NMRPflash R8000P TFTP Transfer Not Working, File Size Too Large

[scrubmcnoob]

I've been using your NMRP tool to try and unbrick a Nighthawk R8000P router with it. Unfortunately, all the firmware file sizes exceed 32mb and I keep getting block rollover issues. Even though it finishes rest of the prompt in the nmrpflash console, it only makes the power light go from solid amber to blinking amber. And after reset, it goes back to its bricked state of turning on and off. https://www.netgear.com/support/product/R8000P.aspx#download

I was wondering if it would be worth a shot to use firmware from R8000 as some is under 32mb. https://www.netgear.com/support/product/R8000.aspx#download

Unfortunately, I ran into 'Ignoring Extra Upload Request' as its firmware from a previous model. However, I noticed you were able to present an older firmware version as new. https://github.com/jclehner/nmrpflash/issues/84

Surely it's not just a name change of the file? I've tried that and did not work. Would you be able to take a R8000 firmware under 32mb and spoof it as a R8000P firmware file? I'm not at all concerned of bricking this router anymore than it is; its braindead as far as I can tell right now. The reset button is completely unresponsive.

Thanks.

[jclehner]

Even though the similar model names might lead you to believe otherwise, flashing the image from a different router isn't going to work. It looks like you're in luck though, as there's an OpenWRT image for your device, which is less than 12 MiB in size.

For some reason though, they only provide a plain binary file, not a .chk image. You can download the latter here (I've set the version to 99.99.99.0_0.0.0).

[scrubmcnoob]

Thanks for the reply.

Unfortunately, I'm getting stuck at 'Ignoring extra upload request' using your file.

However, when I use the files from the netgear website it will go through the whole process. I will get a block rollover warning, obviously, but it will finish the entire nmrp sequence and prompt me to reboot my router. And my router power light actually does start blinking orange again, so clearly the program can interface with the router or affect it in some way. Been using R8000P-V1.4.2.84_1.3.42.chk, the latest.

Would it be possible to set that image to the same file version as the one on the netgear website? That may be able to spoof the router and let it upload. Thanks again for the help.

[jclehner]

Have you tried leaving the router turned on, after flashing the official firmware image? Some devices tell nmrpflash that they're finished before actually flashing the image. Try flashing the Netgear image again, then leave the router turned on for 10 minutes or so. Does the LED pattern change? Is it still bricked after a reboot?

It seems that the TFTP block rollover isn't the actual problem in your case, as the file is flashed successfully.

[scrubmcnoob]

I flashed, got the blinking orange light, and left it for thirty minutes. Didn't touch the console or anything else. Didn't notice any changes to the blinking pattern of the orange light and the one connection light stayed a solid white after it was done flashing.

Still braindead after rebooting. Boots up and then continues the lobotomized process of turning itself off and on, repeating.

I guess I was under the wrong assumption for block rollover, I assumed it was going fail regardless because the file exceeds the allowed 32mb of tftp, and only a partial upload was being done to the router. I assumed this partial upload was leaving the router thinking it got flashed, setting it to its reset blinking state but then being braindead after restart because the whole file is not there.

The most annoying part about this situation is I installed the router for a customer, set it up, everything worked fine, and then a day later it became braindead. There wasn't any storms that I know of, nor physical damage to it. The only thing I can imagine is I had to setup the modem through the ISP's app to allow the router and maybe it tried patching something through? I doubt it though, most likely just very unlucky timing of something going bad inside the router.

Regardless, do you have any recommendations? I'm still don't fully understand the 32mb limitations of TFTP and why the block rollover won't be an issue. Is it not prudent to try the OpenWRT image with the latest spoofed version listed on the netgear site?

[jclehner]

I'm still don't fully understand the 32mb limitations of TFTP

By default, TFTP transfers data in 512-byte chunks. Being UDP, these chunks don't necessarily arrive in their correct order, so each packet also includes a 16-bit index. Since index 0 is used for acknowledging the read/write-request, this theoretically limits the transfer size to

512 B * (2^16 - 1) = 33553920 B = 31.9995 MiB

There's an extension to TFTP that allows for negotiating a larger block size (which nmrpflash tries to), but I have yet to see a bootloader that actually implements this.

... and why the block rollover won't be an issue.

This depends on the bootloader's TFTP implementation. If the rollover is being gracefully handled, the transfer size is unlimited, regardless of the block size.

Is it not prudent to try the OpenWRT image with the latest spoofed version listed on the netgear site?

I just noticed that I made a mistake when creating the last image, so it couldn't have worked. I've attached a ZIP containing the latest OpenWRT image, with the version set to V1.4.2.84_1.3.42.

[scrubmcnoob]

Well the image successfully copied over but unfortunately, the router now shows no power light and only a white light for which ever port has an ethernet cable connected after reboot. And tried hooking it up to the modem to double check, no signals/ethernet still.

And I can no longer flash it as nmrp is having trouble getting a good connection now. Getting timed out during advertising/can't find an IP address. I think I'll just write this off as the board being defective within the router.(I even got another power cord to make sure the cord wasn't the issue originally) A shame, never had any issues with netgear but it seems this model has had plenty of help tickets online asking similar questions; most end with the customer returning on warranty.

Unless you have any suggestions, I think my question is mainly resolved. Will definitely be sure to avoid this model/get extended warranties on future netgear routers. Thanks for your time, hope others have better luck with their routers.

[dutuka]

I tried to flash the .chk image file jclehner provided but it bricked my R8000P, same like scrubmcnoob. I can unbrick it by following the tutorial here: https://community.netgear.com/t5/Nighthawk-WiFi-Routers/R8000P-V1-4-1-50-Update-workaround/m-p/2201116 Since the image jclehner provided is not working, please remove it from here to avoid damaging futher devices.

[jclehner]

@dutuka thanks for that link. I've now made -t 10000 the default, which from the posts I gathered was the culprit. Can you verify that the newest release (0.9.17) works without the -t and -T options?

[dutuka]

@jclehner the version i used is 0.9.16, if my router is not bricked, i can use this command to flash and it worked: nmrpflash.exe -i net6 -f firmware.chk As my router was bricked, it did not work for me, but this command: nmrpflash.exe -v -i net6 -f R8000P-V1.4.2.84_1.3.42.chk -t 10000 -T 10000

I tried the first command many time without success, then i switched to the second and it worked after many many tries. Im not sure, if the -t -T was the key or the timing (few seconds after turning on).

[dutuka]

@jclehner is there a way to flash .w firmware on the R8000P? I tried to flash this image with NMRPflash but it did not change anything, it is a fork from Asuswrt-Merlin.

R8000P_R5.1.8_30044-g0b79964_cferom_squbi.w