Netgear WNR834Bv2

From TechInfoDepot
Jump to navigationJump to search
multiple revisions of this device, use caution
bgn (N300)
RangeMax NEXT Wireless-N Router
Support
Wikipedia
InfoDepot Wiki
WikiDevi.wi-cat.ru
3rd Party Firmware
dd-wrt
Status Unknown
OpenWrt
Incompatible
Tomato any flavor
Incompatible
Gargoyle
Status Unknown
Platform
BrandModelRev
Netgear WNR834B v2
FCC ID
IC ID
Type
wireless router
CPU1
Broadcom BCM4704
CPU1 Type
MIPS32
CPU1 Speed
264 MHz
Flash1 Chip
Macronix MX29LV320CBTC-90G
Flash1 Size
4 MiB4,194,304 B <br />32,768 Kib <br />4,096 KiB <br />32 Mib <br />0.00391 GiB <br />
RAM1 Size
16 MiB16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br />
RAM1 Chip
Samsung K4S641632K-UC75 x 2
ETH chip1
Broadcom BCM4704
Switch
Broadcom BCM5325F
Ethernet Port Count
1-WAN
4-100MbE-LAN
Wired Standard
IEEE 802.3/3u
Stock bootloader
CFE 1.0.37 BCM947XX
Stock FW OS
Linux 2.4.20
Expansion IF types
none specified
Power
12 VDC, 1 A
Connector type
barrel
Serial Port (UART)
yes, internal, 6-pin header, unpopulated, 3.3V TTL, (115200 8N1), JP1
JTAG Port
yes, internal, 10-pin header, unpopulated, J12

Additional chips
2.4GHz Power Amplifier IC;Skyworks;SE2528L;;2;

Other

Default SSID: NETGEAR (43 addl. devices)
Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1303 additional devices
of which 105 are Netgear devices
Default login user: admin
Default login password: password
admin:password credentials used by 420 additional devices
of which 301 are Netgear devices

Manuf/OEM/ODM
Foxconn U12H081
3rd Party Firmware Support
DD-WRT • (List)
Retail
FCC approval date 04 June 2007
UPC 606449041415
(UPC DB, On eBay)
ASIN B000FFRZ1W Flag of the United States.svg
Country of manuf China
Radio 1
Chip1
Broadcom BCM4321
Chip2
Broadcom BCM2055
Wireless interface OUI
00:1B:2F, 00:1E:2A, 00:1F:33, 00:22:3F, 00:24:B2
Antenna Connector Type
U.FL
MIMO status
2x2:2
Wireless Standard
IEEE 802.11b/g/n
802.11n
up to 300 Mbps
802.11g
up to 54 Mbps
802.11b
up to 11 Mbps
WiFi Operating Frequency
2.4 GHz
Radio cor_rev
11
 CPU1 brandRadio1 chip1 brandRadio1 chip2 brand
Netgear WNR834AIntelAtherosAtheros
Netgear WNR834Bv1BroadcomBroadcomBroadcom
Netgear WNR834Bv2BroadcomBroadcomBroadcom
Netgear WNR834MMarvellMarvellMarvell

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.

For a list of all currently documented Netgear device with specifications, see Netgear.

300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = N300 class


Overview

"U12H081", "REV. 3 GP", and "800063" is silkscreened on one production model WN834Bv2.

Links of Interest

Wikis

Forums

Flashing

Flashing dd-wrt

Supported by dd-wrt as of = v24 build 5966 20070222

(See Important Notes below before attempting to flash)

Warning.png

Do not use bin/chk files from the router database older than svn12188. Currently, they are bricking routers. Once this problem is sorted out, this message will be removed. Also you might want a build higher than 12533 because the root-exploit (milw0rm) on older versions.
Sparkie Updated by redhawk0

This file worked perfectly with my router:

This file bricked my router, while earlier versions seem to work:

  • dd-wrt.v24-13577_NEWD_openvpn_jffs_small.bin - deadlyninja
    • This router does not have VLAN support, similar to the WRT610N.**

The Netgear WNR834Bv2 is now fully supported as of 3rd July 2008. Thanks to Eko, Brainslayer, etc. for their superb work in getting this router supported.

These (slightly modified) instructions were first posted by sparkie here. Read that complete thread for the hairy details on getting this device fully supported, if you are so interested or suffer from insomnia.

Step 1: Download the mini version of DD-WRT version 24, build 12548, new driver in the dot CHK format here.

Step 2: Flash the firmware to your router using Netgear's factory firmware standard web interface. Note that to successfully flash this device, you may need to use IE or Firefox 3 or higher. sparkie has reported in the thread linked above that Firefox 2 will not work with the Netgear factory web upgrade page to flash this device.

Step 3: If the mini build is insufficient for your needs, you may download your preferred flash BIN file from here. Then flash up the new .BIN file using the DD-WRT web interface from the Administration tab, then the Firmware Upgrades tab.

Important Notes (Please read these in full before attempting to flash):

  • DO NOT ATTEMPT TO FLASH ANY BUILDS EARLIER THAN 9856 DATED 3RD JULY 2008, or you risk bricking your router. Some of the v24 release candidate 7s worked with minor bugs. But the first final v24 bricked the router for some users as a result of a problem with JFFS.
  • TFTP flashing only works when the router detects a bad flash and puts itself in diagnostic mode. This can be seen by a flashing green power light, and also a ping trace will show response immediately after powerup with TTL=100. Proper flashes will stop replying to pings after about 15 seconds, then will reply with TTL=64. Diag mode will stay at TTL=100. Diag mode can be forced by opening the router and shorting pins 16 and 17 on the MX flash chip during powerup. Some suggest you try the pin short first, other suggest JTAG. Both have their pros and cons.
  • TTL=100 3~6 times means your router is bricked. No amount of uploading an image via tftp at the proper time will work. It will require a pin short, or jtag to fix. It is futile to try and achieve perfect timing to upload an image in this mode.
  • NEWD = New Drivers; VINT = Vintage Drivers. Use only NEWD firmwares with this router. VINT builds are for much older routers.
  • DO NOT INSTALL the generic broadcom dd-wrt.v24_std_generic.bin file (2.4 SP1). It will likely brick your router.
  • If your router is stuck in 'tftp only' mode (characterized by a constant TTL=100 ping response), you can rescue it by TFTPing the original Netgear firmware less the header file located here, which will flash your router back to Netgear's stock 1.0.22 North America firmware. This file is called wnr834bv2_1_0_22_na.bin
  • For routers will a more recent flash, you will need the 2.1.13 version of the flashes 2.1.13_NA / 2.1.13_WW
  • Your router has only 4 MB of Flash RAM. Do not attempt to flash the MEGA version of DD-WRT to this device.

DOUBLE SUPER DUPER Extremely Important Note:

According to Eko, the NVRAM of this router has an additional partition on it which contains your router's serial number, MAC address, and board code. DD-WRT builds prior to 9856 would overwrite this section of NVRAM, if the user enabled JFFS. Builds 9856 and higher include support for turning JFFS on with this model router. In the event that you accidentally erase this part of the NVRAM, you can only recover your router by flashing it via JTAG.


This also implies that if you want to use the OpenVPN version, you'll want one with an openvpn_jffs_small suffix like THIS one (current as of 15/5/2009).

Upgrading

Updating DD-WRT

If dd-wrt is already on the router follow these instructions. If stock firmware is on the router follow the flashing instructions.

  1. Check for recommended builds here first.
  2. Set your computer to a static IP of 192.168.1.7. (or to whatever subnet the router is on) Disable all firewalls and security. Disable wireless on your computer and only have the router connected to the flashing computer by the ethernet cable between the two.
  3. Hard reset or 30/30/30 (If the router supports it, if not, reset to defults in the GUI) prior to flashing. Wait. Check for password page on re-login and change password.
  4. Flash firmware. You can use the webgui except if you have a belkin router. (For belkin use tftp.exe to flash)
  5. Wait...at least three minutes. Lights should return to normal. See important2, below. Failing to wait is how most people brick their routers.
  6. Do a power cycle of the router. (Unplug the cord, count to 30 and plug it back in.)
  7. Wait for the lights to return to normal usually about 2 minutes.
  8. Hard reset or 30/30/30 again (If the router supports it, if not, reset to defults in the GUI). Wait. Check for the password page and re-login to change the password. Then you can reconfigure your settings manually.
  9. Once configured set your computer back to autoIP and autoDNS.

Important1: This Hard reset or 30/30/30 works fine for Asus router, but you do have to power cycle after the reset.

Important2: After you flash the firmware, and before you do the hard reset, the router will be building some nvram settings. YOU MUST WAIT FOR THIS TO FINISH PRIOR TO DOING ANYTHING WITH THE ROUTER INCLUDING A HARD RESET. Usually, you can tell when this process is completed by the WAN light coming on, but it does take several minutes. Go have a beer. There are starting to be more and more people who BRICK their routers by not waiting until the nvram is rebuilt, PRIOR to doing a hard reset. YOU NEED TO WAIT!

JTAG-Serial Info

JTAG

JTAG Pinouts

J12 Pin 1 connected to JP1 pin 1 via 100 ohm resistor. 

J12 Pin 3 --100r--> TDI (Pin 2 of parallel port) 
J12 Pin 5 --100r--> to TD0 (Pin 13 of parallel port) 
J12 Pin 7 --100r--> to TMS (Pin 4 of parallel port) 
J12 Pin 9 --100r--> to TCK (Pin 3 of parallel port) 
J12 Pin 10 -------> to GND (Pin 20&25 of parallel port)

  • Functional NVRAM backup is here.
  • Functional CFE backup is here.
  • Functional Custom backup is here. (REQUIRES MODIFICATION OF MAC ADDRESS)
  • Tornado's JTAG v2.1.4 is here.

JTAG Recovery

One of the best threads that has been found for debricking the WNR834Bv2.

The fastest way to recover a bricked WNR834Bv2 is to wipe the kernel portion of the flash, and reflash the custom section.

  • 1. Download one of the binpacks WNR834Bv2 World Wide. WNR834Bv2 North America, and the custom.bin
  • 2. JTAG the router
  • 3. Erase the kernel portion of the flash
  • 4. Reflash the 'custom' section of the flash (hex edit the custom.bin and put your own MAC address in at offset 40~45!)
  • 4a. flash parameters: -flash:custom /window:1fc00000 /start:1ffe0000 /length:10000
  • 5. Power cycle the router and the router will respond with a constant ttl=100 ping response
  • 6. TFTP a dot CHK file appropriate to your router (NA or WW)
  • 6a. You will know that the transfer was completed and the flash process is working when router power light blinks amber on and off once per second. After a few minutes, the router will begin to respond with a ttl=64 ping and will be functional again.

RECOVERY PROCESS VIA PIN SHORT

  • Pin Locations.
  • Short pins 16 & 17
  • Power up router
  • Open two command prompt/console windows
  • Start a ping of the router, it should respond with TTL=100
  • Initiate TFTP upload of a .chk file (DD-WRT or one of the stock Netgear ones)
  • Immediately remove the short
  • You will know that the transfer was completed and the flash process is working when router power light blinks amber on and off once per second. After a few minutes, the router will begin to respond with a ttl=64 ping and will be functional again. (Yes, it actually does take 2~3 minutes)

Serial

Serial Pinouts

This is a common Netgear / Foxconn pinout..

 1         JP1
(3.3v) (RxD) (NC)  (NC)  (TxD)  (GND)

Info derived from

boot log
Decompressing..........done
Decompressing..........done

CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Thu May  3 14:43:11 CST 2007
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena
Initializing Devices.
Boot partition size = 131072(0x20000)
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.80.53.0
et1: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.80.53.0
CPU type 0x29006: 264MHz
Total memory: 16384 KBytes

Device eth0:  hwaddr 00-24-B2-00-89-60, ipaddr 192.168.1.1, mask 255.255.255.0
              gateway not set, nameserver not set
CPU revision is: 00029006
Primary instruction cache 16kb, linesize 16 bytes (2 ways)
Primary data cache 16kb, linesize 16 bytes (2 ways)
Linux version 2.4.20 (aspen@coolteam.cs) (gcc version 3.2.3 with Broadcom modifications)
#2 Thu Mar 27 15:12:04 CST 2008
Setting the PFC to its default value
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200
CPU: BCM4704 rev 9 at 264 MHz
Calibrating delay loop... 263.78 BogoMIPS
Memory: 14360k/16384k available (1361k kernel code, 2024k reserved, 108k data, 56k init, 0k highmem)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction...  unavailable.
POSIX conformance testing by UNIFIX
PCI: Initializing host
PCI: Enabling CardBus
PCI: Fixing up bus 0
PCI: Fixing up bridge
PCI: Fixing up bus 1
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
Squashfs 2.2-r2 (released 2005/09/08) (C) 2002-2005 Phillip Lougher
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xb8000300 (irq = 3) is a 16550A
ttyS01 at 0xb8000400 (irq = 0) is a 16550A
PPP generic driver version 2.4.2
 Amd/Fujitsu Extended Query Table v1.1 at 0x0040
number of CFI chips: 1
Flash device: 0x400000 at 0x1c000000
Physically mapped flash: squashfs filesystem found at block 620
Creating 8 MTD partitions on "Physically mapped flash":
0x00000000-0x00020000 : "boot"
0x00020000-0x003b0000 : "linux"
0x0009b324-0x003b0000 : "rootfs"
0x003b0000-0x003c0000 : "T_Meter1"
0x003c0000-0x003d0000 : "T_Meter2"
0x003d0000-0x003e0000 : "POT"
0x003e0000-0x003f0000 : "board_data"
0x003f0000-0x00400000 : "nvram"
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
Linux IP multicast router 0.06 plus PIM-SM
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
802.1Q VLAN Support v1.7 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 56k freed
Algorithmics/MIPS FPU Emulator v1.5
Reading board data...
WSC UUID: 0x8062e454105b992f3427e1eda53bf588
Using /lib/modules/2.4.20/kernel/drivers/net/et/et.o
insmod: bcm57xx.o: no module by that name found
Using /lib/modules/2.4.20/kernel/drivers/net/wl/wl.o
Hit enter to continue...NVRAM upgrade required.  Starting.
NVRAM upgrade complete.
Reading board data...
WSC UUID: 0x8062e454105b992f3427e1eda53bf588
WARNING: console log level set to 1
eth2: Numerical result out of range
eth2: Operation not supported
eth2: Invalid argument
eth2: Invalid argument
eth2: Operation not supported
eth2: Operation not supported
eth2: Invalid argument
eth3: No such device
ifconfig: Illegal seek
eth4: No such device
ifconfig: Illegal seek
eth2: ignore i/f due to error(s)
*********************************************
Wi-Fi Simple Config Application - Intel Corp.
Version: Build 1.0.5, November 19 2006
*********************************************
Reading board data...
WSC UUID: 0x8062e454105b992f3427e1eda53bf588
Using /lib/modules/2.4.20/kernel/net/ipv4/acos_nat/acos_nat.o
Info: No FWPT default policies.
info, udhcp server (v0.9.8) started
error, unable to parse 'option wins '
error, unable to parse 'option domain '
POT integrity check OK.
POT time is up.
Initializing stack...button monitor start...!
apLockDownLog_init, counttion = 300, duration = 300!
 OK
Now starting stack
get mac = 00 24 B2 00 89 60
Start DHCP client daemon
info, udhcp client (v0.9.8) started
eth1: No such process
Hit enter to continue...DEVICE PIN: 75885960

******* MODE: Access Point *******

DEVICE PIN:75885960
WSC: In unconfiged AP mode, wait for start command....
tlvPtrChar* : func CMasterControl_InitiateRegistration
line 656 allocating memory 0x10004100 for 0x100040e8
Waiting for Registrar to connect...


Notes

FAULTY POWER SUPPLY

Many of the factory refurb WNR834B v1 and v2 routers sold in 2008 through frys.com, geeks.com, tigerdirect.com, and woot.com were shipped with a marginal or defective power supply manufactured by DVE. These units are smaller than traditional power supplies, and can be identified by the following information:

P/N: 332-10006-01

MODEL: DSA-12R-12 AUS 120120

The routers will operate perfectly with only 9VDC @ 800mA, but older-style surplus Netgear power supplies that output 12VDC @ 1A are available from AllElectronics.com as DCTX-1216