Netgear WNR3500v2



Manuf. by Foxconn (Hon Hai) U12H127T00/U12H127T70

Models

 * Netgear WNR3500v1 • WNR3500 • U12H092T00 (Marvell)
 * Netgear WNR3500v2 • WNR3500V2 • U12H127T00_NETGEAR
 * Netgear WNR3500v2(VCNA) • WNR3500V2VC • U12H127T70
 * Netgear WNR3500U • WNR3500U • U12H136T00_NETGEAR
 * Netgear WNR3500Lv1 • WNR3500L • U12H136T99_NETGEAR
 * Netgear WNR3500Lv2 • WNR3500LV2 • U12H172T00/U12H172T99

Flashing DD-WRT

 * Supported

Flashing FreshTomato

 * FreshTomato hardware compatibility table note the following for this device:
 * "Due to hard-coded jffs2 partition, flash size is reduced to only 3,473,408 bytes. As of v2022.5, FreshTomato MiniIPv6 builds (with the filename pattern ) are 3,467,534 bytes and is the only image type that will fit. It will likely become necessary before long to look back to older releases in FreshTomato's download archive for images that are still small enough to fit it's available space."

Reverting to stock firmware

 * Adapted from NETGEAR's official documentation of the TFTP bootloader recovery process

The most robust method for replacing the stock firmware on this device in the event of a bad flash or a desire to stop using a third-party firmware is done using TFTP (Trivial File Transfer Protocol). Since most third-party firmwares do not alter the device's bootloader, this method can often recover devices that has ceased functioning correctly or even connecting to other devices. As a failsafe, the bootloader is designed to probe its LAN Ethernet ports moments into the start of every boot cycle for the presence of a TFTP server at the IP address, and if one is found, to request its file list and download the first file it encounters with either an   or a   file extension and write its contents into flash memory. Assuming you're working from a modern Windows PC, the process tends to closely resemble this:
 * 1) Download TFTPD64 to your computer and make sure it executes successfully, then exit it for now.
 * 2) Downloads the OEM firmware from the Netgear web site and unzip the file (either with the Windows File Manager or a utility like 7-Zip) so that the   file in it is in a directory by itself.
 * 3) Configure your computer's network adapter with a static/manual IP address of , subnet mask of   and a default gateway of  . Connect your network adapter to one of the router's LAN ports via Ethernet cable with the router powered off.
 * 4) Launch TFTPD64 again and make sure the static IP address you just configured is selected in the drop-down menu labelled Server Interface. Configure the Base Directory for the server as the directory where you extracted the   file containing the OEM firmware to.
 * 5) Power on the router. If the process begins successfully, within a minute of being turned on the power LED with turn orange and begin blinking, signalling that the bootloader found all the conditions needed to trigger the TFTP recovery mode and has begun the process of transferring the file and flashing itself with it. This will be briefly confirmed on the Server tab of TFTPD64 when the router appears in the connection list while it's retrieving the firmware file, and thereafter in the program's Log tab.
 * 6) Wait at least five minutes after the router closes the TFTP connection for the flashing process to complete and the router to reboot itself into the stock firmware; the process is complete when the Power LED has returned to steadily glowing white and the wireless network lights have turned on.
 * 7) Return to your network adapter settings and remove the static/manual IP address, subnet mask and default gateway entries, returning it to the "Automatic" or DHCP configuration mode.
 * 8) Open a web browser and go to the address   to begin reconfiguring your router's new firmware.

From DD-WRT
No GUI reversion possible yet, see serial recovery for reversion.

Flash partitions
 dev: size     erasesize name mtd0: 00040000 00010000 "pmon" mtd1: 00750000 00010000 "linux" mtd2: 005dc000 00010000 "rootfs" mtd3: 00080000 00010000 "jffs2" mtd4: 00010000 00010000 "nvram" mtd5: 00010000 00010000 "board_data"

Serial pinouts
JP1  VCC 1 o RX 2 o N/C 3 o N/C 4 o  TX 5 o GND 6 o J14  nTRST  1o o2	 GND TDI  3o o4	 GND TDO  5o o6	 GND TMS  7o o8	 GND TCK  9o o10	 GND nSRST 11o o12  N/C

Using a Universal JTAG Adapter
 white 1o o2	 black red 3o o4	 GND blue 5o o6	 GND green 7o o8	 GND yellow 9o o10  GND orange 11o o12 N/C

Using a TUMPA
 TUMPA N/C 1o o2  N/C nTRST 3o o4  GND TDI 5o o6  GND TMS 7o o8  GND TCK 9o o10 GND N/C 11o o12 GND TDO 13o o14 GND nSRST 15o o16 GND N/C 17o o18 GND N/C 19o o20 GND

Using the TUMPA's ribbon cable

 * 1) Black to your choice of pins 2,4,6,8,10 on the router and your choice of pins 4,6,8,10,12,14,16,18,20 on the TUMPA for GND (ground)
 * 2) White to pin 1 on the router and pin 3 on the TUMPA for the nTRST signal
 * 3) Grey to pin 3 on the router and pin 5 on the TUMPA for the TDI signal
 * 4) Purple to pin 7 on both devices for the TMS signal
 * 5) Blue to pin 9 on both devices for the TCK signal
 * 6) Green to pin 5 on the router and pin 13 on the TUMPA for the TDO signal
 * 7) Yellow to pin 11 on the router and pin 15 on the TUMPA for the nSRST signal

DD-WRT Serial Recovery
Once you're hooked up and seeing the data output into your terminal, power cycle the router and immediately start rapidly pressing Ctrl + C until it breaks the init process through to the CFE.

Using a Universal JTAG Adapter
Confirmed working with North American unit and firmware.
 * 1) Power Cycle,
 * 2) Power Cycle,
 * 3) Power Cycle,
 * 4) Power Cycle,
 * 5) The last step will backup the board data to "custom.bin, Using a Hex editer, check to make sure all the data looks similar to board_data.bin or post it to your thread in the dd-wrt forums and somebody can check it for you.
 * 6) If it is similar, change "U12H127T70_NETGEAR" to "U12H127T00_NETGEAR". The mac address starts at Hex address 40 in the middle pane, make sure it's correct. The Serial number starts at Dec address 76 in the right pane, make sure it's correct. The Security Pin starts at Dec address 108 in the right pane, make sure it's correct. The actual board data starts at Dec address 256 in the right pane, make sure it matches board_data.bin. If it looks all messed up then start fresh with board_data.bin and make all the changes to it. When done "save as" "custom.bin" without the quotes. Makes sure it's in the same folder as TJTAG.
 * 7) Now do the same with the cfe128, mac sure mac address match(although not as important with the cfe). Check to see if is similar to cfe128.bin. If not or it's just totally messed up use the reference cfe128.bin. Just edit it to match the information from your router.
 * 8) Power Cycle,
 * 9) Power Cycle,
 * 10) Have TFTP.exe ready in WindowsXP, with WNR3500v2-V1.2.2.28_25.0.85NA.chk from that zip file. Configure your computer with a static IP address of 192.168.1.10 . Connect the router to the PC via network cable. Power on the router and when it signals a connection, click Upgrade.

USB
This device has no USB ports.

DD-WRT VLAN Configuration

 * WikiDevi:DD-WRT/VLAN Support Testing Needed

DD-WRT Forum

 * Netgear WNR3500 v2.0 Brick (solved)
 * Netgear WNR3500 v2.0
 * DD-WRT for Netgear WNR3500v2?
 * Netgear WNR3500V2 - rollback to original FW
 * Netgear 3500 v2 died after firmware upgrade
 * WNR3500v2 stuck in waiting for tftp mode &#91;Solved&#93;