User Tools

Site Tools


Netgear WNDR4000

Hardware Specs CPU Broadcom BCM4718 CPU Speed 480 MHz Flash ROM 8 MB RAM 64 MB Radios 2.4 GHz and 5 GHz WLAN Support a/b/g/n WLAN Max Speed 300 mbps on 2.4Ghz and 450mbps on 5Ghz Antenna Location Internal Switch 4x GigE + 1 GigE WAN USB 1x USB 2.0


revert to Original Firmware from 14.07 with Win7

1. Connect PC and Router with Lan

2. Set Password in OpenWRT

3. Disconnect Wlan

4. Set Lan IPv4

               DNS Server

5. start SSH Session with Putty

 login root and password like 1.

6. erase firmware partition (be patient, it's a long process):

  # mtd -r erase firmware   

7. after the router reboots, you will see that the power led is blinking.

8. Download File from Netgear Search for WNDR4000 (tested with WNDR4000-V1.0.0.90_9.1.79.chk)

9. start TFTP2

 password like 1.
 File WNDR4000-V1.0.0.90_9.1.79.chk 

10. click Upgrade and wait until the Router restart

Serial boot log


CFE for WNDR4000 version: v1.0.4
Build Date: Tue Nov 30 17:04:18 CST 2010
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found an ST compatible serial flash with 128 64KB blocks; total size 8MB
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 2010.09.30.0
CPU type 0x19740: 480MHz
Tot mem: 65536 KBytes

Device eth0:  hwaddr C4-3D-C7-70-A1-E9, ipaddr, mask
        gateway not set, nameserver not set
Linux version 2.6.22 (peter@dev2) (gcc version 4.2.3) #10 Mon Apr 25 19:58:10 CS
T 2011
CPU revision is: 00019740
Found an ST compatible serial flash with 128 64KB blocks; total size 8MB
Determined physical RAM map:
 memory: 03fff000 @ 00000000 (usable)
Zone PFN ranges:
  Normal          0 ->    16383
  HighMem     16383 ->    16383
early_node_map[1] active PFN ranges
    0:        0 ->    16383
Built 1 zonelists.  Total pages: 16383
Kernel command line: root=/dev/mtdblock2 console=ttyS0,115200 init=/sbin/preinit

Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 256 (order: 8, 1024 bytes)
CPU: BCM4716 rev 1 at 480 MHz
Using 240.000 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 60016k/65532k available (3087k kernel code, 5460k reserved, 592k data, 2
04k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
SCSI subsystem initialized
PCI: Using membase 8000000
PCI: Initializing host
PCI: Reset RC
PCI: no core
PCI: Fixing up bus 0
PCI/PCIe coreunit 0 is set to bus 1.
PCI: Fixing up bridge
PCI: Fixing up bridge
PCI: Enabling device 0000:01:00.1 (0004 -> 0006)
PCI: Fixing up bus 1
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
squashfs: version 3.4 (2008/08/26) Phillip Lougher
squashfs: LZMA suppport for by jro
fuse init (API version 7.8)
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver $Revision: $ 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 8) is a 16550A
loop: module loaded
PPP generic driver version 2.4.2
NET: Registered protocol family 24
PPPoL2TP kernel driver, V0.17
pflash: found no supported devices
sflash: squash filesystem with lzma found at block 1646
Creating 15 MTD partitions on "sflash":
0x00000000-0x00040000 : "boot"
0x00040000-0x00740000 : "linux"
0x0019bb70-0x00740000 : "rootfs"
0x00740000-0x00750000 : "ML1"
0x00750000-0x00760000 : "ML2"
0x00760000-0x00770000 : "ML3"
0x00770000-0x00780000 : "ML4"
0x00780000-0x00790000 : "ML5"
0x00790000-0x007a0000 : "ML6"
0x007a0000-0x007b0000 : "ML7"
0x007b0000-0x007c0000 : "T_Meter1"
0x007c0000-0x007d0000 : "T_Meter2"
0x007d0000-0x007e0000 : "POT"
0x007e0000-0x007f0000 : "board_data"
0x007f0000-0x00800000 : "nvram"
u32 classifier
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
6WIND/LSIIT IPv6 multicast forwarding 0.1 plus PIM-SM/SSM with *BSD API
lo: Disabled Privacy Extensions
IPv6 over IPv4 tunneling driver
sit0: Disabled Privacy Extensions
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <>
All bugs added by David S. Miller <>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 204k freed
Warning: unable to open an initial console.
Failed to execute /init
[sighandler]: No more events to be processed, quitting.
[cleanup]: Waiting for children.
[cleanup]: All children terminated.
Reading board data...
WSC UUID: 0xdb3b6fcc090e922939fd2363c56c8a2d
NTP synchronized date/time: 00-00-00
MAC address of 1st STA connected: 1C-4B-D6-BD-AD-87
invalid RF magic!
No RF parameters! Use default.
Initialise conn table 2048 entries
Hit enter to continue...wlconf: PHYTYPE: 4
wlconf: PHYTYPE: 7
wlconf: PHYTYPE: 4
wlconf: PHYTYPE: 7
killall: upnp: no process killed
UPnP daemon is ready to run
killall: wps_monitor: no process killed
killall: wps_ap: no process killed
killall: wps_enr: no process killed

### wps_wfi_init(): <wl0_wfi_enable=(null)><wl1_wfi_enable=(null)>WFI is not ena
bled ###
Reading board data...
WSC UUID: 0xdb3b6fcc090e922939fd2363c56c8a2d
shm ID: 0
 Get a correct Segment_ID: 0 and semaphore ID:0
info, udhcp server (v0.9.8) started
error, unable to parse 'option wins '
error, unable to parse 'option domain '
POT integrity check OK.
POT time is up.
Info: No FWPT default policies.
httpd: socket bound in
Start DHCP client daemon
info, udhcp client (v0.9.8) started
eth0: No such process
route: ioctl 0x890c failed: No such process
killall: dhcp6c: no process killed
killall: IPv6-relay: no process killed
killall: pppdv6: no process killed
killall: rtsol: no process killed
killall: dhcp6s: no process killed
killall: radvd: no process killed
route: ioctl 0x890c failed: No such process
killall: dhcp6s: no process killed
killall: radvd: no process killed
Hit enter to continue...

CPU Info

cat /proc/cpuinfo 
system type             : Broadcom BCM4716
machine                 : Netgear WNDR4000
processor               : 0
cpu model               : MIPS 74Kc V4.0
BogoMIPS                : 239.61
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp dsp2
shadow register sets    : 1
kscratch registers      : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

toh/netgear/wndr4000.txt · Last modified: 2016/01/13 16:52 by tapper