User Tools

Site Tools


toh:netgear:dg834g

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision
Previous revision
toh:netgear:dg834g [2013/05/16 14:59]
danitool created moved
toh:netgear:dg834g [2014/08/12 14:03] (current)
scytale Add known issues and note about 10.03.1 compatibility
Line 8: Line 8:
 | v1/2/3 | Backfire 10.03.1-rc1/​2 | Working | | | v1/2/3 | Backfire 10.03.1-rc1/​2 | Working | |
 | v1/2/3 | Backfire 10.03.1-rc3/​4/​5/​6 | Not Working :!: | | | v1/2/3 | Backfire 10.03.1-rc3/​4/​5/​6 | Not Working :!: | |
-| v1/2/3 | Backfire 10.03.1 | Unconfirmed ​| |+| v1/2/3 | Backfire 10.03.1 | Possilby Working ​Works for some users. However one user reports "​Ethernet Switch lost=Reflash using nftp tool + Netgear recovery mode" ​|
 | v1/2/3 | Attitude Adjustment 12.09 beta | Not Working :!: | | | v1/2/3 | Attitude Adjustment 12.09 beta | Not Working :!: | |
  
 :!: Note: This doesn'​t help people using pre-compiled binaries, but YMMV [[https://​dev.openwrt.org/​changeset/​29241|removing certain cpmac patches]] prior to compilation. :!: Note: This doesn'​t help people using pre-compiled binaries, but YMMV [[https://​dev.openwrt.org/​changeset/​29241|removing certain cpmac patches]] prior to compilation.
 +
 +===== Known Issues =====
 +
 +  * Only WEP encryption is available in Wifi settings! not sure why - stock Netgear firmware supported WPA-PSK - need to check, may be a package install issue?
 +[http://​oldwiki.openwrt.org/​OpenWrtDocs(2f)WhiteRussian(2f)Configuration.html#​head-f335c44d5b896564e2fb57831ceb0ab3958a668a] suggests that a package called “nas” is needed, but that does not exist in the backfire packages available from [http://​downloads.openwrt.org/​backfire/​10.03/​ar7/​packages/​] - however there are some “wpa-*” packages there.
 +[https://​forum.openwrt.org/​viewtopic.php?​id=24493] suggests that wpad-mini is needed for WPA and wpad for WPA Enterprise - yet to confirm that this works - doubtful as that topic refers to Broadcom chipsets so it may not work on TI AR7 ... [http://​www.lizardking.biz/​2010/​03/​qwest-actiontec-gt701-wg-ppoe-openwrt/​] seems to reinforce ​
 +
 +  * Further upgrade(s) via web and sysupgrade command not supported, manual upgrade required, here’s how to do that at the device cmdline: <​code>​mtd -r write firmware.trx linux</​code>​
 +  (NB .trx and .bin interchangeable) [http://​wiki.openwrt.org/​doc/​howto/​installing#​flashing.openwrt]
  
 ===== Hardware Versions ===== ===== Hardware Versions =====
Line 21: Line 30:
  
  
-===== Installation =====+===== Installation ​for v3 ===== 
 + 
 +The ADAM2 bootloader in v3 is different, and cannot be patched as shown below. It does not seem to be needed anyway. Another important difference is that the bootloader does not allow FTP access nor interruption of the boot from the serial console, so recovery can only be done with the Windows recovery tool or the nftp.2 tool described below. 
 + 
 +The old wiki has information for this particular model: [[oldwiki/​openwrtdocs/​hardware/​netgear/​dg834gv3]] 
 + 
 +See also: http://​www.pitt-pladdy.com/​blog/​_20100424-103102+0100%20OpenWrt%20Take%202%20-%20native%20IPv6%20on%20DG834%20v3%20%28using%20AAISP%29/​ 
 + 
 +===== Installation for v1 and v2 ===== 
 + 
 +I have successfully installed OpenWrt on a v1 model using the procedure outlined above for the v3 model (after disabling the checksum verification - see below) - however I have not seen any other reports on the internet of anyone doing this successfully - I have no way of knowing if this is because no one else has tried or no one else has succeeded. It must be said that the procedure for the v3 model is simpler and easier than attempting to connect to the bootloader TFTP service which can be infuriatingly tricky. Attempt at your own risk.  
 ==== Flash Layout ==== ==== Flash Layout ====
-An example ​[[doc:​techref:​Flash Layout]] ​with explanationsAnd here the flash layout of the Netgear DG834G:+Please see [[doc:​techref:​Flash Layout]] ​for an overview of how the flash space is partitioned and accessed using [[doc:​techref:​MTD| MTD (Memory Technology Device)]]Here the flash layout of the Netgear DG834G:
  
 ^ Netgear DG834G ​ ^^^ ^ Netgear DG834G ​ ^^^
Line 34: Line 54:
 The mtd2 device/​partition (base location) holds the bootloader with its configuration stored in mtd4 so you can use mtd1 + mtd0 + mtd3, from 0x90020000 to 0x903f0000 to store OpenWrt (providing 3920KiB of storage space). The mtd2 device/​partition (base location) holds the bootloader with its configuration stored in mtd4 so you can use mtd1 + mtd0 + mtd3, from 0x90020000 to 0x903f0000 to store OpenWrt (providing 3920KiB of storage space).
  
-==== Installation Information ==== 
-**''​NOTE:''​** These instructions don't work for v3. See next section. 
  
-For this segment it will be assumed that your routers IP is 192.168.0.1, if it is not please take this into account then performing the following steps.+**''​NOTE:''​** These instructions don't work for v3See previous section.
  
-=== Patching the Bootloader ​=== +==== Overview ====
-The DG834(G) ADAM 2 Bootloader calculates a checksum of the image in flash memory, if this check fails the router will not boot.+
  
-This checksum verification ​can be removed from the bootloader.+For this segment it will be assumed that your routers IP is 192.168.0.1,​ if it is not please take this into account then performing the following steps: 
 +  * telnet to the router 
 +  * check the firmware on the router allows access to the bootloader configuration 
 +  * copy the contents of the mtd blocks containing the firmware to your pc 
 +  * disable the firmware ​checksum verification ​by manually editing one of these files 
 +  * update ​the relevant mtd special device on the router 
 +  * write openwrt to the relevant mtd firmware files 
 +  * manually assign an ip address to the [[doc:​techref:​adam2]] ​bootloader 
 +  * reboot the router and connect to the Adam2 ftp service 
 +  * transfer the updated firmware files to the router and write to the mtd special devices 
 +  * reboot
  
-If there is no adam2 directory in /proc upgrade the device ​to newer firmware for example [[http://www.downloads.netgear.com/files/​dg834_dg834g_3_01_29.zip|DG834_V3.01.29]].+==== Telnet ​to the Router ==== 
 +  * Enable debug mode. Visit http://192.168.0.1/setup.cgi?​todo=debug 
 +  * Telnet into your router <​code>​ 
 +telnet 192.168.0.1</​code>​
  
-Once you patch the bootloader you don't need to patch the device ​again in case of recovery.+==== Check firmware version ==== 
 +If there is no adam2 directory in /proc on the router then upgrade ​the device ​to newer firmware for example [[http://​www.downloads.netgear.com/​files/​dg834_dg834g_3_01_29.zip|DG834_V3.01.29]].
  
-** Obtaining your current Bootloader ​**+==== Obtaining your current Bootloader ​====
  
-  ​Enable debug mode. Visit http://​192.168.0.1/​setup.cgi?​todo=debug +  ​Enable debug mode. Visit http://​192.168.0.1/​setup.cgi?​todo=debug 
-  ​Telnet into your router <​code>​+  ​Telnet into your router <​code>​
 telnet 192.168.0.1</​code>​ telnet 192.168.0.1</​code>​
-  ​- Assign an IP address to ADAM2<​code>​ +  ​Backup each MTD Block to RAM<​code>​
-echo "​my_ipaddress 192.168.0.1"​ > /​proc/​sys/​dev/​adam2/​environment</​code>​ +
-  - Backup each MTD Block to RAM<​code>​+
    dd if=/​dev/​mtdblock/​0 of=/​tmp/​mtd0.bin    dd if=/​dev/​mtdblock/​0 of=/​tmp/​mtd0.bin
    dd if=/​dev/​mtdblock/​1 of=/​tmp/​mtd1.bin    dd if=/​dev/​mtdblock/​1 of=/​tmp/​mtd1.bin
Line 61: Line 90:
    dd if=/​dev/​mtdblock/​3 of=/​tmp/​mtd3.bin    dd if=/​dev/​mtdblock/​3 of=/​tmp/​mtd3.bin
    dd if=/​dev/​mtdblock/​4 of=/​tmp/​mtd4.bin</​code>​    dd if=/​dev/​mtdblock/​4 of=/​tmp/​mtd4.bin</​code>​
-  ​Spawn a HTTP Daemon to download MTD Backups<​code>​+  ​Spawn a HTTP Daemon to download MTD Backups<​code>​
 cd /tmp cd /tmp
 mini_httpd -p 1080</​code>​ mini_httpd -p 1080</​code>​
-  ​- Download ​the MTD Backups<​code>​+  ​* On your PC download ​the MTD Backups<​code>​
 http://​192.168.0.1:​1080/​mtd0.bin http://​192.168.0.1:​1080/​mtd0.bin
 http://​192.168.0.1:​1080/​mtd1.bin http://​192.168.0.1:​1080/​mtd1.bin
Line 71: Line 100:
 http://​192.168.0.1:​1080/​mtd4.bin</​code>​ http://​192.168.0.1:​1080/​mtd4.bin</​code>​
  
 +==== Disable firmware checksum verification ====
 +The DG834(G) ADAM 2 Bootloader calculates a checksum of the image in flash memory, if this check fails the router will not boot.
  
-** Patch ADAM 2 **+This checksum verification can be removed from the bootloader.
  
-ADAM2 is contained in the mtd2.bin file, this should be the focus of alteration.+Once you patch the bootloader you don't need to patch the device again in case of recovery.
  
-  - Verify the current edition ​is eligible for modification:​ +ADAM2 is contained in the mtd2.bin file, we will patch this to disable ​the verificaiton.
-    - These modifications steps apply to the 0.18.01 edition of ADAM2 as distributed by Netgear. +
-    - The MD5 sum of this should be ''​0530bfdf00ec155f4182afd70da028c1''​ if this isn't the case DO NOT follow these instructions (have you previously patched this loader?, if unsure go to step 3). +
-  - Modify ​the bootloeader binary file with a hex editor: +
-    - go to offset 0x3944. Here there should be 4 bytes: 44 09 00 0C  (representing //jal 0x90002510//​ during execution) +
-    - Replace these 4 bytes with 00 (representing nop). +
-  - Verify the modification +
-    - Confirm the new MD5 of the modified mtd2.bin is ''​d8a2f4623bf6f64b7427812f0e849aa7''​.+
  
 +  * Verify the current edition is eligible for modification:​
 +    * These modifications steps apply to the 0.18.01 edition of ADAM2 as distributed by Netgear.
 +    * The MD5 sum of ''​mtd2.bin''​ should be ''​0530bfdf00ec155f4182afd70da028c1''​ if this isn't the case DO NOT follow these instructions (have you previously patched this loader?, if unsure go to step 3).
 +  * Modify the bootloeader binary file with a hex editor:
 +    * go to offset 0x3944. Here there should be 4 bytes: 44 09 00 0C  (representing //jal 0x90002510//​ during execution)
 +    * Replace these 4 bytes with 00 (representing nop).
 +  * Verify the modification
 +    * Confirm the new MD5 of the modified mtd2.bin is ''​d8a2f4623bf6f64b7427812f0e849aa7''​.
  
-** Replace the restricted ADAM2 on the router** +==== Replace the restricted ADAM2 on the router ​==== 
-  ​Place the Modified mtd2.bin onto a web or FTP server (e.g http://​127.0.0.1/​mtd2.bin) +  ​Place the Modified mtd2.bin onto a web or FTP server (e.g http://​127.0.0.1/​mtd2.bin) 
-  - Download the new mtd2.bin to the router via WGET<​code>​+    * for this you can enable IIS on your PC to serve the directory containing the firmware files. Google for details on how to do this.  
 +    * Don't forget to update the firewall on your PC to allow access to the relevant port.  
 +    * You may also need to allow the IIS user read access to the directory and files alternatively configure IIS to access the files as the user that owns them 
 +  * Download the new mtd2.bin to the router via WGET<​code>​
 cd /tmp cd /tmp
 rm mtd2.bin rm mtd2.bin
 wget http://​127.0.0.1/​mtd2.bin</​code>​ wget http://​127.0.0.1/​mtd2.bin</​code>​
-  ​Install the new mtd2.bin to the Router<​code>​+  ​Install the new mtd2.bin to the Router<​code>​
 dd if=mtd2.bin of=/​dev/​mtdblock/​2 </​code>​ dd if=mtd2.bin of=/​dev/​mtdblock/​2 </​code>​
  
 +==== Write OpenWrt to Firmware Files ====
 +Download the OpenWrt SquashFS image: https://​downloads.openwrt.org/​backfire/​10.03/​ar7/​openwrt-ar7-squashfs.bin
  
-=== Installing OpenWrt === 
-Installation of OpenWrt can now be done using the TFTP method by targeting the IP address you specified in part 3 of obtaining the bootloader. 
 It should be noted that due to the memory layout of this device an OpenWrt SquashFS image needs to be split into to files, this can be done using the DD tool. It should be noted that due to the memory layout of this device an OpenWrt SquashFS image needs to be split into to files, this can be done using the DD tool.
  
Line 105: Line 140:
   dd if=openwrt-ar7-squashfs.bin of=ow-mtd0.bin skip=720896 bs=1   dd if=openwrt-ar7-squashfs.bin of=ow-mtd0.bin skip=720896 bs=1
  
-Now that the image has been split appropriately its can now be uploaded (and flashed) ​to the Router using its ADAM2 FTP service. +==== Assign an IP address ​to ADAM2 ==== 
-To connect to the ADAM2 FTP service you need to use a COMMAND LINE ftp client targeting the IP address you specified in part 3 of obtaining the bootloader.+<​code>​ 
 +echo "​my_ipaddress 192.168.0.1" > /​proc/​sys/​dev/​adam2/​environment</​code>​
  
-Note: The size of the two images combined cannot be bigger than 3932160 bytes, or the upload ​will fail and you will end with an unusable device!+This means that the ADAM2 bootloader ​will configure the network interface ​and be reachable over the network before it loads the firmware. It has an embedded TFTP server which we can use to upload the modified firmware files.
  
-Note: Modern Windows FTP command line clients are incompatible with this process ​so the Windows XP one must be used+this can be reached for a second or so before ​the bootloader loads the firmware.
  
-Note: Linux users, make sure to enable Passive mode.+Installation of OpenWrt can now be done using the TFTP method by targeting the IP address you specified in part 3 of obtaining the bootloader.
  
-Note: As soon as the device power on target it with telnet. After you spawn the FTP +Now that the image has been split appropriately its can now be uploaded (and flashed) to the Router using its ADAM2 FTP service
-(need some time..)+To connect to the ADAM2 FTP service you need to use a COMMAND LINE ftp client targeting the IP address you specified in part 3 of obtaining the bootloader.re
- +
-  ​the device will blink amber+
  
-Before you leave the telnet FTP (that actually doesn'​t work)prepare ​command line FTP and open connection.+There are several issues here: 
 +  * The size of the two images combined cannot be bigger than 3932160 bytesor the upload will fail and you will end with an unusable device! 
 +  * Modern Windows FTP command line clients are incompatible with this process so the Windows XP one must be used 
 +  * Linux users, make sure to enable Passive mode. 
 +  * Linux: you may need to reduce the MTU on the interface: <​code>​echo 0 512 512 > /​proc/​sys/​net/​ipv4/​tcp_wmem</​code>​ - don't forget to save the original value 
 +  * The TFTP server is only available for a second or so right after the router boots. You may find that the network interface on your PC will take longer than that to re-sync ​and thus you will mix this window of opportunity. The solution is to connect the router to the PC via a switch. 
 +  * There are reports that even after all this that Linux will fail to connect - try using a Windows machine.
  
 +==== Connect the the ADAM2 TFTP service ====
 +Reboot the router and straight away attempt to connect to it via FTP - the service is only up for a second or so.
  
   ftp 192.168.0.1   ftp 192.168.0.1
Line 150: Line 192:
   221 Goodbye.   221 Goodbye.
  
-==== Installation Information (v3) ==== +The router will now reboot - it should take several minutes ​to unpack ​the new firmware - once it has done so you should ​be able to telnet to it.
-The ADAM2 bootloader in v3 is different, and cannot be patched as shown. It does not seem to be needed anyway. Another important difference is that the bootloader does not allow FTP access nor interruption of the boot from the serial console, ​so recovery can only be done with the Windows recovery tool or the nftp.2 tool described below.+
  
-The old wiki has information for this particular model: [[oldwiki/​openwrtdocs/​hardware/​netgear/​dg834gv3]] +===== Recovery  ​=====
- +
-See also: http://​www.pitt-pladdy.com/​blog/​_20100424-103102+0100%20OpenWrt%20Take%202%20-%20native%20IPv6%20on%20DG834%20v3%20%28using%20AAISP%29/​ +
- +
-==== Recovery ​ ====+
  
 In case of a failed upload, the device might become unresponsive and look bricked. ​ In case of a failed upload, the device might become unresponsive and look bricked. ​
Line 301: Line 338:
  
 The onboard Flash Chip for V1 is a 4MB 29DL32BF-70PFTN when manipulating this chip from JTAG software such as TJTAG it may not be detected, in such cases masquerading as/forcing use of either the MBM29DL323BE or AM29LV320 chips will likely work (This has worked for the user Funkimunk, your mileage may vary). The onboard Flash Chip for V1 is a 4MB 29DL32BF-70PFTN when manipulating this chip from JTAG software such as TJTAG it may not be detected, in such cases masquerading as/forcing use of either the MBM29DL323BE or AM29LV320 chips will likely work (This has worked for the user Funkimunk, your mileage may vary).
 +
 +==== Tags ====
 +{{tag>​4Flash 16RAM ar7 }}
toh/netgear/dg834g.1368709192.txt.bz2 · Last modified: 2013/05/16 14:59 by danitool