• Visit https://www.embeddedcomputers.net/ for Hardware; Software and all other things related to FlashcatUSB

Netgear CG814CCR v2

I take it the modem is still in a bricked state ?? If so try load your full dump and see if that errors out , the errors should not be there , work in progress but hopefully we will find a solution to this
 
I have found a way to Debrick it :D

I am getting a lot of practice :D

None of the Jtags will debrick it.

I found that I can use PJTAG to re-program Noisy Boot.

Then I use Serial to reprogram HAX , Image2, Image1, reboot

These CG's are Wierd....

The jtags seem to read ok

They just write ok

The Noisy Boot wrwwwites both halves of the Flash, correctly
 
Good to see you got it back , could you do me a favour and get me 2 full flash dumps , 1 from NT other from BC , i would really like to compare these to see what the issues could be

Also tell me are you using the noisy bootloader from a 5101 ?
 
Ok

Here you go
 

Attachments

  • BcUSB.console.log.txt
    3.5 KB · Views: 6
  • Netgear CG814CCR v2 FLASH.0x00-0x800000.bin.zip
    2 MB · Views: 8
  • 9f000000.zip
    2.9 MB · Views: 8
Thx for that , will look into this , about the bootloader is it the 5101 noisy bootloader you used , just need to know for a reference when examining the dumps.
 
Can you do 1 more thing for me , do a full getram of your dump using NT and directly after it reads do a verify and tell me if your cmpram comes out as OK . Also when you are dumping this modem using either NT or BC does it seem as if the modem is still working ie. Leds flashing
 
OK

Yes The modems LEDs are still flashing...

Copyright (C) 2010,2011,2012
USB JTAG NT 0.44
Target: CG814CPR v2
-detect
IDCODE 0334917F
Broadcom BCM3349
IMPCODE 00800904
EJTAG V1, V2.0
DMA supoorted
Found Address= 9f000000 CFI Intel 28F640J3
-detect
IDCODE 0334917F
Broadcom BCM3349
IMPCODE 00800904
EJTAG V1, V2.0
DMA supoorted
Found Address= 9f000000 CFI Intel 28F640J3
-getram 9f000000 800000
Time 00:00:34 (.305)
-cmpram 9f000000 800000
Time 00:00:34 (.305)
Compare data Failed address 9F152A84,target FF,PC memory 00
 
Right try this after you do a detect , type program and hit enter , see if it goes to Trap on in the bottom right , if it does do the getram and verify procedure again please .

Looking at the dumps now i can see the bootloader in the correct place in NT but not BC , so please dont use the BC script until i have modified it to the new offsets.
 
OK
program turns TRAP ON
getram OK
cmpram OK
:D

-detect
IDCODE 0334917F
Broadcom BCM3349
IMPCODE 00800904
EJTAG V1, V2.0
DMA supoorted
Found Address= 9f000000 CFI Intel 28F640J3
-program
-getram 9f000000 800000
Time 00:00:28 (.361)
-cmpram 9f000000 800000
Time 00:00:28 (.363)
Compare data OK
 
Right try this script , only do a full flash read for me please ,
So what i need is a full NT and BC dump again , when you get the NT dump do the program bit first please and then post them here if you don't mind
 

Attachments

  • Netgear CG814CCR v2.rar
    1.4 KB · Views: 9
Just need a full dump from BC with the new script now to compare against the trap on one. Also on BC do the leds still flash on BC during dumping as well ??
 
OK

The LEDS are off

Is that what they should be???
 

Attachments

  • FLASH.0x00-0x800000.bin.zip
    1.9 MB · Views: 8
You get a proper read when the led's are not flashing , means the cpu is not running and not writing anything. There still seems to be disceprencies with both dumps , however the NT dump is looking more promising , so once again dont use the script until i have sussed this out .

Once again thx for all your help so far
 
Ok do this please in the script change this JTAG.Flashbase(0x9F000000) to JTAG.Flashbase(0x1FC00000) save it and see if that detects the flash , if it does get me another dump please.
 
You must log in or register to reply here.
Back
Top