Linksys E4200 Serial Pinout

• Linksys E4200 Connect Software
• Linksys E4200 Serial Pinout Connector
• Linksys E4200 Serial Pinout Diagram
• 9 Pin Serial Pinout
• Linksys E4200 Software

Linksys E4200 Appendix C: Specifications Security Key Bits Up to 128-Bit Encryption Appendix C: Specifications Environmental Model Name Linksys E4200 Dimensions 8.86' x 0.98' x 6.30' (225 x 25 x 160 mm) Description Maximum Performance Wireless-N Router Unit Weight 12.52 oz (355 g). Linksys E4200 v2. For a few years now, I’ve been using a Linksys E4200 v1 router (running DD-WRT) as the main router at my house. However, because the WiFi signal from the router isn’t strong enough to reliably reach all the rooms in the house, I picked up a few inexpensive Belkin F7D3302 / F7D7302.

10 PCS, 10cm x 10cm, 2 layers prototype for $38.80 shipped!

• 2Router Basics
• 3Using JTAG Cable to Repair Bricked Router

Buy various JTAG cables for your Satellite Receiver, Cable Modem, Wireless Router, Standard Wiggler from http://www.easymg.com and http://www.diygadget.com

In this tutorial, I am going to show you how to debrick your router using DIYGADGET's dedicated JTAG cable for routers (solderless way).

Before you try to JTAG your router, we highly recommend you to try a few other steps before you JTAG your router.

Things need to try before you JTAG the router

Please read carefully on this article:

If you have tried everything before the section 'Recovery by JTAG cable' and it still doesn't work, you can now proceed with the following tutorials on how to save your router by using DIYGADGET's JTAG cable.

You need a PC with parallel port. USB to parallel adapter will NOT work.

No USB port? no problem, use our USB JTAG:

Tutorial (debrick router using USB):

Router Basics

I think it is very important to introduce some router basics before we get started. Because we are going to work on these stuff later on to save your router.

You probably already heard of terms like, NVRAM, CFE, FLASH ect. So what are they?

NVRAM

NVRAM stands for nonvolatile RAM. It can hold its contents when the main power source is lost. You may even know this type of memory as static RAM (SRAM), Broadcom based router uses NVRAM to store the startup configuration file. Most bricked routers are caused by a wrong configuration file.

Kernel

The kernel is the central component of router. Its responsibilities include managing the router's resources (the communication between hardware and software components).

A corrupted kernel can also brick a router. The kernel is stored in the onboard FLASH chip.

Common Firmware Environment (CFE)

CFE stands for Common Firmware Environment. The Broadcom Common Firmware Environment (CFE) is a collection of software modules for initialization and bootstrap of designs incorporating Broadcom MIPS64™ processors. CFE is used to bootstrap the OS.

On startup, CFE performs the following low-level initialization:

1. Reset and ROM trap handler vectors
2. CPU and FPU initialization
3. L1 and L2 Cache initialization
4. Multiprocessor initialization
5. Memory controller initialization
6. PCI and LDT bus configuration
7. Environment variables
8. Console device initialization
9. Bootstrap device initialization

Corrupted CFE is an uncommon reason for a bricked router. But it could happen.

Using JTAG Cable to Repair Bricked Router

If you have read this far, it means the only way to debrick your router is by using a JTAG cable. Sorry to hear that! However, don't worry, the steps are really straightforward!

DIYGADGET's Router JTAG Cable

The is the schematic of the JTAG cable:

This is the JTAG pinout of the Linksys WRT54G(GS/GL) series routers:

Linksys Series Routers JTAG Pinout

DB25	Router	Function
2	3	TDI
3	9	TCK
4	7	TMS
5	1	TRST (Not Connected)
13	5	TDO
18-25	2,4,6,8,10	GND

The PCB Layout of DIYGADGET's Router JTAG Cable:

The internal construction of DIYGADGET's Router JTAG cable:

Disassemble WRT54G/GS/GL) Series Router

There are no screws on the Linksys WRT54G/GS/GL) Series Routers.

Unscrew the antennas from the back (you may need to slide back the antenna caps to unscrew the antennas):

There is no screws to hold the faceplate. Turn the unit upside down and place your hands between the feet on the side, then push on the blue feet with your thumbs, the faceplate and the back cover are off now:

Now the face plate is off, you can see the board now:

Locate the JTAG Pins/Pads on the Router

The WRT54G(GS/GL) series routers have the standard JTAG pads on the PCB, It's the JP2 on the pcb as shown in the following pictures:

The Softwares

The initial version of the utility is the very famous HairyDairyMaid Debrick utility. You can get it from here:

[HairyDairyMaid Debrick Utility]

However, we recommend to use [TJTAG] program which includes the Newer Router Models.

1. Download [TJTAG] program and unzip it to a temp directory on your harddrive.
2. Copy the giveio.sys and loaddrv.exe to C:windowssystem32drivers for XP or C:winntsystem32drivers for 2000.
3. Double click loaddrv.exe in the system32 dir.
4. Append the giveio.sys onto the path in the utility:
   Load Drv
5. Click the load button and then the start button, they should both confirm success. If this does not happen go no further, go back and fix this. You need to make sure this works first.

Leave the loaddrv.exe running.

Making The JTAG Connection

This is the exciting part of this tutorial. If your router (like the Linksys WRT54G series) already has the standard 12 pin JTAG pads on the PCB, you mostly like do NOT need to solder wires on your PCB! DIYGADGET provides solderless solution for these routers.

This is what you will receive in your purchase. In this package, you will receive a Router JTAG cable, a 12 PIN header and 6 solderless pins. The solderless pins are provided for solderless operation:

The 12 PIN header is for peoples who have the skills soldering on PCB. All you need to do is solder the 12 pin headers on the JTAG port of the router, and then connect the JTAG Cable's black header on the 12 pin header you just soldered on the pcb. Make sure pin 1 of the cable is connected to pin 1 on the board. The pin 1 of the cable can be identified by a little triangle on the black header. Pin 1 on the pcb is marked.

In this tutorial, I will show you how to make the connection using the solderless pins.

We only need 6 solderless pins for the connections because JTAG only uses 6 pins. From the schematic above, we know only the following pins on the 12 pin headers are used: 3, 5, 7, 9 and GND.

Let's carefully insert the solderless pins into the 12 header's 3, 5, 7, 9 and 6 (WRT54G/GS/GL's 2,4,6,8,10 are all grounds and they are all interconnected on the PCB. The wire 6 is the only GND wire of the header so make sure you insert a solderless pin in hole 6 not 2, 4, 8, 10 or 12):

(I also insert a pin into 1, it is optional)

Top view:

Now, let's see how we make the connection. Put the spring loaded solderless pins on top of the JTAG pads, align the pins with the pads, make sure all 6 pins are connected to the corresponding pads. Give it a little pressure, you will feel the little resistance. The pins are spring loaded with crown headers, so if you give it a little pressure and it will 'clamp' to the pads and won't move at all. Try it!

Before we try to 'permanently' attach the pins to the pads, let's make sure other connections are finished.

Linksys E4200 Connect Software

1. Connect the power adapter to the router's power input, but DO NOT attach the transformer to the wall outlet yet.
2. Connect the network cable to one of the LAN port and another end of the network cable to your PC.
3. Connect the DB25 side of the JTAG cable to your PC's parallel port:
   Plug the DB25 side of the cable to your PC
4. Carefully put the pins on top of the JTAG pads, then put a book or something heavy on top of the header, so the spring loaded pins will stay connected with the pads and you do not have to hold the headers any more. In the example, I used a digikey catalog on top of the header:
   A book on top of the header, so the pins don't move

This is the whole setup:

Debrick it!

Let's debrick your router!

1. Attach the router's power adapter to the wall outlet.
2. From the command prompt cd to your unzipped TJTAG's windows directory and run tjtagv2.exe to get a list of options.
3. To check your cable, run command tjtagv2.exe -probeonly. It will automatically detect the CPU type (see pic below for an example of LINKSYS WRT54GS). If not then check your cable.
   Probe Only Output
4. Backup NVRAM (command tjtagv2.exe -backup:nvram):
   Backup NVRAM
   . It took 32 seconds to backup my WRT54GS' NVRAM.
5. Backup CFE (command tjtagv2.exe -backup:cfe):
   backup CFE
   . It took 60 seconds to backup my WRT54GS' CFE.
6. Backup the whole flash (command tjtagv2.exe -backup:wholeflash):
   Backup whole flash
   . It took 1931 seconds (or 33 minutes) to backup my WRT54GS' whole flash.
7. Try above steps at least 2 times, generate backups again, then use a binary comparison software to compares the backups, make sure they are exactly the same before you erase anything.
8. Finally to erase your NVRAM (the usual cause of the problem) with command tjtagv2.exe -erase:nvram
9. If that doesn't work, erase the kernel (firmware): tjtagv2.exe -erase:kernel, then reflash the kernel via TFTP. This is a very good tutorial on how to flash your router with TFTP: [TFTP Flash]
10. If it still doesn't work, try to find a CFE for your router (make sure model/version matches) first. Here are two repositories of some router's CFE: [CFE collection project] and [CFE collection 2]
11. The CFE bin files in the repository all have MAC addresses that DO NOT MATCH your hardware. Use the CFE editing tool 'IMGTOOL_NVRAM' available from The [Bitsum Wiki] to set the et0macaddr and il0macaddr before uploading the CFE. et0macaddr is the address printed on the outside; il0macaddr is that same address, plus one. Example: If the printed address is 00:90:4d:83:00:01, then et0macaddr is 00:90:4d:83:00:01 and il0macaddr is 00:90:4d:83:00:02. These are HEX numbers, so HEX 09 plus one is 0A, not 10.
12. Erase the CFE of your router and flash the working CFE back. tjtagv2.exe -erase:cfe will erase your router's CFE and tjtagv2.exe -flash:cfe will flash the CFE back to your router. Remember to use the modified CFE bin.

Non Linksys Routers

If your router doesn't have JTAG headers or pads, but if it has JTAG enabled, you can still debrick it using the above technique. However, it is very likely you will need to solder the wire on the board.

For a collection of the JTAG pinout of other routers, please take a look [Router JTAG pinouts].

You can cut the DIYGADGET's JTAG cable, solder wire 1, 6, 3, 5, 7 and 9 of the 12 pin flat cable to your router's TDI, GND, TDO, TMS, TCK respectively. You can check the schematic above for details. (Make sure use wire 6 of the 12 pin flat cable for ground. Wire 6 is the only GND line in the 12 pin flat cable, it connects to the DB25's 18-25).

Linksys E4200 Serial Pinout Connector

Buy various JTAG cables for your Satellite Receiver, Cable Modem, Wireless Router, Standard Wiggler from http://www.easymg.com and http://www.diygadget.com

10 PCS, 10cm x 10cm, 2 layers prototype for $38.80 shipped!

Manuf (OEM/ODM):CyberTAN

FCC approval date: 20 October 2010
(Est.) release date: 19 January 2011
UPC: 745883590438 (UPC DB, On eBay)
Country of manuf.: China
Serial Num Prefix: 01C10C

Amazon image
ASIN
B004K1EZDS (, On Amazon, On CCC)
multiple revisions of this device, use caution

FCC ID:Q87-E4200
IC ID:3839A-E4200

CPU1:Broadcom BCM4718A1(480 MHz)
FLA1:16 MiB16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br /> (Winbond W25Q128BVFG)
RAM1:64 MiB67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br /> (Winbond W9751G6JB-3)

WI1 chip1:Broadcom BCM4718A1
WI1 802dot11 protocols: bgn
WI1 MIMO config: 2x2:2
WI1 antenna connector: none
WI2 chip1:Broadcom BCM4331
WI2 802dot11 protocols: an
WI2 MIMO config: 3x3:3
WI2 antenna connector: U.FL

ETH chip1:Broadcom BCM4718A1
Switch:Broadcom BCM53115
LAN speed: 1G
LAN ports: 4
WAN speed: 1G
WAN ports: 1

Additional chips
2.4GHz Power Amplifier IC;Skyworks;SE2528L;SiGe, 2528L, 108EC;2;
2.4/5GHz Front End Module;Skyworks;SE2594L;SiGe, SE2594L, 109HD;3;

Stock FW OS: Linux

TPFirmware supported:DD-WRT • (List), Tomato (Shibby) • (DLs) • (List), Tomato RAF (Victek) • (DLs) • (List)

Default SSID: CiscoXXXXX (6 addl. devices)
Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1214 additional devices
of which 149 are Linksys devices
Default login user:blank
Default login password: admin
blank:admin credentials used by 285 additional devices
of which 142 are Linksys devices

802dot11 OUI:58:6D:8F(8 E, 8 W), C0:C1:C0(12 E, 14 W)
Ethernet OUI:58:6D:8F(8 E, 8 W), C0:C1:C0(12 E, 14 W)

CPU1 brand	WI1 chip1 brand	WI2 chip1 brand
Linksys E4200 v1	Broadcom	Broadcom	Broadcom
Linksys E4200 v2	Marvell	Marvell	Marvell

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.

Maximum Performance Dual-Band N Router

• Support page • (Template link outdated)

'3763-40700105R' and the Cisco logo is silkscreened on the board.

This router uses Galtronics antennas.

Note: Three antennas are used by the 2.4 GHz radio, but it's still a 2T2R radio..

Linksys E4200 Serial Pinout Diagram

The default SSID pattern for this device is CiscoXXXXXX on both bands,

where XXXXX is the last 5 characters of the serial number.

Wi-Fi Certified(alt.) (as of 10/18/2010)

Additional external links

Wikis

Reviews

Forum threads

The v1 serial numbers appear to start with 01C10C..

Firmware projects

This device is supported by...

• Victek's Tomato RAF builds
• Shibby's Tomato builds (K26 and K26RT-N)
• Toastman's Tomato builds

9 Pin Serial Pinout

Images

• from Cisco

• angled unit

• angled front

• top

• front

• back

• box

• internal

• board top

• board top, shields off

• over the BCM4331

• BCM4331 w/ top shield off

• ...and closer up

• CyberTAN P/N, RAM, etc.

• RAM

• antenna and Flash

• 5GHz RF section

• 2.4GHz RF section

• BCM53115 GbE Switch

• L side, top view

• R side, top view

• L side, over top (angled)

• L side, angled internal, over top (angled)

• L side, front, over top (angled)

• L side, antenna view

• R side, angled back, over top (angled)

• R side, angled front, over top (angled)

• back side, angled top view

Linksys E4200 Software