Hello guys,
Is it possible to setup print server without JFFS enable?
I have Archer C9v3 and I know that enabling JFFS will brick device so now looking for alternative way for connect my printer to router :/
Posted: Sun Jan 28, 2018 2:17 Post subject: Try this to recover from build 34311
Added 2/3/18 - This procedure is deprecated. It works for bad loads. However, the MAC address on the unit will be a random value that was left in flash by the bad load. You should use the revised procedure.
-----------------
I web flashed to build 34311, removed the SPI flash and took a look at the image. It appears as if the 34311 webflash image has a much larger rootfs partition than build 33772. It goes past 0xEFFFFF. I extracted a 0x10000 chunk of the build 33772 image starting at 0xF10000. This file is named 34311-hack.bin.
One byte at offset 0x6011 in 34311-hack.bin was changed which is the F/W version that TP-LINK looks at when doing a TFTP recovery. This allows TFTP recovery to TP-LINK firmware.
Grab stock firmware from TP-LINK's website and rename it to ArcherC9v3_tp_recovery.bin.
The general instructions are:
1. Connect the serial port to the main board.
2. Connect a PC to a LAN port on the C9v3.
3. Set the PC Ethernet interface to 192.168.0.66 with a subnet mask of 255.255.255.0
4. Run TFTP server on the PC. Point the TFTP server to the directory with the 34311-hack.bin and ArcherC9v3_tp_recovery.bin file.
5. At the CFE prompt of the C9v3, cut and paste this command:
flash -offset=15794176 -noheader 192.168.0.66:34311-hack-V1.bin flash0
(1/29 - fixed file name to match attachment.)
(2/1 - changed device name. was flash0. flash works more reliably.)
(2/3 - changed device name back to flash0. If the response to the flash command is "device not found" remove the 0 from flash0 and try again.)
6. When finished, the unit will reboot. On my unit it boots into build 34311. (If you want to login, user=root, pw=archer_1) Considering how messed up the firmware was you should immediately do a recovery and load TP-LINK firmware on the unit.
7a. The download the stock firmware for v3 from TP-Link. Unzip the .bin from the file. Place it in the folder the the TFTP server points to. Rename the file to ArcherC9v3_tp_recovery.bin.
7b. Power off the unit. Hold down the reset button and power the unit back up. When you see the TFTP server start to transfer the recovery file, release the reset button.
(2/1 - added info about name needed for recovery file.)
8. The recovery software should load and the unit will reboot with TP-LINK firmware.
9. Change the PC ethernet port back to automatically get an IP address and DNS server.
9. At this point DD-WRT can be reloaded using the factory-to-ddwrt.bin file from the TP-LINK gui.
Hi,
I recently bought the c9 v3 1900 router and attempted to flash the dd-wrt firmware. I first upgraded my firmware from the manufacturer to the latest (Archer_C9(US)_V3_161018_1479887048164h). Then i followed the guide from https://dd-wrt.com/wiki/index.php/TP_Link_Archer_C9 and downloaded the factory-to-ddwrt.bin (10-17-2017-r33525) which flashed successfully.
I was able to get into the GUI of DD_WRT and set the admin pass etc. I then updated to the latest ddwrt firmware (archer-c9v3-webflash). This is when things went left. Now when the router boots it just sits at the WPS light only. No other lights are on the router (the light looks like two arrows going up and down).
...
Hi,
I recently bought the c9 v3 1900 router and attempted to flash the dd-wrt firmware. I first upgraded my firmware from the manufacturer to the latest (Archer_C9(US)_V3_161018_1479887048164h). Then i followed the guide from https://dd-wrt.com/wiki/index.php/TP_Link_Archer_C9 and downloaded the factory-to-ddwrt.bin (10-17-2017-r33525) which flashed successfully.
I was able to get into the GUI of DD_WRT and set the admin pass etc. I then updated to the latest ddwrt firmware (archer-c9v3-webflash). This is when things went left. Now when the router boots it just sits at the WPS light only. No other lights are on the router (the light looks like two arrows going up and down).
...
I expect that it will work for 34080. As long as you don't mess up the arguments on the flash command it won't be any worse. If you are worried I can load 34080 this weekend and try.
This method (34311-hack-v1.bin) does not work for recovering when jffs2 was enabled. That seems to nuke all the way up to 0xFEFFFF in the SPI flash. It may be recoverable but will take more digging.
I expect that it will work for 34080. As long as you don't mess up the arguments on the flash command it won't be any worse. If you are worried I can load 34080 this weekend and try.
Posted: Fri Feb 02, 2018 5:39 Post subject: Still waiting....
Still waiting for a stable release... Bought a C9 because I read it supported DDwrt and was pretty disappointed to get it and find out it's a newer unsupported v3. Have been tempted to try a beta, but I'm hoping the stable version will be out soon. The stock firmware is probably one of the worst I've seen, very little control and utility for what's otherwise a decent router.
I expect that it will work for 34080. As long as you don't mess up the arguments on the flash command it won't be any worse. If you are worried I can load 34080 this weekend and try.
Thank you. I hope it's not too much trouble.
i seem to have maneuvered myself into the same situation,
edit: disregard below, no new information...
stock ArcherC9v4-1_3_0-up_boot-161018-ca_eu_us.bin to 10-17-2017-r33525 went fine enough
01-31-2018-r34777 upgrade via dd-wrt webconsole "bricked" to "wps-button"
boot with pressed wps/reset makes the router ask for ArcherC9v3_tp_recovery.bin at 192.168.0.66 via TFTP from 192.168.0.86, if i supply stock with the requested name tftp transfer is completed and one arp request for 192.168.0.1 is sent from the router, after that nothing.
reboot without wps/reset does the same arp-request
Posted: Sat Feb 03, 2018 23:18 Post subject: Try this to recover from bad builds and jffs2
The earlier procedure has been expanded to also fix up the jffs2 corruption bug.
You need two files. The first file is attached to this message.
Fair Warning: This procedure can really brick your unit if the flash command is typed wrong. This procedure can overwrite critical data if the wrong file is loaded.
This procedure requires the use of the serial port on the circuit board.
This binary file (C9-V3-Fix-R5.bin) can be used as part of the procedure to recover an Archer C9 V3 from a bad DD-WRT flash. It has been tried against build 34311 and 34080. It should work (but has not been tested) against the other bad dd-wrt builds from December 2017.
It also can recover from the corruption after enabling jffs2 in DD-WRT in versions 33525 and 33772. It should work (but has not been tested) against other builds where jffs2 has been enabled and corrupted the flash.
The bad dd-wrt load and or jffs2 bug has overwritten the MAC address of the unit. The C9-V3-Fix-R5.bin file has a MAC address of AA-BB-CC-CC-BB-AA. You should change the MAC address in the file to the one that is on the back of your unit.
Using a hex edititor (for example, HxD under windows) change the hex values located at offset 8,9,A,B,C,D in the file. If the back of your unit is labled MAC:00-12-10-A0-33-2F, change the hex value at 8 to 00, at 9 to 12, at A to 10, B to A0, C to 33 and D to 2F. If using HxD, perform your editing on the left, hex side of the display, not the ASCII side. Save the changes back to the file.
Grab stock firmware from TP-LINK's website and rename it to ArcherC9v3_tp_recovery.bin.
The general instructions are:
1. Connect the serial port to the main board.
2. Connect a PC to a LAN port on the C9v3.
3. Set the PC Ethernet interface to 192.168.0.66 with a subnet mask of 255.255.255.0
4. Run TFTP server on the PC. Point the TFTP server to the directory with the C9-V3-Fix-R5.bin and ArcherC9v3_tp_recovery.bin files.
5. At the CFE prompt of the C9v3, cut and paste this command:
flash -offset=15728640 -noheader 192.168.0.66:C9-V3-Fix-R5.bin flash0
(Make sure that the -offset value is correct before hitting enter.)
(If the response to the flash command is "device not found" remove the 0 from flash0 and try again.)
If all goes well, you will see this upon completion:
CFE> flash -offset=15728640 -noheader 192.168.0.66:C9-V3-Fix-R5.bin flash0
Reading 192.168.0.66:C9-V3-Fix-R5.bin: Done. 917504 bytes read
Programming...done. 917504 bytes written
*** command status = 0
CFE>
6. When finished, reboot or reset. With some of the corruptions, the serial console shows the unit booting into DD-WRT. With others, the unit repeatedly trys to boot and has a kernal panic. Considering how messed up the firmware was, immediately do a TFTP recovery and load TP-LINK firmware onto the unit.
7. Download the stock firmware for V3 from TP-Link. Unzip the .bin from the file. Place it in the folder that the TFTP server points to. Rename the file to ArcherC9v3_tp_recovery.bin.
8. Power off the unit. Hold down the reset button and power the unit back up. When you see on the serial console that the unit is in recovery mode, release the reset button.
9. The recovery software will load and the unit will reboot with TP-LINK firmware.
10. Change the PC ethernet port back to automatically get an IP address and DNS server.
11. At this point DD-WRT can be reloaded using the factory-to-ddwrt.bin file from the TP-LINK gui.
I expect that it will work for 34080. As long as you don't mess up the arguments on the flash command it won't be any worse. If you are worried I can load 34080 this weekend and try.
Thank you. I hope it's not too much trouble.
An updated procedure has been posted to this thread. It was tested against 34080.
Posted: Tue Feb 06, 2018 12:50 Post subject: Re: Try this to recover from bad builds and jffs2
TheDoc wrote:
The earlier procedure has been expanded to also fix up the jffs2 corruption bug.
You need two files. The first file is attached to this message.
Fair Warning: This procedure can really brick your unit if the flash command is typed wrong. This procedure can overwrite critical data if the wrong file is loaded.
This procedure requires the use of the serial port on the circuit board.
This binary file (C9-V3-Fix-R5.bin) can be used as part of the procedure to recover an Archer C9 V3 from a bad DD-WRT flash. It has been tried against build 34311 and 34080. It should work (but has not been tested) against the other bad dd-wrt builds from December 2017.
It also can recover from the corruption after enabling jffs2 in DD-WRT in versions 33525 and 33772. It should work (but has not been tested) against other builds where jffs2 has been enabled and corrupted the flash.
The bad dd-wrt load and or jffs2 bug has overwritten the MAC address of the unit. The C9-V3-Fix-R5.bin file has a MAC address of AA-BB-CC-CC-BB-AA. You should change the MAC address in the file to the one that is on the back of your unit.
Using a hex edititor (for example, HxD under windows) change the hex values located at offset 8,9,A,B,C,D in the file. If the back of your unit is labled MAC:00-12-10-A0-33-2F, change the hex value at 8 to 00, at 9 to 12, at A to 10, B to A0, C to 33 and D to 2F. If using HxD, perform your editing on the left, hex side of the display, not the ASCII side. Save the changes back to the file.
Grab stock firmware from TP-LINK's website and rename it to ArcherC9v3_tp_recovery.bin.
The general instructions are:
1. Connect the serial port to the main board.
2. Connect a PC to a LAN port on the C9v3.
3. Set the PC Ethernet interface to 192.168.0.66 with a subnet mask of 255.255.255.0
4. Run TFTP server on the PC. Point the TFTP server to the directory with the C9-V3-Fix-R5.bin and ArcherC9v3_tp_recovery.bin files.
5. At the CFE prompt of the C9v3, cut and paste this command:
flash -offset=15728640 -noheader 192.168.0.66:C9-V3-Fix-R5.bin flash0
(Make sure that the -offset value is correct before hitting enter.)
(If the response to the flash command is "device not found" remove the 0 from flash0 and try again.)
If all goes well, you will see this upon completion:
CFE> flash -offset=15728640 -noheader 192.168.0.66:C9-V3-Fix-R5.bin flash0
Reading 192.168.0.66:C9-V3-Fix-R5.bin: Done. 917504 bytes read
Programming...done. 917504 bytes written
*** command status = 0
CFE>
6. When finished, reboot or reset. With some of the corruptions, the serial console shows the unit booting into DD-WRT. With others, the unit repeatedly trys to boot and has a kernal panic. Considering how messed up the firmware was, immediately do a TFTP recovery and load TP-LINK firmware onto the unit.
7. Download the stock firmware for V3 from TP-Link. Unzip the .bin from the file. Place it in the folder that the TFTP server points to. Rename the file to ArcherC9v3_tp_recovery.bin.
8. Power off the unit. Hold down the reset button and power the unit back up. When you see on the serial console that the unit is in recovery mode, release the reset button.
9. The recovery software will load and the unit will reboot with TP-LINK firmware.
10. Change the PC ethernet port back to automatically get an IP address and DNS server.
11. At this point DD-WRT can be reloaded using the factory-to-ddwrt.bin file from the TP-LINK gui.
Thanks, your help saved my bricked Archer C9 v4 EU version, the latest safe beta to use on v3 / v4 seems to be 2017-12-04 which is r33986....
I got the dreaded WPS led after upgrading to the latest release before.
Posted: Wed Feb 07, 2018 0:45 Post subject: Re: Try this to recover from bad builds and jffs2
TheDoc wrote:
The earlier procedure has been expanded to also fix up the jffs2 corruption bug.
You need two files. The first file is attached to this message.
Fair Warning: This procedure can really brick your unit if the flash command is typed wrong. This procedure can overwrite critical data if the wrong file is loaded.
This procedure requires the use of the serial port on the circuit board.
This binary file (C9-V3-Fix-R5.bin) can be used as part of the procedure to recover an Archer C9 V3 from a bad DD-WRT flash. It has been tried against build 34311 and 34080. It should work (but has not been tested) against the other bad dd-wrt builds from December 2017.
It also can recover from the corruption after enabling jffs2 in DD-WRT in versions 33525 and 33772. It should work (but has not been tested) against other builds where jffs2 has been enabled and corrupted the flash.
The bad dd-wrt load and or jffs2 bug has overwritten the MAC address of the unit. The C9-V3-Fix-R5.bin file has a MAC address of AA-BB-CC-CC-BB-AA. You should change the MAC address in the file to the one that is on the back of your unit.
Using a hex edititor (for example, HxD under windows) change the hex values located at offset 8,9,A,B,C,D in the file. If the back of your unit is labled MAC:00-12-10-A0-33-2F, change the hex value at 8 to 00, at 9 to 12, at A to 10, B to A0, C to 33 and D to 2F. If using HxD, perform your editing on the left, hex side of the display, not the ASCII side. Save the changes back to the file.
Grab stock firmware from TP-LINK's website and rename it to ArcherC9v3_tp_recovery.bin.
The general instructions are:
1. Connect the serial port to the main board.
2. Connect a PC to a LAN port on the C9v3.
3. Set the PC Ethernet interface to 192.168.0.66 with a subnet mask of 255.255.255.0
4. Run TFTP server on the PC. Point the TFTP server to the directory with the C9-V3-Fix-R5.bin and ArcherC9v3_tp_recovery.bin files.
5. At the CFE prompt of the C9v3, cut and paste this command:
flash -offset=15728640 -noheader 192.168.0.66:C9-V3-Fix-R5.bin flash0
(Make sure that the -offset value is correct before hitting enter.)
(If the response to the flash command is "device not found" remove the 0 from flash0 and try again.)
If all goes well, you will see this upon completion:
CFE> flash -offset=15728640 -noheader 192.168.0.66:C9-V3-Fix-R5.bin flash0
Reading 192.168.0.66:C9-V3-Fix-R5.bin: Done. 917504 bytes read
Programming...done. 917504 bytes written
*** command status = 0
CFE>
6. When finished, reboot or reset. With some of the corruptions, the serial console shows the unit booting into DD-WRT. With others, the unit repeatedly trys to boot and has a kernal panic. Considering how messed up the firmware was, immediately do a TFTP recovery and load TP-LINK firmware onto the unit.
7. Download the stock firmware for V3 from TP-Link. Unzip the .bin from the file. Place it in the folder that the TFTP server points to. Rename the file to ArcherC9v3_tp_recovery.bin.
8. Power off the unit. Hold down the reset button and power the unit back up. When you see on the serial console that the unit is in recovery mode, release the reset button.
9. The recovery software will load and the unit will reboot with TP-LINK firmware.
10. Change the PC ethernet port back to automatically get an IP address and DNS server.
11. At this point DD-WRT can be reloaded using the factory-to-ddwrt.bin file from the TP-LINK gui.
Hey, thanks for your effort
unfortunately after flashing C9-V3-Fix-R5.bin on a v4 EU, when attempting tftp or web-gui recovery with
Archer_C9(EU)_V4_161018_1479287836363l
or
Archer_C9(EU)_V3_160713.zip
i still get the below, can someone give me some pointers where to go from here?
need firmware recovery!
register firmware recovery command
Start firmware recovery command(ifconfig eth0 -addr=192.168.0.86 -mask=255.255.255.0;flash -fr -offset=0x40000 192.168.0.66:ArcherC9v3_tp_recovery.bin flash0)
Device eth0: hwaddr 50-C7-BF-19-20-B4, ipaddr 192.168.0.86, mask 255.255.255.0
gateway not set, nameserver not set
Reading 192.168.0.66:ArcherC9v3_tp_recovery.bin: Done. 14820016 bytes read
Reading Partition Table from NVRAM ... OK
Parsing Partition Table ... OK
Firmware Recovery file length : 14820016
Firmware process id 2.
Image verify OK!
Firmware file Verify ok!
[NM_Error](nm_api_readPtnFromNvram) 00140: partition name not found.
[Error]sysmgr_cfg_getProductInfoFromNvram():00800 @ ucm_nvram_proInfoRead() failed.
[Error]sysmgr_cfg_checkSupportList():00977 @ productName ArcherC9 NOT Match.
[Error]sysmgr_cfg_checkSupportList():00903 @ Entry 0 NOT Match.
[Error]sysmgr_cfg_checkSupportList():00977 @ productName ArcherC9 NOT Match.
[Error]sysmgr_cfg_checkSupportList():00903 @ Entry 1 NOT Match.
[Error]sysmgr_cfg_checkSupportList():00977 @ productName ArcherC9 NOT Match.
[Error]sysmgr_cfg_checkSupportList():00903 @ Entry 2 NOT Match.
Firmwave not supports, check failed.
[NM_Error](nm_checkUpdateContent) 01204: the firmware is not for this model
[NM_Error](nm_buildUpgradeStruct) 01304: checkUpdateContent failed.
[NM_Error](nm_api_readPtnFromNvram) 00140: partition name not found.
[NM_Error](nm_api_checkInteger) 00331: factory boot check integer read flag partition fail.
Device eth0: hwaddr 50-C7-BF-19-20-B4, ipaddr 192.168.0.1, mask 255.255.255.0
gateway not set, nameserver not set
CFE>
Posted: Wed Feb 07, 2018 4:03 Post subject: Re: Try this to recover from bad builds and jffs2
!asdf wrote:
TheDoc wrote:
The earlier procedure has been expanded to also fix up the jffs2 corruption bug.
You need two files. The first file is attached to this message.
Fair Warning: This procedure can really brick your unit if the flash command is typed wrong. This procedure can overwrite critical data if the wrong file is loaded.
This procedure requires the use of the serial port on the circuit board.
This binary file (C9-V3-Fix-R5.bin) can be used as part of the procedure to recover an Archer C9 V3 from a bad DD-WRT flash. It has been tried against build 34311 and 34080. It should work (but has not been tested) against the other bad dd-wrt builds from December 2017.
It also can recover from the corruption after enabling jffs2 in DD-WRT in versions 33525 and 33772. It should work (but has not been tested) against other builds where jffs2 has been enabled and corrupted the flash.
The bad dd-wrt load and or jffs2 bug has overwritten the MAC address of the unit. The C9-V3-Fix-R5.bin file has a MAC address of AA-BB-CC-CC-BB-AA. You should change the MAC address in the file to the one that is on the back of your unit.
Using a hex edititor (for example, HxD under windows) change the hex values located at offset 8,9,A,B,C,D in the file. If the back of your unit is labled MAC:00-12-10-A0-33-2F, change the hex value at 8 to 00, at 9 to 12, at A to 10, B to A0, C to 33 and D to 2F. If using HxD, perform your editing on the left, hex side of the display, not the ASCII side. Save the changes back to the file.
Grab stock firmware from TP-LINK's website and rename it to ArcherC9v3_tp_recovery.bin.
The general instructions are:
1. Connect the serial port to the main board.
2. Connect a PC to a LAN port on the C9v3.
3. Set the PC Ethernet interface to 192.168.0.66 with a subnet mask of 255.255.255.0
4. Run TFTP server on the PC. Point the TFTP server to the directory with the C9-V3-Fix-R5.bin and ArcherC9v3_tp_recovery.bin files.
5. At the CFE prompt of the C9v3, cut and paste this command:
flash -offset=15728640 -noheader 192.168.0.66:C9-V3-Fix-R5.bin flash0
(Make sure that the -offset value is correct before hitting enter.)
(If the response to the flash command is "device not found" remove the 0 from flash0 and try again.)
If all goes well, you will see this upon completion:
CFE> flash -offset=15728640 -noheader 192.168.0.66:C9-V3-Fix-R5.bin flash0
Reading 192.168.0.66:C9-V3-Fix-R5.bin: Done. 917504 bytes read
Programming...done. 917504 bytes written
*** command status = 0
CFE>
6. When finished, reboot or reset. With some of the corruptions, the serial console shows the unit booting into DD-WRT. With others, the unit repeatedly trys to boot and has a kernal panic. Considering how messed up the firmware was, immediately do a TFTP recovery and load TP-LINK firmware onto the unit.
7. Download the stock firmware for V3 from TP-Link. Unzip the .bin from the file. Place it in the folder that the TFTP server points to. Rename the file to ArcherC9v3_tp_recovery.bin.
8. Power off the unit. Hold down the reset button and power the unit back up. When you see on the serial console that the unit is in recovery mode, release the reset button.
9. The recovery software will load and the unit will reboot with TP-LINK firmware.
10. Change the PC ethernet port back to automatically get an IP address and DNS server.
11. At this point DD-WRT can be reloaded using the factory-to-ddwrt.bin file from the TP-LINK gui.
Hey, thanks for your effort
unfortunately after flashing C9-V3-Fix-R5.bin on a v4 EU, when attempting tftp or web-gui recovery with
Archer_C9(EU)_V4_161018_1479287836363l
or
Archer_C9(EU)_V3_160713.zip
i still get the below, can someone give me some pointers where to go from here?
need firmware recovery!
register firmware recovery command
Start firmware recovery command(ifconfig eth0 -addr=192.168.0.86 -mask=255.255.255.0;flash -fr -offset=0x40000 192.168.0.66:ArcherC9v3_tp_recovery.bin flash0)
Device eth0: hwaddr 50-C7-BF-19-20-B4, ipaddr 192.168.0.86, mask 255.255.255.0
gateway not set, nameserver not set
Reading 192.168.0.66:ArcherC9v3_tp_recovery.bin: Done. 14820016 bytes read
Reading Partition Table from NVRAM ... OK
Parsing Partition Table ... OK
Firmware Recovery file length : 14820016
Firmware process id 2.
Image verify OK!
Firmware file Verify ok!
[NM_Error](nm_api_readPtnFromNvram) 00140: partition name not found.
[Error]sysmgr_cfg_getProductInfoFromNvram():00800 @ ucm_nvram_proInfoRead() failed.
[Error]sysmgr_cfg_checkSupportList():00977 @ productName ArcherC9 NOT Match.
[Error]sysmgr_cfg_checkSupportList():00903 @ Entry 0 NOT Match.
[Error]sysmgr_cfg_checkSupportList():00977 @ productName ArcherC9 NOT Match.
[Error]sysmgr_cfg_checkSupportList():00903 @ Entry 1 NOT Match.
[Error]sysmgr_cfg_checkSupportList():00977 @ productName ArcherC9 NOT Match.
[Error]sysmgr_cfg_checkSupportList():00903 @ Entry 2 NOT Match.
Firmwave not supports, check failed.
[NM_Error](nm_checkUpdateContent) 01204: the firmware is not for this model
[NM_Error](nm_buildUpgradeStruct) 01304: checkUpdateContent failed.
[NM_Error](nm_api_readPtnFromNvram) 00140: partition name not found.
[NM_Error](nm_api_checkInteger) 00331: factory boot check integer read flag partition fail.
Device eth0: hwaddr 50-C7-BF-19-20-B4, ipaddr 192.168.0.1, mask 255.255.255.0
gateway not set, nameserver not set
CFE>
I've seen that before. Try the C9-V3-Fix-R5.bin file load again and save the serial port output from when you do it.
A couple of questions. What version of DD-WRT caused your initial problem? Did you enable jffs2?
I've haven't tried using the EU loads. Mine is a V3 US model. The previous poster had success with a V4 EU model. That is positive. The part that makes me wonder about the success of the initial C9-V3-Fix-R5.bin load is that the product name should match after it is loaded. From my testing only the product name and version number checks needed to pass in order for the TP-LINK recovery image to load. Both should have been fixed up.
Posted: Wed Feb 07, 2018 7:01 Post subject: Re: Try this to recover from bad builds and jffs2
TheDoc wrote:
!asdf wrote:
TheDoc wrote:
The earlier procedure has been expanded to also fix up the jffs2 corruption bug.
You need two files. The first file is attached to this message.
Fair Warning: This procedure can really brick your unit if the flash command is typed wrong. This procedure can overwrite critical data if the wrong file is loaded.
This procedure requires the use of the serial port on the circuit board.
This binary file (C9-V3-Fix-R5.bin) can be used as part of the procedure to recover an Archer C9 V3 from a bad DD-WRT flash. It has been tried against build 34311 and 34080. It should work (but has not been tested) against the other bad dd-wrt builds from December 2017.
It also can recover from the corruption after enabling jffs2 in DD-WRT in versions 33525 and 33772. It should work (but has not been tested) against other builds where jffs2 has been enabled and corrupted the flash.
The bad dd-wrt load and or jffs2 bug has overwritten the MAC address of the unit. The C9-V3-Fix-R5.bin file has a MAC address of AA-BB-CC-CC-BB-AA. You should change the MAC address in the file to the one that is on the back of your unit.
Using a hex edititor (for example, HxD under windows) change the hex values located at offset 8,9,A,B,C,D in the file. If the back of your unit is labled MAC:00-12-10-A0-33-2F, change the hex value at 8 to 00, at 9 to 12, at A to 10, B to A0, C to 33 and D to 2F. If using HxD, perform your editing on the left, hex side of the display, not the ASCII side. Save the changes back to the file.
Grab stock firmware from TP-LINK's website and rename it to ArcherC9v3_tp_recovery.bin.
The general instructions are:
1. Connect the serial port to the main board.
2. Connect a PC to a LAN port on the C9v3.
3. Set the PC Ethernet interface to 192.168.0.66 with a subnet mask of 255.255.255.0
4. Run TFTP server on the PC. Point the TFTP server to the directory with the C9-V3-Fix-R5.bin and ArcherC9v3_tp_recovery.bin files.
5. At the CFE prompt of the C9v3, cut and paste this command:
flash -offset=15728640 -noheader 192.168.0.66:C9-V3-Fix-R5.bin flash0
(Make sure that the -offset value is correct before hitting enter.)
(If the response to the flash command is "device not found" remove the 0 from flash0 and try again.)
If all goes well, you will see this upon completion:
CFE> flash -offset=15728640 -noheader 192.168.0.66:C9-V3-Fix-R5.bin flash0
Reading 192.168.0.66:C9-V3-Fix-R5.bin: Done. 917504 bytes read
Programming...done. 917504 bytes written
*** command status = 0
CFE>
6. When finished, reboot or reset. With some of the corruptions, the serial console shows the unit booting into DD-WRT. With others, the unit repeatedly trys to boot and has a kernal panic. Considering how messed up the firmware was, immediately do a TFTP recovery and load TP-LINK firmware onto the unit.
7. Download the stock firmware for V3 from TP-Link. Unzip the .bin from the file. Place it in the folder that the TFTP server points to. Rename the file to ArcherC9v3_tp_recovery.bin.
8. Power off the unit. Hold down the reset button and power the unit back up. When you see on the serial console that the unit is in recovery mode, release the reset button.
9. The recovery software will load and the unit will reboot with TP-LINK firmware.
10. Change the PC ethernet port back to automatically get an IP address and DNS server.
11. At this point DD-WRT can be reloaded using the factory-to-ddwrt.bin file from the TP-LINK gui.
Hey, thanks for your effort
unfortunately after flashing C9-V3-Fix-R5.bin on a v4 EU, when attempting tftp or web-gui recovery with
Archer_C9(EU)_V4_161018_1479287836363l
or
Archer_C9(EU)_V3_160713.zip
i still get the below, can someone give me some pointers where to go from here?
need firmware recovery!
register firmware recovery command
Start firmware recovery command(ifconfig eth0 -addr=192.168.0.86 -mask=255.255.255.0;flash -fr -offset=0x40000 192.168.0.66:ArcherC9v3_tp_recovery.bin flash0)
Device eth0: hwaddr 50-C7-BF-19-20-B4, ipaddr 192.168.0.86, mask 255.255.255.0
gateway not set, nameserver not set
Reading 192.168.0.66:ArcherC9v3_tp_recovery.bin: Done. 14820016 bytes read
Reading Partition Table from NVRAM ... OK
Parsing Partition Table ... OK
Firmware Recovery file length : 14820016
Firmware process id 2.
Image verify OK!
Firmware file Verify ok!
[NM_Error](nm_api_readPtnFromNvram) 00140: partition name not found.
[Error]sysmgr_cfg_getProductInfoFromNvram():00800 @ ucm_nvram_proInfoRead() failed.
[Error]sysmgr_cfg_checkSupportList():00977 @ productName ArcherC9 NOT Match.
[Error]sysmgr_cfg_checkSupportList():00903 @ Entry 0 NOT Match.
[Error]sysmgr_cfg_checkSupportList():00977 @ productName ArcherC9 NOT Match.
[Error]sysmgr_cfg_checkSupportList():00903 @ Entry 1 NOT Match.
[Error]sysmgr_cfg_checkSupportList():00977 @ productName ArcherC9 NOT Match.
[Error]sysmgr_cfg_checkSupportList():00903 @ Entry 2 NOT Match.
Firmwave not supports, check failed.
[NM_Error](nm_checkUpdateContent) 01204: the firmware is not for this model
[NM_Error](nm_buildUpgradeStruct) 01304: checkUpdateContent failed.
[NM_Error](nm_api_readPtnFromNvram) 00140: partition name not found.
[NM_Error](nm_api_checkInteger) 00331: factory boot check integer read flag partition fail.
Device eth0: hwaddr 50-C7-BF-19-20-B4, ipaddr 192.168.0.1, mask 255.255.255.0
gateway not set, nameserver not set
CFE>
I've seen that before. Try the C9-V3-Fix-R5.bin file load again and save the serial port output from when you do it.
A couple of questions. What version of DD-WRT caused your initial problem? Did you enable jffs2?
I've haven't tried using the EU loads. Mine is a V3 US model. The previous poster had success with a V4 EU model. That is positive. The part that makes me wonder about the success of the initial C9-V3-Fix-R5.bin load is that the product name should match after it is loaded. From my testing only the product name and version number checks needed to pass in order for the TP-LINK recovery image to load. Both should have been fixed up.
Hey,
thank you for your response
my situation seems similar to ZaphodB73s:
initially i was on
Archer_C9(EU)_V4_161018_1479287836363l stock
went to
10-17-2017-r33525/factory-to-ddwrt.bin
via webflash
after confirming dd-wrt webgui and changing admin user & pass
i went for
01-31-2018-r34777/archer-c9v4-webflash.bin
via dd-wrt webflash, it did fine, until 300sec reboot timeout
and from there I also got the "dreaded WPS led"
please find attached a log as verbose as i could make,
the C9-V3-Fix-R5_v2.bin is just with patched MAC-Address
