I bricked (and recovered) a Meraki Z1

I bricked (and recovered) a Meraki Z1

I purchased a used Meraki Z1 on eBay (~ $70) because it is supported by LEDE and seems to be pretty good hardware. It has 4 GbE LAN ports, 1 WAN port, and dual-concurrent 802.11n radios 2×2 MIMO. The LEDE support is important because I am not paying Cisco a yearly license to put my device in their cloud. Unfortunately, while flashing it the first time around I ended up with a brick.


Bricked after using beta build on Github. Lesson learned – Build from source.

  1. Build from source
  2. Follow directions and flash
  3. Win

I settled on ordering another Z1 to attempt recovering the broken device. I also ordered a NAND programmer and two extra Hynix H27U1G8F2BTR flash chips.

The idea was to remove the flash chips on each device, pull full backups, modify the broken image, reflash, and solder the chips back on. This was a good theory, but after spending some time on it, I never really figured out how to modify the backup image. If anyone has any suggestions for this then please let me know in the comments.

The bricked Z1 would also not boot using the full backup image from the good device. I imagine Meraki/Cisco have some built-in verification checks.

Sadly  there are no screenshots of any of the boot errors, but I did DuckDuckGo this at the time:

meraki z1 magic is not correct bootkernel 1 failed!

For whatever reason, the initramfs-kernel.bin for the Z1 is not provided on the LEDE repository. After not having much luck modifying the backup image, I decided to build from source, and try the flash process again.

This worked!

It then allowed me to pull another full NAND backup, flash that to a new chip, and solder it onto the broken device. Once this was complete both devices were booting into LEDE.

Soldering these flash chips requires a good soldering iron and a lot of experience. I imagine it would be possible to perform the same process with the JTAG interface.

A bus pirate and bus blaster are on the way…

2 thoughts on “I bricked (and recovered) a Meraki Z1

  1. hai joe,

    can u share ur trick to root meraki z1?
    i have been root meraki z1 but not successful, any trick or advice?


Leave a Reply to Joe Cancel reply

Your email address will not be published. Required fields are marked *