Posted: Tue Apr 13, 2021 23:55 Post subject: Unbricking? an TP Link Archer C9 v2
I received today a bricked Archer C9 v2 from a friend, he said to me that the router just stopped working (no apparent reason), the router only lights the LAN an WPS leds, stays there for a few seconds and it enters an infinite boot loop...
- My first suspicion was that the AC adapter could be faulty, I managed to find one similar from an old HDD enclosure (12v, 2.5A), but it did not solve the problem.
- Next I opened the router checked if the capacitors on the board were swollen/leaked, but no apparent damage.
- After some hours reading on the web, I started to suspect that this could be some kind of soft-brick, so I questioned him again and he find out that one of his kids tried to install/update the firmware (he don't knows which type/version)...
So far I managed to upload the stock firmware using the recovery mode using the TFTP method, but the router didn't change is behaviour, tried all versions available of the stock firmware, without success...
Next I was thinking in using the serial recovery method, but I only have and old serial TTL, and I don't have any computer with a native serial port, so I just order now a new USB TTL...
After further reading here in the forum, I see lots of references (also tutorials) about flashing the firmware using the serial console, and a lot of them refer to a set of files (12.bin and mtd3.bin), this is the part where I'm a bit lost, where can I get these files or can they be extracted from the stock firmware?
Also, is the fact of the TFTP recover working a good sign? Or it just luck, and this can be a permabrick?
I just read this information and acomplished the TFTP Flash procedure, without success, I will have to wait for the USB TTL to arrive to try the Serial Recovery.
Today I just tried the serial recovery without success, the router does not output any data to the serial console...my guess is that the bootloader is also gone...
Moderator note 04.25.2021: Please refer to the rules and guidelines regarding attached image sizes. No wider than 768 pixels without linking to an image hosting site.
I have already done that procedure, tried all the existing versions of the FW in the TP-Link's homepage, and i was able to upload the FW correctly using the TFTP method, but router is still in the bootloop...it blinks all lights, and then only the WPS led stays...
Today a friend of mine, brought me an old laptop with a native COM port, and using my old "RS232 male to RS232 female adapter" I was able to get output to the serial console, but all the text is corrupted, also tested all possible bauds/parity combinations, without success...
I got the feeling that he is trying to boot, because the lines have different data and lengths, and occasionally I see a correct word written, weird
I will try to order a new TTL similar to the ones present on the tutorials, as a final attempt...
And this is *if* all of your connections are good on the router and PC.
Thank you for the tip! @kernel-panic69
I tried Putty with that option, but I'm still getting the same output corruption...
I will have to wait for the new USB TTL, since I can't confirm that my old TTL, and the cable (7 feet long, I don't have another one) are all OK, I will also reflow the connection on the router (just in case).
Device eth0: hwaddr 00-90-4C-11-20-01, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Invalid boot block on disk
flash0.0: Device not found
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: Image compressed with unsupported method
Failed.
Could not load flash0.os:: Unsupported function
CFE>
-------------
I have read the manual "TP-Link Archer C9 v1 - Unbrick and back to stock step-by-step guide", but now I'm missing some files (12.bin and mtd3.bin) the manual have these two steps:
-------------
Flash “12.bin” in the CFE console (adapt IP if necessary)
flash -noheader 192.168.1.66:12.bin flash0.trx
-------------
Flash “mtd3.bin” in the CFE console (adapt IP if necessary)
flash -noheader -offset=0xfe0000 192.168.1.66:mtd3.bin flash0
-------------
The ones available in the forum are for the v1 model, is there a way to get/create these files for the v2?
Regards,
(edit)
PS: After reading all the 22 pages of the thread, the V1 files should work on the v2 model... I will try that soon...
I will leave here my experience, to help others in the future:
1- Used a TTL with the CP210x chip installed using the W10 driver "CP210x_Universal_Windows_Driver" (other drivers gived me corrupted output).
2- Putty (last version) with the legacy option [Window > Translation > "Enable VT100 line drawing even in UTF-8 mode"]
3-Used the the manual an files from this thread (its for V1 model, but works on v2):
4- Before flashing the stock FW, I edited the file "12.bin" with an Hexa Editor and changed the version of the router, has described here: (these also instructions in the thread, how to change the MAC and PIN to the original ones, but I didn't do it)
5- Flashed my new hexa edited FW as described on the manual.
6- Upgraded from the stock FW webinterface, to the lastest official UN TP-Link FW.
7- Downloaded the DD-WRT image from router database "ddwrt-to-factory.bin" (r44715 for v2 model) and flashed from the stock webinterface.
8- From the new DD-Wrt interface, I upgraded again using the most recent "archer-c9v2-webflash.bin".
9-No factory reset (images later than 10/2021 bricks the router if reset is made)
10- Done!
Everything is working ok!
Only issue: Leds are messed up, no Wifi, USB or Power Led, only LAN, WAN and WPS (needs to be enabled manually, using startup GPIO commands), apparently its a known issue...
Thank you all, for helping me with this quest!
Last edited by pawhtiobo on Tue Jan 04, 2022 23:22; edited 2 times in total
For those interested, to enable the 3 possible leds, use this 3 attached files in the OPT root (USB partition mounted as OPT) and add the following to Administration>Commands>Startup:
For those interested, to enable the 3 possible leds, use this 3 attached files (in the OPT root) and add the following to Administration>Commands>Startup:
sleep 5
gpio enable 2
sleep 5
sh /opt/leds.sh
When you say you have the 3 files in /OPT. Do you have a usb mounted in /opt?
I copied the files to a usb, telnet into dd-wrt, but I get a read only file system error when I try to copy.
Code:
root@DD-WRT:/tmp/mnt/sda1# cp *.sh /opt
cp: can't create '/opt/lan_led.sh': Read-only file system
cp: can't create '/opt/leds.sh': Read-only file system
cp: can't create '/opt/wan_led.sh': Read-only file system
Any help would be appreciated.Long time user of dd-wrt but I'm not that familiar with linux.
Joined: 16 Nov 2015 Posts: 6441 Location: UK, London, just across the river..
Posted: Wed Sep 21, 2022 11:08 Post subject:
i guess you either use auto-mount(if partitions are opt or jffs) or mount it via UUID
as on some routers it mounts twice...
I use automount only _________________ Atheros
TP-Link WR740Nv1 ---DD-WRT 55630 WAP
TP-Link WR1043NDv2 -DD-WRT 55723 Gateway/DoT,Forced DNS,Ad-Block,Firewall,x4VLAN,VPN
TP-Link WR1043NDv2 -Gargoyle OS 1.15.x AP,DNS,QoS,Quotas
Qualcomm-Atheros
Netgear XR500 --DD-WRT 55779 Gateway/DoH,Forced DNS,AP Isolation,4VLAN,Ad-Block,Firewall,Vanilla
Netgear R7800 --DD-WRT 55819 Gateway/DoT,AD-Block,Forced DNS,AP&Net Isolation,x3VLAN,Firewall,Vanilla
Netgear R9000 --DD-WRT 55779 Gateway/DoT,AD-Block,AP Isolation,Firewall,Forced DNS,x2VLAN,Vanilla
Broadcom
Netgear R7000 --DD-WRT 55460 Gateway/SmartDNS/DoH,AD-Block,Firewall,Forced DNS,x3VLAN,VPN
NOT USING 5Ghz ANYWHERE
------------------------------------------------------
Stubby DNS over TLS I DNSCrypt v2 by mac913
If one script calls the others, then you could just save the one script as USB in Administration -> Commands so it automatically runs when the USB drive is mounted. _________________ "The woods are lovely, dark and deep,
But I have promises to keep,
And miles to go before I sleep,
And miles to go before I sleep." - Robert Frost
"I am one of the noticeable ones - notice me" - Dale Frances McKenzie Bozzio