Archer A7 V5 (EU) Bricked (Possibly Corrupt Partitions)

Installing and Using OpenWrt
1

I purchased this router a long time ago, but since my ISP provided a better one, I kept it aside. Later, I attempted to set it up as a RADIUS server for WPA Enterprise authentication, but the process proved too complex—especially for iOS devices on my network.

Recently, I decided to repurpose it for IoT devices but couldn’t recall the OpenWrt image I had previously used. I tried multiple images via the TFTP method, but none worked.

Next, I opened the router and soldered it for UART access. Despite having terminal access, flashing different images still failed. The device only displayed:

[NM_Error](nm_api_checkInteger) 00331: factory boot check integer flag is not 1.

I even attempted uploading the firmware via 192.168.1.1, but the process stalled at 40% with an "unsupported" error.

After researching forums, I downloaded:

https://downloads.openwrt.org/releases/24.10.1/targets/ath79/generic/openwrt-24.10.1-ath79-generic-tplink_archer-a7-v5-initramfs-kernel.bin

This time, I loaded the image at 0x82000000 instead of 0x81000000 (which wouldn’t boot).

tftpboot 0x82000000 openwrt-24.10.1-ath79-generic-tplink_archer-a7-v5-initramfs-kernel.bin  
bootm 0x82000000

It worked! I then performed a sysupgrade using:

sysupgrade -n /tmp/openwrt-24.10.1-ath79-generic-tplink_archer-a7-v5-squashfs-sysupgrade.bin

However, the factory boot check integer flag is not 1 error reappeared.

The printenv output showed:

ath> printenv  
bootargs=console=ttyS0,115200 board=AP152 rootfstype=squashfs init=/etc/preinit mtdparts=spi0.0:128k(factory-uboot),128k(u-boot),1152k(uImage),14912k(rootfs),64k@0xff0000(ART) mem=128M  
bootcmd=bootm 0x9f040000  
bootdelay=1  
baudrate=115200  
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee  
ipaddr=192.168.0.2  
serverip=192.168.0.10

Executing bootm 0x9f040000 resulted in the device booting with the following log.

ath> bootm 0x9f040000
bootm 0x9f040000
Booting image at 9f040000 ...
   Image Name:   MIPS OpenWrt Linux-6.6.86
   Created:      2025-04-13  16:38:32 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2614104 Bytes =  2.5 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f040040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
Transferring control to Linux (at address 80060000) ...
Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 6.6.86 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r28597-0425664679) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 Sun Apr 13 16:38:32 2025
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is TP-Link Archer A7 v5
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 119968K/131072K available (6821K kernel code, 602K rwdata, 900K rodata, 1204K init, 233K bss, 11104K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 775.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000001] sched_clock: 32 bits at 388MHz, resolution 2ns, wraps every 5541893118ns
[    0.008310] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.074800] pid_max: default: 32768 minimum: 301
[    0.089111] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.096852] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.113359] RCU Tasks Trace: Setting shift to 0 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=1.
[    0.127993] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.138412] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.148050] pinctrl core: initialized pinctrl subsystem
[    0.156316] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.163177] thermal_sys: Registered thermal governor 'step_wise'
[    0.165110] /ahb/apb: Fixed dependency cycle(s) with /ahb/apb/interrupt-controller@18060010
[    0.192818] clocksource: Switched to clocksource MIPS
[    0.208405] NET: Registered PF_INET protocol family
[    0.213828] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.222882] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.231819] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.240012] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.248112] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.255587] TCP: Hash tables configured (established 1024 bind 1024)
[    0.263013] MPTCP token hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.270883] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.277830] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.286080] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.292125] PCI: CLS 0 bytes, default 32
[    0.300916] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.309352] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.315552] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.333091] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.344173] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[    0.350889] gpio-export gpio-export: 1 gpio(s) exported
[    0.357542] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.369416] printk: console [ttyS0] disabled
[    0.374584] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A
[    0.383840] printk: console [ttyS0] enabled
[    0.383840] printk: console [ttyS0] enabled
[    0.392908] printk: bootconsole [early0] disabled
[    0.392908] printk: bootconsole [early0] disabled
[    0.437565] spi-nor spi0.0: w25q128 (16384 Kbytes)
[    0.442622] 7 fixed-partitions partitions found on MTD device spi0.0
[    0.449270] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.456138] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.463236] Creating 7 MTD partitions on "spi0.0":
[    0.468201] 0x000000000000-0x000000020000 : "factory-uboot"
[    0.477051] 0x000000020000-0x000000040000 : "u-boot"
[    0.484207] 0x000000040000-0x000000f00000 : "firmware"
[    0.491587] 2 uimage-fw partitions found on MTD device firmware
[    0.497763] Creating 2 MTD partitions on "firmware":
[    0.502949] 0x000000000000-0x00000027e398 : "kernel"
[    0.508084] mtd: partition "kernel" doesn't end on an erase/write block -- force read-only
[    0.518567] 0x00000027e398-0x000000ec0000 : "rootfs"
[    0.523767] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[    0.535200] mtd: setting mtd4 (rootfs) as root device
[    0.540507] 1 squashfs-split partitions found on MTD device rootfs
[    0.546943] 0x0000006a0000-0x000000ec0000 : "rootfs_data"
[    0.554494] 0x000000f40000-0x000000f60000 : "info"
[    0.561486] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.568657] 0x000000f60000-0x000000fb0000 : "config"
[    0.576098] 0x000000fc0000-0x000000fd0000 : "partition-table"
[    0.584177] 0x000000ff0000-0x000001000000 : "art"
[    0.591113] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    1.287271] switch0: Atheros AR8337 rev. 2 switch registered on mdio.0
[    1.944559] ag71xx-legacy 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[    1.956578] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: sgmii
[    1.963576] i2c_dev: i2c /dev entries driver
[    1.972115] NET: Registered PF_INET6 protocol family
[    1.991049] Segment Routing with IPv6
[    1.994982] In-situ OAM (IOAM) with IPv6
[    1.999196] NET: Registered PF_PACKET protocol family
[    2.004500] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.018151] 8021q: 802.1Q VLAN Support v1.8
[    2.055756] PCI host bridge to bus 0000:00
[    2.060008] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    2.067269] pci_bus 0000:00: root bus resource [io  0x0000]
[    2.073061] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    2.081285] pci 0000:00:00.0: [168c:003c] type 00 class 0x028000
[    2.087536] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    2.094616] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    2.101611] pci 0000:00:00.0: supports D1 D2
[    2.107104] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    2.114014] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    2.121593] pci 0000:00:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
[    2.132924] clk: Disabling unused clocks
[    2.146815] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    2.160650] Freeing unused kernel image (initmem) memory: 1204K
[    2.166810] This architecture does not have kernel memory protection.
[    2.173481] Run /sbin/init as init process
[    2.904551] init: Console is alive
[    2.908450] init: - watchdog -
[    4.470249] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.562737] usbcore: registered new interface driver usbfs
[    4.568596] usbcore: registered new interface driver hub
[    4.574209] usbcore: registered new device driver usb
[    4.589204] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    4.608133] ehci-platform 1b000000.usb: EHCI Host Controller
[    4.614071] ehci-platform 1b000000.usb: new USB bus registered, assigned bus number 1
[    4.622312] ehci-platform 1b000000.usb: irq 14, io mem 0x1b000000
[    4.652834] ehci-platform 1b000000.usb: USB 2.0 started, EHCI 1.00
[    4.660285] hub 1-0:1.0: USB hub found
[    4.665101] hub 1-0:1.0: 1 port detected
[    4.674575] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.692605] init: - preinit -
[    8.982847] random: crng init done
Cannot parse config file '/etc/fw_env.config': No such file or directory
Failed to find NVMEM device
[   11.573940] Atheros AR8216/AR8236/AR8316 mdio.0:00: Port 3 is up
[   11.582018] eth0: link up (1000Mbps/Full duplex)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   15.904612] jffs2: notice: (564) jffs2_build_xattr_subsystem: complete building xattr subsystem, 9 of xdatum (0 unchecked, 2 orphan) and 10 of xref (2 dead, 0 orphan) found.
[   15.922561] mount_root: switching to jffs2 overlay
[   15.930038] overlayfs: upper fs does not support tmpfile.
[   15.945138] urandom-seed: Seeding with /etc/urandom.seed
[   16.026438] eth0: link down
[   16.052005] procd: - early -
[   16.055436] procd: - watchdog -
[   16.803037] procd: - watchdog -
[   16.807187] procd: - ubus -
[   17.014638] procd: - init -
Please press Enter to activate this console.
[   19.195403] kmodloader: loading kernel modules from /etc/modules.d/*
[   20.265139] Loading modules backported from Linux version v6.12.6-0-ge9d65b48ce1a
[   20.272932] Backport generated by backports.git v6.1.110-1-35-g410656ef04d2
[   21.077898] urngd: v1.0.2 started.
[   21.245751] PPP generic driver version 2.4.2
[   21.254821] NET: Registered PF_PPPOX protocol family
[   21.366042] ath10k 6.10 driver, optimized for CT firmware, probing pci device: 0x3c.
[   21.423741] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002)
[   21.432446] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[   25.386910] ath10k_pci 0000:00:00.0: qca988x hw2.0 target 0x4100016c chip_id 0x043202ff sub 0000:0000
[   25.396532] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   25.406978] ath10k_pci 0000:00:00.0: firmware ver 10.1-ct-8x-__fW-022-ecad3248 api 2 features wmi-10.x,has-wmi-mgmt-tx,mfp,txstatus-noack,wmi-10.x-CT,ratemask-CT,txrate-CT,get-temp-CT,tx-rc-CT,cust-stats-CT,retry-gt2-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT crc32 3e4cf97f
[   26.298626] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id N/A crc32 bebc7c08
[   27.267527] ath10k_pci 0000:00:00.0: 10.1 wmi init: vdevs: 16  peers: 127  tid: 256
[   27.284314] ath10k_pci 0000:00:00.0: wmi print 'P 128 V 8 T 410'
[   27.290764] ath10k_pci 0000:00:00.0: wmi print 'msdu-desc: 1424  sw-crypt: 0 ct-sta: 0'
[   27.299075] ath10k_pci 0000:00:00.0: wmi print 'alloc rem: 24984 iram: 38672'
[   27.349260] ath10k_pci 0000:00:00.0: htt-ver 2.1 wmi-op 2 htt-op 2 cal nvmem max-sta 128 raw 0 hwcrypto 1
[   27.362177] ath10k_pci 0000:00:00.0: NOTE:  Firmware DBGLOG output disabled in debug_mask: 0x10000000
[   27.601173] ieee80211 phy1: Atheros AR9561 Rev:0 mem=0x6a315e7c, irq=2
[   27.653303] kmodloader: done loading kernel modules from /etc/modules.d/*
[   48.247430] eth0: link up (1000Mbps/Full duplex)
[   48.256807] br-lan: port 1(eth0.1) entered blocking state
[   48.262416] br-lan: port 1(eth0.1) entered disabled state
[   48.268081] eth0.1: entered allmulticast mode
[   48.272595] ag71xx-legacy 19000000.eth eth0: entered allmulticast mode
[   48.279617] eth0.1: entered promiscuous mode
[   48.284088] ag71xx-legacy 19000000.eth eth0: entered promiscuous mode
[   48.388281] br-lan: port 1(eth0.1) entered blocking state
[   48.393930] br-lan: port 1(eth0.1) entered forwarding state

Additionally, cat /proc/mtd displayed:

dev:    size   erasesize  name
mtd0: 00020000 00010000 "factory-uboot"
mtd1: 00020000 00010000 "u-boot"
mtd2: 00ec0000 00010000 "firmware"
mtd3: 0027e398 00010000 "kernel"
mtd4: 00c41c68 00010000 "rootfs"
mtd5: 00820000 00010000 "rootfs_data"
mtd6: 00020000 00010000 "info"
mtd7: 00050000 00010000 "config"
mtd8: 00010000 00010000 "partition-table"
mtd9: 00010000 00010000 "art"

Clearly, I made a mistake by proceeding without proper research. Now, what are my options without JTAG?

2

Try to recover to (oldest compatible) OEM version first, if it boots "upgrade" it to same version. Now p4oceed with OpenWrt normal way.

no anomalies in openwrt managed partitions.

1 Like
3

Thanks for your quick response. Ah... I see I had read about this....using oldest firmware first (I am not able to concentrate due to lot of turmoil in my life). Kindly suggest as:

Index of releases "https://mirror-03.infra.openwrt.org/releases/19.07.0/targets/ath79/generic/" says earliest is 19.07.0 whereas router firmware selector page "https://firmware-selector.openwrt.org/?version=19.07.4&target=ath79%2Fgeneric&id=tplink_archer-a7-v5" says it's 19.07.4??

4

I mean this

Once tplink fw runs well install openwrt normal way

5

I am sorry to tell you the oldest firmware from tp-link's my country specific as well as from the UK website does not work.

Command used:

tftpboot 0x81000000 ArcherC7v5_tp_recovery.bin
erase 0x9f040000 "+filesize in hex"
cp.b 0x81000000 0x9f040000 "filesize in hex"
reset

also tried using 0x82000000 and 0x9f020000 (C7)...plus I want to ask you a noob question:

My UART interface to the pins of archer a7 does not blink TX while data transfer (yes tx pin shorted with r24) but certainly I get the following output in putty:

ath> cp.b 0x82000000 0x9f020000 ef33c8
Copy to Flash... write addr: 9f020000
done
ath> reset

That does says the file is transferred.
Now, I remember have also tried the tp-links oldest firmware by tftp method.

6

Read the tftp instructions for once

7

From the following tftp instructions at router's page:

After downloading the zip file, extract the bin file and name it ArcherC7v5_tp_recovery.bin (this is not a typo; even though we are recovering for the A7v5, the name has to be C7v5). Then follow the [TP-Link Archer A7 installation using the TFTP method]

(https://openwrt.org/toh/tp-link/archer_a7_v5#tp-link_archer_a7_installation_using_the_tftp_method) using this file instead of the OpenWrt firmware.

Also checked

There is a thread on the forum about this recovery that had been successful.

You can revert OpenWrt to version 19.07.10 and subsequently install the stock firmware using TFTP injection, as mentioned in this topic.
But this does not work , I even tried dd-wrt but the result is same.

Since uart method for a7 and c7 are same as per page:

Set up a TFTP server with your firmware at 192.168.1.100, then run the following commands:
Commands for 16MB flash are:
For 16MB Flash:

tftp 0x81000000 [name of your firmware file].bin
erase 0x9f020000 +f80000
cp.b 0x81000000 0x9f020000 0xf80000
reset

Instead of server at 192.168.1.100 you need to set it at 192.168.0.10
But this also is not working for various images.

All I can do was install 19.07.10 to ram and upgraded it then booted at bootm 0x9f040000 since I have access to LUCI so can i upgrade to tp-link 19 version at ddwrt or stock version at tp-link country website?

8

Yours is A7 V5 (filename c7v5)

9

FWIW, in a similar situation I was able to recover the device only after manually rewriting some of the partitions (dumped from a working router) using mtd.

I wasted hours trying everything else without any success.

1 Like
10

I am aware of the filename...fyi while using tftp flashing:

  1. Filename should be " ArcherC7v5_tp_recovery.bin" for archer A7.
  2. Double checked tftpd64 settings and confirmed the transfer size from the log.
  3. Used all the firmwares available on tp-link country specific website for the model archer a7 v5 (eu).
  4. Confirmed the full tftp transfer process required from the website and forums for the model.
  5. Used dd-wrt method as described (which includes an old tp-link firmware).
  6. Tried uploading various firmwares from the recovery web-server provided by u-boot.
  7. Even explored all the links on the tftp page (up to many levels) to find any possible solutions.

After exhausting all the options, I switched to UART method. Hence kindly provide solutions based on UART method only.

11

Uart output of tftp recovery please

12

That's good idea...but I don't have an extra a7.

13

I will post the output...but I need some clarifications first:

  1. The uart recovery page i.e., https://openwrt.org/toh/tp-link/archer-c5-c7-wdr7500#recovery_using_serial_connection says to use:

For 16MB Flash:

tftp 0x81000000 [name of your firmware file].bin
erase 0x9f020000 +f80000
cp.b 0x81000000 0x9f020000 0xf80000
reset

Whereas this guy in the forum TP-Link Archer C7 V5(EU): Problems to unbrick - #24 by PeterImNetz used command:

tftp 0x81000000 18_06_2_squashfs-sysupgrade.bin
erase 0x9f0c0000 +800000
cp.b 0x81000000 0x9f0c0000 0x800000
reset

for a successful recovery, but reading his post clarifies .....we definitely need the router to be flashed once by tp-link firmware first....as you stated earlier.

I could not find any description about these UART commands and an AI bot suggested to use:

tftpboot 0x81000000 file.bin
erase 0x9f020000 +$(filesize)
cp.b 0x81000000 0x9f020000 $(filesize)
reset

It's also suggesting that the boot log is almost ok ...you can check router's functionality via luci and set env to boot permanently as per boot log on my first post.
I feel direct access to flash memory via UART is dangerous and can bring permanent damage to the router if i don't know what the proper commands are...hence kindly clarify.

I have also read somewhere it is suggested to use only system-upgrade files in UART method ...if that the case then how I am supposed to flash tp-link firmware in UART?

1 Like
14

Your assumption on dangers is correct. What is safe - provide oem bin via tftp, but you tried that.

15

I guess I will try the tftp solution at:

That's the last thing left to try and if that fails then use openwrt as per AI bot's recommendations.

Update: tftp method- All the firmwares failed.

Now, I will try to install openwrt 19.07.1 on ram, upgrade it to 19.07.2 then try first the oldest tp-link stock firmware.
Keep this repeating till all 3 tp-link firmware have been tried.

1 Like
16

Once oem fw runs upgrade it to same version to hopefully fix uboot variables, then install ath79 factory (19.07.latest or better)

17

Okay, now I have the following dump of working Archer a7 v5 (eu) edition:

mtd0.factory-uboot.bin
mtd1.u-boot.bin
mtd2.firmware.bin
mtd3.kernel.bin
mtd4.rootfs.bin
mtd5.rootfs_data.bin
mtd6.info.bin
mtd7.config.bin
mtd8.partition-tabled.bin
mtd9.art.bin

Kindly, suggest which partitions can be written safely and step by step procedures with files:

openwrt-22.03.5-ath79-generic-tplink_archer-a7-v5-initramfs-kernel.bin
openwrt-22.03.5-ath79-generic-tplink_archer-a7-v5-squashfs-sysupgrade.bin
and
kmod-mtd-rw_5.10.176+git-20160214-2_mips_24kc.ipk

Unsuccessfully tried without touching the boot loaders first.

mtd write /tmp/mtd2.firmware.bin /dev/mtd2
mtd write /tmp/mtd5.rootfs_data.bin /dev/mtd5
mtd write /tmp/mtd7.config.bin /dev/mtd7
mtd write /tmp/mtd8.partition-table.bin /dev/mtd8

Please suggest further....

18

ART contains your friends MAC address

19

That I thought was in mtd6.info.bin

20

Start with uboots, flashing oem twice then openwrt.