Restoring the Netfaster WLAN 3 firmware

In a previous post I described how you can backup the flash image of the Netfaster WLAN 3. In this post I’ll show you how you can restore the image by writing directly to the modem’s flash.

To restore the image we will be using the following hardware and software:

  • Bus Pirate to connect computer and modem flash chip.
  • (Optional) Pomona 5250 SOIC 8-pin Test Clip, to simplify the task of attaching the Bus Pirate to the flash chip.
  • flashrom to perform the write to flash.

(I admit that the 5250 Test Clip is an expensive little piece of equipment – currently going for about $12 – but I find that it is nearly impossible to connect directly to the flash chip otherwise; the chip pins are 0.41 mm wide, spaced 1.27 mm apart. Perhaps you could try one of these (just the cable and clip) instead of the 5250; they should be cheaper. As I said above, this is optional).

The flash chip is depicted below. It is the Macronix (MXIC) MX25L1606E M2 (2 MB, SPI, 200mil 8-SOP).

Netfaster WLAN 3 flash chip

The Netfaster WLAN 3 PCB. The position of the flash chip is shown.

Implement the following connection between Bus Pirate and flash chip. The modem must be turned off.


The Bus Pirate connected to the flash chip.

Bus Pirate pin Flash Chip pin
CS 1
3.3v 3
3.3v 7
3.3v 8

Now connect the Bus Pirate to your computer via USB.

With the connection in place, we are ready to write the image file to the flash. (Here is the image backup I created in that previous post).

Do not turn on the modem. If you do, flashrom won’t be able to write to the flash. Assuming the image backup is named fw.bin and that you have installed flashrom (sudo apt-get install flashrom on Ubuntu, else check, open a command terminal and issue the following command:

$sudo flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -w fw.bin

This will start the process of writing fw.bin to the flash. You will get the following output:

flashrom v0.9.6.1-r1563 on Linux 3.13.0-37-generic (x86_64)
flashrom is free software, get the source code at

Calibrating delay loop... OK.
Found Macronix flash chip "MX25L1605" (2048 kB, SPI) on buspirate_spi.
Reading old flash chip contents... done.
Erasing and writing flash chip... Erase/write done.
Verifying flash... VERIFIED.          

The whole process lasts about 12 minutes, with the ‘Reading old flash contents‘ and ‘Verifying flash‘ stages taking the most time. Just be patient. Notice that flashrom v0.9.6.1 reports having found an MX25L1605 flash chip, even though the modem uses an MX25L1606E. This is ok.

Once the process is completed you can disconnect the Bus Pirate and boot the modem. You should be good to go!

One last note: when you attempt to run flashrom, you may get an error along the lines of:

Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI) on
This flash part has status NOT WORKING for operations: PROBE READ ERASE

In this case proceed as follows:

  1. Disconnect the Bus Pirate from the computer USB port (not from the modem).
  2. With the modem PSU connected, do a quick on/off of the modem. Turn it on, wait 2 seconds, turn it off.
  3. Disconnect the modem PSU.
  4. Again do a quick on/off without the PSU connected.
  5. Connect the modem PSU but do not turn on the modem.
  6. Lastly, connect the Bus Pirate via USB, and rerun flashrom.

flashrom should now be able to identify the modem’s flash chip properly.

(I admit that the above procedure seems a bit like voodoo to me, but it’s the only way I’ve found to make flashrom identify the chip. Anybody can explain what is going on behind the scenes?)

If you have any questions or if you spotted any errors or omissions, please leave me a comment.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: