[foxpose]

Hi,

I was able to brick my router . Now I solderd a serial cable and I'm able to see the output during start process unitl it comes to the "autoboot in 1 sec".

After this point, I need help please.

Could you told me what to do?

I already uploaded a firmware without boot with tftp.


regards, foxpose

[foxpose]

Update:

I was able to get a connection and putty is printed some information also.

[foxpose]

Ok, it looks like I need to buy a pull-up resistor and solder it from tx to vcc. Currently I can't send 'tpl' to the board


But, could you give me some help when the 'tpl' command is working? What should I do to get a firmware back? I don't care if it is the stock or an other custom firmware.

Thanks...

regards, foxpose

[ckm]

HEY foxpose git you one of theses

http://www.dx.com/p/ca-42-compatible-usb-2-0-data-cable-for-nokia-2110-2112-2115-more-45715
or anything with a FTDI chip

http://www.ebay.com/itm/FT232RL-FTDI-3-3V-5-5V-USB-to-TTL-Serial-Adapter-Module-for-Arduino-Mini-Port-/121351210789?pt=LH_

check the voltage with everything hooked up at the rx and tx if its not 3.3volts thin thats the problem get a difrent usb to TTL adapter you dont need a pull resistor.The ca 42 cable is what i use it works everytime i used it on my wr1043nd,wr941nd,841nd,wr940n,wr740n and more.

[ckm]

OK i found this yours starts booting at 9f020000 so theses should work.

Type following fast: tpl .Then everything stops and execute commands.
1. Configure networking
> setenv ipaddr 192.168.0.6
> setenv serverip 192.168.0.5
Confirm the settings have been accepted correctly so:
> printenv
2. Erase the corrupt firmware:
> erase 0x9f020000 +0x7c0000
3. Download new firmware over TFTP to router memory
> tftp 0x80060000 code.bin
4. Flash the new firmware
> cp.b 0x80060000 0x9f020000 0x7c0000
5. Boot the new firmware
> bootm 0x9f020000
Disconnect the serial wires and switch off/switch on the power button
Put in your browser 192.168.0.1…. .

The router is back in bussines.

Also you mite check with LOM
DD-WRT Guru he mite know a diffrent way to get your router fixed through TFTP.

[foxpose]

Hi,

thanks for the reply. I just ordered a pull-up resistor. It's much cheaper for now than to buy a new cable or usb converter.

Currently I have 0 volt for the tx, so I cant use tpl...

I'll try your steps to reanimate my router and give a feedback. For the moment I'm waiting for receiving my order.

One question: When I erase also 0x9f020000, must the firmware within boot or without?

regards, foxpose

[ckm]

set your pc to 192.168.0.5 its the server.
at the prompt>erase 0x9f020000 +0x7c0000 will erase the firware that will not boot.
prompt> tftp 0x80060000 code.bin will use TFTP program i use TFTP64 this will copy code.bin over to memory,code.bin is the firmware you are going to use just shortin the name to code.bin and put it into the TFTP directory so it can find the file.
prompt>cp.b 0x80060000 0x9f020000 0x7c0000 this will flash the code.bin where it needs to go.
prompt>bootm 0x9f020000 this will reboot router and start boot at 0x9f020000.
If you did everything right the router is unbricked and ready to go.

Also the firmware i serial flash is DDWRT factory flash that is for your router it does not have a
boot loader, thin i flash the upgrade bin through the GUI.if you flash firmware with a boot loader it will brick it again.

[foxpose]

Hey,

so, I was able to get it run with the serial cable, but after I follow your steps, the router has a boot loop.

Here ist the output. Could you give me a hint pls?

[ckm]

Look at this its 2 part video i think it will help you.

https://www.youtube.com/watch?v=t35Pei_eb6o

i think the copy command mite be wrong 0x80060000 needs to be 0x81000000

[foxpose]

Dude, thanks in so many ways, I got it.

I follow your steps, also the vid and had to change the addresses of the memory.

I did the following:

after tpl

1. just used 'tftpboot' and rename the image to the name the router is watching about. In my case: '6F01A8C0.img'
2. erase 0x9f020000 +f8000
3. cp.b 0x81000000 0x9f020000 0xf80000

That's it

I used the original firmware wihtout boot.
http://wikisend.com/download/513446/ArcherC5v1_en_3_14_1_up_without_boot(140912).zip <---Include the parenthesis for download.



Thanks...foxpose

[Hijlko]

Yesterday I bought a bricked TP-Link Archer C5 for a small price. The router was bricked by a wrong firmware file that was flashed. This caused a boot-loop.
I read a lot about this issue (thanks for that info ('') )and because my current router sucks (wifi signal lost every now and then) and because I have already had a serial-to-usb connector I thought I would give it a try and share my "unbrick process". I found out that you can NOT simply copy/past commands with start/load/filsize addresses because it depends on your own device and on the firmware file you want to flash. So be carefull.


Needed for the TP-link Archer v5:
Firmware file without "boot"part in it. I used "factory-to-ddwrt.bin" from the site of DD-WRT (routerdatabase - other downloads - betas - 2014 - 12022014 - tplink_archer-c5-v1 ) http://www.dd-wrt.com/site/support/other-downloads?path=betas%2F2014%2F
Putty download this from www.putty.org
TFTPd64 or TFTPd32 that you can download at [url]tftpd32.jounin.net[/url] (standard edition in zip file will do)
Serial-to-usb connector (I used a Nokia C45 datacable)

Preparation:
Download al the needed files and install them
Make a map on a drive on your PC/laptop like C:\firmware and copy the image-file that you want to flash to the router to this map.

I used a Nokia C45 datacable from wich I removed the nokia-connector, leaving 3 wires at one end and a USB connector at the other end.
You can open the USB connector carefully to see what color of wire is connected to the USB rx, tx and ground pin.
Connect the serial-to-usb to the serial 'holes' on the board of the router
- tx (that's the one that's most far from the edge of the board an has a thicker white printed border around it),
- rx
- ground
- Leaving the vcc (3,3 Volt) open (that is the one closest to the border of the board)
Connect the other end of you serial-to-usb to a USB port on you PC/laptop.
When you use this type of serial-to-usb for the first time, it needs to install the driver for it.
Probably it will look for a driver for the Prolific PL2303 but if you let Windows search for the driver by itself, then it will probably install a driver that doen't let the com port start.
So before you connect it, search for a driver for the Prolific PL2303 for Windows VISTA (Say what, "VISTA?", Yes for Vista) and use that driver. This driver will let the com port start (It worked for me in Windows 7 x64) http://www.cooldrives.com/lib/cooldrives/vista-prolific-chip-driver-for-serial-adapters.zip

To avoid any communication problems between the router and you pc/laptop best thing to do is to disable your firewall (remember to enable it when done).
Connect a lan cable to the ethernet 1 port of the router (so not the wan port) and to your pc/laptop

Get started:
When the com port is active then start Putty and chose "serial" connection and set the com port to the portnumber that is given to (see your device manager)
set the speed to 115200

Power on the router
In Putty: click "OPEN"

The connection is opened.
Booting starts at 9f020000 (in my case)
Because of the boot-loop you see it all repeat itself over and over againg.

As soon as you see "Autobooting in 1 seconds" you have to stop the boot process bij typing tpl at the prompt then hit ENTER:
> tpl [ENTER]

If you were on time then Boot(loop) stopped
You have to do this very fast, else the boot process continues (and if in a boot-loop starts again. Then just type fast: tpl [ENTER] tpl [ENTER] tpl [ENTER] tpl [ENTER] etc. untill you see it stopped)

Now we must retreive the IP address of the router, of the server and the name of the firmware file that the router is looking for from the server: type tftpboot and [ENTER] at the prompt
> tftpboot [ENTER]
device attempts to boot, meanwhile showing important info
In this case:
---------------------------------------------------------------
TFTP from server 192.168.1.100; our IP address is 192.168.1.111
Filename '6F01A8C0.img'.
Load address: 0x81000000
---------------------------------------------------------------
As soon as you see this info abort the booting process
> [CTRL]+[C]

Now we know:
- the ip adress of the server (in this case 192.168.1.100)
- the ip adress of the router (in this case 192.168.1.111)
- the name of the image file (in this case 6F01A8C0.img)
that it was looking for while booting

It's a good idea to open Notepad and write both IP numbers as well as the image name as the load address (in this case 0x81000000) and the bootstart address (in this case 9f020000).

Now change the IP-address of you lan connection to the server-IP address that it was looking for (in my case: 192.168.1.100, subnet 255.255.255.0, leave the rest blanc)

Start TFTPd64 or TFTPd32
In tftpd64 or TFTPd32 in the field for the server interface, set the ip-address as mentiond before (in my case 192.168.1.100)
In tftpd64 or TFTPd32 Browse to the map with the firmwarefile ( in this example C:\firmware) or in the field "current directory" type the path of this map (C:\firmware)
Now if you click the showdir button in tftpd64 or TFTPd32. You should see the firmware file. Close that screen but leave tftpd64 or TFTPd32 opened.

Now remember that earlier in this process at the tftpboot-part, we saw the name of the image that the router was looking.
Go to you C:\firmware map and change the name of the downloaded firmware file to the name that the router was looking for.
So by example if the name of the image file that was shown was "6F01A8C0.img" and the name of the firmware file in your C:\firmware map is ZYXWVU.BIN OR ZYXWVU.IMG then change that to "6F01A8C0.img" (so the extention must also be altered if not "IMG" like in this example)

Let's proceed.
We have already set the IP addresses and the name of the firmware file to the right values and we have set tftpd64 or TFTPd32 to the right IP address en path so now it is time to copy the new firmware file
to the memory of the router:
> tftpboot [ENTER]
We have used this command before to retreive the IP addresses and file name but at that time the router couldn't find it and we aborted the tftpboot process.
Because we changed some setting the file will now be found and copied to the router and you will see something like:

---------------------------------------------------------------
TFTP from server 192.168.1.100; our IP address is 192.168.1.111
Filename '6F01A8C0.img'.
Load address: 0x81000000
Loading: ###############################################
---------------------------------------------------------------

and a lot more lines with ###############################################

After copying is done you see:
---------------------------------------------------------------
done
Bytes transferred = 8060928 (7b0000 hex)
---------------------------------------------------------------
(these value can be different for you: depends on the size of the firmware file). The part at "hex" is important

In your notepad with the ip-adresses, the bootstart address and the load address, also write the 0x<hex value> (in this example 0x7b0000) Save this file. You may need it again.

Now it is time to erase the flash by the command "erase 0x"<bootstartaddress>" +"<hex value of the size, without 0x>
In this example
> erase 0x9f020000 +7b0000 [ENTER]

At the right side of putty you can see a number increasing. That are the sectors that were erased so far.

When done it is time to flash the new firmware with the CP.b command. This command is followd by the load addres, the bootstart address an the filesize.
In this example it looks like this:
> cp.b 0x81000000 0x9f020000 0x7b0000 [ENTER]

You don't see the progress so just wait untill it says "Done".

When it is done you restart/reset the router
> reset [ENTER]
the router will now reboot and you will now see that the router is booting with the new firmware.
Disconnect the serial-to-usb, close Putty and tftpd64 or TFTPd32.

Enable your firewall and reset the Ip address of your lan card to the value that you used before this process,

Start you browser and go to 192.168.0.1 (or 192.168.1.1 if it is set to this ip address). Maybe you have to power off/on the router first.

It took me a while before I had it up and running because I used commands with values/adressess that were given in other "how-to's" and not paying attention to values that Putty presented for my situation.
So if you try this at home: adjust tha parameters to YOUR situation.

Now for me it's time to experience my new TP-Link Archer C5 router with its powerfull wifi capacity. Besides that it's the first time I use non-factory firmware for a router so I'm excited to find out how that works.

I hope that sharing my experience is/can be helpfull for others. Good luck.

[sborra]

[foxpose]

Hi Sborra,

i didn't used a transitore anymore. I switched to a Nokia CA-42 cable and it started working properly.


So I didn't further investigate how to solder the transitor (10k ohm pull-up) to the usb-converter.


regards, foxpose

[sborra]

Hey foxpose,

Thanks for getting back to me.

I do apologize for the extremely late reply but I have been quite busy with work and family lately.

I stumbled upon this USB TTL adapter that is capable of doing both 3.3V and 5V, would I be able to type into serial using this adapter with 3.3V VCC connected, or would I still need to sold a resistor anyway?

Thanks

[mstradman]

i hope someone can help me with my router. this is where im at in the router.

U-Boot 1.1.4 (Nov 26 2014 - 17:02:17)

ap135 - Scorpion 1.0DRAM:
sri
Scorpion 1.0
ath_ddr_initial_config(178): (32bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x4, 0x1d)
Tap values = (0x10, 0x10, 0x10, 0x10)
128 MB
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment

*** Warning *** : PCIe WLAN Module not found !!!
In: serial
Out: serial
Err: serial
Net: ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0xe
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ----> S17 PHY *
Vlan config...
TEST: FINAL REG VAL after TX Calibration - 0x46000000
TEST: FINAL XMII VAL after RX Calibration - 0x56000000
TEST: FINAL ETH_CFG VAL after RX Calibration - 0x00028001
athrs17_reg_init: complete
: cfg1 0x80000000 cfg2 0x7335
eth0: ba:be:fa:ce:08:41
eth0 up
athrs17_reg_init_wan done
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x800c0000 cfg2 0x7214
eth1: ba:be:fa:ce:08:41
eth1 up
eth0, eth1
Setting 0x18116290 to 0x58b1214f
Autobooting in 1 seconds
## Booting image at 9f020000 ...
Uncompressing Kernel Image ... Too big uncompressed streamLZMA ERROR 1 - must RESET board to recover

U-Boot 1.1.4 (Nov 26 2014 - 17:02:17)

ap135 - Scorpion 1.0DRAM:
sri
Scorpion 1.0
ath_ddr_initial_config(178): (32bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x3, 0x1c)
Tap values = (0xf, 0xf, 0xf, 0xf)
128 MB
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment

*** Warning *** : PCIe WLAN Module not found !!!
In: serial
Out: serial
Err: serial
Net: ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0xe
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ----> S17 PHY *
Vlan config...
TEST: FINAL REG VAL after TX Calibration - 0x46000000
TEST: FINAL XMII VAL after RX Calibration - 0x56000000
TEST: FINAL ETH_CFG VAL after RX Calibration - 0x00028001
athrs17_reg_init: complete
: cfg1 0x80000000 cfg2 0x7335
eth0: ba:be:fa:ce:08:41
eth0 up
athrs17_reg_init_wan done
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x800c0000 cfg2 0x7214
eth1: ba:be:fa:ce:08:41
eth1 up
eth0, eth1
Setting 0x18116290 to 0x58b1214f
Autobooting in 1 seconds
ap135>