I accidentally completely erased the Winbond W25Q128FV SPI flash chip on my MikroTik hEX S (RB760iGS, MMIPS architecture) using an external hardware programmer without making a backup first.
To give some context on how I got here: I had forgotten the admin password to the device and tried to perform a standard hardware reset using the physical button. However, the router refused to reset. It turns out the previous configuration had the RouterBOOT button protection enabled (protected-routerboot), which completely disables the hardware reset button. My only option to regain access was to desolder the flash chip and use an external programmer, but I mistakenly executed a full erase without a prior read/backup.
Right now, the router is completely dead. I connected a TTL serial console adapter to the onboard UART pins to check for life, but it gives absolutely no output (completely blank console), confirming that the bootloader is entirely gone.
I tried flashing a full 16MB dump from a working hEX (RB750Gr3) since they share the same MT7621 processor, but due to hardware differences (SFP cage, RAM config, etc.), the hEX S gets stuck in a silent boot loop and still won't initialize Netinstall or show anything useful on the TTL console.
Could anyone please share a working, clean 16MB SPI flash dump (.bin or .hex) specifically extracted from a MikroTik hEX S (RB760iGS)?
I am fully aware that I will need to patch/change the MAC addresses and handle the RouterOS License ID issue via MikroTik support afterward. I just need a working dump structure to get the hardware bootloader initialization running properly so the device can respond to Netinstall.
You were given a link to the firmware on 4PDA.
There’s a chance you won’t lose your license.
First, try flashing the entire firmware from the donor device. If the device works, you can try to restore the license. To restore the license, you’ll need the serial number and software ID. If the dump from the donor device is version 6.49 or lower, you can try to restore the factory license.
I thought Netinstall can write OS to an absolutely clean flash chip. I was replacing flash on my tile router with a new one and had no problems installing RouterOS on it. Or it has 2 different chips for OS and bootloader?
I thought Netinstall can write OS to an absolutely clean flash chip. I was replacing flash on my tile router with a new one and had no problems installing RouterOS on it. Or it has 2 different chips for OS and bootloader?
Hmmm, It's interesting.
How did you manage to boot after replacing the flash?
My first mikrotik router (RB493G) was turned into a non-bootable brick after I replaced a flash on it. All as a result of excessive flash wear at the time. I don't remember the exact details on how it was failing as it was years ago. At that time I reached out to Mikrotik support, and they said they couldn't help.
Mine was not able to boot with the new flash. If I remember correctly, RB493G "complained" about the license so I pulled the newly soldered flash out again and re-soldered the original back onto the board (the one that was failing). The board didn't survive as some traces delaminated beyond repair so whole package went into the recycling bin.
The devices that have a nand flash also have a 16 MB nor flash. The latter contains the bootloader (and everything else that's required for startup) and also the device-specific things, including the license, mac addresses, etc. Btw, the license is attached to the otp area/serial number of the nor flash as well.
This means that for these nor+nand devices replacing the nand is pretty straightforward, but for the ones that only have the nor chip it's painful.
I think the above is true for every device that has nand, but MT has many products, so I'm not entirely sure.
The flash memory is WInbond family 25Q128JVSM so its SPI programming and everything is stored here inside bootloader, checksums, second bootloader probaby etc. SOIC8 SPI NOR flash
My comment referred to teslasystem's easy win with simply using netinstall. He has a system that has the nand+nor arrangement. You have a device that only has a nor chip - obviously for these everything goes on that one.
Restoring one of these would not be very difficult if you had the dump from your specific device. Well, that ship has sailed.
I'd gladly send you a dump of an original device, but I don't have the specific model.
Even if you obtain a dump, you're looking at an uphill battle. I would consider that maybe it's not even worth it. Good luck though if you try.
It's really not that complicated.
You need to fill in the data for the “hard config” section; if the original data had been preserved, you could just replace it with the data from the donor's dump.
Did you download the dump from the link you were given on that other forum?
