Posted on Di 26 Oktober 2010

My dear friend nbd did some redboot modifications some time ago and now he ported it to ubnt nanostation-2 and Bullet-2.

The Problem: whenever i brick a nanostation or bullet, i have to climb to the roof and press the resetbutton to reflash the device. During cold and windy evenings, it is an experience you do not want to repeat.

An old Linksys WRT-54gl has a nvram variable called boot_wait, if it is enabled, you have 5 seconds to send a firmware image via tftp, so you just powerccle your device and send a new firmware after bricking it. As most devices on the roof are powered over ethernet, you can do this without climbing on the roof.

So nbd patched a Redboot to do the same and i will decribe how to flash the bootloader via the serial console.

First, get your tftpserver up and running, serving the files from redboot-ar231x.tar or the openwrt-mirror. Test your tftpserver. I have my tftpserver running on, feel free to change the address and chage it in the example.

Connect your serial console, 9600 baud, i usually use screen as a terminal programm.

Plug your device in and press ctrl-c as soon as the message "== Executing boot script in 1.000 seconds - enter \^C to abort" comes.

now, issue following commands:

::: {#_mcePaste} ip_address -l -h :::

::: {#_mcePaste} fis init :::

::: {#_mcePaste} load -r -b %{FREEMEMLO} ubnt_ns2.rom :::

::: {#_mcePaste} fis create RedBoot :::

After this, use "reset" or powercycle the device and it should expect a new firmwareimage via tftp. Use the openwrt combined image.