Archer C5 1.20 Bricked - Hours Trying to Recover - Please He

Post new topic   Reply to topic    DD-WRT Forum Index -> Atheros WiSOC based Hardware
Author Message
bzowk
DD-WRT Novice


Joined: 15 Mar 2012
Posts: 7

PostPosted: Wed Jan 13, 2016 20:44    Post subject: Archer C5 1.20 Bricked - Hours Trying to Recover - Please He Reply with quote
Hey Guys,

A few months ago, I saved up and purchased a new Archer C5 1.20 (TP-Link AC1200) from NewEgg. Once it arrived, I flashed it with the latest stable OpenWRT and it worked well. A couple of months later, I saw there was an updated OpenWRT firmware and decided to upgrade, but when doing so, carelessly flashed it with the firmware to be used from stock - not the upgrade version.

Now, I know what you may be saying and I get it - I used OpenWRT originally - not DD-WRT. I get it. The problem is that no one in OpenWRT's forums seems to be able to help so far. As I use DD-WRT on some other routers, I know how similar they can be - plus- your forums are so much better and have been trying to restore with DD-WRT, so wanted to post here, too.

The Issue
Since flashing the wrong firmware, the router goes into an infinite boot loop each time I power it on. Sad

I have spent hours, upon hours, upon hours trying to un-brick it. Many times I have felt I've come close, but can't seal the deal. Currently, I'm trying two different methods and have hit a roadblock on both. Details for each are below. If you have any suggestions, please let me know...

De-brick Method #1 of 2: Load Firmware via TFTP
Process Following
1. Attach router's LAN 1 port to PC and set PC to 192.168.0.66
2. Load TFTP and have firmware in it named "ArcherC5v1_tp_recovery.bin"
3. Hold down WPS button on router, power it on, wait until WPS light comes on (~5-6 seconds) then let go of WPS button

Result
I have the router connected via serial -> USB at the same time so can watch what happens. The echo from the latest attempt today is below. Seemingly, I have the wrong firmware, but have tried at least 30 including ones with boot, pre-stripped ones, factory ones, openwrt, ddwrt versions, plus ones for archer c7 - all with the same result
Exmaple of pre-stripped one I tried: http://www.friedzombie.com/tplink-stripped-firmware/

Code:
: cfg1 0x800c0000 cfg2 0x7214
eth1: ba:be:fa:ce:08:41
eth1 up
eth0, eth1
Setting 0x18116290 to 0x60c1214f
Using eth1 device
TFTP from server 192.168.0.66; our IP address is 192.168.0.86
Filename 'ArcherC5v1_tp_recovery.bin'.
Load address: 0x80060000
Loading: *#################################################################
 #################################################################
[i]Removed many similar hash lines to save space[/i]
 #######################################################
done
Bytes transferred = 16252928 (f80000 hex)
original_product_id = 75000001

 original_product_ver = 01

 recovery_product_id = c5000001

 recovery_product_ver = 01

 auto update firmware: product id verify fail!
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... Too big uncompressed streamLZMA ERROR 1 - must RESET board to recover

U-Boot 1.1.4 (Nov 26 2014 - 17:02:17)

ap135 - Scorpion 1.0DRAM: 
sri
Scorpion 1.0
ath_ddr_initial_config(178): (32bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x3, 0x1c)
Tap values = (0xf, 0xf, 0xf, 0xf)
128 MB
Flash Manuf Id 0x1, DeviceId0 0x20, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment

*** Warning *** : PCIe WLAN Module not found !!!
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0xe
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Scorpion  ----> S17 PHY *
Vlan config...
TEST: FINAL REG VAL after TX Calibration - 0x46000000
TEST: FINAL XMII VAL after RX Calibration - 0x56000000
TEST: FINAL ETH_CFG VAL after RX Calibration - 0x00028001
athrs17_reg_init: complete
: cfg1 0x80000000 cfg2 0x7335
eth0: ba:be:fa:ce:08:41
eth0 up
athrs17_reg_init_wan done
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x800c0000 cfg2 0x7214
eth1: ba:be:fa:ce:08:41
eth1 up
eth0, eth1
Setting 0x18116290 to 0x60c1214f
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... Too big uncompressed streamLZMA ERROR 1 - must RESET board to recover

U-Boot 1.1.4 (Nov 26 2014 - 17:02:17)

ap135 - Scorpion 1.0DRAM: 
.....................loop.............................



De-brick Method #2 of 2: Load Firmware Over Serial
Process Followed
1. Connect router to serial -> usb adapter and plug into laptop
2. Ensure driver is correctly loaded (Win10x64)
3. Launch Putty on COM port assigned using 115200/8/N/1/Flow Control Off
4. Boot Router
5. Constantly type "tpl" then enter to break the boot

Result
Everything initially works. I get the echo from the router's boot (shown below) and see it loop. The issue is that I can type "tpl" then enter (on keyboard with putty console open, typing the t, p, l, then enter keys) 1000 times and cannot break the boot to get a prompt. I've tried starting it from the moment I power on the router and even wrote a script that would send "tpl" enter every 200ms which I started after booting the router without luck.

I looked up other common "break" commands, but none worked. Below's the echo I get when simply powering on the router currently...

Code:
=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2016.01.13 13:40:19 =~=~=~=~=~=~=~=~=~=~=~=


U-Boot 1.1.4 (Nov 26 2014 - 17:02:17)

ap135 - Scorpion 1.0DRAM: 
sri
Scorpion 1.0
ath_ddr_initial_config(178): (32bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x3, 0x1c)
Tap values = (0xf, 0xf, 0xf, 0xf)
128 MB
Flash Manuf Id 0x1, DeviceId0 0x20, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment

*** Warning *** : PCIe WLAN Module not found !!!
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0xe
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Scorpion  ----> S17 PHY *
Vlan config...
TEST: FINAL REG VAL after TX Calibration - 0x46000000
TEST: FINAL XMII VAL after RX Calibration - 0x56000000
TEST: FINAL ETH_CFG VAL after RX Calibration - 0x00028001
athrs17_reg_init: complete
: cfg1 0x80000000 cfg2 0x7335
eth0: ba:be:fa:ce:08:41
eth0 up
athrs17_reg_init_wan done
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x800c0000 cfg2 0x7214
eth1: ba:be:fa:ce:08:41
eth1 up
eth0, eth1
Setting 0x18116290 to 0x60c1214f
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... Too big uncompressed streamLZMA ERROR 1 - must RESET board to recover

U-Boot 1.1.4 (Nov 26 2014 - 17:02:17)

ap135 - Scorpion 1.0DRAM: 
---------------------------loop---------------------------------


So - any suggestions? I've invested so much time in it that it's no longer about getting my money back; but more of a challenge.

Please help!
Sponsor
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Thu Jan 14, 2016 0:17    Post subject: Reply with quote
Quote:

original_product_id = 75000001
original_product_ver = 01

recovery_product_id = c5000001
recovery_product_ver = 01

auto update firmware: product id verify fail!


The bootloader in your router uses an old id (WDR7500v1) when checking the tftp uploaded recovery firmware.

Download the utility for changing the firmware header, bottom of this page:

http://www.dd-wrt.com/phpBB2/viewtopic.php?p=879928

It is in Chinese but easy to understand:

Small button with ?? = load file. point it to the pre-stripped stock firmware you used before.

It will show the C5000001 00000001 id for the file

change it to 75000001 00000001 in the input fields

press the bottom left ?? button to write out the changed file.
press the bottom right ?? button to exit

the bootloader should now be able to accept the modded file.

_________________
Kernel panic: Aiee, killing interrupt handler!
GreyDoc
DD-WRT User


Joined: 04 Jun 2015
Posts: 392

PostPosted: Thu Jan 14, 2016 7:03    Post subject: Reply with quote
bzowk, TFTP this factory firmware. it's Archer C5_V1.20_150428 from http://www.tp-link.com/en/download/Archer-C5_V1.20.html#Firmware
with bootloader stripped and header changed to match your hardware
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Atheros WiSOC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum