It seems likely that the best approach for re-flashing will be to use the TFTP option provided by the [CommonFirmwareEnvironment CFE boot firmware].
These are the instructions I found on http://www.wl500g.info/:
1. Extract the two "trx" files from the "nas" firmware file. There is a "disk" trx file and a "flash" trx file. The TFTP upload will only send the "flash" trx file. (instructions on how to extract will follow presently.)
1. Connect a computer with static IP address 192.168.1.50/24 directly to the WL-700gE port LAN 1.
1. Unplug the WL-700gE for around 20 seconds
1. Press and hold the orange EZSetup button while plugging in router
1. As soon as the blue Ready LED turns on or starts blinking, release EZS button
1. Use TFTP to put the flash trx file to host 192.168.1.1 port 69
tftp> connect 192.168.1.1 tftp> bin tftp> put foo.trx
[DohOfTheDay don't forget the "bin" command]
When one powers-on the device with the orange EZS button pressed, the serial console shows the following:
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: ¥| 12¤ë 29 20:36:58 CST 2005 (root@localhost.localdomain)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
Initializing Arena
Initializing Devices.
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.90.23.0
rndis0: Broadcom USB RNDIS Network Adapter (P-t-P)
CPU type 0x29006: 264MHz
Total memory: 67108864 KBytes
Total memory used by CFE: 0x80800000 - 0x8089BA00 (637440)
Initialized Data: 0x80831B70 - 0x80834250 (9952)
BSS Area: 0x80834250 - 0x80835A00 (6064)
Local Heap: 0x80835A00 - 0x80899A00 (409600)
Stack Area: 0x80899A00 - 0x8089BA00 (8192)
Text (code) segment: 0x80800000 - 0x80831B70 (203632)
Boot area (physical): 0x0089C000 - 0x008DC000
Relocation Factor: I:00000000 - D:00000000
Device eth0: hwaddr 00-17-31-2A-90-30, ipaddr 192.168.236.137, mask 255.255.255.0
gateway not set, nameserver not set
Null Rescue Flag.
Null Rescue Flag.
10 seconds to Rescue mode...
Null Rescue Flag.
9 seconds to Rescue mode...
Null Rescue Flag.
8 seconds to Rescue mode...
Null Rescue Flag.
7 seconds to Rescue mode...
Null Rescue Flag.
6 seconds to Rescue mode...
Null Rescue Flag.
5 seconds to Rescue mode...
Null Rescue Flag.
4 seconds to Rescue mode...
Null Rescue Flag.
3 seconds to Rescue mode...
Null Rescue Flag.
2 seconds to Rescue mode...
Null Rescue Flag.
1 seconds to Rescue mode...
Null Rescue Flag.
Hello!! Enter Rescue Mode: (by Force)
Reading :: TFTP Server.
Failed.: Timeout occuredS
So that pretty much shows how to do it. Just hold down the EZS button for a while until the unit enters rescue mode. Note that the device will somehow retain the IP address it last had; maybe that's written to NVRAM. You can reset this to the default 192.168.1.1 by pressing the black "Reset" button on the back of the unit; when the device reboots, it will have the defaults restored.
During the countdown to rescue mode, the "Ready" LED flashes once per second. When the device enters rescue mode, the "Ready" light goes out altogether.
The last two lines, when it's trying to listen for incoming TFTP puts, repeat indefinitely until one hits control-C over the serial console -- at that point, one gets a CFE> prompt.
Presumably the thing that needs to be uploaded via TFTP is the flash trx image file, which is only one part of the nas firmware file.
From the CFE prompt, you can do some things, I haven't experimented much. But you can do this:
CFE> help Available commands: rndis Broadcom USB RNDIS utility. et Broadcom Ethernet utility. nvram NVRAM utility. reboot Reboot. printdefault Display the environment default variables embeded in the bootloader flash Update a flash memory device autoboot Automatic system bootstrap. batch Load a batch file into memory and execute it go Verify and boot OS image. boot Load an executable file into memory and execute it load Load an executable file into memory without executing it write_block Write a block of memory write Write an address of memory read Read a region of memory save Save a region of memory to a remote file via TFTP ping Ping a remote IP host. arp Display or modify the ARP Table ifconfig Configure the Ethernet interface unsetenv Delete an environment variable. printenv Display the environment variables setenv Set an environment variable. help Obtain help for CFE commands For more information about a command, enter 'help command-name' *** command status = 0
And printenv shows:
Variable Name Value -------------------- -------------------------------------------------- BOOT_CONSOLE uart0 CFE_VERSION 1.0.37 CFE_BOARDNAME BCM947XX CFE_MEMORYSIZE 67108864 NET_DEVICE eth0 NET_IPADDR 192.168.236.137 NET_NETMASK 255.255.255.0 NET_GATEWAY 0.0.0.0 NET_NAMESERVER 0.0.0.0 STARTUP go; *** command status = 0
Moreover, printdefault shows:
CFE> printdefault FLSH b boardtype=0x042f boardnum=44 boardrev=0x10 boardflags=0x0110 clkfreq=264 sdram_init=0x0009 sdram_config=0x0062 sdram_refresh=0x0000 sdram_ncdl=0 et0macaddr=00:17:31:2A:90:30 et0phyaddr=30 et0mdcport=0 et1macaddr=40:10:18:00:00:2c et1phyaddr=31 et1mdcport=1 watchdog=5000 reset_gpio=7 dl_ram_addr=a0001000 os_ram_addr=80001000 os_flash_addr=bfc40000 scratch=a0180000 boot_wait=off wait_time=1 lan_ipaddr=192.168.1.1 lan*** command status = 0
the first line is obviously mangled, and I think the last one is as well. But you can see that the default IP 192.168.1.1 is in the default environment. The clock frequency is also there as a default -- probably one could clock the board up to the standard 300MHz if one wanted.
That's all for now.