[osm0sis]

Hi all, looking into how to make "webrevert" files like LOM did in his thread, but for the Archer C7 v4 which doesn't have one yet.

From comparing the C7 v2 stock to LOM's webrevert and DD-WRT's factory-to-ddwrt to the std build it looks like the only important thing is adding the DD-WRT-like header to a stock image like:

[kernel-panic69]

Had you done a search on "how to create webrevert files"...

https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=302851

You have the option of TFTP recovery on these devices that do not require modifying anything.

https://openwrt.org/toh/tp-link/archer_c7#installation_or_restore_with_tftp

In fact, TFTPD32/TFTPD64 log will tell you what filename it is looking for, or so I found out, but you can also use wireshark to verify, if needed. If you produce a usable revert file, I can add it to that thread.

[osm0sis]

Thanks for the link! I searched a little more and found the following for the TP-Link Archer C7v4 in the DD-WRT source:

https://github.com/mirror/dd-wrt/blob/master/src/router/Makefile.pb42#L1972-L1974

Which lead me to what appears to be the firmware bin creation utility here: https://github.com/mirror/dd-wrt/blob/master/src/router/tools/safeloader/tplink-safeloader.c

And the added DD-WRT header creation utility used for all non-broadcom here: https://github.com/mirror/dd-wrt/blob/master/opt/tools/trx_n.c

Presumably anyone who needed a webrevert for their devices could just grab the correct trx* source from DD-WRT's repo and build the utility, then sign the latest stock firmware bin using the Makefile trx command so DD-WRT will recognize it.

I'll give this a shot for my device next time I've got time to muck with compiles and router downtime.

[kernel-panic69]

But the *recovery.bin files are for TFTP flashing, not webflashing.

[osm0sis]

Yes, that's the naming used by TFTP, but it also appears to just be the filename the DD-WRT build system uses as an interim before adding the trx "HDR0" header so that the WebUI will accept it.

As further evidence, I quickly found an example where the build script then just copies the trx_n signed and unsigned files over to the build server with their final DD-WRT names: https://github.com/mirror/dd-wrt/blob/master/src/router/configs/buildscripts/build_archerc7v2.sh#L18-L19

So, signing stock firmware with trx_n to make our own webreverts should work, theoretically! May just need the bootloader stripped too, as I've read, but that also may differ between devices/revisions. 🙂

Edit: `gcc trx_n.c` compiled without issue in Cygwin, no changes needed, and the utility appears to have successfully trx signed the stock C7 v4 firmware.🤘

But I'll have to save testing it and reporting whether the WebUI accepts it (and whether it needs to be stripped before signing it on the v4) when it's not the middle of a work week. 🤞🤠

[kernel-panic69]

When you have a working solution, please update us. Having something that would actually work without having to use a hex editor would be great!

[osm0sis]

Well the WebUI said the flash was successful, so presumably the trx_n signing of the file was correct, but unfortunately the device then wouldn't boot and I had to tftpd it.

Not sure if that's because the final stock firmware needed to be stripped or not (I didn't see any obvious point at which to strip it around 0x20200 like other C7 stripping tutorials mention), or whether with the added header the firmware was simply too large. I had told it to factory reset so it shouldn't have been an nvram settings issue.

Either way the compiled trx_n "HDR0" signing utility might still be useful to others on non-broadcom hardware wanting to try to make webreverts, so I've uploaded my Cygwin build (+lib) of it, and the .c source file (from DD-WRT's repo as linked above), and if anyone wanted it for MacOS or Linux I'm sure it would be just as simple to make a native compile as I mentioned in my previous post.

Judging from the Makefile most non-broadcom devices can just use: `./trx_n -m 40000000 -o <output-file> <input-file>`

[kernel-panic69]

If you read KrypteX's post in the thread I linked, you would know you had to strip the bootloader to create the file.

[osm0sis]

[kernel-panic69]

All of LOM's files use the oldest firmware for the device, not the newest AFAIK. If I missed something where you have done your homework, sorry. If there is no bootloader or anything that needs to be stripped or overwritten, I am at a loss; but it has to be one or the other as to why it didn't work, if I am not mistaken. I believe you would have to compare the webflash file with the stock firmware file in a hex editor as you already know.

[d33b0_n4p41m]

I have not tested this file and I claim no responsibility if it does not work.