Netgear CMD31T - any hope?

[theinfiniti]

Tried to scan through the forums, only found info showing that the modem needs to be flashed through SPI. Are there any diagrams available? Should I just get SB6121/SB6141 and start over? Is this even a quality modem?

Thanks all

[daviddds]

I can't find anything about this modem - if I HAD to use the modem I'd pull the flash chip off and dump it, then reflash it, but it requires some specialized hardware to do it, I suppose you could do it with a USBJTAG NT, but I don't know much about that.

I would put the modem on eBay or craigslist myself and get a SB61xx series or a Ubee u10c035, I'm a fan of the Ubee modems, I see them pop up on eBay for $25-30 bucks often and they're good modems (I had one survive a lightning strike that hit a power pole and ended up entering the house via the cable line, blew out all the cable boxes and TV's, the modem survived!), plus most of them can be flashed directly from uboot AND some of them have a telnet server running on the stock firmware! Though, I don't know how many people are using Ubee's so I'm not sure how much info is publicly available.

[neo_]

This modem is fully compatible with ForceWare and I have flashed two already.

It has a serial header already soldered to it, you can try flashing it through there although I didn't have much luck with that method.

It does have a SPI chip, and like all SPI chips THEY ALL use the same wiring diagram. Simply use a USBJTAG NT and flash it like every other ForceWare modem. You DO NOT need any unique guide specifically for this modem.

[daviddds]

It does have a SPI chip, and like all SPI chips THEY ALL use the same wiring diagram. Simply use a USBJTAG NT and flash it like every other ForceWare modem. You DO NOT need any unique guide specifically for this modem.

Good point about that, they all do use a standard pin configuration depending on the package, ie, 8 pin or 16 pin. But if you're curious theinfiniti just find the flash ship on the board and google "partnumber datasheet" and read it, you'll find the pins there.

[neo_]

It does have a SPI chip, and like all SPI chips THEY ALL use the same wiring diagram. Simply use a USBJTAG NT and flash it like every other ForceWare modem. You DO NOT need any unique guide specifically for this modem.

Good point about that, they all do use a standard pin configuration depending on the package, ie, 8 pin or 16 pin. But if you're curious theinfiniti just find the flash ship on the board and google "partnumber datasheet" and read it, you'll find the pins there.

Every ForceWare modem has the same number of pins and pinout.

Here is a complete USBJTAG NT guide. Even though it is for another modem, the procedure is exactly the same.

How To Jtag Motorola SB6121 Modem With USBJTAGNT





The SB6121 uses a 16-pin SPI chip and the method is done the exact same way as the SB6120. There is plenty of information how to solder a SB6120 online. There is one “trick” I discovered which lead me to about 5 hours total (going mad) to dump the SPI when it should have only taken 30 minutes. To help others avoid this (as I’ve found in this forum and others) since there are people running into the same issue without an answer, I am writing this tutorial. This is mostly to help all the lazy individuals who cannot search hard enough. I also thought I'd share my method of soldering as I believe that if it is truly your testing modem it should be easily flashable. The test clip is cool but it requires you to disassemble the modem (every time) and is way too expensive now. I use a 8-9" 14 pin cable which can be bought at usbjtag website for an expensive $2.00. I like buying a IDC (2 x 7) 14pin ribbon cable (anywhere around 18”) on ebay or elsewhere for a whole lot cheaper in bundles of 10 or so. Once soldered you will never have to open up the modem again and can just flash with the external IDC connector. I am going to break this down to baby steps as this modem is cute and I believe all the new “testers” will buy this since it can commonly be found for $50.

**Before you continue you should test the modem and make sure everything is working as it should as you do have to cut the serial/mac sticker to disassemble**



Requirements

-Motorola SB6121 Modem
-Soldering Iron & Solder + soldering paste/flux
-T10 screwdriver + small flat head screwdriver (1.5)
-Wrench / Needle nose
-USB cable for external 5V
-USB JtagNT
-Electric tape
-Scissors and / or wire stripper
-Knife



Disassembly

1) Remove T10 screw above the ethernet & hexagon nut on the coaxial F-type connector
2) Cut the sticker
3) Depress 4 clips on the 2 top and 2 bottom of the modem ( use a small flat)
4) Remove PCB and flip over as the SPI chip is located in the back.



Prepare The Ribbon cable

1) cut the cable 8-9" long
2) strip and separate wires (you can cut the unused short to eliminate shorts & clutter)
**Use the RED cable for reference as it is easily identified as pin/wire number 1**
3) Wires 2 and 13 conductors should be twisted and tinned
4) use electric tape to wrap around the ribbon cable 2 inches from the IDC connector. (Used to protect cable and prevent stress on the solder joints)
5) Cut and seperate wires 14 & 13 near the IDC and
a)solder to your connector (here I used an old CD drive audio cable)
b)twist conductors to prevent fraying


Soldering

1) Tin the wire conductors using soldering paste then dip in paste and solder to corresponding pin. ( easiest way to a wire to the SPI joint is to come from on top and point downward so the wire and the pin are vertical.
2) Inspect all soldered joints
3) Place a piece of electric tape over the SPI chip.

5-Volt USB cable

1) Strip outer jacket to expose 4 wires and strip some of the commonly red and black coated wires (+ and GND)
2) twist or connect the + and - external power to modem.
** For the 5V source try to use either a PC jack or under 1 amp charger because of the low amps and not your 2 amp phone charger as I do not know how sensitive the chip is**

Confirm Soldering / SPI Access

1) Plug in USB 5V cable
2) connect DC jack on modem and let the modem boot (done waiting when the blue light is flashing "Receiving")
**Note: Sometimes the modem will boot with 2/3 dim LED's instead. Just wait 1 minute after providing power then proceed to #3**
3) while waiting go ahead and connect your USBJtagNT usb cable on both ends and start the software
4) set Category as Modem, Protocol to SPIFLASH and Target to SB6120
5) Connect USBJtagNT to ribbon cable (pay attention to pin 1 on the RED side)
6) set range to AllFlash and press ID to identify the chip
7) It should fail with FF,FF,FF
8) Unplug DC jack from modem (took me some time to find out)
9) ID the chip it should now be successful
**You can now reassemble the modem since the soldering was good**

Reassembly



1) Feed the 14 pin cable through the back plate's Ethernet port cutout.
2) Replace and hand tighten the F-type hexagon nut keeping the electric tape on the ribbon cable centered in between the shield and ethernet jack.
3) Reverse the disassembly process

Complete



Congrats you should now be good to go and never have to open up that modem again (unless you want serial). It was a pain figuring out that the modem needed power than it had to be removed in order for USBJtagNT to communicate with it.

****
Notes:
- You cannot use pin1 of USBJtag on pin 2 of SPI flash for Voltage, just not enough power.
- I know about the 5V on the NT, but I'd rather keep the insulator around the board, I'm sure many other new testers would.
- I will post the ISP point once I try it myself but soldering on the large SPI flash is easy and can save new solderers trouble.
- With this method I'm 110% sure this way would always work and would not have varying results.

[teddyalmonds]

Neo is making some great points. I personally use a usb ttl with 3.3 to power pin 2 to get the Blackcat USB or Jtag NT to detect the flash.

[neo_]

Neo is making some great points. I personally use a usb ttl with 3.3 to power pin 2 to get the Blackcat USB or Jtag NT to detect the flash.

Yes sir, that works perfect.

Although recently, I simply used the 5V directly from the USB port on the USBJTAG NT to simplify from having to use a secondary cable.

[daviddds]

Neo is making some great points. I personally use a usb ttl with 3.3 to power pin 2 to get the Blackcat USB or Jtag NT to detect the flash.

Yes sir, that works perfect.

Although recently, I simply used the 5V directly from the USB port on the USBJTAG NT to simplify from having to use a secondary cable.

Have you ever had any problems using 5v? most of the flash chips are only rated for vcc max of 3.6v~ but I'm guessing since it worked for you that they are 5v tolerant on the vcc pin.

Also, I was thinking of older, pre D3 modems having 8 pin flash chips, had a bit of a brain fart

Anyhow, great tutorial, I'm definitely going to give it a try with a modem I have laying around, sure beats pulling the flash chip.

[theinfiniti]

Holy shit guys, thanks so much for the quick response. Just opened it up and sure enough there is a 16 pin SPI chip (C?)L064PIF. From therein it looks like following the SB6121 Method should be fine. Now as for flashing through less conventional methods, namely using an arduino or just a serial port - does such a possibility exist? I did dig up this: http://arduino.cc/en/Tutorial/SPIEEPROM. Looks like I just have to adapt it to use the 8 pins on this particular spi chip that have those functions?

Also this modem is risk free in terms of disassembly and I love that. 4 screws and the cover literally falls off. No warnings to peel like the Motorola modems.

Again thanks so much everyone. I will attempt something later with my arduino as I don't quite have the budget for a specialized dongle (nor will I be doing this on a large scale anyways).

[daviddds]

I bet its a Spansion S25FL064PIF flash chip, but that's just guessing off the part number you gave.

I've never seen an Ardiuno based eeprom programmer, it's possible I just don't think anyone's ever wrote one for our purpose, plus you would need more than 9600buad serial to do it in any reasonable amount of time... dumping 8MB of flash @ 9600buad would take 2 hours, even 115200 buad would take 10 minuets or so and I'm not even sure of the clocks are fast enough to read/write a SPI flash chip @ that speed on an Ardiuno. The closest thing I know of is the FlashcatUSB that uses the Atmega32U2