Unable to flash R7000

[PhAlAnXcOiN]

Just got a brand new Netgear R7000 router. Something new that has crept into these routers is an inability to 'downgrade' firmware versions. For instance, trying to upload the initial .chk file for dd-wrt through the gui will result in 'this firmware is incompatible with your router'.

I have read that others have used nmrpflash successfully to rectify this issue and flash a different firmware. However, I am not having the same success.

I am using Windows 10, have installed npcap and all commands seem to be working fine. Windows firewall is off, comodo firewall and all antivirus, HIPS, etc are all off.
Anything that could interfere such as programs like syncthing, or other syncing or backup programs are exited.

My firmware file which is the dd-wrt initial load file of dd-wrt.K3_R7000.chk found at this page: http://www.desipro.de/ddwrt/K3-AC-Arm/ (renamed to ddwrt.chk) is in same folder with nmrpflash. I have also tried this with stock netgear .chk files that are lower version that I am currently running.

I am running a CMD window with administrator privileges.

This is what i'm doing:

C:\Program Files\Portable Programs\nmrpflash>nmrpflash -L
net0 192.168.1.2 d0:50::::0b (Ethernet)
net1 192.168.56.1 0a:00::::05 (VirtualBox Host-Only Network)

I then turn router off and turn it back on while immediately running:
nmrpflash -i net0 -a 192.168.1.1 -A 192.168.1.2 -f ddwrt.chk -vvv
net0: \Device\NPF_{43AC58E6-0C5F-43B2-**39-**AECB}
Adding 192.168.1.2 to interface net0.
Advertising NMRP server on net0 ... -
Received configuration request from 3c:37::::f0.
Sending configuration: 192.168.1.1, netmask 255.255.255.0.
Timeout while waiting for TFTP_UL_REQ.

For some reason, it times out here after just a few seconds so then i paste it in immediately below and it continues:

nmrpflash -i net0 -a 192.168.1.1 -A 192.168.1.2 -f ddwrt.chk -vvv
net0: \Device\NPF_{43AC58E6-0C5F-43B2-**39-********AECB}
Adding 192.168.1.2 to interface net0.
Advertising NMRP server on net0 ...
Received TFTP_UL_REQ while waiting for CONF_REQ!
Received upload request without filename.
Using remote filename 'ddwrt.chk'.
Uploading ddwrt.chk ... << WRQ(ddwrt.chk, octet)

ACK(0)
<< DATA(1)
ACK(1)
<< DATA(2)
ACK(2)
<< DATA(3)
ACK(3)
<< DATA(4)
ACK(4)
<< DATA(5)
ACK(5)
<< DATA(6)
ACK(6)
<< DATA(7)
ACK(7)
<< DATA(8)
ACK(8)
<< DATA(9)
ACK(9)
<< DATA(10)
ACK(10)

this continues many thousands of lines down, deleted due to redundancy

<< DATA(46409)

ACK(46409)
OK
Waiting for remote to respond.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Received configuration request from 3c:37:::**:f0.
Sending configuration: 192.168.1.1, netmask 255.255.255.0.
Timeout while waiting for TFTP_UL_REQ.

At this point, after a few minutes the router boots up like nothing happened and nothing has been flashed. Any help would be appreciated!

[jclehner]

As mentioned in #13, it appears that the image fails some integrity check, and the device re-requests an upload.

Not sure yet as to why this happens on this device, but it doesn't appear to be a bug in nmrpflash itself.

[jclehner]

As I suspected, this might be related to the image version numbers: the latest official Netgear image uses

1.0.9.64_10.2.64

whereas the DD-WRT image uses

1.0.5.5_1.1.99

Now the bootloader probably notices that the version number of the DD-WRT image is less than the current image, and thus rejects the image. To test this theory, I've modified the dd-wrt image to use the version number 99.0.0.0_99.0.0:

dd-wrt.K3_R7000_mod.zip

[jclehner]

@PhAlAnXcOiN any news on this?

[4lt4n0rd]

@jclehner Can confirm the modified DD-WRT provided flashes fine on stock 1.0.9.64_10.2.64.

Can also confirm it was a breeze to flash to tomato-R7000-1.28.AT-ARM-3.5-140-initial-64K and then upgrade to tomato-R7000-AT-ARM-3.5-140-AIO-64K from DD-WRT web GUI.

[speediedan]

Thanks for your work @jclehner! I've validated this works for me as well on a new R7000 and updated the official wiki for the R7000 to suggest temporary use of this mod until the kong build integrates this fix.
https://wiki.dd-wrt.com/wiki/index.php/Netgear_R7000#How_to_install

[jclehner]

Thanks for the feedback! Closing this, as it's not an issue in nmrpflash itself. I've opened a PR for OpenWRT, that should fix future issues of this kind.

[mozilla2012]

For future people who Google and find this thread:

I was seeing this error:
bind: The requested address is not valid in its context

To fix this, I added these args to my command:
-a 192.168.1.1 -A 192.168.1.2
(Those are the addresses I was using for my laptop and router.)

Then things worked for me. (I also used "dd-wrt.K3_R7000_mod.zip" listed above, but I'm not sure if that was needed.)

[shiecldk]

I also flashed my R6300V2 (Koolshare Merlin 380) with asusR6300V2_back-to-ofw.trx through nmrpflash. The flash did roll back the firmware to the stock Netgear FW. However,I cannot flash any firmware via the Netgear GUI; it complaints "This firmware file is incorrect! Please get the firmware file again and make sure it is the correct firmware for this product." Nor can I flash any thing with nmrpflash; not to mention that ssh cannot be enable with the stock firmware.

Could anyone tell me how can I do flash solve this issue. I think I have tried to put it to tftp mode but looks my R6300V2 only reboots every time I hold the reset button when I power it on.

[jclehner]

@shiecldk Please don't hijack a closed issue, and instead open a new one!