asus rt-n16 PL2303 TA USB TTL线救砖备忘录

俗话说出来混总是要还的， 所以lz的n16终于挂了

1. aliexpress买了根TTL线等了两个月orz，都准备投诉退款了，终于在下单后的第60天收到了

   

2. 接法

   黑色线接地（GND），接 n16 的接地（GND）
   白色线为接收（RXD），接 n16 的传送（TXD）
   绿色线为传送（TXD），接 n16 的接收（RXD）
   红色线不接

   

   接好以后插电源，windows上装驱动, 设备管理器里可见是COM4

   

   设置里设成下图所示

   

3. putty 设置

   

   

4. windows网络连接设置

   

5. windows上开好tftpd,把cfe和各种需要刷的固件放一个目录里

   

6. 连接之后，之前挂点的时候的输出内容

   CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
   Build Date: ▒T  5▒▒ 27 16:47:24 CST 2009 (root@localhost.localdomain)
   Copyright (C) 2000-2008 Broadcom Corporation.
   
   Init Arena
   Init Devs.
   Boot partition size = 262144(0x40000)
   et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.3
   CPU type 0x19740: 480MHz
   Tot mem: 131072 KBytes
   
   CFE mem:    0x80700000 - 0x8079B310 (635664)
   Data:       0x80731B30 - 0x80734880 (11600)
   BSS:        0x80734880 - 0x80735310 (2704)
   Heap:       0x80735310 - 0x80799310 (409600)
   Stack:      0x80799310 - 0x8079B310 (8192)
   Text:       0x80700000 - 0x80731B30 (203568)
   
   Device eth0:  hwaddr XX-XX-XX-XX-XX-XX, ipaddr 192.168.1.1, mask 255.255.255.0
           gateway not set, nameserver not set
   Null Rescue Flag.
   Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
   Loading: TFTP Server.
   Failed.
   Could not load :: Timeout occured
   Loader:raw Filesys:raw Dev:flash0.os Fine: Options:(null)
   Loading: .. 3856 bytes read
   Entry at 0x80001000
   Starting program at 0x80001000
   Linux version 2.6.24.111 (root@dd-wrt) (gcc version 4.1.2) #1977 Sat Aug 7 00:53:12 CEST 2010
   CPU revision is: 00019740
   Determined physical RAM map:
    memory: 07fff000 @ 00000000 (usable)
   Built 1 zonelists in Zone order.  Total pages: 32512
   Kernel command line: console=ttyS0,115200 root=1f02 rootfstype=squashfs noinitrd
   Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
   Primary data cache 32kB, 4-way, linesize 32 bytes.
   Synthesized TLB refill handler (20 instructions).
   Synthesized TLB load handler fastpath (32 instructions).
   Synthesized TLB store handler fastpath (32 instructions).
   Synthesized TLB modify handler fastpath (31 instructions).
   PID hash table entries: 512 (order: 9, 2048 bytes)
   CPU: BCM4716 rev 1 at 480 MHz
   Using 240.000 MHz high precision timer.
   console [ttyS0] enabled
   Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
   Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
   Memory: 124656k/131068k available (3144k kernel code, 6264k reserved, 1479k data, 144k init, 0k highmem)
   Mount-cache hash table entries: 512
   NET: Registered protocol family 16
   Generic PHY: Registered new driver
   PCI: Using membase 8000000
   PCI: Initializing host
   PCI: Reset RC
   PCI: Fixing up bus 0
   PCI: Fixing up bridge
   PCI: Fixing up bridge
   PCI: Enabling device 0000:01:00.1 (0004 -> 0006)
   PCI: Fixing up bus 1
   NET: Registered protocol family 2
   Time: MIPS clocksource has been installed.
   IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
   TCP established hash table entries: 4096 (order: 3, 32768 bytes)
   TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
   TCP: Hash tables configured (established 4096 bind 4096)
   TCP reno registered
   RT-N16 GPIO Init
   devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
   devfs: boot_options: 0x1
   squashfs: version 3.0 (2006/03/15) Phillip Lougher
   io scheduler noop registered
   io scheduler deadline registered (default)
   HDLC line discipline: version $Revision: 4.8 $, maxframe=4096
   N_HDLC line discipline registered.
   Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
   serial8250: ttyS0 at MMIO 0x0 (irq = 8) is a 16550A
   PPP generic driver version 2.4.2
   PPP Deflate Compression module registered
   PPP BSD Compression module registered
   MPPE/MPPC encryption/compression module registered
   NET: Registered protocol family 24
   PPPoL2TP kernel driver, V1.0
   tun: Universal TUN/TAP device driver, 1.6
   tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
   VID 0 is set in nvram, Ignoring
   eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.27
   Physically mapped flash: Found 1 x16 devices at 0x0 in 8-bit bank
    Amd/Fujitsu Extended Query Table at 0x0040
   Physically mapped flash: CFI does not contain boot bank location. Assuming top.
   number of CFI chips: 1
   cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
   Flash device: 0x2000000 at 0x1c000000
   bootloader size: 262144
   Physically mapped flash: Filesystem type: squashfs, size=0x1fb5dc
   partition size = 2174976
   Creating 5 MTD partitions on "Physically mapped flash":
   0x00000000-0x00040000 : "cfe"
   0x00040000-0x01fe0000 : "linux"
   0x0018d000-0x003a0000 : "rootfs"
   mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
   0x01fe0000-0x02000000 : "nvram"
   0x003a0000-0x01fe0000 : "ddwrt"
   Found a 0MB  serial flash
   sflash: found no supported devices
   Broadcom Watchdog Timer: 0.07 initialized.
   u32 classifier
       Actions configured
   Netfilter messages via NETLINK v0.30.
   nf_conntrack version 0.5.0 (2048 buckets, 8192 max)
   ctnetlink v0.93: registering with nfnetlink.
   IPv4 over IPv4 tunneling driver
   GRE over IPv4 tunneling driver
   ip_tables: (C) 2000-2006 Netfilter Core Team
   ClusterIP Version 0.8 loaded successfully
   TCP bic registered
   TCP cubic registered
   TCP westwood registered
   TCP highspeed registered
   TCP hybla registered
   TCP htcp registered
   TCP vegas registered
   TCP scalable registered
   NET: Registered protocol family 1
   NET: Registered protocol family 17
   Welcome to PF_RING 3.2.1
   (C) 2004-06 L.Deri <deri@ntop.org>
   NET: Registered protocol family 27
   PF_RING: bucket length    128 bytes
   PF_RING: ring slots       4096
   PF_RING: sample rate      1 [1=no sampling]
   PF_RING: capture TX       No [RX only]
   PF_RING: transparent mode Yes
   PF_RING initialized correctly.
   PF_RING: registered /proc/net/pf_ring/
   802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
   All bugs added by David S. Miller <davem@redhat.com>
   decode 1f02
   VFS: Mounted root (squashfs filesystem) readonly.
   Mounted devfs on /dev
   Freeing unused kernel memory: 144k freed
   start service
   starting Architecture code for broadcom
   Booting device: Asus RT-N16
   loading bcm57xx
   sh: can't create /proc/switch/eth0/reset: nonexistent directory
   sh: can't create /proc/switch/eth1/reset: nonexistent directory
   sh: can't create /proc/switch/eth0/vlan/0/ports: nonexistent directory
   sh: can't create /proc/switch/eth0/vlan/0/ports: nonexistent directory
   sh: can't create /proc/switch/eth0/vlan/1/ports: nonexistent directory
   sh: can't create /proc/switch/eth0/vlan/1/ports: nonexistent directory
   sh: can't create /proc/switch/eth0/vlan/2/ports: nonexistent directory
   sh: can't create /proc/switch/eth0/vlan/2/ports: nonexistent directory
   /etc/preinit: line 66: can't create /proc/sys/net/ipv4/ip_conntrack_max: nonexistent directory
   eth1: Operation not supported
   wl0.1: No such device
   wl0.2: No such device
   wl0.3: No such device
   nbw = 20
   eth1: Operation not supported
   eth1: Operation not supported
   eth1: Operation not supported
   eth1: Operation not supported
   eth1: Invalid argument
   eth1: Invalid argument
   

7. 恩山随便搜了个别人共享的n16原版cfe,使用编辑器编辑mac地址后刷入，似乎没什么变化，刷完后就停在那里，只好手动重启

   CFE> flash -noerase -noheader 192.168.1.100:cfe_mine.bin flash1.boot
   Reading 192.168.1.100:cfe_mine.bin: TFTP Client.
   TFTP_BLKLEN!!
   Done. 262144 bytes read
   Download of 0x40000 bytes completed
   Write bootloader binary to FLASH (0xbfc00000)
   Programming...
   copysize=262144, amtcopy=262144
   done. 262144 bytes written
   

   还试过清nvram,没什么效果

   nvram erase
   

   然后试了下minidd，似乎也无效，最后试验的是shibby tomato max v138，刷完等了一会，没看到自动重启，于是手动重启了下，满血复活…

   flash -noerase  -noheader 192.168.1.100:max138.trx flash1.trx
   

   然后lz进webui恢复到了之前一直在用的AIO v138版本
   

链接:
PL2303 TA驱动下载地址
tftpd32
PuTTY: a free SSH and Telnet client
Tomato by Shibby
dd-wrt.v24-14896_NEWD-2_K2.6_mini_RT-N16.trx – minidd

参考：
使用 PL2303 HXD USB 轉 TTL 傳輸線，從序列埠登入到 Raspberry Pi B+
用TTL线在CFE环境下拯救半砖wrt54g路由器
Recover bricked TL-MR3020 via serial console