Netgear CMD31T - any hope?

[teddyalmonds]

6 pins yes. 5 for talking to the modem and then 1 pin on pin 2 to power the spi chip.

[theinfiniti]

OK all, I dumped the current firmware into a file. Flashrom is complaining that the file I choose to flash is not 8Mb. What should I do regarding it?

[theinfiniti]

Damn it. Looks like the ROM is _NOT_ structured identically to the SB6120. The XML for it is useless, seeing how Boot Script is located where Image1 should be... although I don't have an SB6120 dump to compare to. Anyone willing to provide me with one? Feel free to x out important information, just don't change the file size.

Here's a preview of the supposed Image1 section: http://i.imgur.com/qFikJ6u.png

@neo_, got any advice?

EDIT: Looks like the start of the supposed Image0 and Image1 locations is IDENTICAL. This means that those should also be the locations of the netgear. However, configuration and log locations appear to be WHERE BLANK IS ON THE SB6120! Here, they start at 7C0000, as compared to 7D0000 on the SB6120!

UPDATE: Flash successful but modem dead. Had to flash the full chip because flashrom. Used a hex editor and seemingly successfully compiled a forceware 1.2 image that replaced image0 and image1 locations on the backup of my modem. Apparently not. Lights are very faint and I can't connect to it through LAN. Further experiments tomorrow.

[teddyalmonds]

Flash only the bootloader, get serial with the ttl you ordered and restore back that way.

Hopefully the backup you made does contain the nvram which can be also restored via bootloader. You ideally always want to be able to establish a path to restore to default if need be.

[neo_]

Damn it. Looks like the ROM is _NOT_ structured identically to the SB6120.

@neo_, got any advice?

I've never compared them, but I do have a stock SB6120 dump. PM me your e-mail and I'll send it.

Flash only the bootloader, get serial with the ttl you ordered and restore back that way.

I am unsure if they all are the same, but my CMD31T bootloader was unlocked. Although it didn't want to take the UBFI1 flash by giving me an error mid-transfer. It could have just been my environmental problem.

[teddyalmonds]

If I had to guess, I would guess it was an environmental problem. Plus now that his flash is corrupt, getting a proper bootloader back on my prompt the modem to clear the rest of it's flash back to default values. It would still require him to do the following:

SET UBFINAME1 firmwarename
run update1

Before doing that, hit print and it'll list the default ip address that the modem looks for a tftp server on. Then do what I listed above and hope that it works out.

[neo_]

Oh you're correct, I forgot the corrupt bootloader part.

[mforce]

As Teddy said,
Flash the uboot on there, and tftp a forceware image
you can run mfnvreinit on the forceware shell prompt to "format" a new nvram

Regards,
force.