Debug mode then unplug the usbjtag NT from the PC and close the software. Then open software (v0.21 and v0.22 had same issue, others untested) and plugin usb. I did not reboot the router as I was hoping Debug would remain ON and it did. After the software was open and detected usbjtag NT was connected I preformed a detect command, on the fourth detect command it had the right flash code and further detect commands also found the correct flash codes. I preformed this twice and each time it was on the fourth detect command that it got the correct flash codes.

Now that it detected the correct flash codes I preformed a "getram 9fc00000 400000" command, it read properly and I preformed a "cmpram 9fc00000 400000" to verify the read, it verified OK.

Using the "erase 9fc00000 400000" command I erased the flash and then I loaded the backup image I had taken initially with command "ldram 9fc00000". Once loaded I used the "sprogram 9fc00000 400000" command to write the flash and "cmpram 9fc00000 400000" to verify.

Router is now functioning properly.

Lessons learned -

1. It seems this router does not respond properly to the "program" command. I believe this is what bricked it in the first place as when I commanded "program 9fc00000 400000" the first operation is to erase the flash during this time the status bar at the bottom showed two bars then froze. After that the router was bricked. Make sure to use "sprogram" on this router.

2. When the router would not respond with proper flash codes two steps were required to correct it;
A. Use commands "tap c" and "tap a ffffffff" to put the processor in debug mode.
B. when "DEBUG ON" is displayed in the status bar disconnect the USB cord from the PC, restart the software and plug the USB cord back in then command "detect" a few times (in my case four) until you get proper flash detected. I do not know if both the software and the the usbjtag NT needed restated or just one of them, I did not break up the testing that far.

I hope this information is helpful and urge everyone who posts with a problem to also post the resolution to their specific problem. I hate it when threads are left open with no resolution.
shrooms
Junior Member
Posts: 20
Joined: Mon Oct 22, 2007 11:21 am

Post by shrooms »

great info
i was wondering what happened to the mn-700 profile under USBJTAG NT>Routers?
Mine got bricked last night, all i get is an orange/amber light for power, restore mode and reset arent working. The reset button doesnt seem to do anything. i would use a pjtag but I have no machine momentarily with a parallel port.
Any info on the clock speed, memory range and pinout would be appreciated. This was my first router i flashed way back when, and wouldn't want to toss it.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

shrooms wrote:great info
i was wondering what happened to the mn-700 profile under USBJTAG NT>Routers?
Mine got bricked last night, all i get is an orange/amber light for power, restore mode and reset arent working. The reset button doesnt seem to do anything. i would use a pjtag but I have no machine momentarily with a parallel port.
Any info on the clock speed, memory range and pinout would be appreciated. This was my first router i flashed way back when, and wouldn't want to toss it.
IF you have treamviewer and have NT ready I might be able to help you remotely.
shrooms
Junior Member
Posts: 20
Joined: Mon Oct 22, 2007 11:21 am

Post by shrooms »

thanks for the reply man, I ended up figuring it out.
for the first time I noticed that for every device profile in configuration is the sw, under help you've placed pinouts.
thanks again
Post Reply

Who is online

Users browsing this forum: No registered users and 11 guests