Archer C6 V2 (EU) bricked/bootloop

[noseran]

Hi, i've been trying to go back to the original firmware on my Archer C6 V2 (EU) but today i screwed up. I flashed the sysupgrade bin instead of the factory bin and now i can't even go back to openwrt. I have serial access to the router and when i try to upload the original firmware through tftpd i get the following output:

TFTP from server 192.168.0.66; our IP address is 192.168.0.86
Filename 'ArcherC6v2_tp_recovery.bin'.
Load address: 0x80060000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ####################################################
done
Bytes transferred = 7919281 (78d6b1 hex)
Firmware downloaded... filesize = 0x78d6b1 fileaddr = 0x80060000.
Firmware Recovery file length : 7919281

Firmware process id 2.

handle_fw_cloud 146

[NM_Error](handle_fw_cloud) 00164: Check rsa error.


recovery failed.
now restart...

[123serge123]

Did you read this topic?

Can't boot tftp recovery Archer C6 v2

Hi everyone, First, I'm sorry for my bad english (i'm french) Here's my problem : i just bought the Archer C6 Tp Link router (V2). I want Open WRT on it for experience and DHCP connection (my ISP is Orange Telecom) I follow this link : https://openwrt.org/toh/hwdata/tp-link/tp-link_archer_c6_v2_eu I download the openwrt factory firmware et sysupgrade firmware : both of them don't work with web gui. I have error message : "Invalid file type" So I decide to go with tftp recovery with tftpd64…

[noseran]

@123serge123 Yes, i've read that topic before. My problem is not using tftpd, i can upload openwrt successfully... The problem is that the router rejects the original firmware and now i can't even boot openwrt (bootloop). My main goal is going back to the original firmware, but if i can't, i wouldn't mind having it running openwrt again...

[noseran]

I can provide command outputs if needded

[123serge123]

1. It's possible that you use wrong vendor firmware, isn't it? Try older/newer version.
2. You can try prepare new image from vendor firmware for flashing from openwrt command line.
   Vendor firmware file contain all information for this procedure. Flash layout:

partition fs-uboot base 0x00000 size 0x20000
partition default-mac base 0x20000 size 0x00200
partition pin base 0x20200 size 0x00100
partition product-info base 0x20300 size 0x00200
partition device-id base 0x20500 size 0x0fb00
partition os-image base 0x30000 size 0x100000
partition file-system base 0x130000 size 0x6a9400
partition soft-version base 0x7d9400 size 0x00100
partition extra-para base 0x7d9500 size 0x00100
partition support-list base 0x7d9600 size 0x00200
partition profile base 0x7d9800 size 0x03000
partition default-config base 0x7dc800 size 0x03000
partition partition-table base 0x7df800 size 0x00800
partition user-config base 0x7e0000 size 0x0c000
partition certificate base 0x7ec000 size 0x04000
partition radio base 0x7f0000 size 0x10000

And vendor firmware layout:

fwup-ptn product-info base 0x01000 size 0x00115
fwup-ptn os-image base 0x01115 size 0xffdb8
fwup-ptn file-system base 0x100ecd size 0x69363f
fwup-ptn soft-version base 0x79450c size 0x00059
fwup-ptn extra-para base 0x794565 size 0x0000b
fwup-ptn support-list base 0x794570 size 0x00055
fwup-ptn profile base 0x7945c5 size 0x02e1d
fwup-ptn default-config base 0x7973e2 size 0x02a34
fwup-ptn partition-table base 0x00800 size 0x00800

So you can split vendor firmware file to get kernel (os-image) and rootfs (file-system) files. Then pad kernel file upto os-image partition size (partition os-image base 0x30000 size 0x100000) and append rootfs. This new firmware file may be flashed from openwrt command line with sysupgrade or mtd command.
P.S. To split vendor firmware file you can use tplink-safeloader utility from current openwrt trunk.
P.P.S. For example I use file ArcherC6v2_ru-up-ver1-3-0-P1[20200508-rel63078].bin

[noseran]

I've managed to boot openwrt with an alternative version i had with a tp-link style theme and after that i could boot the newer version. (i don't know what did it but it worked)

It's possible that you use wrong vendor firmware, isn't it? Try older/newer version.

Regarding firmware i always double check the versions i download so i don't have the wrong ones laying around.

You can try prepare new image from vendor firmware for flashing from openwrt command line. (...)

I've never messed with stuff specifically like this but i'll give it a try in the next days, i'll keep you posted.

[noseran]

@123serge123 Thanks a lot man! I tought i would be a lot slower following your instructions but i made it! Here is what i did:

1. got tplink-safeloader.c, md5.c and md5.h from the lede-project github page

2. compiled md5 and the tplink-safeloader:

gcc -c md5.c
gcc tplink-safeloader.c md5.c -o tplink-safeloader

3. got an older version of the original firmware (so i could update it after, using the webpage) and ran the tool: (got the arguments and board model (ARCHER-C6-V2) digging through the tplink-safeloader.c code)

mkdir firmware
./tplink-safeloader -B "ARCHER-C6-V2" -x ArcherC6v2_eu-up-ver1-1-0-P1[20190115-rel71848].bin -d firmware/

4. added pad to the kernel file (the partition is 0x100000, so hex to dec, 1048576 bytes minus the size of kernel (wc -c < os-image) = #your own value# (so people don't lead into error))

cd firmware
dd if=/dev/zero bs=1 count=#your own value# >> os-image

5. appended the two files:

dd if=os-image >> original_sysupdate.bin
dd if=file-system >> original_sysupdate.bin

6. using the openwrt web interface i flashed the new original_sysupdate.bin image with the option to force the update (risking bricking it if i didn't know how to recover)

7. now on tplinks web interface i updated to the latest firmware and voila, running oem again!

P.S.: Thanks a lot for the help @123serge123. And if i mistyped something please say so.