jclehner/nmrpflash

Netgear Unbrick Utility

nmrpflash's Issues

not working on windows 10

hello i flash my router netgear R6220

under openwrt more than a year ago today I wish I could reinstall the original firmware

but it does not work

version currently install openwrt 18.6.4

C:\Users\andy\Downloads\Compressed\R6220-V1.1.0.86>nmrpflash.exe -i net0 -f R6220-V1.1.0.86.img
Advertising NMRP server on net0 ... |
No response after 60 seconds. Bailing out.

please solve problem or create firmware en on.bin file

Cannot Flash WNDR3400v2

I am trying to flash the official Netgear firmware back on a Netgear WNDR3400v2 router after a bad OpenWRT flash in order to unbrick it. I am running the following command: ./nmrpflash -i enx00e04c0311dc -f WNDR3400v2-V1.0.0.54_1.0.82.chk -vvv nad am met with the following logs:

Adding 10.164.183.253 to interface enx00e04c0311dc.
Advertising NMRP server on enx00e04c0311dc ... -
Received configuration request from 2c:b0:5d:2b:48:e1.
Sending configuration: 10.164.183.252/24.
rtnl_neigh_delete: Object not found
Timeout while waiting for TFTP_UL_REQ.

If it means anything, I also tried this version of the command: /nmrpflash -i enx00e04c0311dc -f WNDR3400v2-V1.0.0.54_1.0.82.chk -vvv -a 192.168.1.1 -A 192.168.1.10 but received the same output (different ips of course). I am on Debian 10 and hooked up to the router using a thunderbolt 3 to Ethernet adapter, and an Ethernet cable.

I honestly have no clue what I'm doing with this stuff, as I'm complete newbie. Any help would be greatly appreciated!

Unable to input commands in prebuilt Windows binary

If you try to input a command, command prompt automatically closes. I've tried opening it within command prompt and while that works, you need admin privileges to push the firmware.

Fails on XAU2511

Hello!
I'm glad I found this tool, which looks (looked :( ) very promising.
However it fails on a bricked XAU2511 device.
I connected the console, and pressing the reset button for a while (10sec+), the process started.
However as soon as nmrpflash starts to try to upload, the device either stops downloading and resets, or when keeping the reset button pressed, complains in an endless loop (until nmrpflash timeout) about

[...]
NMRP client Configuring Request send
NMRP Config Ack received
NMRP set tftp-server IP success
No DEV-REGION option (-> here, maybe it expects CE which is the current region?!)
Recv FW-UP options
No ST-UP option
timeouts..Back to tftp waiting state.
[...]

Any idea?

Best regards
Michael

Clarify instructions?

Thanks for a wonderful tool!

If it matters, when you say to connect the PC to the router via ethernet, mention it should go in the blue (downstream) ports, not the yellow (WAN) port?

I wasn't able to get the tool to work:

C:\Users\ericlaw\Downloads\routerfix>nmrpflash -i net0 -f R6700v3-V1.0.4.98_10.0.71.chk
Failed to bind after 5 seconds: bind: The requested address is not valid in its context.

C:\Users\ericlaw\Downloads\routerfix>nmrpflash -i net1 -f R6700v3-V1.0.4.98_10.0.71.chk
Failed to bind after 5 seconds: bind: The requested address is not valid in its context.

... until I manually edited my IPv4 settings to use a fixed IP address (as documented in https://kb.netgear.com/000059633/How-to-upload-firmware-to-a-NETGEAR-router-using-TFTP-client)

this is not issues, but I just test my R7000. all work well

This is the detail Log, Thx u jclener

D:>nmrpflash.exe -i net0 -a 192.168.1.1 -f R7000-V1.0.9.6_1.2.19.chk
Advertising NMRP server on net0 ... /
Received TFTP_UL_REQ while waiting for CONF_REQ!
Received upload request without filename.
Uploading R7000-V1.0.9.6_1.2.19.chk ... OK
Waiting for remote to respond.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Remote finished. Closing connection.
Reboot your device now.

Writing to routing socket: No such process

From MacOS I'm attempting to flash my netgear r7000, but am having issues connecting to make the transfer. Here's my latest command and logs:

sudo ./nmrpflash -v -i en10 -A 10.0.0.4 -a 10.0.0.250 -f dd-wrt.K3_R7000_mod.chk

This returns an error:

Adding 10.0.0.4 to interface en10.
Advertising NMRP server on en10 ... -
Received configuration request from cc:40:d0:0a:16:dd.
Sending configuration: 10.0.0.250/24.
arp: writing to routing socket: No such process
arp: 10.0.0.250: No such process
arp: writing to routing socket: No such process
arp: 10.0.0.250: No such process

My Router is using 10.0.0.1 for the network's IP and I've reserved 10.0.0.4 for my computer.

Any ideas?

Netgear R7000P. Waiting for CLOSE-ACK

My major issue is that board_id shows incorrectly with U12H270T00_NETGEAR due to me flashing tomato with the wrong firmware (R7000 not R7000P). This resulted in bricked R7000P. I was hoping that nmrpflash would correctly set the board_id to show U12H270T20_NETGEAR and unbrick my router.

History context:
Netgear R7000P firmware -> WWDRT R7000P firmware -> Tomato R7000 (bricked system, tried to use other R7000P images but serial console to router showed that router rejected different firmware because the board_id now shows R7000 U12H270T00_NETGEAR, "nvram set board_id=U12H270T20_NETGEAR" did not persist across reboots) -> nmrpflash with "factory-to-dd-wrt.chk" (successfully did set to R7000P U12H270T20_NETGEAR and flashed to WWDRT R7000P firmware)

---

Here's the message on the router side.

KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 1048576 bytes written
KEEP-ALIVE-REQ sent...Waiting for KEEP-ALIVE-ACK...
done. 32826 bytes written
done. 29392954 bytes written
Skip writing CHK checksum for nflash.
Device eth0:  hwaddr 9C-3D-CF-50-34-51, ipaddr 10.164.183.252, mask 255.255.255.0
        gateway not set, nameserver not set
CLOSE-REQ sent...Waiting for CLOSE-ACK...

Client side.

MacBook-Pro-2 Downloads % sudo ./nmrpflash -i en7 -f factory-to-dd-wrt.chk
Advertising NMRP server on en7 ... -
Received TFTP_UL_REQ while waiting for CONF_REQ!
Received upload request without filename.
Uploading factory-to-dd-wrt.chk ... OK
Waiting for remote to respond.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Remote finished. Closing connection.
Reboot your device now.

in windows, it is saying error accessing file 'firmware.img'

please help me. i have to debrick my r6220

suggestion

Hi jclehner ,
First of all, thx for your work. You helped many poople.
Could you make package for AUR pamac (arch linux)... it would help linux noobs like me...
I spent a lot of time to build from git and intall successful...
cheers,
mile-lile

keeps getting "Received keep-alive request" after uploading the firmware (R6220)

The router is supposed to close the connection when it's done, but it keeps sending keep-alive request and the uploaded firmware seems to not be installed.

nmrpflash.exe -i "net4" -f "d:\R6220-V1.1.0.64_1.0.1.img"
Advertising NMRP server on net4 ... -
Received configuration request from **:**:**:**:**:**.
Sending configuration: 10.164.183.252, netmask 255.255.255.0.
Received upload request without filename.
Uploading R6220-V1.1.0.64_1.0.1.img ... OK
Waiting for remote to respond.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
...

Thanks in advance for any tips and help.

Cannot flash on r8000

Router off
Run nmrpflash
router on

Result:
D:>nmrpflash -i net9 -f R8000-V1.0.4.56_10.1.71_BETA.chk -vv
net9: \Device\NPF_{346FE1D0-935B-4DCB-B431-660800195026}
Adding 10.164.183.253 to interface net9.
Failed to bind after 5 seconds: bind: The requested address is not valid in its context.

Router on
Run nmrpflash
router off and on

result:
D:>nmrpflash -i net9 -f R8000-V1.0.4.56_10.1.71_BETA.chk -vv
net9: \Device\NPF_{346FE1D0-935B-4DCB-B431-660800195026}
Adding 10.164.183.253 to interface net9.
Advertising NMRP server on net9 ... -
Received configuration request from 9c:3d:cf:5c:2c:06.
Sending configuration: 10.164.183.252/24.
Timeout while waiting for TFTP_UL_REQ.

Failure flashing an R6400v2

Hi there! Thanks for putting together what seems like such a useful utility. I'm running into some problems trying to flash a Netgear R6400v2, and I'm wondering if you've seen any of these issues before.

First, after running nmrpflash -i eth0 -f R6400v2-V1.0.4.102_10.0.75.chk and powering on the router, nmrpflash displays:

Waiting for Ethernet cable to be plugged in.
Adding 10.164.183.253 to interface eth0.
Advertising NMRP server on eth0 ... 
Timeout while waiting for TFTP_UL_REQ.

At this point, if I immediately re-run the command, it appears to transfer the image to the router. I see:

Adding 10.164.183.253 to interface eth0.
Advertising NMRP server on eth0 ... \
Received upload request without filename.
Using remote filename 'R6400v2-V1.0.4.102_10.0.75.chk'.
Uploading R6400v2-V1.0.4.102_10.0.75.chk ... 
<< WRQ(R6400v2-V1.0.4.102_10.0.75.chk, octet)
>> ACK(0)
<< DATA(1)
.
.
.
OK
Waiting for remote to respond

That fails with Timeout while waiting for 0000.

At this point, no LEDs are lit on the router other than the power light and the light for the port to which my laptop is connected, and the router doesn't seem to boot. If I re-run the nmrpflash command without doing anything else, I see:

Received KEEP_ALIVE_REQ while waiting for CONF_REQ!
Timeout while waiting for CONF_REQ

Any idea what could be going on here? The router was previously working fine, but was refusing to accept firmware updates via the web ui, which is what originally brought me to nmrpflash. R6400v2-V1.0.4.102_10.0.75.chk is the latest firmware, but I've had the same results if I try earlier versions.

Application was unable to start correctly (0xc000007b)

after trying to install this on my windows computer the first error I got was wpcap.dll was not found. I reinstalled npcap and that also didn't work. I looked it up and installed wpcap.dll from a website. Once I put wpcap.dll in the folder I ran nmrpflash again and got the Application was unable to start correctly (0xc000007b) error. Any suggestions?

press any key to exit

run nmpflash.exe popped up press any key to exit.
WIN7 64

Timeout while waiting for TFTP_UL_REQ.

~/Downloads sudo nmrpflash -i en0 -f R6700v3-V1/x.chk
Advertising NMRP server on en0 ... /
Received configuration request from cc:40:d0:8b:0c:6a.
Sending configuration: 10.164.183.252/24.
delete: cannot locate 10.164.183.252
Timeout while waiting for TFTP_UL_REQ.
10.164.183.252 (10.164.183.252) deleted

This is on a Mac, with a bricked NetFear R6700V3.

r6700 config request loop

hi, i am very inexperienced with any sort of coding. i'm going to try to give a lot of info mostly because i'm not sure what is important.
i bricked my r6700 router somehow while doing a regular update. i am trying to transfer the official current firmware to my router.
i am running cmd in admin mode in windows 10. i've set the net2 ip address to static 192.168.1.2 (although i don't really understand the -a and -A commands). here's what happens right now

nmrpflash -vvv -i net2 -f R6700-V1.0.2.16_10.0.57.chk -t 10000 -T 10000
net2: \Device\NPF_{56ECE67A-0AA7-4D25-8615-13FC873CF13B}
Adding 10.164.183.253 to interface net2.
Advertising NMRP server on net2 ... \
Received TFTP_UL_REQ while waiting for CONF_REQ!
Received upload request without filename.
Using remote filename 'R6700-V1.0.2.16_10.0.57.chk'.
Uploading R6700-V1.0.2.16_10.0.57.chk ... << WRQ(R6700-V1.0.2.16_10.0.57.chk, octet)
>> ACK(0)
<< DATA(1)
>> ACK(1)
<< DATA(2)
....
<< DATA(62017)
>> ACK(62017)
OK
Waiting for remote to respond.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Received configuration request from 28:80:88:1e:91:c9.
Sending configuration: 10.164.183.252/24.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Received CONF_REQ while waiting for TFTP_UL_REQ!
Received configuration request from 28:80:88:1e:91:c9.
Sending configuration: 10.164.183.252/24.

i've been running this with my router on, waiting for the advertising line, then turning off the router for 30 seconds, and then turning it back on. i can't start the command with my router off. i previously managed to get

Received TFTP_UL_REQ while waiting for CONF_REQ!
Received upload request without filename.
Uploading R6700-V1.0.2.16_10.0.57.chk ... OK
Waiting for remote to respond.
Received configuration request from 28:80:88:1e:91:c9.
Sending configuration: 10.164.183.252/24.
Timeout while waiting for TFTP_UL_REQ.

which at least received the TFTP_UL_REQ (but in the wrong order i guess?) but i lost the command i used to get the output and haven't been able to replicate it.
thanks for any help! i appreciate the work you've put into this. (also i don't think i've seen my specific issue in these posts, but i may have missed one that applies here)

R6220 not getting past "advertising NMRP server"

I have a working openWRT installation on my R6220, but I wish to revert to the stock image.

I started off following the official openWRT unbricking guide for the R6220 and checking this closed issue to this tool, connecting the computer to theLAN1 port on the router and disconnecting all other cables. For some reason, I just can't get past the No response after 60 seconds. Bailing out. part.

Now I've tried the following:

sudo ./nmrpflash -i eno2 -f R6220_V1.1.0.100_1.0.1.img -vv
sudo ./nmrpflash -i eno2 -f R6220_V1.1.0.100_1.0.1.img -a 192.168.1.1 -A 192.168.1.2 -vv
sudo ./nmrpflash -i eno2 -f R6220_V1.1.0.100_1.0.1.img -a 192.168.2.1 -A 192.168.2.2 -vv
sudo ./nmrpflash -i eno2 -f R6220_V1.1.0.100_1.0.1.img -a 192.168.1.1 -A 192.168.1.2 -m *mac_address_hidden* -vv

Both after and before resetting openWRT to default settings. I'm working with a /24 subnet and the router's IP is 192.168.1.1 by default. I also tried setting the computer's IP statically to 192.168.1.2 and redoing all these commands, to no avail. Am I missing something or there something else I can try?

Not quite working on a DGND3700v2

I've got it very close to working on a Netgear DGND3700v2, but am struggling with a time out issue. HEre is the sequence:

prompt% ./nmrpflash.exe -i net1 -f DGND3700v2.img -a 192.168.1.1 -R WW -vvv
net1: \Device\NPF_{A3BC8ABB-D204-4020-A5B2-1AD61BE9AD18}
Advertising NMRP server on net1 ... \
Received configuration request from 9c:d3:6d:0b:3c:26.
Sending configuration: ip 192.168.1.1, mask 255.255.255.0.
Received upload request with empty filename.
Using remote filename 'DGND3700v2.img'.
Uploading DGND3700v2.img ... << WRQ(DGND3700v2.img, octet)
<< WRQ(DGND3700v2.img, octet)
<< WRQ(DGND3700v2.img, octet)
<< WRQ(DGND3700v2.img, octet)
<< WRQ(DGND3700v2.img, octet)
<< WRQ(DGND3700v2.img, octet)
<< WRQ(DGND3700v2.img, octet)
<< WRQ(DGND3700v2.img, octet)
<< WRQ(DGND3700v2.img, octet)
Timeout while waiting for initial reply.

This on a Windows 10 machine using the pre-compiled version (0.9.3) for windows. It seems to make the connection just fine, but when it tries the tftp upload it stalls somehow.

cannot use nmrpflash on my netgear r6220

everytime i try to use the command:
nmrpflash.exe -i net2 -f R6220-V1.1.0.68_1.0.1.img
in my command prompt i get this return:
No response after 60 seconds. Bailing out.
ive already tried to add the macadress but it seems not to work anymore.

On this router is openwrt installed.
Hope you can help me.

libpcap.so.0.8 not widely available (e.g., Fedora 31)

For reference and for anyone else running across this bug:

stealing libpcap0.8_1.9.1-2_amd64.deb from Debian and extracting everything from data.tar.xz/./usr/lib/x86_64-linux-gnu/ into somewhere in LD_LIBRARY_PATH worked

The most efficient patch for this is sudo ln -sv libpcap.so.1 /usr/lib64/libpcap.so.0.8 (Red Hat) or sudo ln -sv libpcap.so.1 /usr/lib/`uname -m`-linux-gnu/libpcap.so.0.8 (Debian), assuming/after libpcap is already installed

Success with R8000

Hi. I just wanted to let you know that this just worked with my NETGEAR R8000 AC3200 Nighthawk router. There was one notable difference from your described steps though: the router had to be on when I ran the command. I had to plug into Ethernet 4 on the router and power it on, then wait until the power light was solid amber before running the command. Thanks so much for the awesome tool!

R6350 netgear Handle CONFIGURING error

Hi
I am having trouble passing the initial handshake of the NMRP with my router
this is my set up:

linux mint machine
running your nmrpflash 0.9.14 (-V command)
this machine is connected to router via a USB Ethernet dongle (enx002449015e82)
this machine also has wireshark looking at traffic on enx002449015e82 (could not get your dissector to work have not figured out why (wireshark Version 2.6.10 (Git v2.6.10 packaged as 2.6.10-1~ubuntu18.04.0) )
this machine is also connected to the serial console of the router and displaying boot process

enx002449015e82 is set as follow static : 192.1168.1.2 255.255.255.0 (192.168.1.1 gateway)
and connected to router

sudo ./nmrpflash -L 
enx002449015e82  192.168.1.2      00:24:49:01:5e:82

host is running this as the router is powered on

sudo ./nmrpflash -i enx002449015e82  -f openwrt-19.07.1-ramips-mt7621-netgear_r6350-squashfs-factory.img -m 14:59:c0:ba:68:df -v
Adding 10.164.183.253 to interface enx002449015e82.
Advertising NMRP server on enx002449015e82 ... /
No response after 60 seconds. Bailing out.

the router's mac add is 14 59 c0 ba 68 df (confirmed also on router label)

excerpt of boot process:

**************************************************
   Sercomm Boot Version 1.3.0.0, at Aug 22 2018, 14:51:35
***************************************************
Entering Firmware : Everything is OK.
Enter NMRP_main
0x0000:14  59  c0  ba  68  df  
Trying Eth0 (10/100-M)
 Waitting for RX_DMA_BUSY status Start... done
 ETH_STATE_ACTIVE!! 
Our ETH MAC:
0x0000:14  59  c0  ba  68  df  

NMRP_FLASH_SIZE_buffer --> 03000000.
NMRP:LISTENING
Enter NMRP_handle_LISTENING_state
### Found NMRP Server ###
NMRP:CONFIGURING
Handle CONFIGURING error
NMRP:CONFIGURING

...... this goes on for many lines until nmrp bails out after 60 sec
and then terminates with

NMRP,NO CONFIG-ACK got
Handle CONFIGURING error

then router continues boot into the bricked state....

As for what i can see the host sends always the same packet to router and router does not recognize it as a valid handshake

wireshark capture for bad header? (sorry could not get your dissector working)

Frame 110: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface 0
    Interface id: 0 (enx002449015e82)
    Encapsulation type: Ethernet (1)
    Arrival Time: Feb 23, 2020 12:06:31.892044832 EST
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1582477591.892044832 seconds
    [Time delta from previous captured frame: 0.200259719 seconds]
    [Time delta from previous displayed frame: 0.200259719 seconds]
    [Time since reference or first frame: 17.477900217 seconds]
    Frame Number: 110
    Frame Length: 64 bytes (512 bits)
    Capture Length: 64 bytes (512 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:data]
Ethernet II, Src: ShenZhen_01:5e:82 (00:24:49:01:5e:82), Dst: Netgear_ba:68:df (14:59:c0:ba:68:df)
    Destination: Netgear_ba:68:df (14:59:c0:ba:68:df)
    Source: ShenZhen_01:5e:82 (00:24:49:01:5e:82)
    Type: Unknown (0x0912)
Data (50 bytes)
    Data: 00000100000e000100084e54475200000000000000000000...

date : in Hex + ascii

0000   14 59 c0 ba 68 df 00 24 49 01 5e 82 09 12 00 00   .YÀºhß.$I.^.....
0010   01 00 00 0e 00 01 00 08 4e 54 47 52 00 00 00 00   ........NTGR....
0020   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0030   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
 Text: 
    [Length: 50]

the router never sends back ANY DATA no unicast / no boardcast /no multicast / NOTHING

So all that said how can I help you in making your NMRPflash better an working with my router

let me know if i can send your more data or things i can try

regards Martin

Success with R8500

Similar to coopsteve’s comment two weeks ago, I found success with a Netgear R8500 AC5300 (Nighthawk X8).

I used the pre-compiled 0.9.14 MacOS distribution. There was a MacOS Catalina permissions/gatekeeper issue which I’ve run into frequently with un-signed code. To help others, maybe it’d be worthwhile adding these tips/steps to allow execution. Feel free to cut and paste these steps into any release docs.

This is resolved by going to System Preferences, selecting “Security & Privacy options, and select the “General” tab. 3/4 of the way down the window, there’s a message “nmrpflash”was blocked from opening because it’s not from an identified developer. Press “Open Anyway” button to the left of the error and your good to go.

One issue though. The R8500 has dual gigabit WAN interfaces which may be a factor... could it actually be user error..? The tool would terminate with an error. However, a subsequent execution would resume/start the TFTP process.

I’m assuming that it successfuly sends the magic packet to place it in tftp mode, but because I can’t determine the root cause, I’ll share the logs belowZ. What could it be..?

Still, it worked..!

Thanks for writing this utility, and breathing life back into a router I thought was a heavy doorstop!

Execution#1

sh-3.2# ./nmrpflash -i en0 -f R8500-V1.0.2.134_1.0.99.chk -vvv
Adding 10.164.183.253 to interface en0.
Advertising NMRP server on en0 ...
Received configuration request from a0:04:60:8e:49:08.
Sending configuration: 10.164.183.252/24.
delete: cannot locate 10.164.183.252
Timeout while waiting for TFTP_UL_REQ.
10.164.183.252 (10.164.183.252) deleted

Execution#2: (within 3 seconds)

sh-3.2# ./nmrpflash -i en0 -f R8500-V1.0.2.134_1.0.99.chk -vvv
Adding 10.164.183.253 to interface en0.
Advertising NMRP server on en0 ... -
Received TFTP_UL_REQ while waiting for CONF_REQ!
Received upload request without filename.
Using remote filename 'R8500-V1.0.2.134_1.0.99.chk'.
Uploading R8500-V1.0.2.134_1.0.99.chk ... << WRQ(R8500-V1.0.2.134_1.0.99.chk, octet)
ACK(0)
DATA(1)
ACK(1)
...
OK
Waiting for remote to respond.
Received keep-alive request (27).
Remote finished. Closing connection.
Reboot your device now.

delete: cannot locate 10.164.183.252 using Catalina on R6400v2

Hi Joseph,

1. Compiled and installed nmrpflash on Catalina. Got some errors but I figure that since it did compile, the result is still good.

make

fatal: not a git repository (or any of the parent directories): .git cc -c -Wall -g -DNMRPFLASH_VERSION=\"\" nmrp.c -o nmrp.o fatal: not a git repository (or any of the parent directories): .git cc -c -Wall -g -DNMRPFLASH_VERSION=\"\" tftp.c -o tftp.o fatal: not a git repository (or any of the parent directories): .git cc -c -Wall -g -DNMRPFLASH_VERSION=\"\" ethsock.c -o ethsock.o fatal: not a git repository (or any of the parent directories): .git cc -c -Wall -g -DNMRPFLASH_VERSION=\"\" main.c -o main.o fatal: not a git repository (or any of the parent directories): .git cc -c -Wall -g -DNMRPFLASH_VERSION=\"\" util.c -o util.o fatal: not a git repository (or any of the parent directories): .git cc -Wall -g -DNMRPFLASH_VERSION=\"\" -o nmrpflash nmrp.o tftp.o ethsock.o main.o util.o -lpcap

2. Downloaded oldest firmware image, R6400v2-V1.0.2.14_1.0.7.chk from Netgear as used successfully used by user LP128 on the Netgear Community Forum: https://community.netgear.com/t5/Nighthawk-WiFi-Routers/R6400v2-bricked-after-firmware-update/m-p/1802293

3. Ran nmrpflash, with the following output...

sudo nmrpflash -i en0 -f R6400v2-V1.0.2.14_1.0.7.chk -v

Adding 10.164.183.253 to interface en0. Advertising NMRP server on en0 ... \ delete: cannot locate 10.164.183.252 Received configuration request from a0:40:a0:94:3c:a6. Sending configuration: 10.164.183.252/24. Timeout while waiting for TFTP_UL_REQ. 10.164.183.252 (10.164.183.252) deleted

This response came all at once within 3 seconds, as soon as the router connected.

Any help would be much appreciated.

Many thanks,
Mike

I owe you a beer

Is there a way I can donate as thanks for your hard work?

R8000 no success

not connected to the router in either ways but i have access through http://192.168.1.1 but cant able to update firmware there too

R7900p

Hi, I tried to restore the firmware on my R7900p that it's having a boot loop with the Power in solid amber, I tried the nmrpflash but I am stucked. After it uploads the image with the warning of TFTP block rollover. Upload migh fail!

Then it says:

OK
Waiting for remote to respond
Remote finished. Closing connection.
Reboot your device now.

After that the router's Power Led starts bliking amber and after the reboot it remains the same boot loop (Reset button does nothing and I've tried using TFTP without success as well). Let me know if anyone can help me revive this router.

Let me know if you need ANY additional information.

Thank you!

Adding a switch between router and computer helped

First of all, THANK YOU for such a great tool!

I am trying to debrick a Netgear R8500. As recommended I connected my Windows 10 laptop directly to the ethernet port 1 on the router. I kept getting the same error “Failed to bind after 5 seconds: bind: The requested address is not valid in its context” as soon as starting the nmrpflash command. I already manually set my computer IP address 192.168.1.10, but still cannot get pass this error.
I was about to give up on nmrpflash when I came across this article: openWRT unbricking guide for the R6220, in which it was mentioned **For Windows users, ethernet cable must be connected to a switch or nmrpflash would fail to operate.**
So I decided to give it a try out of desperation. Added a switch between the laptop and the router, BOOM! “Advertising NMRP server on enet…” started. I don’t know why adding a switch made such a big difference or why it only applies to Windows users but apparently enough of other people have found this tip useful. You might want to consider adding it in your README.

I found keeping a separate DOS window open with “ping 192.168.1.1 -t” running pretty handy in helping me to decide on the timing of when to start the nmrpflash command. Since the router is in a boot loop, there is infinite chances for you to try. The most reliable moment for me to start nmrpflash command is when all lights go out, so that the program is advertising when the router starts to respond to the ping.

Also I found that I always have to try the command twice in order to upload the firmware. The first try always timeout even when the connection is established, but all I have to do is use up arrow to rerun the command immediately after the first error. Works every time.

Sample log below:

C:\Users\eric_\Downloads>nmrpflash -i net0 -f R8500-V1.0.2.134_1.0.99.chk
Advertising NMRP server on net0 ... |
Received configuration request from 50:6a:03:b3:c7:12.
Sending configuration: 10.164.183.252/24.
Timeout while waiting for TFTP_UL_REQ.

C:\Users\eric_\Downloads>nmrpflash -i net0 -f R8500-V1.0.2.134_1.0.99.chk
Advertising NMRP server on net0 ...
Received TFTP_UL_REQ while waiting for CONF_REQ!
Received upload request without filename.
Uploading R8500-V1.0.2.134_1.0.99.chk ... OK
Waiting for remote to respond.
Received keep-alive request (31).
Remote finished. Closing connection.
Reboot your device now.

"rtnl_neigh_delete: Object not found" in Linux

Hi, I was trying to use my linux laptop to fix my R6220, but it always give this error:

(jessie)trx@localhost:~$ sudo ./nmrpflash -vvv -i wlan0 -f ~/Downloads/backups/R6220_V1.1.0.50_1.0.1.img 
Adding 10.164.183.253 to interface wlan0.
Advertising NMRP server on wlan0 ... /
Received configuration request from 40:5d:82:fc:b6:b0.
Sending configuration: 10.164.183.252, netmask 255.255.255.0.
rtnl_neigh_delete: Object not found
Timeout while waiting for TFTP_UL_REQ.

The version is nmrpflash 0.9.12. After switch to windows system, it worked out.

Netgear D6220

I used the tool successfully on the D6220 with a .chk file from the netgear site. Used V1.0.0.16_1.0.16 because the newer fw file was too big(36mb)

The flash command need to be run twice first time prints
Timeout while waiting for TFTP_UL_REQ.
Then on the second time it works correctly

Unable to flash D7000 - Protocol Error

I've been having an issue flashing a D7000 router I just picked up.

My Macbook Pro is connected directly to the via an ethernet cable and ethernet to usb dongle

nmrpflash -i en7 -f D7000-V1.0.1.70_1.0.1.img -vvv

results in:

Adding 10.164.183.253 to interface en7.
Advertising NMRP server on en7 ... |
Received configuration request from [mac].
Sending configuration: 10.164.183.252, netmask 255.255.255.0.
delete: cannot locate 10.164.183.252
Received upload request without filename.
Using remote filename 'D7000-V1.0.1.70_1.0.1.img'.
Uploading D7000-V1.0.1.70_1.0.1.img ... << WRQ(D7000-V1.0.1.70_1.0.1.img, octet)
<< WRQ(D7000-V1.0.1.70_1.0.1.img, octet)
>> ACK(0)
<< DATA(1)
>> ACK(1)
<< DATA(2)
>> ACK(2)

ACK(0)
<< DATA(1)
ACK(1)
.
.
<< DATA(65532)
>> ACK(65532)
<< DATA(65533)
>> ACK(65533)
<< DATA(65534)
>> ACK(65534)
<< DATA(65535)
>> ACK(65535)
<< DATA(0)
<< DATA(0)
<< DATA(0)
>> ACK(65535)
Expected ACK(0), got ACK(65535).
<< DATA(0)
<< DATA(0)
>> ACK(65535)
Expected ACK(0), got ACK(65535).
<< DATA(0)
<< DATA(0)
>> ACK(65535)
Expected ACK(0), got ACK(65535).
<< DATA(0)
<< DATA(0)
>> ACK(65535)
Expected ACK(0), got ACK(65535).
<< DATA(0)
<< DATA(0)
>> ACK(65535)
Expected ACK(0), got ACK(65535).
<< DATA(0)
<< DATA(0)
>> ACK(65535)
Expected ACK(0), got ACK(65535).
Protocol error; bailing out.

As far as I'm aware, the D7000 is the same chipset as the R7000 but with a DSL modem attached, so I'm unsure as to why it's having issues.

Any ideas on what to do next? I have a UART into the router available for troubleshooting.

I have exactly the same problem as issue #14 and #13 but unfortunately the fix provided didn't work in my case

I was running a version of XWRT on a R7000, and to revert back to original, I used this firmware:
https://mega.nz/#F!ct9zUaCS!lG4g5i5SDhSzG_NH-QSl1g?cpsnBYBQ
Version R7000-V1.0.3.80_1.1.38.zip

The router still works fine, but I can't upload ANY firmware on the web page, tried different browsers etc. I get this error:
"This firmware file is incorrect! Please get the firmware file again and make sure it is the correct firmware for this product. "

Resetting to factory settings both in the GUI and through the reset button made not difference. It's gives the same error even using the GUI native online update feature.

After searching a lot I found this tool, and after a steep learning curve to get it to this point, I have the same problem as the issues mentioned in the title (#13 and #14 ):

"OK
Waiting for remote to respond.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Received configuration request from 68:fd:3a:47:dd:85.
Sending configuration: 10.164.183.252/24.
Timeout while waiting for TFTP_UL_REQ."

I tried using the the firmware you provided , with a modified version number, but in my case, it still doesn't work...
I'm not sure where the problem is, I'm thinking it's not your software, but decided to ask for some help... If there some way to force flash what I want.

Thanks!

Donation options?

Hey @jclehner - this utility saved my ass when I bricked a friend's router. I would love to send a little love your way - can you send up a donate link?

I've heard good things about https://www.buymeacoffee.com/, and I'm sure there are other platforms out there. Keep us posted.

Cannot flash R6220

It has been reported to work in the past (#3), but it doesn't with my router.

sudo ./nmrpflash -vvv -i enp0s25 -f ../R6220_FW_V1.1.0.34_1.0.1/R6220_V1.1.0.34_1.0.1.img
Adding 10.164.183.253 to interface enp0s25.
Advertising NMRP server on enp0s25 ... -
Received configuration request from 40:5d:82:dd:61:60.
Sending configuration: 10.164.183.252, netmask 255.255.255.0.
Received upload request with empty filename.
Using remote filename '../R6220_FW_V1.1.0.34_1.0.1/R6220_V1.1.0.34_1.0.1.img'.
Uploading R6220_V1.1.0.34_1.0.1.img ... << WRQ(R6220_V1.1.0.34_1.0.1.img, octet)
<< WRQ(R6220_V1.1.0.34_1.0.1.img, octet)
<< WRQ(R6220_V1.1.0.34_1.0.1.img, octet)
<< WRQ(R6220_V1.1.0.34_1.0.1.img, octet)
<< WRQ(R6220_V1.1.0.34_1.0.1.img, octet)
<< WRQ(R6220_V1.1.0.34_1.0.1.img, octet)
<< WRQ(R6220_V1.1.0.34_1.0.1.img, octet)
<< WRQ(R6220_V1.1.0.34_1.0.1.img, octet)
<< WRQ(R6220_V1.1.0.34_1.0.1.img, octet)
Timeout while waiting for ACK(0)/OACK.

Am I doing something wrong?

Works great with Netgear R6220

Just for record, not a real issue.
Many thanks for your great works, your tool helps to unbricked my Netgear R6220 just now.
The device comes with a nand flash, it is not possible for me to recover it without this tool.

NMRP_R6220.txt

After flashing stock firmware i still get the LuCI Interface from OpenWrt

Hey, I just flashed the stock firmware for my R6220 from netgear but when i try to connect to the router via 192.168.1.1 i get the LuCI Interface instead of the netgear one. See this pic. routerlogin.net doesnt worke ither, it just brings me to https://www.netgear.com/home/products/networking/routerlogincom.html even after clearing my browser cache.

EDIT: my log is: https://pastebin.com/fZAstkPb

Works with Netgear R6400v2

On an R6400v2 remove the CHK file from the zip you download from Netgear.
eg. use -f R6400v2-V1.0.4.78_10.0.55.chk NOT ZIP

Note: I was bricked by an update to R6400v2-V1.0.4.82_10.0.57
I used nmrpflash to bring it back.

R6220- infinite loop of "sending configuration"

Hi. I got the program working, and everything. However it refuses to fully flash the stock firmware for some reason. It goes as far as "waiting for remote to respond," and then it goes to "sending configuration 10.164.183.252" I have included the commands and feedback (or whatever the name is for it, not sure what it is supposed to be called) in this post as well.

Any suggestions on how to fix this? I would love to get my router working again.
Thanks!

C:\Users\username\Desktop\r6220 firmware>nmrpflash -vvv -i net4 -f R6220_V1.1.0.100_1.0.1.img
net4: \Device\NPF_{D44A643D-B3EC-4982-A49D-1B054D64A6B4}
Adding 10.164.183.253 to interface net4.
Advertising NMRP server on net4 ... /
Received configuration request from a0:04:60:a3:c1:00.
Sending configuration: 10.164.183.252/24.
Received upload request without filename.
Using remote filename 'R6220_V1.1.0.100_1.0.1.img'.
Uploading R6220_V1.1.0.100_1.0.1.img ... << WRQ(R6220_V1.1.0.100_1.0.1.img, octet)
<< WRQ(R6220_V1.1.0.100_1.0.1.img, octet)

ACK(0)
<< DATA(1)
ACK(1)
OK
Waiting for remote to respond.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Received configuration request from a0:04:60:a3:c1:00.
Sending configuration: 10.164.183.252/24.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Received CONF_REQ while waiting for TFTP_UL_REQ!
Received configuration request from a0:04:60:a3:c1:00.
Sending configuration: 10.164.183.252/24.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Received CONF_REQ while waiting for TFTP_UL_REQ!
Received configuration request from a0:04:60:a3:c1:00.
Sending configuration: 10.164.183.252/24.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Received CONF_REQ while waiting for TFTP_UL_REQ!
Received configuration request from a0:04:60:a3:c1:00.

R6120 will not restart

I have a Netgear R6120. I did an update with the router login page from Netgear, and it crashed. I have tried to tftp directions with no luck and found your fix and followed the steps line by line. It does complete the flash all the way to "reboot your device now" with the power led flashing. When i reboot, i get 1 of 2 responses:

1. if I just turn it off with the power button and turn it on, I get the ethernet led quickly flashes on and off, and then the power led comes on for 20 seconds, then the ethernet quickly flashes on and off, and then the power led comes on for 20 seconds and it continues this routine for 6 cycles and then the power light goes out and i get nothing again.
2. if I hold the factory reset button while turning it on, i get back to the power led alternating with the ethernet led

C:\Users\Jeff\Desktop\nmrpflash>nmrpflash -i net6 -f openwrt-19.07.3-ramips-mt76x8-netgear_r6120-squashfs-factory.img -A192.168.1.2 -a 192.168.1.1
Advertising NMRP server on net2 ... |
Received configuration request from 78:d2:94:70:7c:ae.
Sending configuration: 192.168.1.1/24.
Received upload request without filename.
Uploading openwrt-19.07.3-ramips-mt76x8-netgear_r6120-squashfs-factory.img ... OK
Waiting for remote to respond.
Received keep-alive request (3).
Remote finished. Closing connection.
Reboot your device now.

when I try to ping it:

C:\Users\Jeff\Desktop\nmrpflash>ping 192.168.1.1

Pinging 192.168.1.1 with 32 bytes of data:
Reply from 192.168.1.2: Destination host unreachable.
Reply from 192.168.1.2: Destination host unreachable.
Reply from 192.168.1.2: Destination host unreachable.
Reply from 192.168.1.2: Destination host unreachable.

Ping statistics for 192.168.1.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)

Any suggestions or is this router dead?

Successful nmrpflash on Netgear WNR3500U/L

Connected router at 192.168.1.1 directly to computer ethernet. I put nmrpflash.exe in system32 (Win10) and my firmware file on the root (C:). Ran nmrpflash: nmrpflash -i net7 -f x.chk. I powered router but it failed an ack. Used the cursor key to quickly re-run nmrpflash and after a few tries of some type of timing difficulties between running the flash and router boot, it responded:

C:\>nmrpflash -i net7 -f x.chk
Advertising NMRP server on net7 ... \
Received TFTP_UL_REQ while waiting for CONF_REQ!
Received upload request without filename.
Uploading x.chk ... OK
Waiting for remote to respond.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Received keep-alive request.
Remote finished. Closing connection.
Reboot your device now.

Success! Thanks!

R6220 unable to flash

I have somehow bricked a new 6220 router by flashing openwrt img file from the web GUI (original firmware) so i amtrying nmrpflash to unbrick it.

I have downloaded latest stock IMG from netgear support page.

This is what i get:

WillyPC /home/willy/Downloads #  ./ww/nmrpflash-master/nmrpflash -i enp0s20f0u2 -f R6220_V1.1.0.100_1.0.1.img
Advertising NMRP server on enp0s20f0u2 ... -
Received configuration request from 14:59:c0:ce:00:58.
Sending configuration: 10.164.183.252/24.
Received upload request without filename.
Uploading R6220_V1.1.0.100_1.0.1.img ... OK
Waiting for remote to respond.
Timeout while waiting for 0000.

Any suggestions?

The router of course does not boot.

R8000 not working.

Am i missing a step here?

record: R6800 okay

not a issue, just for recording. many thanks!
One thing is important:
run the command 'nmrpflash.exe -i net0 -a 192.168.1.1 -f RXXX_X.X.X.img' when the Power LED is on immediately, when the Power LED is on immediately, when the Power LED is on immediately!!!

cheers!

Netgear WNDR3800 works great thanks to you

today I bricked one for reasons of dumbness, and your software unbricked it for me.
I wonder if anyone has used this to unbrick the china version of this router.
Anywho, thanks a lot!

I appreciate it, thank you!

I used this,

nmrpflash -i eth0 -f EX2700-V1.0.1.8.img

Albeit my way of doing it was different due to the operating system being a bit odd,

eth0 was replaced with enp0s25, but yeah, I use a very niche linux distro so yeah.

Please add this to the list of supported routers for your software, I am sure other people will want to know. :)

Unable to flash R7000

Just got a brand new Netgear R7000 router. Something new that has crept into these routers is an inability to 'downgrade' firmware versions. For instance, trying to upload the initial .chk file for dd-wrt through the gui will result in 'this firmware is incompatible with your router'.

I have read that others have used nmrpflash successfully to rectify this issue and flash a different firmware. However, I am not having the same success.

I am using Windows 10, have installed npcap and all commands seem to be working fine. Windows firewall is off, comodo firewall and all antivirus, HIPS, etc are all off.
Anything that could interfere such as programs like syncthing, or other syncing or backup programs are exited.

My firmware file which is the dd-wrt initial load file of dd-wrt.K3_R7000.chk found at this page: http://www.desipro.de/ddwrt/K3-AC-Arm/ (renamed to ddwrt.chk) is in same folder with nmrpflash. I have also tried this with stock netgear .chk files that are lower version that I am currently running.

I am running a CMD window with administrator privileges.

This is what i'm doing:

C:\Program Files\Portable Programs\nmrpflash>nmrpflash -L
net0 192.168.1.2 d0:50::::0b (Ethernet)
net1 192.168.56.1 0a:00::::05 (VirtualBox Host-Only Network)

I then turn router off and turn it back on while immediately running:
nmrpflash -i net0 -a 192.168.1.1 -A 192.168.1.2 -f ddwrt.chk -vvv
net0: \Device\NPF_{43AC58E6-0C5F-43B2-**39-**AECB}
Adding 192.168.1.2 to interface net0.
Advertising NMRP server on net0 ... -
Received configuration request from 3c:37::::f0.
Sending configuration: 192.168.1.1, netmask 255.255.255.0.
Timeout while waiting for TFTP_UL_REQ.

For some reason, it times out here after just a few seconds so then i paste it in immediately below and it continues:

nmrpflash -i net0 -a 192.168.1.1 -A 192.168.1.2 -f ddwrt.chk -vvv
net0: \Device\NPF_{43AC58E6-0C5F-43B2-**39-********AECB}
Adding 192.168.1.2 to interface net0.
Advertising NMRP server on net0 ...
Received TFTP_UL_REQ while waiting for CONF_REQ!
Received upload request without filename.
Using remote filename 'ddwrt.chk'.
Uploading ddwrt.chk ... << WRQ(ddwrt.chk, octet)

ACK(0)
<< DATA(1)
ACK(1)
<< DATA(2)
ACK(2)
<< DATA(3)
ACK(3)
<< DATA(4)
ACK(4)
<< DATA(5)
ACK(5)
<< DATA(6)
ACK(6)
<< DATA(7)
ACK(7)
<< DATA(8)
ACK(8)
<< DATA(9)
ACK(9)
<< DATA(10)
ACK(10)

this continues many thousands of lines down, deleted due to redundancy

<< DATA(46409)

ACK(46409)
OK
Waiting for remote to respond.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Received configuration request from 3c:37:::**:f0.
Sending configuration: 192.168.1.1, netmask 255.255.255.0.
Timeout while waiting for TFTP_UL_REQ.

At this point, after a few minutes the router boots up like nothing happened and nothing has been flashed. Any help would be appreciated!

Trying to flash expressvpn on to an R7000 router

I've played around with this for ages but haven't managed to crack it.

MBP connected directly via ethernet cable and ethernet to usb dongle

nmrpflash -i en7 -a 192.168.1.1 -A 192.168.1.10 -f express.chk -vvv

results in: -

Adding 192.168.1.10 to interface en7.
Advertising NMRP server on en7 ... |
Received TFTP_UL_REQ while waiting for CONF_REQ!
Received upload request without filename.
Using remote filename 'express.chk'.
Uploading express.chk ... << WRQ(express.chk, octet)

ACK(0)
<< DATA(1)
ACK(1)
.
.
.>> ACK(22272)
<< DATA(22273)
ACK(22273)
OK
Waiting for remote to respond.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Ignoring extra upload request.
Received configuration request from 14:59:c0:89:f9:4c.
Sending configuration: 192.168.1.1, netmask 255.255.255.0.
192.168.1.1 (192.168.1.1) deleted
set: can only proxy for 192.168.1.1

Any pointers on what to do next? I bought the R7000 especially for expressvpn router as they advised it was supported, obviously not since the latest firmware release.

Andy

make error

Hi,

When I try to compile with make I get this error:

make: pkg-config: Command not found
cc -c -Wall -g -DNMRPFLASH_VERSION="0.9.13-10-ged27079" ethsock.c -o ethsock.o
ethsock.c:42:10: fatal error: netlink/route/addr.h: No such file or directory
#include <netlink/route/addr.h>
^~~~~~~~~~~~~~~~~~~~~~
compilation terminated.
make: *** [Makefile:24: ethsock.o] Error 1

How to fix this?

It's a Debian 10 x64 system.

Thanks.

Help with Flashing Netgear r6220

I'm noob and bricked the router with the wrong bin file and now I am having trouble recovering.
Following the instructions and a lot of trial and error, I am not certain what have done wrong and/or right. Into hour 6 and going to shutdown for now. I am working on windows machine, but, could switch to a Ubuntu distro on a laptop, if that is a better way to flash the OEM firmware back.

Work failed

C:\>nmrpflash.exe -i net0 -a 192.168.1.1 -f R6300v2-V1.0.4.6_10.0.76.chk
pcap_setdirection: Setting direction is not implemented on this platform