Recovery of BEFSR41 v2 Router (Pin Short Trick) - Simplified     2011/06/14
by CW Cyrix/Ami Sapphire


Table of Contents

  I. The What Is and What For
 II. Now, the instructions!
III. Notes

----****----

I. The What Is and What For


This trick is a variation of the WRT54G series flash chip pin trick.

It can be used to recover:
* from Bad Firmware Flash (which usually results in a blinking DIAG light, but
  instead results in a solid DIAG light)
* in hopes of recovering a bricked/near dead router (solid DIAG light)

Although, I think the chances of recovering the router when it is near death is
slimmer than bad firmware, in theory.

This may not help the ones that got rid of their routers years ago due to this
issue, but it may help the ones, especially me, that kept their routers for
years and still have a use for them... somehow.


Other things cause the router's red DIAG light to go solid:

* leaky/failing/failed capacitors (YOU MUST GET THESE REPLACED FIRST)
* bad AC adapter/power brick (use another if that is the case)
* brownouts (this may lead to internal failure or firmware corruption)

References:
http://www.askmarvin.ca/forums/index.php?showtopic=5977
http://www.dslreports.com/forum/r5295144-BEFSR41-Solid-Red-Diag-Light
http://www.badcaps.net/forum/showthread.php?t=4784
http://www.tek-tips.com/viewthread.cfm?qid=540955&page=20

----****----

II. Now, the instructions!


*Copied from DD-WRT's Wiki*
WARNING - This method can cause permanent damage. Success rate is only about
20%. The other 80% is permanent damage to the flash chip rendering the router
permanently inoperable. Use at your own risk. You've been warned.

*my text*
Honestly, it's either this method or a good JTAG kit that would cost upwards
500 USD and ongoing.


Steps:

 1. Set up a static wired network connection on the computer.	   

 2. Ping the router continuously.

 3. Unplug the router, if already plugged in.

 4. Disassemble the router.

 5. Plug in one end of your Ethernet cable in the computer and the other end in
    the router PCB.

 6. Short pins 1 and 2 on the flash chip [see diagram below] using a small
    flat head screwdriver to connect them together. Hold it there.
    a. It is located on the very right of the PCB, next to the CPU, rotated 90
       degrees clockwise. It has a notch on the top left corner. The Xs are the
       designated pins.


          4  3  2  1  32 31 30
         _=__=__X__X__=__=__=_
        /                     |
     5 =|                     |=29
     6 =|                     |=28
     7 =|                     |=27
     8 =|       ROUTER'S      |=26
     9 =|         PLCC        |=25
    10 =|     FLASH  CHIP     |=24
    11 =|                     |=23
    12 =|                     |=22
    13 =|                     |=21
        -----------------------
          =  =  =  =  =  =  =
         14 15 16 17 18 19 20


 7. Plug the router back in. You should get a blinking DIAG light. That means
    it is in fail-safe mode. Look at the command prompt or terminal. You should
    see pings. If not, try again.

 8. Use a TFTP client to upload a good firmware to the router.

 9. Wait a minute, then attempt to access the admin management screen using
    192.168.1.1. If you can access it, you have succeeded in reviving your
    BEFSR41 v2 router!

----****----

III. Notes


The defaults for this router:
Address: http://192.168.1.1/
Username: (blank)
Password: admin

The defaults for a static connection for your computer:
Static IP: 192.168.1.x (where x can be a range from 2 to 253)
Subnet mask: 255.255.255.0 (Linux can use either that or 24)
Gateway: 192.168.1.1 [optional]