Okay, after realizing that my Device is a "Archer D7 EU v1 " not a "Archer D7b V1" and finding the right image which strangely is not provided on the German TP-Link website. I downloaded the image stripped it (dd skip=257 bs=512 for the beginning and for the modem firmware by using hex editor) flashed it:
U-Boot 1.1.4 (Jan 21 2016 - 16:02:58)
...
Hit any key to stop autoboot: 0
AP135> tftp 0x81000000 TheRightFirmwareForMyRouter_haxed_stripped.bin
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'TheRightFirmwareForMyRouter_haxed_stripped.bin'.
Load address: 0x81000000
Loading: #################################################################
#################################################################
done
Bytes transferred = 12832256 (c3ce00 hex) //yes I deleted to much at the end but it worked
AP135> erase 0x9f020000 +f80000
Erasing flash...
First 0x2 last 0xf9 sector size 0x10000 249
Erased 248 sectors
AP135> cp.b 0x81000000 0x9f020000 0xf80000
Copy to Flash... write addr: 9f020000
done
AP135> reset
just a normal boot from here on.....
U-Boot 1.1.4 (Jan 21 2016 - 16:02:58)
ap135 - Scorpion 1.0
DRAM: 128 MB
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment
In: serial
Out: serial
Err: serial
Net: ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0xe
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ----> S17 PHY *
athrs17_reg_init: complete
: cfg1 0x80000000 cfg2 0x7114
eth0: c4:e9:84:d6:6c:81
eth0 up
athrs17_reg_init_wan done
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x800c0000 cfg2 0x7214
eth1: c4:e9:84:d6:6c:82
eth1 up
eth0, eth1
Setting 0x18116290 to 0x4081214f
Hit any key to stop autoboot: 0
## Booting image at 80800000 ...
Uncompressing Kernel Image ... OK
Starting kernel ...
Booting QCA955x
Linux version 2.6.31--LSDK-9.5.2.18 (root@localhost.localdomain) (gcc version 4.3.3 (GCC) ) #2 Thu Jan 21 16:05:34 CST 2016
flash_size passed from bootloader = 16
arg 1: console=ttyS0,115200
arg 2: root=31:02
arg 3: rootfstype=squashfs
arg 4: init=/sbin/init
arg 5: mtdparts=ath-nor0:128k(u-boot),1280k(kernel),14656k(rootfs),64k(radioDECT),64k(config),64k(romfs),64k(rom),64k(radio)
arg 6: mem=128M
CPU revision is: 00019750 (MIPS 74Kc)
cpu apb ddr apb ath_sys_frequency: cpu 720 ddr 600 ahb 200
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 08000000 @ 00000000 (usable)
Zone PFN ranges:
Normal 0x00000000 -> 0x00008000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00008000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512
Kernel command line: console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:128k(u-boot),1280k(kernel),14656k(rootfs),64k(radioDECT),64k(config),64k(romfs),64k(rom),64k(radio) mem=128M
PID hash table entries: 512 (order: 9, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 112256k/131072k available (2268k kernel code, 18644k reserved, 600k data, 136k init, 0k highmem)
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 359.42 BogoMIPS (lpj=718848)
Mount-cache hash table entries: 512
****************ALLOC***********************
Packet mem: 8030f300 (0xe00000 bytes)
********************************************
NET: Registered protocol family 16
ath_pcibios_init: bus 0
***** Warning PCIe 0 H/W not found !!!
registering PCI controller with io_map_base unset
ath_pcibios_init: bus 1
ath_pcibios_init(232): PCI 1 CMD write: 0x356
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
pcibios_map_irq: IRQ 76 for bus 1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
fuse init (API version 7.12)
msgmni has been set to 219
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
brd: module loaded
loop: module loaded
PPP generic driver version 2.4.2
NET: Registered protocol family 24
8 cmdlinepart partitions found on MTD device ath-nor0
Creating 8 MTD partitions on "ath-nor0":
0x000000000000-0x000000020000 : "u-boot"
0x000000020000-0x000000160000 : "kernel"
0x000000160000-0x000000fb0000 : "rootfs"
0x000000fb0000-0x000000fc0000 : "radioDECT"
0x000000fc0000-0x000000fd0000 : "config"
0x000000fd0000-0x000000fe0000 : "romfs"
0x000000fe0000-0x000000ff0000 : "rom"
0x000000ff0000-0x000001000000 : "radio"
Mirror/redirect action on
u32 classifier
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (2048 buckets, 10240 max)
CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
arch/mips/atheros/gpio.c (ath_simple_config_init) JUMPSTART_GPIO: 16
athwdt_init: Registering WDT success
ath_otp_init: Registering OTP success
VFS: Mounted root (squashfs filesystem) readonly on device 31:2. //this is the part where it paniked
Freeing unused kernel memory: 136k freed
starting pid 165, tty '': '/etc/init.d/rcS'
mount: mounting devpts on /dev/pts failed: No such device
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
Port Status 1c000004
ath-ehci ath-ehci.0: ATH EHCI
ath-ehci ath-ehci.0: new USB bus registered, assigned bus number 1
ehci_reset Intialize USB CONTROLLER in host mode: 13
ehci_reset Port Status 1c000000
ath-ehci ath-ehci.0: irq 3, io mem 0x1b000000
ehci_reset Intialize USB CONTROLLER in host mode: 13
ehci_reset Port Status 1c000000
ath-ehci ath-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
Port Status 1c000000
ath-ehci1 ath-ehci1.1: ATH EHCI
ath-ehci1 ath-ehci1.1: new USB bus registered, assigned bus number 2
ehci_reset Intialize USB CONTROLLER in host mode: 13
ehci_reset Port Status 1c000000
ath-ehci1 ath-ehci1.1: irq 3, io mem 0x1b400000
ehci_reset Intialize USB CONTROLLER in host mode: 13
ehci_reset Port Status 1c000000
ath-ehci1 ath-ehci1.1: USB 2.0 started, EHCI 1.00
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
dns_init
domain_name:tplinkmodem.net
PPPoL2TP kernel driver, V1.0
and so on....
And for save cleanup I flashed the FW as It came from TP-Link thru the TP-Link web interface
Looks like this in Serial if someone needs this info:
[ rsl_sys_verifyFirmware ] 1230: Image Signature check OK(firmwareLength=0x1196564)!
[ rsl_sys_updateFirmware ] 1301: NEW: swRevision-0x55aa0106, platformVer-0xa5000901, swSignature-0x90101
[ rsl_getCurrSwSignature ] 761: CURR: swRevision-0x55aa0106, platformVer-0xa5000901, swSignature-0x90101
**** drop_caches_sysctl_handler: all done timer added ...****
Erase from 0 with fb0000 bytes .............................FWLOG: [877582] WAL_DBGID_BB_WDOG_TRIGGERED ( 0xd640e, 0x2300000a, 0x11030, 0xfe7 )
............................................................................................................................................................
Enet:1 port:0 down
............
Enet:1 port0 up
......................................................
Write flash to 0, len is 10000
Write flash to 10000, len is 10000
Write flash to 20000, len is 10000
Write flash to 30000, len is 10000
Write flash to 40000, len is 10000
Write flash to 50000, len is 10000
Write flash to 60000, len is 10000
Write flash to 70000, len is 10000
Write flash to 80000, len is 10000
Write flash to 90000, len is 10000
Write flash to a0000, len is 10000
Write flash to b0000, len is 10000
Write flash to c0000, len is 10000
Write flash to d0000, len is 10000
Write flash to e0000, len is 10000
Write flash to f0000, len is 10000
Write flash to 100000, len is 10000
Write flash to 110000, len is 10000
Write flash to 120000, len is 10000
Write flash to 130000, len is 10000
Write flash to 140000, len is 10000
Write flash to 150000, len is 10000
Write flash to 160000, len is 10000
Write flash to 170000, len is 10000
Write flash to 180000, len is 10000
Write flash to 190000, len is 10000
Write flash to 1a0000, len is 10000
Write flash to 1b0000, len is 10000
Write flash to 1c0000, len is 10000
Write flash to 1d0000, len is 10000
Write flash to 1e0000, len is 10000
Write flash to 1f0000, len is 10000
Write flash to 200000, len is 10000
Write flash to 210000, len is 10000
Write flash to 220000, len is 10000
Write flash to 230000, len is 10000
Write flash to 240000, len is 10000
Write flash to 250000, len is 10000
Write flash to 260000, len is 10000
Write flash to 270000, len is 10000
Write flash to 280000, len is 10000
Write flash to 290000, len is 10000
Write flash to 2a0000, len is 10000
Write flash to 2b0000, len is 10000
Write flash to 2c0000, len is 10000
Write flash to 2d0000, len is 10000
Write flash to 2e0000, len is 10000
Write flash to 2f0000, len is 10000
Write flash to 300000, len is 10000
Write flash to 310000, len is 10000
Write flash to 320000, len is 10000
Write flash to 330000, len is 10000
Write flash to 340000, len is 10000
Write flash to 350000, len is 10000
Write flash to 360000, len is 10000
Write flash to 370000, len is 10000
Write flash to 380000, len is 10000
Write flash to 390000, len is 10000
Write flash to 3a0000, len is 10000
Write flash to 3b0000, len is 10000
Write flash to 3c0000, len is 10000
Write flash to 3d0000, len is 10000
Write flash to 3e0000, len is 10000
Write flash to 3f0000, len is 10000
Write flash to 400000, len is 10000
Write flash to 410000, len is 10000
Write flash to 420000, len is 10000
Write flash to 430000, len is 10000
Write flash to 440000, len is 10000
Write flash to 450000, len is 10000
Write flash to 460000, len is 10000
Write flash to 470000, len is 10000
Write flash to 480000, len is 10000
Write flash to 490000, len is 10000
Write flash to 4a0000, len is 10000
Write flash to 4b0000, len is 10000
Write flash to 4c0000, len is 10000
Write flash to 4d0000, len is 10000
Write flash to 4e0000, len is 10000
Write flash to 4f0000, len is 10000
Write flash to 500000, len is 10000
Write flash to 510000, len is 10000
Write flash to 520000, len is 10000
Write flash to 530000, len is 10000
Write flash to 540000, len is 10000
Write flash to 550000, len is 10000
Write flash to 560000, len is 10000
Write flash to 570000, len is 10000
Write flash to 580000, len is 10000
Write flash to 590000, len is 10000
Write flash to 5a0000, len is 10000
Write flash to 5b0000, len is 10000
Write flash to 5c0000, len is 10000
Write flash to 5d0000, len is 10000
Write flash to 5e0000, len is 10000
Write flash to 5f0000, len is 10000
Write flash to 600000, len is 10000
Write flash to 610000, len is 10000
Write flash to 620000, len is 10000
Write flash to 630000, len is 10000
Write flash to 640000, len is 10000
Write flash to 650000, len is 10000
Write flash to 660000, len is 10000
Write flash to 670000, len is 10000
Write flash to 680000, len is 10000
Write flash to 690000, len is 10000
Write flash to 6a0000, len is 10000
Write flash to 6b0000, len is 10000
Write flash to 6c0000, len is 10000
Write flash to 6d0000, len is 10000
Write flash to 6e0000, len is 10000
Write flash to 6f0000, len is 10000
Write flash to 700000, len is 10000
Write flash to 710000, len is 10000
Write flash to 720000, len is 10000
Write flash to 730000, len is 10000
Write flash to 740000, len is 10000
Write flash to 750000, len is 10000
Write flash to 760000, len is 10000
Write flash to 770000, len is 10000
Write flash to 780000, len is 10000
Write flash to 790000, len is 10000
Write flash to 7a0000, len is 10000
Write flash to 7b0000, len is 10000
Write flash to 7c0000, len is 10000
Write flash to 7d0000, len is 10000
Write flash to 7e0000, len is 10000
Write flash to 7f0000, len is 10000
Write flash to 800000, len is 10000
Write flash to 810000, len is 10000
Write flash to 820000, len is 10000
Write flash to 830000, len is 10000
Write flash to 840000, len is 10000
Write flash to 850000, len is 10000
Write flash to 860000, len is 10000
Write flash to 870000, len is 10000
Write flash to 880000, len is 10000
Write flash to 890000, len is 10000
Write flash to 8a0000, len is 10000
Write flash to 8b0000, len is 10000
Write flash to 8c0000, len is 10000
Write flash to 8d0000, len is 10000
Write flash to 8e0000, len is 10000
Write flash to 8f0000, len is 10000
Write flash to 900000, len is 10000
Write flash to 910000, len is 10000
Write flash to 920000, len is 10000
Write flash to 930000, len is 10000
Write flash to 940000, len is 10000
Write flash to 950000, len is 10000
Write flash to 960000, len is 10000
Write flash to 970000, len is 10000
Write flash to 980000, len is 10000
Write flash to 990000, len is 10000
Write flash to 9a0000, len is 10000
Write flash to 9b0000, len is 10000
Write flash to 9c0000, len is 10000
Write flash to 9d0000, len is 10000
Write flash to 9e0000, len is 10000
Write flash to 9f0000, len is 10000
Write flash to a00000, len is 10000
Write flash to a10000, len is 10000
Write flash to a20000, len is 10000
Write flash to a30000, len is 10000
Write flash to a40000, len is 10000
Write flash to a50000, len is 10000
Write flash to a60000, len is 10000
Write flash to a70000, len is 10000
Write flash to a80000, len is 10000
Write flash to a90000, len is 10000
Write flash to aa0000, len is 10000
Write flash to ab0000, len is 10000
Write flash to ac0000, len is 10000
Write flash to ad0000, len is 10000
Write flash to ae0000, len is 10000
Write flash to af0000, len is 10000
Write flash to b00000, len is 10000
Write flash to b10000, len is 10000
Write flash to b20000, len is 10000
Write flash to b30000, len is 10000
Write flash to b40000, len is 10000
Write flash to b50000, len is 10000
Write flash to b60000, len is 10000
Write flash to b70000, len is 10000
Write flash to b80000, len is 10000
Write flash to b90000, len is 10000
Write flash to ba0000, len is 10000
Write flash to bb0000, len is 10000
Write flash to bc0000, len is 10000
Write flash to bd0000, len is 10000
Write flash to be0000, len is 10000
Write flash to bf0000, len is 10000
Write flash to c00000, len is 10000
Write flash to c10000, len is 10000
Write flash to c20000, len is 10000
Write flash to c30000, len is 10000
Write flash to c40000, len is 10000
Write flash to c50000, len is 10000
Write flash to c60000, len is 10000
Write flash to c70000, len is 10000
Write flash to c80000, len is 10000
Write flash to c90000, len is 10000
Write flash to ca0000, len is 10000
Write flash to cb0000, len is 10000
Write flash to cc0000, len is 10000
Write flash to cd0000, len is 10000
Write flash to ce0000, len is 10000
Write flash to cf0000, len is 10000
Write flash to d00000, len is 10000
Write flash to d10000, len is 10000
Write flash to d20000, len is 10000
Write flash to d30000, len is 10000
Write flash to d40000, len is 10000
Write flash to d50000, len is 10000
Write flash to d60000, len is 10000
Write flash to d70000, len is 10000
Write flash to d80000, len is 10000
Write flash to d90000, len is 10000
Write flash to da0000, len is 10000
Write flash to db0000, len is 10000
Write flash to dc0000, len is 10000
Write flash to dd0000, len is 10000
Write flash to de0000, len is 10000
Write flash to df0000, len is 10000
Write flash to e00000, len is 10000
Write flash to e10000, len is 10000
Write flash to e20000, len is 10000
Write flash to e30000, len is 10000
Write flash to e40000, len is 10000
Write flash to e50000, len is 10000
Write flash to e60000, len is 10000
Write flash to e70000, len is 10000
Write flash to e80000, len is 10000
Write flash to e90000, len is 10000
Write flash to ea0000, len is 10000
Write flash to eb0000, len is 10000
Write flash to ec0000, len is 10000
Write flash to ed0000, len is 10000
Write flash to ee0000, len is 10000
Write flash to ef0000, len is 10000
Write flash to f00000, len is 10000
Write flash to f10000, len is 10000
Write flash to f20000, len is 10000
Write flash to f30000, len is 10000
Write flash to f40000, len is 10000
Write flash to f50000, len is 10000
Write flash to f60000, len is 10000
Write flash to f70000, len is 10000
Write flash to f80000, len is 10000
Write flash to f90000, len is 10000
Write flash to fa0000, len is 10000
U-Boot 1.1.4 (Jan 21 2016 - 16:02:58)
...
Thanks a lot for your help and time. It was a somehow stupid mistake...