Adventures in unbricking a router

Another fantastic illustration of how Linux ‘gets the job’ done. Although sometimes the operator (ahem) is sometimes a bit slow on the uptake.

Anyway, I had a Linksys WRT54G router in which the wireless unit had blown up after a power outage and surge. Gotta love the Philippines. I had dd-wrt on it, but decided to try out OpenWRT. Well lets just say that OpenWRT isn’t to my taste. I wanted something which worked more or less immediately, rather than poring over documentation trying to figure out how to get the WAN interface up via a command line.

So I dropped the router into a drawer until today, when I needed to use it for something (without the need for wireless). Well of course when I needed it, it wouldn’t boot. In fact I couldn’t even ping it. This is bad news.

I tracked down an internet post which mentioned that if I held the reset button while booting, the router would go into admin mode, which meant I could ping it. I did this and it worked. I read elsewhere that in order to flash it with tftp, I needed to do so when the ping response time was 100ms, before it dropped to 64ms. Exciting stuff. I set up the tftp flashing machine and tried, possibly 50 or 60 times, to flash back ddwrt. No luck. For reference, here is the one liner:

echo -e "binary\nrexmt 1\ntimeout 60\ntrace\nput ddwrt.bin\n" | tftp 192.168.1.1

I did an nmap scan of the router and found that port 23 was open, so I managed to telnet into it. I couldn’t connect the wan interface (as previously noted), but I had a command prompt. No SSH, no web interface. So how to get the ddwrt.bin file onto the router via telnet?

Here’s how: On my PC, at 192.168.1.50, I went to the directory which held the ddwrt.bin file. At the command prompt I typed

python -m SimpleHTTPServer

This serves up the current directory over HTTP, port 8080.

In my router telnet session I went to the /tmp directory (the only place with enough space for the file) and typed

wget http://192.168.1.50:8080/ddwrt.bin

After a few seconds, the file was there! Alright!

Still in the router, I did

mtd -r write dd-wrt.bin linux

The router whirred for a while, rebooted and … ddwrt was back, in all its web-interfacy autoconfigurating glory.

What a great trick with SimpleHTTPServer. Shame I wasted hours on the tftp approach. Incidentally, there’s a similar tool which will let people upload files to your computer via HTTP, called droopy.

Leave a Comment