View source for Debrick Routers Using zJTAG and DIYGADGET.COM's Blackcat JTAG Cable for Cable Modems

<meta name="keywords" content="TIAOWIKI,JTAG,TJTAG,FTA,JTAG,WRT54G,DD-WRT,debrick,tomato,router,wireless router,motorola modem,sb5100,wiggler,arm,mips,avr,buffered jtag,unbuffered jtag,10 pin,20 pin, 12 pin,xbox,xbox 360,modchip mod-chip,mod chip,liteon,lite-on,samsung,hitachi,lg,dvd rom,sata,dvd key,usb probe,cable modem, usb spear,serial spear, serial probe, extract dvd key,mod xbox 360,video games"></meta>
<meta name="description" content="TIAOWIKI tutorials on how to fix your fta receiver, debrick your wireless router, fix you cable modem, mod your xbox 360, extract the xbox 360 dvd key, flash xbox 360 dvd firmware, flash ixtreme firmware"></meta>

__TOC__

<span class="plainlinks">

<include nopre noesc src="/home/tiao/public_html/tiaowiki/wiki/extensions/include/jtag.inc"/>

Buy various JTAG cables for your Satellite Receiver, Cable Modem, Wireless Router, Standard Wiggler from [http://www.easymg.com http://www.easymg.com] and [http://www.diygadget.com http://www.diygadget.com]
</span>



In this tutorial, I am going to show you how to debrick your router using DIYGADGET's blackcat JTAG cable for routers.

<font color=red size=+1><b>This tutorial only works with [http://www.tiaowiki.com/download//file.php?id=37 zJTAG], which is the only software supports debricking wireless routers using blackcat JTAG cable</b></font>


Before you try to JTAG your router, we highly recommend you to try a few other steps before you JTAG your router.  

==Things need to try before you JTAG the router==

Please read carefully on this article:

[http://www.dd-wrt.com/wiki/index.php/Recover_from_a_Bad_Flash Recover from a Bad Flash]

If you have tried everything before the section "Recovery by JTAG cable" and it still doesn't work, you can now proceed with the following tutorials on how to save your router by using DIYGADGET's FTA JTAG cable.


You need a PC with parallel port.  USB to parallel adapter will NOT work.

No USB port? no problem, use our USB JTAG:

[http://www.diygadget.com/tiao-usb-multi-protocol-adapter-jtag-spi-i2c-serial.html http://www.diygadget.com/media/catalog/product/t/u/tumpa-small.jpg]

[http://www.diygadget.com/tiao-usb-multi-protocol-adapter-jtag-spi-i2c-serial.html TIAO Multiple Protocol Adapter (JTAG/SPI/I2C/Serial)]

Tutorial (debrick router using USB):

[[Debrick Wireless Router Using TUMPA and zJTAG]]

==Router Basics==

See [[Debrick_Routers_Using_JTAG_Cable#Router_Basics]]

==Using JTAG Cable to Repair Bricked Router==

If you have read this far, it means the only way to debrick your router is by using a JTAG cable.  Sorry to hear that!  However, don't worry, the steps are really straightforward!

===DIYGADGET's Blackcat JTAG Cable===

The blackcat jtag cable is different than the FTA or wireless router jtag cable.  The pin assignments are complete different.

The following are the pin assignments for blackcat jtag cable:

{| class="wikitable" style="font-style:italic; font-size:120%; border:3px dashed red;"
|+Blackcat JTAG cable Pinout
|-
! DB25 !! Blackcat JTAG female header
|-
! 6
| 1
|-
! 7
| 7
|-
! 8
| 3
|-
! 9
| 9
|-
! 11
| 5
|-
! 18-25
| 2,4,6,8,10
|}


This is the JTAG pinout of the Linksys WRT54G(GS/GL) series routers:

 nTRST  1   2 GND
 TDI    3   4 GND
 TDO    5   6 GND
 TMS    7   8 GND
 TCK    9  10 GND
 nSRST 11  12 GND

zJTAG uses the following DB25 pin assignments when cable is set to BlackCat:

 DB25         Signal
 8            TDI
 9            TCK
 7            TMS
 11           TDO
 18-25        GND


===Disassemble WRT54G/GS/GL) Series Router===

See [[Debrick_Routers_Using_JTAG_Cable#Disassemble_WRT54G.2FGS.2FGL.29_Series_Router]]

===Locate the JTAG Pins/Pads on the Router===

See [[Debrick_Routers_Using_JTAG_Cable#Locate_the_JTAG_Pins.2FPads_on_the_Router]]

===The Softwares===

We will need to use DIYGADGET's zJTAG (version 0.2 or above) for our debricking process.

[[Image:Zjtag02.png|none]]

Download [[http://www.tiaowiki.com/download//file.php?id=37 zJTAG]] program and unzip it to a temp directory on your harddrive.

You will have the following files:

[[Image:Zjtag.files.png|none]]

WinIO32 is used for accessing parallel port, no need to run loaddrv or giveio.

===Making The JTAG Connection===

If your router (like the Linksys WRT54G series) already has the standard 12 pin JTAG pads on the PCB, you mostly like do NOT need to solder wires on your PCB.  Otherwise you many need to solder IDC headers on your board's JTAG pads or holes.

In this demonstration, I soldered 12 pin header on my router (WRT54GS).

Now we need to make the following connections:

Blackcat JTAG cable connected to Wireless router:

[[image:Blackcat.conn.jpg|none]]

Now, make the connections using the flexible cables provided in the package.  

It looks like this:

[[Image:blackcat.header.jpg|none]]

Whole setup:

[[Image:blackcat.whole.jpg|none]]

Now get your PC ready, make sure the parallel port is 0x378 and mode is ECP or EPP. (Check BIOS setting of your PC if you are not sure).

Plug the db25 connector to your PC's parallel port:

[[image:blackcat.parallel.jpg|none]]

===Debrick it!===

Let's debrick your router!

#Attach the router's power adapter to the wall outlet.
#From the command prompt cd to your unzipped zJTAG's windows directory and run ''zjtag.exe'' to get a list of options.
#To check your cable, run command <font color=red>''zjtag.exe -probeonly /diygadgetblackcat''</font>.  It will automatically detect the CPU type (see pic below for an example of LINKSYS WRT54GS). If not then check your cable. [[Image:Zjtag.blackcat.probe.png|none|thumb|Probe Only Output]]
#Backup CFE (command <font color=red>''zjtag.exe -backup:cfe /diygadgetblackcat''</font>):[[Image:Zjtag.blackcat.backup.png|none|thumb|backup CFE]].  It took 60 seconds to backup my WRT54GS' CFE.
#Try above steps at least 2 times, generate backups again, then use a binary comparison software to compares the backups, make sure they are exactly the same before you erase anything.
#Finally to erase your NVRAM (the usual cause of the problem) with command ''zjtag.exe -erase:nvram /diygadgetblackcat''
#If that doesn't work, erase the kernel (firmware): <font color=red>''zjtag.exe -erase:kernel /diygadgetblackcat''</font>, then reflash the kernel via TFTP.  This is a very good tutorial on how to flash your router with TFTP: [[http://www.dd-wrt.com/wiki/index.php/TFTP_flash TFTP Flash]]
#If it still doesn't work, try to find a CFE for your router (make sure model/version matches) first.  Here are two repositories of some router's CFE: [[http://www.dd-wrt.com/phpBB2/viewtopic.php?t=25971&postdays=0&postorder=asc&start=0 CFE collection project]] and [[http://ftp.timisoara.roedu.net/mirrors/openwrt.org/people/inh/cfe/ CFE collection 2]]
#The CFE bin files in the repository all have MAC addresses that DO NOT MATCH your hardware.  Use the CFE editing tool "IMGTOOL_NVRAM" available from The [[http://www.bitsum.com/openwiking/owbase/ Bitsum Wiki]] to set the et0macaddr and il0macaddr before uploading the CFE.  et0macaddr is the address printed on the outside; il0macaddr is that same address, plus one.  Example: If the printed address is 00:90:4d:83:00:01, then et0macaddr is 00:90:4d:83:00:01 and il0macaddr is 00:90:4d:83:00:02.  These are HEX numbers, so HEX 09 plus one is 0A, not 10.
#Erase the CFE of your router and flash the working CFE back.  <font color=red>''zjtag.exe -erase:cfe /diygadgetblackcat''</font> will erase your router's CFE and <font color=red>''zjtag.exe -flash:cfe /diygadgetblackcat''</font> will flash the CFE back to your router.  Remember to use the modified CFE bin. [[Image:Blackcat.flash.cfe.jpg|none|thumb|flash CFE]]


==Non Linksys Routers==

If your router doesn't have JTAG headers or pads, but if it has JTAG enabled, you can still debrick it using the above technique.  However, it is very likely you will need to solder the wire on the board.

For a collection of the JTAG pinout of other routers, please take a look [[http://www.dd-wrt.com/wiki/index.php/JTAG_pinouts Router JTAG pinouts]].

You can connect DIYGADGET's JTAG cable's pin 3, 5, 7, 9 and 2 to your router's TDI, TDO, TMS, TCK, GND respectively, then run zjtag with "/diygadgetblackcat" option to erase/backup/flash the flash chip.




<span class="plainlinks">

<include nopre noesc src="/home/tiao/public_html/tiaowiki/wiki/extensions/include/adsense.inc"/>

Buy various JTAG cables for your Satellite Receiver, Cable Modem, Wireless Router, Standard Wiggler from [http://www.easymg.com http://www.easymg.com] and [http://www.diygadget.com http://www.diygadget.com]
</span>