Unbricking? an TP Link Archer C9 v2

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Goto page 1, 2  Next
Author Message
pawhtiobo
DD-WRT User


Joined: 13 Apr 2021
Posts: 68
Location: Portugal

PostPosted: Tue Apr 13, 2021 23:55    Post subject: Unbricking? an TP Link Archer C9 v2 Reply with quote
I received today a bricked Archer C9 v2 from a friend, he said to me that the router just stopped working (no apparent reason), the router only lights the LAN an WPS leds, stays there for a few seconds and it enters an infinite boot loop...

- My first suspicion was that the AC adapter could be faulty, I managed to find one similar from an old HDD enclosure (12v, 2.5A), but it did not solve the problem.

- Next I opened the router checked if the capacitors on the board were swollen/leaked, but no apparent damage.

- After some hours reading on the web, I started to suspect that this could be some kind of soft-brick, so I questioned him again and he find out that one of his kids tried to install/update the firmware (he don't knows which type/version)... Confused

So far I managed to upload the stock firmware using the recovery mode using the TFTP method, but the router didn't change is behaviour, tried all versions available of the stock firmware, without success...

Next I was thinking in using the serial recovery method, but I only have and old serial TTL, and I don't have any computer with a native serial port, so I just order now a new USB TTL...

After further reading here in the forum, I see lots of references (also tutorials) about flashing the firmware using the serial console, and a lot of them refer to a set of files (12.bin and mtd3.bin), this is the part where I'm a bit lost, where can I get these files or can they be extracted from the stock firmware?

Also, is the fact of the TFTP recover working a good sign? Or it just luck, and this can be a permabrick?

Thank you all in advance!
Sponsor
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 14125
Location: Texas, USA

PostPosted: Wed Apr 14, 2021 5:10    Post subject: Reply with quote
https://wiki.dd-wrt.com/wiki/index.php/TP_Link_Archer_C9

https://wiki.dd-wrt.com/wiki/index.php/Tftp_flash

https://wiki.dd-wrt.com/wiki/index.php/Serial_Recovery

_________________
"Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT
Pogo - A minimal level of ability is expected and needed...
DD-WRT Releases 2023 (PolitePol)
DD-WRT Releases 2023 (RSS Everything)

----------------------
Linux User #377467 counter.li.org / linuxcounter.net
pawhtiobo
DD-WRT User


Joined: 13 Apr 2021
Posts: 68
Location: Portugal

PostPosted: Wed Apr 14, 2021 10:33    Post subject: Reply with quote
kernel-panic69 wrote:
https://wiki.dd-wrt.com/wiki/index.php/TP_Link_Archer_C9

https://wiki.dd-wrt.com/wiki/index.php/Tftp_flash

https://wiki.dd-wrt.com/wiki/index.php/Serial_Recovery


I just read this information and acomplished the TFTP Flash procedure, without success, I will have to wait for the USB TTL to arrive to try the Serial Recovery.

Thank you very much for your reply!
pawhtiobo
DD-WRT User


Joined: 13 Apr 2021
Posts: 68
Location: Portugal

PostPosted: Sun Apr 25, 2021 3:36    Post subject: Reply with quote
After o long wait for the TTL to arrive...

Today I just tried the serial recovery without success, the router does not output any data to the serial console...my guess is that the bootloader is also gone...

If anyone has any suggestion, let me know.
mikesal57
DD-WRT User


Joined: 27 Aug 2007
Posts: 228

PostPosted: Sun Apr 25, 2021 20:30    Post subject: Reply with quote
Try this...

I used this on my Archer A7 about 2 months ago..

https://www.youtube.com/watch?v=ZW5fpOWpI0I

Make sure you get right version of stock file...

Moderator note 04.25.2021: Please refer to the rules and guidelines regarding attached image sizes. No wider than 768 pixels without linking to an image hosting site.



Capture.JPG
 Description:
 Filesize:  30.27 KB
 Viewed:  6853 Time(s)

Capture.JPG


pawhtiobo
DD-WRT User


Joined: 13 Apr 2021
Posts: 68
Location: Portugal

PostPosted: Sun Apr 25, 2021 23:57    Post subject: Reply with quote
Thank you for your reply @mikesal57!

I have already done that procedure, tried all the existing versions of the FW in the TP-Link's homepage, and i was able to upload the FW correctly using the TFTP method, but router is still in the bootloop...it blinks all lights, and then only the WPS led stays...

Today a friend of mine, brought me an old laptop with a native COM port, and using my old "RS232 male to RS232 female adapter" I was able to get output to the serial console, but all the text is corrupted, also tested all possible bauds/parity combinations, without success...

I got the feeling that he is trying to boot, because the lines have different data and lengths, and occasionally I see a correct word written, weird Laughing

I will try to order a new TTL similar to the ones present on the tutorials, as a final attempt...
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 14125
Location: Texas, USA

PostPosted: Mon Apr 26, 2021 0:31    Post subject: Reply with quote
If you are using the latest version of PuTTY, you have to enable VT-100 line drawing in UTF-8 mode.

Quote:
Window > Translation > "Enable VT100 line drawing even in UTF-8 mode".


https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=323931

And this is *if* all of your connections are good on the router and PC.

_________________
"Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT
Pogo - A minimal level of ability is expected and needed...
DD-WRT Releases 2023 (PolitePol)
DD-WRT Releases 2023 (RSS Everything)

----------------------
Linux User #377467 counter.li.org / linuxcounter.net
pawhtiobo
DD-WRT User


Joined: 13 Apr 2021
Posts: 68
Location: Portugal

PostPosted: Mon Apr 26, 2021 9:19    Post subject: Reply with quote
kernel-panic69 wrote:
If you are using the latest version of PuTTY, you have to enable VT-100 line drawing in UTF-8 mode.

Quote:
Window > Translation > "Enable VT100 line drawing even in UTF-8 mode".


https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=323931

And this is *if* all of your connections are good on the router and PC.


Thank you for the tip! @kernel-panic69

I tried Putty with that option, but I'm still getting the same output corruption...

I will have to wait for the new USB TTL, since I can't confirm that my old TTL, and the cable (7 feet long, I don't have another one) are all OK, I will also reflow the connection on the router (just in case).
pawhtiobo
DD-WRT User


Joined: 13 Apr 2021
Posts: 68
Location: Portugal

PostPosted: Wed May 12, 2021 0:06    Post subject: Reply with quote
I received the new TTL, and finally I get output from the serial console! Very Happy

-------------

Decompressing...done

CFE version 6.37.14.93 (r469350) based on BBP 1.0.37 for BCM947XX (32bit,SP,)
Build Date: 2015年 07月 08日 星期三 16:42:42 CST (tomcat@buildserver)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
DDR Clock: 800 MHz
Info: DDR frequency set from clkfreq=1000,*800*
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.14.93 (r469350)
CPU type 0x0: 1000MHz
Tot mem: 131072 KBytes

CFE mem: 0x00F00000 - 0x02F80F3C (34082620)
Data: 0x00F48C1C - 0x00F490F0 (1236)
BSS: 0x00F49100 - 0x00F7EF3C (220732)
Heap: 0x00F7EF3C - 0x02F7EF3C (33554432)
Stack: 0x02F7EF3C - 0x02F80F3C (8192)
Text: 0x00F00000 - 0x00F3F36C (258924)

Device eth0: hwaddr 00-90-4C-11-20-01, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Invalid boot block on disk
flash0.0: Device not found
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: Image compressed with unsupported method
Failed.
Could not load flash0.os:: Unsupported function
CFE>

-------------

I have read the manual "TP-Link Archer C9 v1 - Unbrick and back to stock step-by-step guide", but now I'm missing some files (12.bin and mtd3.bin) the manual have these two steps:

-------------
Flash “12.bin” in the CFE console (adapt IP if necessary)
flash -noheader 192.168.1.66:12.bin flash0.trx
-------------
Flash “mtd3.bin” in the CFE console (adapt IP if necessary)
flash -noheader -offset=0xfe0000 192.168.1.66:mtd3.bin flash0
-------------

The ones available in the forum are for the v1 model, is there a way to get/create these files for the v2?

Regards,

(edit)

PS: After reading all the 22 pages of the thread, the V1 files should work on the v2 model... I will try that soon...
pawhtiobo
DD-WRT User


Joined: 13 Apr 2021
Posts: 68
Location: Portugal

PostPosted: Thu May 13, 2021 18:35    Post subject: Reply with quote
Finally the router is up and running! Very Happy

--------

I will leave here my experience, to help others in the future:

1- Used a TTL with the CP210x chip installed using the W10 driver "CP210x_Universal_Windows_Driver" (other drivers gived me corrupted output).
2- Putty (last version) with the legacy option [Window > Translation > "Enable VT100 line drawing even in UTF-8 mode"]
3-Used the the manual an files from this thread (its for V1 model, but works on v2):

@reroute post:

https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=283784&postdays=0&postorder=asc&start=90

4- Before flashing the stock FW, I edited the file "12.bin" with an Hexa Editor and changed the version of the router, has described here: (these also instructions in the thread, how to change the MAC and PIN to the original ones, but I didn't do it)

@user1514 post:

https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=283784&postdays=0&postorder=asc&start=225

5- Flashed my new hexa edited FW as described on the manual.
6- Upgraded from the stock FW webinterface, to the lastest official UN TP-Link FW.
7- Downloaded the DD-WRT image from router database "ddwrt-to-factory.bin" (r44715 for v2 model) and flashed from the stock webinterface.
8- From the new DD-Wrt interface, I upgraded again using the most recent "archer-c9v2-webflash.bin".
9- No factory reset (images later than 10/2021 bricks the router if reset is made)
10- Done!

Everything is working ok!

Only issue: Leds are messed up, no Wifi, USB or Power Led, only LAN, WAN and WPS (needs to be enabled manually, using startup GPIO commands), apparently its a known issue...

Thank you all, for helping me with this quest!


Last edited by pawhtiobo on Tue Jan 04, 2022 23:22; edited 2 times in total
pawhtiobo
DD-WRT User


Joined: 13 Apr 2021
Posts: 68
Location: Portugal

PostPosted: Tue Oct 12, 2021 18:14    Post subject: Reply with quote
For those interested, to enable the 3 possible leds, use this 3 attached files in the OPT root (USB partition mounted as OPT) and add the following to Administration>Commands>Startup:

sleep 5
gpio enable 2

sleep 5
sh /opt/leds.sh



Archer C9.zip
 Description:
wan_led.sh
lan_led.sh
leds.sh

Download
 Filename:  Archer C9.zip
 Filesize:  1.64 KB
 Downloaded:  205 Time(s)



Last edited by pawhtiobo on Tue Sep 27, 2022 21:53; edited 2 times in total
marbss
DD-WRT Novice


Joined: 13 Jul 2007
Posts: 26

PostPosted: Wed Sep 21, 2022 4:47    Post subject: Reply with quote
pawhtiobo wrote:
For those interested, to enable the 3 possible leds, use this 3 attached files (in the OPT root) and add the following to Administration>Commands>Startup:

sleep 5
gpio enable 2

sleep 5
sh /opt/leds.sh


When you say you have the 3 files in /OPT. Do you have a usb mounted in /opt?
I copied the files to a usb, telnet into dd-wrt, but I get a read only file system error when I try to copy.

Code:
root@DD-WRT:/tmp/mnt/sda1# cp *.sh /opt
cp: can't create '/opt/lan_led.sh': Read-only file system
cp: can't create '/opt/leds.sh': Read-only file system
cp: can't create '/opt/wan_led.sh': Read-only file system


Any help would be appreciated.Long time user of dd-wrt but I'm not that familiar with linux.
pawhtiobo
DD-WRT User


Joined: 13 Apr 2021
Posts: 68
Location: Portugal

PostPosted: Wed Sep 21, 2022 10:04    Post subject: Reply with quote
Hi @marbss

Yes, the usb drive is mounted as /OPT, I have it configured the way it is on the attached image.

To find the UUID of your drive, just type blkid on the terminal:

root@TPLINK:~# blkid
/dev/sda1: LABEL="OPT" UUID="dc7f392c-3e48-d701-9064-392c3e48d701"



Services_USB.JPG
 Description:
 Filesize:  54.61 KB
 Viewed:  3258 Time(s)

Services_USB.JPG


Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 6409
Location: UK, London, just across the river..

PostPosted: Wed Sep 21, 2022 11:08    Post subject: Reply with quote
i guess you either use auto-mount(if partitions are opt or jffs) or mount it via UUID
as on some routers it mounts twice...
I use automount only Cool

_________________
Atheros
TP-Link WR740Nv1 ---DD-WRT 55179 WAP
TP-Link WR1043NDv2 -DD-WRT 55303 Gateway/DoT,Forced DNS,Ad-Block,Firewall,x4VLAN,VPN
TP-Link WR1043NDv2 -Gargoyle OS 1.15.x AP,DNS,QoS,Quotas
Qualcomm-Atheros
Netgear XR500 --DD-WRT 55460 Gateway/DoH,Forced DNS,AP Isolation,4VLAN,Ad-Block,Firewall,Vanilla
Netgear R7800 --DD-WRT 55460 Gateway/DoT,AD-Block,Forced DNS,AP&Net Isolation,x3VLAN,Firewall,Vanilla
Netgear R9000 --DD-WRT 55363 Gateway/DoT,AD-Block,AP Isolation,Firewall,Forced DNS,x2VLAN,Vanilla
Broadcom
Netgear R7000 --DD-WRT 55460 Gateway/SmartDNS/DoH,AD-Block,Firewall,Forced DNS,x3VLAN,VPN
NOT USING 5Ghz ANYWHERE
------------------------------------------------------
Stubby DNS over TLS I DNSCrypt v2 by mac913
dale_gribble39
DD-WRT Guru


Joined: 11 Jun 2022
Posts: 1899

PostPosted: Wed Sep 21, 2022 15:07    Post subject: Reply with quote
If one script calls the others, then you could just save the one script as USB in Administration -> Commands so it automatically runs when the USB drive is mounted.
_________________
"The woods are lovely, dark and deep,
But I have promises to keep,
And miles to go before I sleep,
And miles to go before I sleep." - Robert Frost

"I am one of the noticeable ones - notice me" - Dale Frances McKenzie Bozzio

<fact>code knows no gender</fact>

This is me, knowing I've ruffled your feathers, and not giving a ****
Some people are still hard-headed.

--------------------------------------
Mac Pro (Mid 2012) - Two 2.4GHz 6-Core Intel Xeon E5645 processors 64GB 1333MHz DDR3 ECC SDRAM OpenSUSE Leap 15.5
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum