Debricking Meraki MR18

This is JTAG to debrick any JTAG device. Modem, cable boxes, dish boxes routers.
darthcircuit
Posts: 3
Joined: Thu Jul 21, 2016 4:50 pm

Debricking Meraki MR18

Post by darthcircuit » Wed Jul 27, 2016 8:12 pm

My brother and I both have Meraki MR18's

I was successfully able to get my brothers MR18 flashed through usbjtagnt.

I flashed his first so i could get a boot.bin to hopefully unbrick mine. There was a trick posted on the openwrt forums to short 2 resistors on boot that forced it into a bash shell. When I tried it on mine, it corrupted the flash so I get this on boot:
__________________sri____________________
944x BootROM Ver. (asic) 1.0 [Nov 8 2011 13:42:57]
_________________________________________
find_hif: bootstrap = 0x31c58
Nand Flash init
otp_get_nand_table: 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0

Read Failure: 0x60
Read Failure: 0x0
Read Failure: 0x60hdr: [0x3d000400 : 0x3d000400 : 0x6f34 : 0x65486b04]
nand_load_fw: read 27 pages
nand_load_fw: 0x10000 0x400 0x3d0007f0

Read Failure: 0x0
Read Failure: 0x7b
Read Failure: 0x18nand_load_fw: 0x20000 0x400 0x3d000bf0

Read Failure: 0x60
Read Failure: 0x21
Read Failure: 0x60nand_load_fw: 0x30000 0x400 0x3d000ff0

Read Failure: 0x21
Read Failure: 0x60
Read Failure: 0x21nand_load_fw: 0x40000 0x400 0x3d0013f0

Read Failure: 0x40
Read Failure: 0x40
Read Failure: 0x40nand_load_fw: 0x50000 0x400 0x3d0017f0

Read Failure: 0x60
Read Failure: 0x6f
Read Failure: 0x7fnand_load_fw: 0x60000 0x400 0x3d001bf0

Read Failure: 0x6f
Read Failure: 0x7f
Read Failure: 0x6fnand_load_fw: 0x70000 0x400 0x3d001ff0

Read Failure: 0x7f
Read Failure: 0x6f
Read Failure: 0x7fnand_load_fw: 0x80000 0x400 0x3d0023f0

Read Failure: 0x6f
Read Failure: 0x7f
Read Failure: 0x6fnand_load_fw: 0x90000 0x400 0x3d0027f0

Read Failure: 0x7f
Read Failure: 0x6f
Read Failure: 0x7fnand_load_fw: 0xa0000 0x400 0x3d002bf0

Read Failure: 0x6f
Read Failure: 0x7f
Read Failure: 0x6fnand_load_fw: 0xb0000 0x400 0x3d002ff0

Read Failure: 0x7f
Read Failure: 0x6f
Read Failure: 0x7fnand_load_fw: 0xc0000 0x400 0x3d0033f0

Read Failure: 0x6f
Read Failure: 0x7f
Read Failure: 0x6fnand_load_fw: 0xd0000 0x400 0x3d0037f0

Read Failure: 0x7f
Read Failure: 0x6f
Read Failure: 0x7fnand_load_fw: 0xe0000 0x400 0x3d003bf0

Read Failure: 0x6f
Read Failure: 0x7f
Read Failure: 0x6fnand_load_fw: 0xf0000 0x400 0x3d003ff0

Read Failure: 0x7f
Read Failure: 0x6f
Read Failure: 0x7fnand_load_fw: 0x100000 0x400 0x3d0043f0

Read Failure: 0x6f
Read Failure: 0x7f
Read Failure: 0x6fnand_load_fw: 0x110000 0x400 0x3d0047f0

Read Failure: 0x7f
Read Failure: 0x6f
Read Failure: 0x7fnand_load_fw: 0x120000 0x400 0x3d004bf0

Read Failure: 0x6f
Read Failure: 0x7f
Read Failure: 0x6fnand_load_fw: 0x130000 0x400 0x3d004ff0

Read Failure: 0x7f
Read Failure: 0x6f
Read Failure: 0x7fnand_load_fw: 0x140000 0x400 0x3d0053f0

Read Failure: 0x6f
Read Failure: 0x7f
Read Failure: 0x6fnand_load_fw: 0x150000 0x400 0x3d0057f0

Read Failure: 0x7f
Read Failure: 0x6f
Read Failure: 0x7fnand_load_fw: 0x160000 0x400 0x3d005bf0

Read Failure: 0x6f
Read Failure: 0x7f
Read Failure: 0x6fnand_load_fw: 0x170000 0x400 0x3d005ff0

Read Failure: 0x7f
Read Failure: 0x6f
Read Failure: 0x7fnand_load_fw: 0x180000 0x400 0x3d0063f0

Read Failure: 0x6f
Read Failure: 0x7f
Read Failure: 0x6fnand_load_fw: 0x190000 0x400 0x3d0067f0

Read Failure: 0x7f
Read Failure: 0x6f
Read Failure: 0x7fnand_load_fw: 0x1a0000 0x400 0x3d006bf
Even tho It starts to boot, I cannot get mine to enter "Trap" mode. I am able to activate "Debug On."

The problem is on mine that when i'm in "debug on" mode in usbjtag i get this error when i try to detect the flash:

-PROGRAM
-DETECT
IDCODE 00000001
Atheros
IMPCODE A0414000
EJTAG V2.6
DMA not supported
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum 0000,0000
From the research I've done, it seems to be a common problem with other routers that got bricked, but it prevents me from programming the boot partition. I think I can use flshset to force it into reprogramming boot at least, but I don't know what values I need to use for the chip id.

I have a full flash backup from my brother's Meraki that I can put back on this.

Am I on the right track? Can anyone give me any advice?

Thanks so much for your help!

EDIT: Just as a side note, I have tried detecting the flash at all 3 speeds available.

usbbdm
Posts: 8628
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm » Thu Jul 28, 2016 8:41 am

I can try to help you via teamviewer to see if it can be revived. Short pins on router is not a good idea.
Program a bad firmware on router will NOT "brick" a router, it should always be able to recover by program good firmware.
Short pins can brick it such that it cannot be debricked any more.

ricktendo
Posts: 134
Joined: Sat Nov 29, 2014 12:41 pm

Post by ricktendo » Thu Jul 28, 2016 9:02 am

darthcircuit, go ahead and park yourself over in the IRC Channel (enter Channels: #usbjtag) and wait for usbbdm to show up.

By the way the MR18 shorted resisters not pins, here are some links describing the hack

https://forum.openwrt.org/viewtopic.php ... 09#p296209

https://forum.openwrt.org/viewtopic.php ... 16#p296416

darthcircuit
Posts: 3
Joined: Thu Jul 21, 2016 4:50 pm

Post by darthcircuit » Fri Jul 29, 2016 5:50 am

I'll try the IRC channel help weekend if i get time :) thanks for your help

ricktendo
Posts: 134
Joined: Sat Nov 29, 2014 12:41 pm

Post by ricktendo » Mon Aug 01, 2016 4:41 am

Out of curiosity, any luck with this?

darthcircuit
Posts: 3
Joined: Thu Jul 21, 2016 4:50 pm

Post by darthcircuit » Mon Aug 01, 2016 6:44 am

No unfortunately. I had to work all weekend and wasn't able to hop on the Irc.

Post Reply