The black arrow points at the two pins that will need to be shorted

How to Unbrick a Netgear WNDR3400 N600 Router after a Bad DD-WRT Flash 29


I’m going to start out this blog post by saying you should NOT do this. I repeat: do NOT do this. There’s at least a 50/50 chance that if you try this, it won’t work and you could potentially fry your router beyond the point of recovery. You might even start World War III, instantaneously deplete the ozone layer, bring Hitler back to life, and kick off the Apocalypse… all at the same time.

Seriously. Super bad things could happen if you try this. There are far more reliable ways of recovering a bricked router (like using a JTAG or serial cable, for example) that will give you a 100% chance of a successful recovery without toasting your router. I want to get that out in the open right now so that you can’t whine in the comments if you try this and ruin your router. If you do, it’s your own darn fault. You have been warned.

Now, with that all said, I ignored all those warnings and recovered my bricked Netgear WNDR3400 N600 router this week in a few short minutes by shorting two pins on the control board with a tiny jeweler screwdriver.

How did I brick it? It’s a funny story, actually. OK, not really. I had flashed a “mini” trailed version of DD-WRT on the Netgear N600 WNDR3400 router, and was attempting to flash a later “mega” NV64K build of DD-WRT onto it… but apparently the mega build was too big, and I bricked it. So I stumbled across this post by JuanPedro012 on the DD-WRT forums (apparently all of the usernames between JuanPedro001 and JuanPedro011 were already taken?) who described how he also threw caution to the wind and pin-shorted his Netgear WNDR3400 and recovered it. Here are my instructions based on his, with some additional explanations and “safety” measures (even though this isn’t really “safe” for your router).

  1. Download the two files you’ll need onto your computer (I used a laptop): the stock Netgear firmware for the router from http://www.downloads.netgear.com/files/WNDR3400-V1.0.0.34_15.0.42.chk and the TFTP2 utility (for Windows) from http://www.shadowsoftware.net/shadowgameworld/downloads/tftp2.exe
  2. With the power cord unplugged, open the router by removing the rubber feet from the four corners on the bottom, then use a small Torx screwdriver remove the four screws under the feet, as well as the two screws in the middle (six screws in total). Here’s what it looks like all opened up:

    Netgear WNDR3400 router open and ready to be pin-shorted

    Netgear WNDR3400 router open and ready to be pin-shorted

  3. Connect an Ethernet cable from the laptop to one of the router’s LAN ports (don’t use the WAN port).
  4. If using a WiFi network, disable the WiFi adapter on the laptop so that your wireless network IP settings don’t interfere with the local wired connection to the bricked router.
  5. Configure the local network adapter on the laptop to a Static IP of 192.168.1.25, Netmask 255.255.255.0, and Default Gateway of 192.168.1.1.
  6. From a command prompt, type ping -t 192.168.1.1 (which will show the laptop attempting to repeatedly ping the bricked router)
  7. Plug the router in and press in the power button on the back. Watch the command prompt and note that immediately after a specific LED light on the board starts blinking (like it’s sensing network traffic), you’ll see three successful pings at the command prompt before getting the “Destination host unreachable” message again. This small window of opportunity during those three successful pings is when the ping short must be completed. Leave the power cord plugged in, but use the power button on the back of the router to turn it on and off a few times while watching the LED blinking light and corresponding pings, just to get a feel for the timing.
  8. Locate the two pins closest to the front of the router on the chip designated by the black arrow in this picture from JuanPedro012 (you can click the image for a higher-res version):
  9. With the router turned off, use a tiny screwdriver (or other piece of metal that is small enough to only touch those two pins) and practice a few times (again, with the router off) to verify that you can quickly touch those two pins at the same time which touching nothing else!
  10. When you’re ready to go for it, turn the router on, and as soon as you see the LED blinking that corresponds to the successful pings in your command prompt, short the two pins for 1 second, then remove the screwdriver. If the pin short was successful, the router will begin to ping continuously.
  11. If it doesn’t work, try again a few times (I attempted the pin short 5 or 6 times before it worked for me).
  12. Once the router is pinging continuously, open the TFTP2 utility and enter 192.168.1.1 in the Server field, then browse for the stock Netgear firmware file in the File field. Hit the Upgrade button. You should see a “success” message within a few seconds.
    TFTP2 Client Settings

    TFTP2 Client Settings

  13. Wait for 6 minutes. Seriously. Wait. It doesn’t say this on JuanPedro’s instructions, but you need to do it. Go get a drink. Leave the room. Don’t feel any temptation to power cycle the router, or touch it, or even make eye contact. Let it do its thing for 6 whole minutes. Heck, maybe even wait 10 minutes. You’ll brick it again if you try to power cycle it too early.
  14. Power cycle the router after 6-10 minutes.
  15. Try to connect to the router as normal, using the Netgear default of admin/password as the login credentials.

With your router recovered, you can now attempt to re-flash a trailed mini build of DD-WRT specifically for this router per the instructions on the DD-WRT WNDR3400 wiki page, after which you should do a 30/30/30 reset before attempting to flash any other K2.6 build of DD-WRT ending in -nv64k and that will fit in an 8MB flash.

But seriously, you shouldn’t do this. For a safer way to recover a bricked router, search for “JTAG recovery” or “serial recovery” along with the model number of your router. That should shove you in a safer direction. Shorting pins can let out the “magic smoke,” and can destroy your router forever.

I’ve seen reports of this pin shorting working on other Netgear routers, but different models will have different pin locations for the two that you’ll need to short. Don’t guess. Find a post somewhere online that shows the specific pins for your router. This post only shows the ones for the Netgear WNDR3400, since that’s the only Netgear router I’ve personally done this with (and I’ve done it successfully twice).

So again — don’t do this. But if you do, and it works, please tell me about it in the comments. 🙂

  • Nick

    This DID work for me. I struggled a bit at first. I too took several tries just to get a continuous ping. Once I did I followed the steps using the TFPT2 to upload the Netgear firmware. I tried the newest and the oldest firmware from Netgear site and neither worked. I was just about to give up and I thought to try the DD-WRT firmware and it worked. I thought I would comment just in case someone out there is about to give up when the Netgear firmware isn’t working.

    Thanks for the great tutorial.

    • Awesome, Nick! Glad you were able to bring your router back to the land of the living. Congratulations! 🙂

  • asad

    Thank you. It also worked for me…. I just held down those two pins before i even turned the router on so i dont have to time myself and it worked the first time 🙂 …. Thanks for your detailed instructions along with the warnings….

  • syth

    Thanks! I bricked my wndr3400 upgrading to the mega firmware as well. I followed the instructions on the wndr3400 wiki, but these instructions are extremely vague. Can the mega version be installed on the wndr3400? Do I have to do a 30/30/30 reset after the initial mini version flash? Anyway, because of the instructions here, my wndr3400 is up and running. Thanks for the resurrection.

  • Tim

    After messing around with my WNDR3400 for nearly an hour with a screwdriver making contact with the prongs, it finally worked! Thank you so much for this tutorial. Using the router right now and no issues so far.

  • Max Hopper

    Uhh, why not use the serial connector instead? It is simple to remove the solder and using lengths of a paper clip create the necessary pin-outs for the TTL UART leads. And, the method is not limited to a router model / revision nor manufacturer.

    N.B. dd-wrt needs to do better than to release images that exceed pre-defined memory areas. One need look no further than the countless bricks created by the TP-Link WR841N rev 8 image.

    • Hey, Max. A serial connector is indeed the ideal method. But sometimes quick and dirty is all you need… as long as you’re willing to assume the risks. 🙂

  • Pingback: Recuperar router brikeado despues de instalar dd-wrt()

  • pete

    dd-wrt.v24-23838_NEWD-2_K2.6_mini-WNDR3400.chk is the latest stable K26 version flashed successfully. I was going to ask if a K3x could be used; looking at the manufacturer’s firmware (WNDR3400-V1.0.0.34_15.0.42.chk), the file size is only 4.405 MB in Windows. The smallest K3x firmware seems to be 7,6MB. Although there is a ‘dd-wrt.v24-24160_NEWD-2_K3.x_mega-WNDR3400.chk’, and so it seems purpose-built for the WNDR3400, I had no luck flashing it, and used your pin-reset method to fix it.

  • Kyle

    This worked for me when I bricked my WNDR3400v1 with the usb-ftp-samba3-dlna-nv64k-broadcom.bin 7.2MB firmware. So back to DD-WRT v24-sp2 mega 21061.

  • Mark

    It worked, while using the internal TFTP server with my MAC. I used the script written in an ASUS post on the dd-wrt wiki site, but substituted the WNDR3400 mini file. Yes, I was impatient, and bricked it again. The second time took a few extra shorts on the pins, but the router has been up for about 10 min now….

  • Erik

    Thank you very much for this very helpful and simple tutorial. I really did help me in recovering my WNDR3400v1 router. Seriously, again great job on the simplicity of this tutorial.

    Additional info:
    When upgrading my WNDR3400v1 router from the “18946_K2.6_mini” firmware, as said by WIKI, I tried another firmware listed on their, “18946_K2.6_mega-nv64k” and it was this firmware that bricked my router. Odd as it was recommended in the WIKI.

    But nevertheless after the recovery from brick I was successful with “18946_NEWD 2_K2.6_big-nv64k” and then successfully upgrading it again to “21676_NEWD 2_K2.6_mega-nv64k”.

  • Ian

    Worked like a charm, thanks! (Took 6 attempts).

    I spent 8 hours trying to get my router back after updating to “usb-ftp-samba3-dlna-nv64k-broadcom.bin” (like Kyle, above). Clearly the DD-WRT Router Wiki needs some updating…

  • Liz

    Well! There’s 12 hours of my life I’ll never see again, thanks to the mega build. But, thanks to you, I don’t have to go buy a new router! I was never able to get 3 pings in a row, just one ping every once in a while, based on some odd combination of connecting and disconnecting the various cords. Thanks for the advice!

    • That made me chuckle, but glad to see it worked for you! 🙂

  • I read this guide elsewhere and followed the steps and this pin shorting method actually does work with no sparks flying around anywhere at all. I recommend holding the WNDR3400v1 from the plastic bottom while using a flathead screwdriver to touch the 2 pins. Make sure the width of the flathead isn’t long enough to touch other pins or you may have sparks flying indeed but I thought I would add my results to here for others to read. I’ve been into obtaining and flashing different routers for quite awhile and never had a bricked one but I managed to brick this particular one that I picked up from a neighbor for experimentation on my own time. Like many it bricked using the Kong vpn build but I did manage to flash the Kong DLNA version but it was all bloaty and buggy. It seemed that it hogged up so much of the flash memory that it was impossible to get rid of it by flashing back to stock or flashing another build. After trying to revert back to WNDR3400-V1.0.0.52_20.0.60.chk stock, no success. So I tried to revert back to dd-wrt.v24-21676_NEWD-2_K2.6_mini-WNDR3400.chk, no success either. So I decided to do what I didn’t think was a good idea to start with but I did it anyways, I flashed the vpn Kong after the Kong DLNA version was successfully flashed and it resulted in a brick. I realized almost immediately that I had bricked it when I couldn’t access the web interface so for fun I looked around to see if anyone had reported any methods other than JTAG and I stumbled on this so I did just this:

    Direct Connected from PC NIC via ethernet cable to WNDR3400v1 LAN port 1, any should work except WAN port, do not attempt WAN port!

    PC NIC IPV4: 192.168.1.3
    255.255.255.0
    192.168.1.1

    192.168.1.1
    2nd dns blank

    Opened up command prompt and issued continuous ping 192.168.1.1 -t

    Downloaded TFTP2 and selected 192.168.1.1 for address to erase/flash
    password field was left blank
    Selected tomato-K26USB-NVRAM64K-1.28.RT-N5x-MIPSR2-123-WNDR-WNDR3400v3.chk as my file since it’s so much better and I was tired of looking at these bloated dd-wrt builds and the stock build was decent but what was the point in going back to stock at this point so Tomato it was.

    Set retries to 10 on TFTP2

    Tried waiting for the 2 or 3 pings to happen before I tried to short the pins but it wasn’t working when trying to time it out perfectly so instead I placed the flathead screwdriver in place (joining the 2 pins and no others). Then tried the power button off and on but to no avail. You actually have to pull the power plug from the router forcing it to lose all power. I counted 10 seconds but no more than 15 seconds and with the screwdriver tip placed accordingly, command prompt displaying ping attempts, and tftp2 trying repeatedly I attached the power cord to the back of the WNDR3400 and started getting ping replies non-stop and tftp2 erased the bloaty half flashed firmware and flash in the new Tomato firmware and after rebooting all was well.

    The tomato firmware is actually for v3 router but it works superb on the v1. The only problem is the dome led wont come on but it’s very bright and shows everybody in your house where you router is located and it actually creates a more professional, stealth-like look to the router with it being off. There is a beta v1 tomato build that let’s the dome light work afaik but the wifi leds don’t work properly or not at all so just use v3 build mentioned above or try a future beta v1 or v3 firmware at your own risk and post your own replies. I’m very pleased with the wifi features of this router, especially with tomato handling it all. 10/100 sucks but to have 2.4ghz and 5ghz wifi makes it a good WDS bridge or good router/switch for wifi repeating/extending. I own 2 Cisco Linksys E3000 gigabit/2.4ghz/5ghz routers and they are my favs out of all the ones I’ve flashed. I’ve also flashed the Cisco Linksys E1000v2, and Linksys WRT54GL with tomato and it makes then something other than useless and slow routers that otherwise end up in a landfill.

  • Lenny

    TL;DR VERSION: If your router is bricked anyway, try the pin short method because it’s not a myth, it actually worked for me.

    Just happened upon this website while searching for something else, but I had to comment that the pin short method worked for me. I was skeptical, but figured what the hell, it’s bricked anyway. When it started pinging, I practically danced a jig. Actually, I literally did. My version of one, anyway, cause I’m Asian.

    • LOL – thanks, Lenny. Please tell me you had your webcam on when you danced this Asian jig?!?!?!

  • This exact mechanism worked for me, except that I found I had to hold the pins for more like 3-4 seconds, certainly much longer than one second. Thanks very much for the detailed instructions!

    For what it’s worth, the build that bricked my WNDR3400 v1 was dd-wrt.v24-18946_NEWD-2_K2.6_mega-nv64k.bin, which is unfortunately linked from http://www.dd-wrt.com/wiki/index.php/Netgear_WNDR3400. Yes, I painstakingly did 30-30-30 resets before loading the mini (which went fine) and again afterwards, before the mega. No, I’m not a n00b. Yes, next time I’ll try to find a build that someone I know can vouch for personally. Meanwhile, you saved my bacon, or at least my $25 or so and my sense of independence. Thanks again.

  • Jason

    Just wanted to drop a line and say thanks for this! I’ve spent the weekend trying to unbrick my router after the same failed “mega” upgrade… I was about to try the serial cable method when I thought I’d give this a go.

    The only thing that helped in my case was to hold the reset button for 30 seconds during the power on (extra tricky with the case apart). About 2-3 seconds after releasing the reset button, I was able to get the initial pings back and hit the short. Worked the first time!

    Thanks again… I already ordered another router to replace this one, but I’m glad to have it in my back pocket again!

  • Enrique

    Thanks for the instructions! I just did this and it worked for me! I was doing it wrong at first, I was doing the short after the 3 initial pings and of course it didn’t work.. then I did the pin short quickly after reconnecting the power then the power led started blinking green.. it only took one (correct) try and a 1 sec pin short and done! I was able to reflash it!

    So I am guessing that this WNDR3400v1 does not support the DD-WRT mega? I don’t want to brick it again!

  • NOTE: If you’re unable to update to the stock NETGEAR firmware (aka the light is still amber/not getting any pings after the flash) use the DD-WRT mini. Worked like a charm!

    • Great tip! 🙂

      • Curtissleeth75

        I have a Netgear 3300 and I’m trying this but it keeps failing saying: (Unable to get response from the server) help!

  • Great to hear, Doug! Of course, making something spark inside an electronic device is probably not the ideal situation, but if it comes down to that vs. tossing it in the trash, it’s worth a shot. Glad to hear it worked for you, too! 🙂

  • Bryan Waters

    Got it first time! THanks for the info Steve!

  • Douglas

    Thank you. It worked for me. I attempted the pin short about 9 times before I got the pings, but it worked out great.

  • FLY

    Hi,
    Maybe not the 3400 BUT….
    If You have WNDR3700v3 this is my case:

    I made bad flash of experimental DDWRT firmware, and router stopped responding. It gave me TTL=100 (about 10 pings) at power up, but did not respond to TFTP. 3700v3 has no safe mode so I decided to try PIN SHORTING.
    If you browse through the web you will find pictures for WNDR4000 PCB and pins to short to put router into constant TTL=100 (chip layout on PCB is same as 3700v3).

    Te hint is: in my case I had to short pins much longer than recomended on different forums. What worked was to short pins right after first LED blinks after power up (about 1s after pushing power button) AND HOLD IT about 10 sec UNTILL ROUTER WENT INTO CONSTANT POWER LED BLINKING IN GREEN. (before pin short it was solid orange light).
    With power led blinking green TFPT worked. I tested it later a few times more, and it always worked.
    I suppose you have to short pins as long as router is giving you pings after power up (if you get 5 pings = 5 secs, 10pings =10 sec).

    Hope that will help.
    Regards