This is a 802.11n Router for the 2.4 GHz band with three built-in antennas of which the one in the middle (ANT_1_1) isn't used.

The stock firmware for the v3 device runs OpenWRT 7.09 and contains 4 antennas:

1. Soldered aluminium antenna
2. On the main PCB
3. PCB antenna daughter board
4. PCB antenna daughter board

These are v0 of the WNR2000, the primary difference being that there is NO WAN PORT. Stock units run Kamikaze 7.09, I followed the main directions for the WNR2000 and the only issue ive seen is an inability to do a hardware reset. Havent bothered to look into it, just plugged it back into the serial connection and restored the device from there. Good luck.

1. follow Unlocking the Netgear Telnet Console to unlock telnet on the OEM firmware and be able to telnet into the router
2. (optional, but recommended) Back up your u-boot and art flash partitions as outlined by forum user CheBuzz in the second code box in this post
3. Follow the info in radengr's post and fuhry's post to flash. Linking to the posts instead of copying the commands here is intentional so you know what you are doing
   • Note: Fuhry's domain has changed. His new domain is: "http://fuhry.com/". He does NOT allow director traversal, meaning you must know the exact file you need.
     • For example his re-partition script is at http://fuhry.com/b/wnr2000//install-repart.sh.
   • 500K Additional Space: According to dony71 on the forum, to gain the additional 500K space that fuhry refers to, you must make these additional changes.
4. Reboot, then basic.config.

The original U-Boot bootloader runs a CRC check on the flash before it executes the bootcmd command. This prevents OpenWrt from being run from flash. As long as you do not replace the OEM bootloader, you can only create an OpenWrt ramdisk image and load it via tftp. This requires access to the serial console:

• configure the NIC of a PC with a tftp server at 192.168.1.12
• copy openwrt-ar71xx-uImage-initramfs-lzma.bin into the directory of the tftp server (e.g. /tftpboot)

On the WNR2000v1 serial console:

• press any key after Hit any key to stop autoboot: to stop autoboot
• tftpboot 0x81000000 openwrt-ar71xx-uImage-initramfs-lzma.bin - this should print a couple of # signs
• setenv bootargs board=WNR2000
• bootm - boots the kernel

e.g.

U-Boot 1.1.4.16-g04e9b8bf (May 14 2008 - 17:04:28)

AP81 (ar7100) U-boot
sri
32 MB
Top of RAM usable for U-Boot at: 82000000
Reserving 245k for U-Boot at: 81fc0000
Reserving 192k for malloc() at: 81f90000
Reserving 44 Bytes for Board Info at: 81f8ffd4
Reserving 36 Bytes for Global Data at: 81f8ffb0
Reserving 128k for boot params() at: 81f6ffb0
Stack Pointer at: 81f6ff98
Now running in RAM - U-Boot at: 81fc0000
id read 0x100000ff
flash size 4MB, sector count = 64
Flash: 4MB
In:    serial
Out:   serial
Err:   serial
Net:   ag7100_enet_initialize...
Fetching MAC Address from 0x81fea7b0
: cfg1 0xf cfg2 0x7114
eth0: 00:1f:33:f3:30:05
dup 1 speed 100
eth0 up
eth0
### main_loop entered: bootdelay=4

### main_loop: bootcmd="bootm 0xbf2a0000"
Hit any key to stop autoboot:  0 
ar7100> tftpboot 0x81000000 wnr2000
Using eth0 device
TFTP from server 192.168.1.12; our IP address is 192.168.1.10
Filename 'wnr2000'.
Load address: 0x81000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #############################
done
Bytes transferred = 2143454 (20b4de hex)
ar7100> setenv bootargs board=WNR2000
ar7100> bootm
## Booting image at 81000000 ...
   Image Name:   MIPS OpenWrt Linux-2.6.32.10
   Created:      2010-03-28   6:54:52 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2143390 Bytes =  2 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ...OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 33554432

Starting kernel ...

Linux version 2.6.32.10 (joerga@quad) (gcc version 4.3.3 (GCC) ) #1 Sun Mar 28 08:54:48 CEST 2010
bootconsole [early0] enabled
CPU revision is: 00019374 (MIPS 24Kc)
Atheros AR9130 rev 1, CPU:400.000 MHz, AHB:200.000 MHz, DDR:400.000 MHz
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00002000

Note: This will void your warranty!

• To remove the cover remove two little silver screws (Torx 5 or 6) at the bottom and slide the front and back cover down to the feet for some mm.

PCB upper side

PCB back side

PCB detail at the CPU

• WNR2000v0 (rev0)
  • Serial == Unknown. dmesg states it is a v1, yet both externally and internally the physical stickers state "rev0". Can someone please update this? *Note: I own a "rev0" model running Trunk Generic k3.8.12 currently (generic version fills /rom to 100%, thus custom versions are recommended).

    root@OpenWrt:/tmp# dmesg
    [    0.000000] Linux version 3.8.12 (fnord@tschunk) (gcc version 4.6.4 (OpenWrt/Linaro GCC 4.6-2012.12 r36641) ) #1 Wed May 15 21:23:58 UTC 2013
    [    0.000000] MyLoader: sysp=aaaa5554, boardp=aaaa5554, parts=aaaa5554
    [    0.000000] bootconsole [early0] enabled
    [    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
    [    0.000000] SoC: Atheros AR9132 rev 1
    [    0.000000] Clocks: CPU:400.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:5.000MHz
    [    0.000000] Determined physical RAM map:
    [    0.000000]  memory: 02000000 @ 00000000 (usable)

• WNR2000v1
  • The serial port is at JP1: 115200 8N1 at 3.3V. Pins are, from left with the ethernet ports above: [Vcc] [Tx] [Rx] [GND]
• WNR2000v2
  • The serial port is at JP1: 115200 8N1 at 3.3V. Pads are, from top to bottom with the ethernet ports above: [Vcc] [Tx] [-] [-] [Rx][GND]
• WNR2000v3
  • The serial port is at JP1: 115200 8N1 at 3.3V. Pads are, from left to right with the ethernet ports on right: [Vcc] [Tx] [Rx] [GND]

JTAG pins were found by removing the BGA from a WNR2000 and a TP-Link WR-1043ND (AR9132 with JTAG header) and comparing the PCB traces. The top side of the PCB is the one with the heatsinks.

(Be aware that there is no "I" row in the BGA counting!)

• Review at Smallnetbuilder.com
• Thread in OpenWrt Forum
• Another Thread with the quest for the JTAG pins