Anyone interested in photos of internals of MR2100 (M2)?

[Hogwild]

Is anyone interested in seeing photos of the internals of the Netgear MR2100 (M2)?

Note: This particular device does not complete the boot process.

[Hogwild]

Okay...well no one requested them, but since there were already 62 page views, I'm guessing someone must be interested.

This is the MR2100-100EUS (EU) model.

Some of these shots were very difficult to get in focus, since the case is smooth plastic. Also, some of the components have a protective layer of plastic or maybe conformal coating on them. By default, the website seems to blur them. If you want them in focus and with more detail, clicking on the image and zooming in afterwards seems to work well.

I'll start with the case, and the rear of the LCD and associated components.

[Hogwild]

Next are some photos of the main PCB, with the cans still intact. I was reluctant to remove them, as they appear to be glued on.

[Hogwild]

Here are a couple more of the PCB.

[Hogwild]

Here's a list of the chips I found inside:
(Note: I've indicated that I'm not sure about some chips, as it's hard to make out their labels).


Qualcomm SDX50m
Logic IC
Baseband Processor, Snapdragon X50, 5G NR, 2x2 MIMO mmWave, 4x4

- SPEC SHEET lists SDX24


SK Hynix H9HKHNNEBMAV(u?)
ARNEH 813A
(U?)TBKH823FA2


Image Hazy (Qty: 2)
QDM4670
2112T306 (hazy)
RF Module
FEM, Mid & High Band, Contains Qualcomm RF Switch & LNA, w/ SAW Filter


SEC 828
B0C1
KLUCG2K1EA

Package on Package
Samsung 4 GB LPDDR4x SDRAM memory on top of...



S7FT701U
??GB UFS2.1
Voltage: 1.8 / 3.3V



Qualcomm QPA5461
001 (DD1?)
(D?)C819ZJ8 (fuzzy)



Qualcomm SDR8160
00?
JE(8?)36QRX


358762G
761181
1824HUL
JAPAN



Qualcomm QTM052 (PCB partly encased in can/shielding)
mmWave antenna


Qualcomm QTM052 (PCB partly encased in can/shielding)
800
mmWave antenna


On LCD ribbon connector PCB
HSG2233
A7MPS?9A
?6138

Can on rear of LCD
TM5059CA024C-01
180920-000288

[Renate]

The GST5009 is the "magnetics", the tranformers for the ethernet.
The IC on the flex is probably a touch sensor using I²C.
I'd look into the gold dots. The big 4 are are for powering up without a battery.
The tiny 3 in a triangle could be boot options. Check voltages, short between them using a resistor of 1K or so while doing a long power press reset.

[Hogwild]

Thanks, Renate.

Measurements on the big 4, as you put it were (assuming I measured right):
0V, 5.01V, 1.8V, GND

Can you be more specific about what you mean by shorting between them using a resistor? Which pins, or does it matter? What would I expect/hope to see while shorting them while doing a power reset. Is there an easy way to get the resistor to stay attached temporarily without soldering?

[Renate]

Measurements on the big 4, as you put it were (assuming I measured right):
0V, 5.01V, 1.8V, GND

I meant the little three are worthy of our attention.
3*(3-1)/2=3 There are three combinations of jumping a resistor between three points.
You could measure them first. I think that maybe one is 1.8V and the other two are zero.
So it could be UART or boot options.
Put your oscilloscope on the 1.8V one when rebooting and see if it dances for you.
If not jumper the three possibilities in turn while rebooting.
Look to see if USB VID/PID appears/changes.

[Hogwild]

Dances for me? Please clarify.

Sorry, how will I know if VID/PID change? You're talking about viewing through a USB-serial adapter or some other way? This is largely above my pay grade.

[Renate]

Dances for me? Please clarify.

Do you have an oscilloscope? You can look to see if data comes over at 115200,8,n,1
The logic level is probably 1.8V so you'll need a USB UART that works at that level.

Sorry, how will I know if VID/PID change?

You can use my usblog.exe to watch for new USB devices popping up/disappearing.
You can also use plain old devmgmt.msc to see what's connected.
Then there is the old Windows usbview.exe

[Hogwild]

Hmm...okay.

Talk to me like I"m five.

I'm not clear, you want me to connect the pads to an oscilloscope WHILE a USB-Serial adapter is connected at the same time?

And, you want me to connect this to my PC via USB? Separately? At the same time? Spell it out for me, Renate.

[Renate]

Hmm...okay.

Step one: What do you have on the USB? Does it "bong" when you plug it in? Then something is there. Run usblog.exe (in my sig), plug it in, does anything show? Does Device Manager (devmgmt.msc) show anything? Run https://ftdichip.com/Support/Utilities. ... oftUSBView. See anything?

Step two: Check the voltages (vs. ground) on the "triangle" dots. Is one 1.8V? Do you have a 'scope? Put it on when the device is resetting. Is there data going up and down on it? Or is it boring?

Step three: No real data? It could be boot options. Try using a 1k resistor to jump between A-B, B-C, C-A while resetting. (3 tests).

[Hogwild]

Ah, I think I've got it. Thanks.

[bkerler]

@Hogwild Thanks for those pictures !
Can you please post the result of "AT!PRIID?" and "AT!PACKAGE" of this device ?

[Hogwild]

I would love to, if I had a working router. Unfortunately, mine doesn't finish booting. It flashes the LED red, which as I understand it, is a known firmware bug, or possibly a hardware bug. Netgear's docs aren't terribly clear on this.

[Renate]

Since this is a discrete SDX50 (and not a Quectel module) you have access to data/clock to the Hynix flash.
You can ground a data line or clock (carefully, through a 100 ohm resistor or so) while rebooting to get a 9008.
I'm not sure there is a Firehose loader available, but it looks like there are lots of candidates for SDX55.

[Hogwild]

From another website:

Code: Select all

/ # cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 00b00000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "multi_image"
mtd9: 00100000 00040000 "aop"
mtd10: 00100000 00040000 "qhee"
mtd11: 00100000 00040000 "abl"
mtd12: 00280000 00040000 "uefi"
mtd13: 00180000 00040000 "toolsfv"
mtd14: 00180000 00040000 "loader_sti"
mtd15: 00100000 00040000 "scrub"
mtd16: 001c0000 00040000 "misc"
mtd17: 00180000 00040000 "devinfo"
mtd18: 00100000 00040000 "sec"
mtd19: 00800000 00040000 "factory"
mtd20: 00a00000 00040000 "userdata"
mtd21: 00800000 00040000 "recovery"
mtd22: 01200000 00040000 "recoveryfs"
mtd23: 00300000 00040000 "sbldata"
mtd24: 00800000 00040000 "boot"
mtd25: 03c00000 00040000 "modem"
mtd26: 03b00000 00040000 "system"
mtd27: 05a00000 00040000 "custapp"
mtd28: 00a00000 00040000 "custdata"
mtd29: 0c900000 00040000 "fota"

[Renate]

Ok, so this device uses NAND/MTD/ubifs.
I'm not sure which utilities can deal with writing it.
My edl.exe can, but that requires a loader.
The Python EDL uses a streaming protocol without Firehose.
I don't know much about that either.

[cgigate]

Very good info!
Great job!

[Renate]

Are we making progress yet?

If this thing were here I think that I would:

Figure out battery power conditions.
A stock MiFi 8800L will not fully boot up without a battery, but can boot to EDL without any battery.
That's because checking battery status is part of xbl and EDL doesn't use the xbl in flash.

Use a physically switched USB connection, either a hub with individual physical power switches or a hub that use hub control of power or a toggle switch that you stuck in a cable.
Now you've got a way to do a full reset/reboot every couple of seconds.
I've done this with a relay working off a µC connected to my desktop to sequence battery eliminator and USB connection.
I hit the spacebar and it disconnects power, pauses, then reapplies it.

Map out all the test points on the board showing approximately zero voltage.
Using "single point" EDL test with either a 1.8V supply (or fresh AAA) and 1k resistor or "diode test" on a DVM try to find the test point.

If you have a realtime current monitor running you can easily see and learn the booting current profiles and notice when you've made it do something interesting.

[Hogwild]

The device does not trigger any reaction when connected to Windows PC via USB-C. So, I guess the PC is not seeing it.

I tested the three dots in the triangle you mentioned with a multimeter. I did this this with just the meter-no resistors. They're very small, by the way. I had no way of keeping my DMM probes on them before bootup, and I had to insert the USB cable to trigger bootup. That means I couldn't put the probes on them before bootup. I measured 0V on all three pins.

However, again, on the larger group of 4 pads you see in the photos, I got 0V, 5V, 1.8V and 0V. So I wonder if those aren't for the serial interface.

I probably won't go farther than using a scope. And right now, I'm not even sure if I'll be able to do that.

I'm just curious about something...there are only two of the spring-loaded pins on my SIM card slot. In photos of other peoples' MR2100 units, I see three pins. Is there some reason for that?

[Renate]

However, again, on the larger group of 4 pads you see in the photos, I got 0V, 5V, 1.8V and 0V. So I wonder if those aren't for the serial interface.

Hmm, that could be serial. It was so close to the battery that I presumed that it was just thermistor and stuff.
Check the 1.8V while booting. If it wiggles it could be important.

[Hogwild]

Will a multimeter suffice (voltage) or are we talking about waveform shape changes or something that would only be detected on a scope?


WTH? I type the word "waveform" and it shows an "o" in waveform, but when I click Submit, it shows "wavefirm" with an "i". What the heck is going on with the forum software?

[Renate]

What the heck is going on with the forum software?

Don't you mean the "firum siftware"?

Yes, a scope would be more insightful.
Even with a DVM if something reads 1.8V steady, then seems to read 1.6V, then back to 1.8V it might be a candidate to look at more closely.

[Renate]

You can do this. You haven't even popped the cans yet.
I use a penknife along the edge of a can to pry an edge away and up.
You can always get it to 9008 by holding down a data or clock line with a 100 ohm resistor.
Find the SoC. If there are EDL test points they are either near or else conspicuous somewhere else.

[Hogwild]

I barely knew how to use a scope that last time I used one, which was about 5 or 6 years ago.

I tried, but only got straight-line DC-type signal on the large pads near the battery connector. I tried to pry the cans off, but

1. I think they're soldered on and
2. My arms/hands are very unstable, so I had to be careful to use little pressure to avoid breaking something.

So I couldn't get the cans off. I may try again at some point and will post back if anything changes.

Does anyone else have one of these to play with? We've already got a bit of a head start here.

[Renate]

I do see one can that is soldered on, but I think the big ones aren't.
I can't see from the photos, but the removable ones usually have little dimples on the side that you can see.

[Hogwild]

Would someone be kind enough to check their MR2100 to see if they have 3 or 2 contacts in the SIM card slot. See picture 8 above to see what I'm talking about. I'm wondering why mine shows 2 when all the photos on the Web show 3. I've never seen that before on a device that uses a SIM card.

[Rich Hathaway]

The one in the pic looks to be broken off, it happens. I dont have a mr2100 here to look at but I have about a thousand other devices and all of them have 6 tabs.

[Renate]

Yeah, you need a total of 6 contacts, 3 in front (that look good) and 3 in back (looks like the middle one broke off).

[Hogwild]

Ouch. Okay, thanks both of you. So I guess even if I ever got this thing flashed, it would be useless unless I could get someone to replace the SIM card slot.

[Renate]

Ah, you don't need no stinking sockets.

[Hogwild]

Sheesh. Rich was right, Renate. Your microsoldering skills are really great.

[Rich Hathaway]

I have a friend who use to take the layout from another device, cut it to length if needed and put it onto a broken off layout like that one you have, he was good at micro welding also, much better than I am. He had to remove the cage most of the time I think then re-attach it, it was alot of work but if you cant find a new tray its what you are left with is improvise

[Renate]

SIMs are pretty low speed (5 MHz) and also only have a single data line so a bit of wire doesn't hurt them.
SD cards are faster and have up to 4 data lines that you have to watch out (a bit) for data skew.

[Transfluxor]

Hey guys, what are you trying to do? And most importantly - why?
You can load the MR2100 into the EDL mode without disassembling the case.
Or do you have some kind of hardware problem?

[Hogwild]

Rich had kindly offered to try to build a firmware file. There are at least a couple of us here who have this model that only goes into EDL mode. Netgear calls it a firmare or hardware issue, but won't say more than that. Plus, of course, learning...and you know..because it's there.

I don't know if check other partitions, but Rich had said that it appears the mtd29 partition image appeared to mostly contain null characters. Apparently, it wasn't extracted properly. I have no understanding of such things, but maybe Rich can say something about it. This applied to both the mtd files from the EU model and the TLAUS model.

[Transfluxor]

Rich had kindly offered to try to build a firmware file.

Do you have a working method of writing MR2100 partitions in EDL mode?

[Rich Hathaway]

Rich had said that it appears the mtd29 partition image appeared to mostly contain null characters. Apparently, it wasn't extracted properly. I have no understanding of such things, but maybe Rich can say something about it. This applied to both the mtd files from the EU model and the TLAUS model.

That part is not always populated in these devices, the device would have had to have taken an over the air update to be fully populated, it comes from the factory empty (FF FF FF FF)
I was offering to make an spk and to help get the device back to 900E mode from 9008 mode so it can be loadable, I do not have patched loader for sdx50/55 for this one but there is a way for 900E that can work if sbl is still intact.

[Renate]

Is Secure Boot enabled on this?
I've been surprised how many non-phone devices do not have Secure Boot enabled.
If you have UART you can see Secure Boot state while booting.
Otherwise, the best way is to take a working Firehose loader, trivially modify it (change spelling of a message), re-hash it and see if it still works.
If it works then Secure Boot is not enabled.

[Hogwild]

Rich/Transflux0r/Renate:

I'm guessing from its name that that partition is for storage of any over the air firmware updates?

If that's the case, is is possible to get current/previous firmware that came from the factor or isn't on that partition? If so, on which partition would it be?

Also, just for the sake of curiosity/learning, would it be possible to look at the system log to see at what point the router stops booting or if there's an error or something else useful? Or would it not even be getting that far with my router as it is?

[Hogwild]

Bump.

Surely someone knows some possible answers these questions?

[Renate]

Sorry, I'm not really sure what the question is.
I don't know anything about updates or spk.
If you found the UART it might tell you outright why it's not booting.

[Hogwild]

Sorry if I was not clear. What I meant was:

IIRC, the partition Rich was asking for was the OTA firmware update partition, yes?

If that was empty, there must be firmware on another partition, no? Whatever version shipped from the factory?

[Rich Hathaway]

That is what you are trying to replace so if you were able to "grab" it then whatever you load it to would have the same problems, the partition I was asking for if populated contains needed info to help make a recovery file but yours is not populated it only contains a header the rest is FF FF FF FF so you need to find another one.
I already checked netgears amazons3 bucket for it and I do not see anything for it there, because it is a tf device there wouldnt be likely anything ever there for it.

[Hogwild]

What is a "tf device"?

[Rich Hathaway]

tracfone

[Hogwild]

That is what you are trying to replace so if you were able to "grab" it then whatever you load it to would have the same problems,

Yes, but if someone who had a working device could get the data, it could work, right?

[Rich Hathaway]

Yes a working device with its ports enabled and that partition populated would be helpful

[Hogwild]

Which partition would have the contents I need?

And would we need just the contents of that partition or other partitions too?

[Rich Hathaway]

Which partition would have the contents I need?

if that snippet of the mtd above is correct then mtd29 for starters

And would we need just the contents of that partition or other partitions too?

but it is also possible mtd26 can restore your device depending on whats wrong with it, which I assume you do not know yet, but the system part will recover alot of these borked devices.
but my offer still stands, get me those both or either of them and I will make a recovery file for this device and
post it here for the public to have and use free of charge.

[Hogwild]

Ah, okay.

And I certainly appreciate the offer, but easier said than done. I don't know anyone yet with those files. I'll keep trying.

[Rich Hathaway]

Just need a working device, then will have to see if you can enable the ports or maybe find fastboot mode, this is generally on sierra devices found by holding the reset button while you plug in the usb cable and keep holding reset until your pc dings which will be about 5 seconds.

[Imbir22]

Hi,

i can provide working mr2100(NTGX24_10.19.03.00) MR2100-100EUS for fw download during remote session or do it by myself with some tutorial.

[AKosterin]

I can share firmware files for:

• MR2100-100EUS_23114195_NTGX24_10.19.03.00_00_Generic_06.00_00-field.010_Enc.cwe - https://mega.nz/file/r1cijb4A#TQ_4-k0da ... 5qz-hcEMG4

• MR2100-1TLAUS_23113814_NTGX24_10.19.03.00_00_TELSTRA_05.02_00-field.010_Enc.cwe - https://mega.nz/file/O5kD3TrJ#0oKVsONZI ... vgM0fqcK6w

*.cwe file can be unpacked using binwalk and 7z
The archive contains many .aes files that are encrypted with AES ECB with the key:
0x51, 0x53, 0x73, 0x45, 0x55, 0xF7, 0x43, 0xB3,
0xB8, 0x8E, 0x07, 0x5D, 0xDA, 0x44, 0xD3, 0x0E,
0x5D, 0x23, 0xDB, 0x9B, 0xA4, 0x2D, 0xB9, 0x8A,
0xE2, 0xFF, 0xAB, 0x1F, 0xC4, 0x6C, 0xE3, 0x29

The standard firmware update process is carried out using the wnc-fw-upgrade utility

If this allows me to correctly restore the MR2100 from the 9008, then I will be grateful for my friend’s help in restoring such a device. He shared data with which I was able to find the encryption key.

[Hogwild]

Would someone please clarify how this would work to do an emergency mode restore? IIRC, the router will only recognize .secc.cwe files, right? So you can't just put the router into emergency download mode and let it access this file?

What steps would need to be taken to get this firmware to work?

[Rich Hathaway]

use fdt, just drag one of those files onto the fdt file and have your device in factory dl mode, get there by holding power while you plug it in and keep holding power until you see download mode on the screen.

[Hogwild]

Wait, I thought FDT was only designed to use .secc.spk files. However, the above zip files contain .cwe files. Are you sure FDT can safely upload them?
I don't want to ruin my hardware.

To be clear, my unit never finishes booting. So will this make it boot properly (assuming it's a firmware problem)? This will flash everything fresh, so my device should boot afterwards?

FDT is a command-line based program. What do you mean drag one of the files? Would you (please) give me the fdt command switches to use? I can't find anything on the Web except on Sierra's website, which is privileged. Is is just "fdt.exe <firmwareimagefilename>" ?

[Rich Hathaway]

Wait, I thought FDT was only designed to use .secc.spk files. However, the above zip files contain .cwe files. Are you sure FDT can safely upload them?

yes it can

To be clear, my unit never finishes booting. So will this make it boot properly (assuming it's a firmware problem)? This will flash everything fresh, so my device should boot afterwards?

No, spk and/or cwe files do not flash everything, it does not touch efs, fota, custapp & data parts

FDT is a command-line based program. What do you mean drag one of the files? Would you (please) give me the fdt command switches to use? I can't find anything on the Web except on Sierra's website, which is privileged. Is is just "fdt.exe <firmwareimagefilename>" ?

You dont need any command to run it but if you insist you can use

fdt -f MR2100-100EUS_23114195_NTGX24_10.19.03.00_00_Generic_06.00_00-field.010_Enc.cwe

Now, take anything you read here with a grain of salt and know anything you or anyone does to there to their devices is their own doing and no one else is responsible but you.
I do not have this device so what I am saying is not from my experience with this model but from other models in the same class.
Yes fdt can handle cwe files, cwe is just an spk with a sort of control file, like I was saying you can easily just drop the cwe or spk onto the fdt.exe to execute it unless you need specific keys and fdt does not have many keys.
you can see them by calling up its help file
fdt -h <---like this

here is the help file below
-----------------------------------------------------------------------------------------------
FDT version: 4.6.2.0

FDT usage:

fdt -o [normal/emergency] -d [9x00/9x15/9x25/9x35/9x45/9x55/g3k/g5k] -fd [folder name] -f [file name 1] [file name 2
-p [port] -h -a -r -q -sc -force -slot [slot #] -baud [baud rate] -ssdp

-o [normal/emergency]
Specifies the operation type. Must be lower cases. This option is
optional, and if it is omitted, normal is the default setting.
- normal: This is a regular image download.
- emergency: This is an emergency download to an empty device.

-d [9x00/9x15/9x25/9x35/9x45/9x55/g3k/g5k]
Specifies the device type. Must be lower cases. This option is mandatory
for emergency download process, but optional for normal
image download process. If this option is omitted, 9x15 is the
default setting.
- 9x00: This is a 9x00 based device.
- 9x15: This is a 9x15 based device.
- 9x25: This is a 9x25 based device.
- 9x35: This is a 9x35 based device.
- 9x45: This is a 9x45 based device.
- 9x55: This is a 9x55 based device.
- g3k: This is a Gobi3000 device.
- g5k: This is a Gobi5000 device.

-fd [folder to firmware images]
This specifies the folder location of the firmware images. If this
option is omitted, the current folder is used for searching the images.

-f [image file name 1] [image file name 2]
This specifies the image file names (in normal image download).
This option is not required for G3K devices.
If this option is omitted, FDT will search for the image(s) in either
specified folder or the current folder location. If the user specifies
the images, the following rules applied:
For non-Gobi like devices, one image file is required.
For G5K devices, a pair of images (firmware and configuration) is required.
- image file name 1: This is required for normal image download for
9x00 and 9x15 based devices. It can also be used to specify the
spkg image file following the emergency boot loader download for 9x15
based devices. For G5K devices, this indicates the firmware image.
- image file name 2: For G5K devices, this indicates the configuration
image.

-p [<AT:DM:BHold]
2 or 3 serial ports that FDT uses to download firmware.
If omitted, FDT will search for serial ports.
If 2 ports are passed like "COM7:COM10", they are <DM:BHold>
and only the DM port is used to switch the device into BootHold mode
If 3 ports are pased such as "COM8:COM7:COM10", they are <AT:DM:BHold>
and the AT or DM ports are used to switch the device into BootHold mode
2 or 3 ports must be used in conjunction with -force in Gang Download mode.

-a Indicate the automated mode. If not specified, FDT requires user
input by pressing the Enter key to continue at the end.

-r Indicate to skip the final device arrival check after image download.
If not specified, the default is to check at the end.

-q Indicate if reset device is required or not before downloading the
images. In some scenarios, SetImagePreference is done via another
application, FDT is only responsible for downloading the image data.

-sc Final firmware update status check at firmware download completion.
If no specified, the default is not to check update status via QMI.

-force Force download. If specified, both images will be downloaded to
the modem. Must be used with -p in Gang Download mode

-slot [slot #]
Indicate the desired storage slot to store the download image.
This is designed mainly for Gobi devices, and has no effect on other
devices. If omitted, the device will decide the slot to use to store
the image. A valid slot number should be between 1 and 5 inclusive.
An example of usage would be "-slot 2".

-baud [baud rate]
This option specifies the baud rate to use for a specified serial
port. An example of the usage would be "-baud 115200".

-ssdp Indicate FDT to start with SSDP protocol to the device.

-timeout [value]
Impacts two timeouts:
A) wait [value] seconds for modem flashing new firmware.
B) wait 5 minutes + [value] seconds for Total download process.
The default [value] is 120 seconds if this option is missing.
Press Enter to continue ...
-----------------------------------------------------------------------------------------
after decopiled
this file may be able to be loaded by qpst or possibly edl, I am not sure I do not have this device to try with

decompiled cwe.PNG

You can try to point it at the xml's and see if it will run but likely you would have to make a partition.xml file.

[Rich Hathaway]

If you can find your way to fastboot mode tell me and ill send you a system file you can load to it and see if it clears up your issue.

[Hogwild]

I'm confused. You mean flashing the firmware above won't fix my freezing during boot issue?

What do you mean I "won't need to run any command"? If so, how do I flash this firmware? Am I supposed to put it onto USB storage connected to the USB port, or ?? A few more hints would be helfpul. You're assuming I'm highly technical with this gear, which I'm not.

Is FDT supposed to be run over Ethernet or USB? I can't get an IP address with a router that never finishes booting, so Ethernet is out.

How would I get the MR2100 into Fastboot mode?

[Rich Hathaway]

I'm confused. You mean flashing the firmware above won't fix my freezing during boot issue?

To know this you would have to know what is keeping it from booting, which you do not know.

What do you mean I "won't need to run any command"? If so, how do I flash this firmware? Am I supposed to put it onto USB storage connected to the USB port, or ?? A few more hints would be helfpul. You're assuming I'm highly technical with this gear, which I'm not.

Is FDT supposed to be run over Ethernet or USB? I can't get an IP address with a router that never finishes booting, so Ethernet is out.

Like I said, drag the cwe file and drop it onto the fdt.exe while your device is plugged into your pc, if it does not start by itself it will tell you why, its error handling is not great but there is some in it.

How would I get the MR2100 into Fastboot mode?

I posted how to do this a few posts up, go find it so I dont have to type all this over and over.

if you get to fastboot correctly the device will show as android in your device manager.
what pid is it using now? <-- to see it open properties for it in device manager and go to details then hardware id
it will be 900E or 9008
I also gave you the command to use fdt if you cant drop the firm onto the fdt executable.

if you cant get it send it to me and ill do it for you

[Hogwild]

I'm still quite confused.

I put the device into a state where it reads "Downloading software update" on its LCD screen. Is that EDL mode?
I then tried running fdt <relevantfilename>
I got:
Firmware download failed.
Primary error code: 82 - Failed in checking modem mode.
Secondary error code: 68 - Received incorrect response.
The power LED continued to flash red then blue then red then blue.

I tried what you said...pressing reset while powering on the device and waiting about 5 seconds. I once again got "Downloading software update" on the LCD screen with the power button flashing alternating red and blue. I see Netgear devices under Ports, but nothing with the word Android.

DeviceMgr Contents.JPG

When you wrote: "To know this you would have to know what is keeping it from booting, which you do not know."
Did you mean just whether it was a hardware or software problem, or something more specific? Because officially, Netgear says it is a firmware problem, IIRC. Is that specific enough?

I still don't understand why you're mentioning drag and drop to FDT when FDT is a command-line program? How does a command-line program support drag and drop?

[Rich Hathaway]

I'm still quite confused. When you wrote: "To know this you would have to know what is keeping it from booting, which you do not know."
Did you mean just whether it was a hardware or software problem, or something more specific? Because officially, Netgear says it is a firmware problem, IIRC. Is that specific enough?

you would need to where the problem is either what partition has the issue or the address 0-1000

I put the device into a state where it reads "Downloading software update" on its screen. Is that EDL mode?
I then tried running fdt <relevantfilename>
I got:
Firmware download failed.
Primary error code: 82 - Failed in checking modem mode.
Secondary error code: 68 - Received incorrect response.
The power LED continued to flash red then blue then red then blue.

in that state you should get a NETGEAR QDLoader Port
like this

port.PNG

it is "FACTORY DOWNLOAD MODE" and is different from download mode, it is what fdt and your spk/cwe looks for

if you do not have it look for an uninstalled driver and correct it, then fdt will run

I tried what you said...pressing reset while powering on the device and waiting about 5 seconds. I once again got "Downloading software update" on the LCD screen with the power button flashing alternating red and blue. I see Netgear devices under Ports, but nothing with the word Android.

Thats not what I said
I said hold power not reset

I still don't understand why you're mentioning drag and drop to FDT when FDT is a command-line program? How does a command-line program support drag and drop?

Why dont you just try it and see????
I would make a video to show it but I do not have time for that right now

[Hogwild]

Rich:

Your exact words upthread were:

Just need a working device, then will have to see if you can enable the ports or maybe find fastboot mode, this is generally on sierra devices found by holding the reset button while you plug in the usb cable and keep holding reset until your pc dings which will be about 5 seconds.

I/m not really sure if the power button works on my unit.

The device receives power via USB, so how is what I did any different than what you suggested? So in this case, removing the USB cable is removing power. Unless I should've been only powering it via battery, but if that's the case, you didn't say so.

As in the screenshot, I didn't get any QDLoader entry in Device Manager. So now what should I do?

[Rich Hathaway]

Power is for Factory Download mode
reset is for Fastboot mode
This is how it is on most devices
no battery needed on most devices for either
power buttons are easy to test, I am sure you can figure out how to test it.
if your pc dings when you enter fdm then look in your device manager and find it and load a driver for it

[Hogwild]

WAIT...I got the QDLoader port entry in Device Manager! I had to hold down the reset button longer.

Now what?

And BTW, I have to hold down Reset and then apply power and then wait about 10 seconds to get this state, and in spite of what you said, it still/also reads "Downloading software update".

Also, the power switch doesn't immediately turn off the device when pressed. Once the unit has started booting, it will only turn off the display. It will not turn off the device. I believe the power button only sends a shutdown/halt command once the unit has fully booted. And remember, my unit never fully boots. And unfortunately, the power button doesn't turn on the unit either. So I'm having to plug/unplug the USB-C to power cycle. Or maybe my power switch is just broken.

[Rich Hathaway]

Is it
NETGEAR QDLoader Port
or just
QDLoader Port
and what is the PID of it?

[Hogwild]

Is it
NETGEAR QDLoader Port
or just
QDLoader Port
and what is the PID of it?

It's Netgear QDLoader Port (COM8)

[Rich Hathaway]

ok good then you can run your file on it
You never found fastboot?

[Hogwild]

ok good then you can run your file on it
You never found fastboot?

And by "Run my file", you mean...

Can you please spell it out for me?

[Rich Hathaway]

the cwe, run it and see if it fixes your problem

[Hogwild]

FDT version: 4.6.2.0
Checking modem mode ...

Firmware download failed.
Primary error code: 82 - Failed in checking modem mode.
Secondary error code: 68 - Received incorrect response.
Total time elapsed: 2562 ms.
Press Enter to continue ...

[Rich Hathaway]

when it was at firmware download did the lines go across the screen like it was sending the file?

[Hogwild]

Unfortunately, No. What I posted is all it displayed.

I do have a copy of QPst, but I have no idea how to use it.

It took me a bit to figure out what you meant by "drag the firmware file to FDT", since FDT wasn't a gui-based program. I did not know MS had implemented some Drag and Drop features to command-line based programs. I tried it and I understand what you meant now.