Is there a way to fix bricked router?

Question

I got a bricked UBNT EdgeRouter X router. It was bricked while changing the firmware using SSH. Then when I was trying to unbrick it using UART - the 3v3 router pin was connected to 3v3 UART.

Now router's 3v3 pin is giving 0.0 voltage. But router's LEDs are still working in case I power on or connect and disconnect patch cords.

I tried to connected it using

• TXD↔RX, RXD↔TX, GND↔GND
• and TXD↔TX, RXD↔RX, GND↔GND.

I used PuTTY, tried to connect using the COM number that I get from Computer>Manage>Device Manager. Baud rate 115200, Data Bits 8, Stop Bits 1, Flow Control None.

And in both cases I get blank PuTTY window.

Is there a way to fix it? If I give router to a service center they will be able to fix it?

Answer 1

You didn't say exactly what you did via ssh that "bricked the firmware".

Most routers have different parts for the firmware. The first stage is a comparatively simple, often uboot. This first-stage then loads the real firmware as second stage. Googling seems to confirm that UBNT EdgeRouter X uses uboot.

So if you didn't destroy uboot by whatever you were doing, you should be able to use the uboot recovery mode (google).

If you did destroy it, there's probably nothing you can do. The lessen to learn then is that when doing a firmware upgrade, you always upgrade the "proper" (second-stage) firmware only. And before you do it, you have a good look at what part of the flash ROM contains which kind of information.

Edit

As there seems to be some confusion about this, let's sort out serial/UART vs. JTAG.

Looking at the OpenWRT page for the router, one can see the UART/serial connection in the following picture:

This will provide a serial console to the device, which needs a working firmware, e.g. uboot. If uboot is already running anyway, there's no advantage in using the serial console over using the network console in recovery mode (unless this doesn't work for some reason). And the network console doesn't need additional hardware, like the wires one needs to connect to the serial port.

The chipset also seems to have a JTAG port, though I haven't found any indication where it is on the board. The standard JTAG header has 20 pins, in the picture one can see room for a header (not soldered) with 14 pins, which may contain some of the JTAG pins (or may be something completely different). There also may be no unsoldered JTAG header at all, and it would be necessary to get the JTAG signals directly from the main chipset.

With JTAG, it's possible to also flash the first-stage bootloader, but to do that, one needs special hardware that understand the JTAG protocol. A simple serial connection won't do.

When having the choice between buying JTAG-protocol hardware, and buying a new router, buying a new router usually is cheaper. Unless one plans to do a lot of hacking in the future using JTAG.