Anyone interested in photos of internals of MR2100 (M2)?

[Hogwild]

Really? No one has any further ideas?

[Renate]

I did not know MS had implemented some Drag and Drop features to command-line based programs.

Ha! I've been doing Windows for 30+ years and I never knew that either.
OTOH, I hate drag-n-drop.

Did you ever get your device to fastboot?

[Hogwild]

Well, who knows what mode I had it in. Rich said I had to hold down power for Factory Boot Mode.

All I found that worked was to hold down reset button during and before replugging power for about 10 seconds until I got alternating red and blue flashing LED. Screen displayed: "Downloading software update".

And I had the following entry in Device Manager under ports:
Netgear QDLoader Port


But again, I held down reset button, not just power, to do this. So ???

[Renate]

But again, I held down reset button, not just power, to do this. So ???

Well, use UsbLog.exe to keep track of the VID/PID of what is popping up.
[url]http://www.temblast.com/windows.htm[/url]

[Hogwild]

Okay. How will knowing that information help?

[Renate]

Okay. How will knowing that information help?

Because you can tell if you're in fastboot quickly and you can differentiate different Qualcomm modes.

[Hogwild]

How will the VID and PID (IF I can see them) tell me that?

[Rich Hathaway]

when in fastboot mode, the only port you will have is an android port, no other ports will be open as the device will be in bootloader so all you have to do is watch your device manager while your trying to get to fastboot.
Most devices will have a black screen when in fb mode, some may show a logo.

[Hogwild]

I tried a few different timings in terms of the reset switch/replugging power combo. All I can seem to get is the same thing I mentioned above.

I had USBView running the whole time, and it displayed nothing at all. I tried unplugging and replugging some other USB devices, and it didn't show anything for them either.

Any idea what else I should try?

[Rich Hathaway]

use device manager its already in your windows machine

[Hogwild]

It looks like I spoke too soon. I have no idea when these entries appeared, but...

[Rich Hathaway]

that is factory download mode it is in and not fastboot.

[Hogwild]

Just as we'd expected. So, any idea why fdt throws the error?

And while I'm asking questions, what exactly does Factory Download Mode expect to be able to download firmware? Does it expect a flash drive with the firmware file connected to the USB port?

[Rich Hathaway]

Just as we'd expected. So, any idea why fdt throws the error?

might be because it is a TF device and they can have their own protocol. just a guess though as I do not have this device.

And while I'm asking questions, what exactly does Factory Download Mode expect to be able to download firmware? Does it expect a flash drive with the firmware file connected to the USB port?

no, not a flash drive, you are dropping or calling up the file so it knows where it is.

You can try Swiflash ( hope Sierra does not ban me for posting this here )

swiflash.zip

and here is a cache of the support page from the sierra developers' forum

source.sierrawireless.com_resources_airprime_software_swiflash_.rar

read it, read the help file, and try to figure it out for yourself I do not use this tool and am not very familiar with it.

That CWE file the guy posted is missing the system and other parts so I am doubting if it
will recover your device anyway, maybe it would.......But for as much effort as you are putting into recovering it, it
might be a better route for you to get another one, then at least you would have what you need to
make a complete recovery file.

[Hogwild]

Ugh. Then it's probably of no use to me.
I tried it anyways, just in case.
I tried:
fdt2.exe -i <filename>
then:
fdt2.exe -f <filename>
(separately of course).

and both times got:

FDT version: 1.0.1902.1
No images to download, exiting FDT2.
Firmware download failed - invalid arguments.


Could the error message be occurring because the Netgear is expecting an .secc.spk file?

[Rich Hathaway]

like fdt, swiflash can deal with both spk/secc and cwe files

[Hogwild]

Any idea what my "invalid argument" is?

[Rich Hathaway]

do it again then copy and paste a snippet here

[Hogwild]

I'm not sure how that would help. That's all that's displayed, there is nothing else.


Has anyone else managed to flash their MR2100 with this firmware?

[Rich Hathaway]

how it would help is to know the exact command you wrote since it is giving you a command error this would be needed to know.

It may load fine on a working device but not recover yours because it is missing a partition that happens to be borked on your device.

[Hogwild]

how it would help is to know the exact command you wrote since it is giving you a command error this would be needed to know.

It may load fine on a working device but not recover yours because it is missing a partition that happens to be borked on your device.

I showed above what I typed. And thanks again for your help this far, Rich.

[Rich Hathaway]

I tried:
fdt2.exe -i <filename>
then:
fdt2.exe -f <filename>
(separately of course).

Friend, if this is what you input then it would not have run at all, it seems to me that if you really want help
you would be eager to answer.
I ask again pls run it and copy and paste the query and result here

[Hogwild]

fdt2.exe -i MR2100-100EUS_23114195_NTGX24_10.19.03.00_00_Generic_06.00_00-field.010_Enc.cwe


FDT version: 1.0.1902.1
No images to download, exiting FDT2.
Firmware download failed - invalid arguments.

FDT usage:

fdt -usbhub [hubnumber] -usbport [portnumber] -json [file name]

-json [file name]
Uses download parameters contained in json file.
Note that if this option is present, all other command-line options
are ignored.
IMPORTANT: All emergency download scenarios must be handled using
this option. They are no longer supported through the obsolete
option -o emergency.

fdt -d [g5k/wpspk] -fd [folder name] -f [file name 1] [file name 2] [file name x] -h -a -v -nsc -multi -timeout [mins] -resettimeout [mins] -prto [seconds] -usbhub [hubnumber] -usbport [portnumber] -mi -impref [Pref 1] [Pref 2] -reset -force -pcie -rdm -noqmikick -freset -nofwdl -epd [seconds] -log [folder]

-d [g5k/wpspk]
Specifies how image preferences information should be retrieved during
an image switching scenario. Must be lower cases. If this option is
omitted, FDT will not change device image preferences.
- g5k: Image preferences information is retrieved from the following
specified FW CWE file and carrier NVU file.
- wpspk: Image preferences information is retrieved from the
following specified SPK file.

-fd [folder to firmware images]
This specifies the folder location of the firmware images. If this
option is omitted, the current folder is used for searching the images.

-f [image file name 1] [image file name 2] [image file name x]
This specifies the image file names (in normal image download).
For multi-image download, list all the image files here.
If this option is omitted, FDT will search for the image(s) in either
the specified folder or the current folder location.

-a Indicate the automated mode. If not specified, FDT requires user
input by pressing the Enter key to continue at the end.

-v Display current FDT binary version.

-nsc No final firmware update status check at firmware download completion.
This option is typically used when downloading an image which is
intended to erase the device.
If not specified, the default is to check update status via QMI.

-multi Allow multiple FDT2 instances to run simultaneously.

-timeout [mins]
Time out in minutes for the total download process.

-resettimeout [mins]
Time out in minutes for the device reset process.

-prto [seconds]
Time out in seconds for the device port removal.

-usbhub [hubnumber]
Restrict devices to this USB hub number.

-usbport [portnumber]
Restrict devices to this USB port number.

-mi Indicate a multi-image download

-impref [Pref 1] [Pref 2]
Image preference setting after a multi-image download.
Image file names are needed for image preference setting.

-nopl Disable persistent logging.

-reset Reset device. If specified, no FW download will proceed

-force Force to download images during image switches

-pcie Indicate PCIe workaround logic is required for the specified device

-rdm Indicate to reset device via DM command

-noqmikick Indicate no QMI kick messages sent to device after resetting device

-freset Indicate using fast reset mechanism when resetting device

-nofwdl Indicate no FW download after device into BOOT&HOLD mode.
FDT resets device back to APP mode once download protocol is detected.

-epd [seconds]
Number of seconds to wait before enabling PCIe interface.

-log [Folder]
Folder location of where FDT2 and corresponding GobiApi logs should be.


Preexisting images information:
Current:
Firmware:
ImageId:
BuildId:
Configuration:
ImageId:
BuildId:
Final images information:
Current:
Firmware:
ImageId:
BuildId:
Configuration:
ImageId:
BuildId:

OEM PRI:

IMEI:

Total time elapsed: 125 ms.


Images downloaded:


Press Enter to continue ...

[Rich Hathaway]

the image name is wrong unless you changed it, that is fdt's current problem

[Hogwild]

I didn't copy and paste it properly here, but it was properly done when trying to execute FDT. Corrected in above post. Maybe FDT requires some other parameters I don't know about.

[Transfluxor]

Deleted

[Transfluxor]

Deleted

[Rich Hathaway]

Guys, why did you even decide that MR2100 can be flashed through FDT?

No one decided it can be flashed via fdt, perhaps you did not read this thread, his device will not boot up
so that tool cannot work here. his device can only boot to factory download mode which is the mode fdt requires to run, and the fact that fdt is used for most other netgear/sierra devices.
You should be careful telling people to delete partitions on their devices because likely some will do it then be screwed.
in this case he has no way to delete it anyway since he cannot pass hello because of no proper loader.

[Hogwild]

Thanks for clarifying that, Rich.

[AKosterin]

fact that fdt is used for most other netgear/sierra devices.

My guess is that the Netgear MR2100 is not based on Sierra Wireless Air Cards.
The first sign is a different firmware structure, it is very different from the firmware of other Netgear MR and AC series devices.
The second sign is a very different set of AT commands, I am attaching a screenshot with the commands found in the modem firmware using IDA Pro. AT commands are similar to the products https://www.wnc.com.tw/ - https://pdfslide.net/download/link/at-c ... ject-name- m14a2am18q2m14q2
The third sign is that the MR2100 is built on SDX24, and Sierra Wireless does not have a single other module on this modem (usually there are some EM series modules).

It seems that for the MR2100 the closest analogue is the Netgear LB1120 (https://forums.whirlpool.net.au/archive/348vl683) and other LB and LM models.
Therefore, I would not use the fdt utility, but would look for some material about restoring Netgear LB and LM, or about restoring WNC products

Also, when analyzing the wnc-fw-upgrade utility built into the firmware, I found the lines “flash_erase /dev/mtd%d 0 0” and “nandwrite -p /dev/mtd%d %s”. Therefore, there is an assumption that the process of updating the MR2100 firmware is much more primitive than that of Sierra Wireless products

[Rich Hathaway]

Thats not unusual at all, Tracfone is very proprietary and most of their devices break away from the norms of other same line/class devices, this is true with their phones and data devices. however they seem to always have some similarities to other same class non TF devices, they are always high security devices, they do not want us getting into them that is for sure, like this one most are fuzed/secure boot enabled devices

I see the partition names would suggest it is not so much a sierra device for instance the fota partition is
"fota" and the other netgear devices are "ntgfota" but they still both use the amazon server.

you can see it for instance use the OPENADM challenge like the other MR class devices.

at cmds.PNG

I have not had this device before I am sure at some point ill get one to play with.

Anyways I do not have the utility you reference to share with this guy that is trying to recover his device.
I did make a reloadable system file for it which is why I was trying to guide him to find fastboot mode so he could load it and see if it helped.
it is likely that the factory firmware tool or pst is on the amazon server with the firmwares for it, but tracfone files on the amazon server those buckets are always closed.

[AKosterin]

I have not had this device before I am sure at some point ill get one to play with.

Anyways I do not have the utility you reference to share with this guy that is trying to recover his device.
I did make a reloadable system file for it which is why I was trying to guide him to find fastboot mode so he could load it and see if it helped.
it is likely that the factory firmware tool or pst is on the amazon server with the firmwares for it, but tracfone files on the amazon server those buckets are always closed.

I also don’t have an MR2100, and I probably won’t ever buy one - there’s no point in it.

Utility in the attachment. But knowing the AES ECB encryption key. Having the firmware that I already posted. Using binwalk, you can pull out the entire system and find the wnc-fw-upgrade utility itself.

If you know the format of the file name of the factory firmware or other important artifacts, then in theory I can try searching on the Netgear Update servers. After all, I got the firmware itself from there

[Hogwild]

Thanks for that. I'm not too technical when it comes to these things, so...would the filename be something a bit cryptic or something more intuitive-sounding?

If it's something that's intuitive, here's some text grabbed from a screenshot of SOMEONE ELSE'S TLAUS version of the router. (Since mine doesn't boot, I can't get this data from mine).

Firmware Version
NTGX24J 0.13.05.00
Modem Version
SDX24J 0.21.00.02
GUI Version
MR2100-1 TLAUS_04.03.00.07
PRI Version
02.10
Firmware Build Date
2019/05/14


And BTW, what is tracfone? When I Google it, search results show it as a wireless carrier. So I'm not clear how that relates to this. They don't sell this model of router, so what's the connection, or is another company/technology?

[Renate]

Tracfone is the crappy "burner" phones used by drug dealers.
You can pick them up very cheaply so it would be a good supply for experimenters if they didn't make the security hard.

[Hogwild]

I don't understand...is the wnc-fw-upgrade something you're suggesting I could use to restore my hotspot that doesn't finish booting?

[Hogwild]

Here are some more photos of the PCBs, underneath the cans.

I wasn't able to remove the can to the left on the top (label) side of the PCB.
Is there somewhere that looks like it might be a serial interface (since I was previously unable to get any data using the four large copper pads.

Thank you to Renate, who suggested a dental scaling tool to remove the cans.

[Renate]

Is that a battery connector near the 4 copper dots?
It's probably the same then.

It looks like a 10 pin JTAG connector (unpopulated) at the bottom center of the first photo, to the left of ethernet.

[Hogwild]

Counting the ones that are closely together, I count only 9 pads. Am I missing something? Does it matter?

[BillA]

Counting the ones that are closely together, I count only 9 pads. Am I missing something? Does it matter?

I'm only seeing 8 pins, the layout looks like a JTAG contact of some sort.

[Hogwild]

Oops! Yes, thanks Bill, it is indeed 8 pins.

While prying off the cans, I accidentally removed one of these brass tab things.

Can anyone tell me what is its purpose by looking at the PCB photos?

I'm used to soldering larger through-hole components. If I wanted to resolder it, how would I do so when it covers the solder pad underneath it, with seemingly no overflow of solder? Would I have to use a heat gun/rework station? I ask because I don't have one.

[Rich Hathaway]

Those are usually for the antennas that are either on the midframe if it has one or the outer frame

[BillA]

Oops! Yes, thanks Bill, it is indeed 8 pins.

While prying off the cans, I accidentally removed one of these brass tab things.

Can anyone tell me what is its purpose by looking at the PCB photos?

I'm used to soldering larger through-hole components. If I wanted to resolder it, how would I do so when it covers the solder pad underneath it, with seemingly no overflow of solder? Would I have to use a heat gun/rework station? I ask because I don't have one.

As long as the pads are not ripped off the circuit board, you should be able to resolder the antenna contacts either with a fine soldering tip and a bit of Chip-Quik solder to lower the temperature, or a hot air station. Just need to be careful to avoid the solder getting sucked into the contact, preventing it from making good contact.

[Renate]

I'm only seeing 8 pins...

I count only 9 pads.

1 2 3 4 5 6 7 8 9 10!

[Hogwild]

Thanks Renate....I love the count.

To that I reply....BRRRRRRING. Phone? Phone. Yup yup yup yup yup.

But you forget what a newbie I am. So, if I try to perform a JTAG at some point, do I connect to those 10 solder joints, or the 8 copper pads?

[BillA]

Thanks Renate....I love the count.

To that I reply....BRRRRRRING. Phone. Phone? Yup yup yup yup yup.

But you forget what a newbie I am. So, if I try to perform a JTAG at some point, do I connect to those 10 solder joints, or the 8 copper pads?

Usually JTAG uses contact pins for quick programming (not solder joints), course there's always exceptions.

[Renate]

If you had a connector soldered in and the 10 pin out of your interface matched it's a straight connection.
Otherwise you need to tack on single wires to the pads.
Usually a 10 pin JTAG connector is 2 x 5 in either 100 mil or 50 mil pitch.

[BillA]

If you had a connector soldered in and the 10 pin out of your interface matched it's a straight connection.
Otherwise you need to tack on single wires to the pads.
Usually a 10 pin JTAG connector is 2 x 5 in either 100 mil or 50 mil pitch.

That's possible too. On the main board of phones there are usually contact pads without the need for soldering.

[Hogwild]

If you had a connector soldered in and the 10 pin out of your interface matched it's a straight connection.
Otherwise you need to tack on single wires to the pads.
Usually a 10 pin JTAG connector is 2 x 5 in either 100 mil or 50 mil pitch.

I don't know anything about this subject. So, do I just assume the pinouts will be correct based on the pattern in which they're located on the board?

[seloka190]

any recommanded of compatible uart jtag tool
from aliexpress exemple...

[BillA]

any recommanded of compatible uart jtag tool
from aliexpress exemple...

It's not just the JTAG interface that's needed, but the proper loaders specific to each device.
Simply having a hammer, you can built a house without all the constructions materials. heh

[seloka190]

what about qtools
anyone try it with netgear ?

[Hogwild]

any recommanded of compatible uart jtag tool
from aliexpress exemple...

It's not just the JTAG interface that's needed, but the proper loaders specific to each device.
Simply having a hammer, you can built a house without all the constructions materials. heh

I'm not too knowledgeable about this, but I believe what you said is true...to fix it. To only see where the boot process stops, I believe a USB-serial interface will do (if you can get it working).

[Rich Hathaway]

what about qtools
anyone try it with netgear ?

Qtools requires a signed or properly patched loader to work.
There is/are no known or leaked loaders beyond SDX20 for these devices so we
are stuck with fastboot for now.