nmrpflash - Netgear Unbrick Utility

nmrpflash

Prebuilt binaries for Linux, macOS and Windows are available here (Npcap is required on Windows). FreeBSD packages can be fetched and installed using the FreeBSD

pkg

Usage: nmrpflash [OPTIONS...]

Options (-i, and -f or -c are mandatory):
 -a      IP address to assign to target device
 -A      IP address to assign to selected interface
 -B              Blind mode (don't wait for response packets)
 -c     Command to run before (or instead of) TFTP upload
 -f    Firmware file
 -F    Remote filename to use during TFTP upload
 -i   Network interface directly connected to device
 -m         MAC address of target device (xx:xx:xx:xx:xx:xx)
 -M     Subnet mask to assign to target device
 -t     Timeout (in milliseconds) for NMRP packets
 -T     Time (seconds) to wait after successfull TFTP upload
 -p        Port to use for TFTP upload
 -R      Set device region (NA, WW, GR, PR, RU, BZ, IN, KO, JP)
 -v              Be verbose
 -V              Print version and exit
 -L              List network interfaces
 -h              Show this screen

Using nmrpflash

Download the correct firmware image for your device. When downloading from the Netgear site, the firmware is usually contained in a

.zip

.chk

.bin

.trx

.img

Now, using an Ethernet cable, connect your Netgear router to the computer that will run

nmrpflash

1

Next, you'll have to determine which network interface corresponds to the one connected to the Netgear router. All available interfaces can be listed using

# nmrpflash -L
eth0      192.168.1.2  c0:de:fa:ce:01:23
eth2      0.0.0.0      ca:fe:ba:be:45:67
wifi0     10.0.10.138  de:ad:be:ef:89:ab

For the rest of this example, let's assume that your router is connected to

eth2

EX2700-V1.0.1.8.img

First of all, turn off the router. Then start

nmrpflash

# nmrpflash -i eth2 -f EX2700-V1.0.1.8.img
Waiting for physical connection.

As soon as you see the

Waiting for physical connection.

nmrpflash

Advertising NMRP server on eth2 ... /
Received configuration request from fe:ed:1b:ad:f0:0d
Sending configuration: 10.164.183.252/24
Received upload request: filename 'firmware'.
Uploading EX2700-V1.0.1.8.img ...
Upload successful.
Waiting for remote to respond.
Received keep-alive request (11).
Remote finished. Closing connection.
Reboot your device now.

Now reboot the device, and you're good to go.

Common issues

In any case, run

nmrpflash

-vvv

"Error while loading shared libraries: ..." (Linux)

You must install your Linux distribution's

libpcap

libnl-3

On Debian based distros (such as Ubuntu) you can install these dependencies with

sudo apt install libpcap libnl-3

"The program can't start because wpcap.dll is missing" (Windows)

Install Npcap. For

nmrpflash

Version 0.9.13 was the last version to support Windows XP.

"nmrpflash cannot be opened because the developer cannot be verified." (macOS)

Go to

 -> System Preferences -> Security & Privacy

General

Allow anyway

nmrpflash

If that doesn't work, try this.

"No suitable network interfaces found."

Make sure the network interface is up (wireless interfaces are not supported). On Windows, try restarting the WinPcap service (commands must be run as administrator):

C:\> net stop npf
C:\> net start npf

"No response after 60 seconds. Bailing out."

The router did not respond. Always run

nmrpflash

If that still doesn't work, you can try "blind mode", which can be invoked using

-B

-m xx:xx:xx:xx:xx:xx

nmrpflash

It's also possible that your device does not support the NMRP protocol.

"Timeout while waiting for ACK(0)/OACK."

The device did not respond to

nmrpflash

nmrpflash

10.164.183.252

10.164.183.253

-i

-a

192.168.1.0/24

-a 192.168.1.252

-A

"Timeout while waiting for CLOSE_REQ."

After a successful file upload,

nmrpflash

-T

It's entirely possible that the image was flashed successfully, but the operation took longer than 5 minutes.

"Address X/Y cannot be used on interface Z."

nmrpflash

nmrpflash

"IP address of X has changed. Please assign a static IP to the interface."

This can happen if the network interface in question automatically detects that the network cable has been connected, and your computer tries to reconfigure that interface (NetworkManager on Linux does this for example) - this can usually be disabled.

"Received keep-alive request."

This usually means that flashing is in progress. On some devices, you may get a few hundred keep-alive requests before it eventually finishes!

"TFTP block rollover. Upload might fail!"

By default, file transfers using TFTP are limited to

65535 * 512

"Ignoring extra upload request."

Extraneous upload requests are usually sent by the device if the image validation failed. Some possible causes are:

• If you downloaded a firmware that's contained in an archive (a

  .zip

  for example), you must extract this file, and then use the contained firmware file as the argument to the

  -f

  parameter. Some examples for file extensions used for firmware:

  .chk

  ,

  .bin

  ,

  .trx

  ,

  .img

  .

• Some devices prevent you from downgrading the firmware. See if it works with the latest version available for your device. If you're already using the latest version, it might be possible to patch the version info of the firmware file. A future version of

  nmrpflash

  might incorporate an auto-patch feature for these cases.

• Your device might expect a different image format for

  nmrpflash

  than when flashing via the web interface.

"Timeout while waiting for 0000." after "Waiting for remote to respond."

This could indicate that the device hasn't finished flashing, after the default timeout (5 minutes until version

0.9.4

-T 

-T 1800

"bind: Cannot assign requested address"

Specify the address of the router (

-a

-A

-A 10.0.0.2 -a 10.0.0.1

or

-A 192.168.1.2 -a 192.168.1.1

Building and installing

Linux, Mac OS X, BSDs

On Linux, developer packages for

libpcap

libnl

$ sudo apt install libpcap-dev libnl-3-dev

Then, it's as easy as

$ make && sudo make install

On FreeBSD (assuming the ports infrastructure is installed and you have root permissions):

$ cd /usr/ports/sysutils/nmrpflash
$ make install

Or install the FreeBSD binary package with:

$ pkg install nmrpflash

Windows

The repository includes a DevCpp project file (

nmrpflash.dev

nmrpflash

Donate

You can buy me a coffee if you want, but please consider donating the money for charity instead - Médecins Sans Frontiers comes to mind, but any other organization, local or international, that you think deserves support will do. Thank you!