Hi, I've bricked a TP-Link Archer C60 V2 and I couldn't bring it back alive even trying to flash it with tftp over Serial. If I let it boot, it loads the recovery HTTP page, in which I can upload a new firmware, but this doesn't succeed also, saying that "This firmware is not for this device", on both BR and EU stock firmwares (OpenWRT it doesn't like also, says that the file is invalid).
I initially read on this topic that I can flash it with OpenWRT specifying some adresses (0x......), but there are some variables that I don't know.
which addresses are $filesize and $fileaddr ? I already tried replacing $filesize with the size in bytes of the firmware ( 0x{firmware size bytes in HEX} ) and $fileaddr with 0x80060000, but when I do run bootcmd and watch the Serial, it loads uboot, says "Starting application at 0x...." and then hangs there. If I restart it physically, some errors appear such as "partition name not found" and then proceeds to start the TP-Link recovery HTTP server, which is also useless.
The full output of the U-Boot help and environment as well as a reference to the flash layout of the device would be helpful. Also echo of those variables, if not listed in printenv
Thanks for the reply jeff.
As soon as I get home I'll log the serial and post it here, but let me ask you one more question first:
Which commands should I perform in order to get the flash layout and variables?
Your bootcmd is trying to boot from RAM, that will not work after power on since the only code in RAM is the running copy of the bootloader and a lot of empty space. The OS is stored in flash at addresses that start with 9F.
Try manually running bootm 0x9f030000
That is the normal process to read the kernel from flash, uncompress it to RAM, and then jump ("go") into RAM to boot it. bootcmd should be set to some sort of bootm command.
When you tftp a file in it will tell you the number of bytes transferred, that is the filesize. The fileaddr is the location in RAM you specified in the tftp command, or 0x80060000 in this case.
It is very important to get the numbers right when manually erasing and copying to flash, so you don't damage the data in the bootloader or ART partitions.
Many factory bootloader builds hard-code the environment and don't have a saveenv command. Thus it is strange that it would be wrong. I'm not sure where to go from here.
I would suggest to try push-button tftp recovery and flashing an OEM firmware again, make sure to flash an OEM firmware with included bootloader to get a known-good (well, at least according to the vendor) on your flash - before you can flash OpenWrt again.
This router doesn't seem to support that mode, only seen that on some older models.
However, I've trimmed the original firmware and flashed it with this way. Unfortunately, it didn't boot also and goes straight into the recovery HTTP server.
Well, I flashed it back with the above addresses, now I've found these also here. Don't know how I've missed them:
Note: Replace $filesize below with value in hex reported after tftp command completes below. Uboot should replace the variable automatically, but it didn't seem to.
Now I'm as far as before. It boots when I specify the "bootm" address, but it doesn't save it and therefore it doesn't boot anymore when I reboot.
Has anyone a clue what I could do about it?
EDIT: I have another C60 V2 running OpenWRT in active use, maybe I could take a "byte backup" from there and restore it via tftp on this one? Is this possible? I was thinking about that if everything else fails (and later share that .img here). But shouldn't TP-Links stock firmware provide the boot part also, and if yes, where is it? I'm a little bit lost and pretty much a noob when it comes to low-level things...
I think it's expecting a parameter or something, but it tells me nothing.
I already tried all of those commands before, most of them just echo back. Others like "md" shows me a little bit of memory of a particular address, but that's mostly it.
I already tried that. In fact, this was the first thing I did try and it didn't work on both EU and BR stock firmwares (neither on any OpenWRT).
It begins uploading and then says: "This firmware is not for this device", no matter which file I upload. Meanwhile in the Serial console I see: "Archer C60 NOT match!" two times and that's it.
I already tried renaming the files: ArcherC60v2_tp_recovery.bin, ArcherC60_tp_recovery.bin or even tp_recovery.bin to no avail.
Those all failed. The device is from Paraguay, if that matters, so technically it's not BR or EN. And I also couldn't find any TP-Link page from that location, so it's probably one of these, but none worked.
