Archer C50 AC1200 V4 bricked

Dear Developers and Experts,

I flashed a wrong firmware on my TP-Link Archer C50 AC1200 V4.

It is usually possible to do a tftp recover (server on 192.168.0.6 containing tp_recovery.bin)
If I use a stock firmware from the tp-link page or it doesn't matter which firmware I flash with the tftp method, the device isn't booting after the flash.

I connected through the serial port on the router and the boot information is the following:
DDR Calibration DQS reg = 00008887


U-Boot 1.1.3 (Mar 13 2018 - 15:00:35)


Board: Ralink APSoC DRAM:  64 MB

relocate_code Pointer at: 83fac000

gpiomode1 54154404.

gpiomode2 05540555.

flash manufacture id: c8, device id 40 17

find flash: GD25Q64B

============================================ 

Ralink UBoot Version: 4.3.0.0

-------------------------------------------- 

ASIC 7628_MP (Port5<->None)

DRAM component: 512 Mbits DDR, width 16

DRAM bus: 16 bit

Total memory: 64 MBytes

Flash component: SPI Flash

Date:Mar 13 2018  Time:15:00:35

============================================ 

icache: sets:512, ways:4, linesz:32 ,total:65536

dcache: sets:256, ways:4, linesz:32 ,total:32768 


 ##### The CPU freq = 580 MHZ #### 

 estimate memory size =64 Mbytes

RESET MT7628 PHY!!!!!!gpiomode2 00000555.


continue to starting system 0

nothing happens, only the pwoer led is on

and if I do the recovery boot, the following text is received:


DDR Calibration DQS reg = 00008887



U-Boot 1.1.3 (Mar 13 2018 - 15:00:35)


Board: Ralink APSoC DRAM:  64 MB

relocate_code Pointer at: 83fac000

gpiomode1 54154404.

gpiomode2 05540555.

flash manufacture id: c8, device id 40 17

find flash: GD25Q64B

============================================ 

Ralink UBoot Version: 4.3.0.0

-------------------------------------------- 

ASIC 7628_MP (Port5<->None)

DRAM component: 512 Mbits DDR, width 16

DRAM bus: 16 bit

Total memory: 64 MBytes

Flash component: SPI Flash

Date:Mar 13 2018  Time:15:00:35

============================================ 

icache: sets:512, ways:4, linesz:32 ,total:65536

dcache: sets:256, ways:4, linesz:32 ,total:32768 


 ##### The CPU freq = 580 MHZ #### 

 estimate memory size =64 Mbytes

RESET MT7628 PHY!!!!!!gpiomode2 00000555.

..................................................

starting recovery...

TODO, Read MAC Address from Flash



 netboot_common, argc= 3 


 NetTxPacket = 0x83FE4480 


 KSEG1ADDR(NetTxPacket) = 0xA3FE4480 


 NetLoop,call eth_halt ! 


 NetLoop,call eth_init ! 

Trying Eth0 (10/100-M)


 Waitting for RX_DMA_BUSY status Start... done



 ETH_STATE_ACTIVE!! 

TFTP from server 192.168.0.66; our IP address is 192.168.0.2

Filename 'tp_recovery.bin'.


 TIMEOUT_COUNT=10,Load address: 0x80060000

Loading: Got ARP REPLY, set server/gtwy eth addr (54:53:ed:33:75:46)

Got it

#################################################################

	 ############checksum bad

checksum bad

####checksum bad

#################################################

	 ######checksum bad

###########################################################

	 #################################################################

	 #################################checksum bad

checksum bad

###checksum bad

#checksum bad

############################

	 #############checksum bad

####################################################

	 #################################################################

	 ########Got ARP REQUEST, return our IP

#########################################################

	 #################################################################

	 #################################################################

	 #################################################################

	 #################################################################

	 #################################################################

	 #################################################################

	 #################################################################

	 #################################################################

	 #################################################################

	 #################################################################

	 #################################################################

	 #################################################################

	 #################################################################

	 #################################################################

	 #################################################################

	 ######################################################

done

Bytes transferred = 7930368 (790200 hex)

NetBootFileXferSize= 00790200


 Erase flash !!

From 0x30000 length 0x790000

.........................................................................................................................


 Copy 0x80090000 to 0x00030000, count 0x790000.... 

.........................................................................................................................

.

.

Done!

[03060D09][03060D0B]

DDR Calibration DQS reg = 00008887



U-Boot 1.1.3 (Mar 13 2018 - 15:00:35)


Board: Ralink APSoC DRAM:  64 MB

relocate_code Pointer at: 83fac000

******************************

Software System Reset Occurred

******************************

gpiomode1 54154404.

gpiomode2 05540555.

flash manufacture id: c8, device id 40 17

find flash: GD25Q64B

============================================ 

Ralink UBoot Version: 4.3.0.0

-------------------------------------------- 

ASIC 7628_MP (Port5<->None)

DRAM component: 512 Mbits DDR, width 16

DRAM bus: 16 bit

Total memory: 64 MBytes

Flash component: SPI Flash

Date:Mar 13 2018  Time:15:00:35

============================================ 

icache: sets:512, ways:4, linesz:32 ,total:65536

dcache: sets:256, ways:4, linesz:32 ,total:32768 


 ##### The CPU freq = 580 MHZ #### 

 estimate memory size =64 Mbytes

RESET MT7628 PHY!!!!!!gpiomode2 00000555.


continue to starting system 0

Is there a chance to flash something, that the router is able to boot again or could it be, that I completely destroyed the flash partition/bootloader with a wrong firmware?

After some googling V4 is different from the other versions. "Split uboot". Look here https://github.com/blocktrron/openwrt/commit/c38577305289fd1d0659d5e1008eda6104869a6a

Hey thank you for the answer, does it mean your steps provided before are unnecessary to try because of that split uboot?

And what do you think if on this openwrt page they are adding support for this router, how long does it take for a working openwrt firmware to exist for this model?

Do you think I will be able to flash this firmware via TFTP or not because I am not really able to flash a stock firmware via TFTP.

Previous answer was based on single uboot image. V4 is dual boot like, which also means, almost brick proof. Try this instead, remove the first 0x200 (512 bytes) or the tp-link firmware header, and flash using that.

if that doesnt work, try this remove first 512 bytes then insert 0x30000 dummy bytes at offset 0. remove the last 0x30000 bytes at the end of file. save and try flash with the file.

3 Likes

Btw openwrt for your device should be coming soon

1 Like

OMFG this really worked, I am so happy right now I don't have to throw this device away.
Thank you so much gurangax.

Cant wait to flash a working openwrt firmware or even a not working firmware to repair the device with this steps hahaha

Do you know a link or something else where I can see if the firmware is existing in the future?

I'm glad that it works out. I think someone is actively working on it, see the link I mentioned above, maybe you can ask him for the firmware upgrade which he has.

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.