Archer MR200v1 tftp bricked

Hi everyone. I tried installing the latest openwrt but my router is not booting up (signal led flashing). It does not respond to tftp recovery anymore but lan ports are working. I read through some threads here and I am not sure where to start.
Is the flash chip located at the bottom side of the board? Also, can I connect to J1 pins on the board?
I want to try and recover just for the sake of it even though it's probably not worth the trouble.


if it's not doing tftp then it's most likely bricked:

What exactly you did install? Had to be frankenstain image for first install:

No, I used the latest offical build.
EDIT: This one from the official website: openwrt-24.10.0-ramips-mt7620-tplink_archer-mr200-squashfs-sysupgrade.bin
Maybe I held the reset button for too long. I tried to hold it until everything was uploaded.

since TFTP assumes uboot is part of the openwrt image, you most likely bricked your MR200.

2 Likes

After wiping out bootloader (with recovery) only chance is re-programming bootloader to flash chip.
Instructions were quite clear to concatenate OEM bootloader with OpenWrt image.

1 Like

That's why you don't flash your routers at 3am. Can you help me locating the actual chip? I got a ch341 and waveshare usb to ttl with clips/cables. Adding the right code seems a bit overwhelming for me but I am willing to try it.

It is past serial connection. You need flash programmer to program chip with (likely) winbond on it to get that serial+tftp boot loader back.

For the protocol, the flash chip has 8 legs, it is located on the other side of the board which you didn't take a photo of, designated U18 and has "Winbond" printed on it, along with the part number.

(picture taken from here)

1 Like


Looks like that mine is a MACRONIX MX25L6433F. I am going to try and read it.

1 Like

Yeah, typically manufacturers have several alternatives for the flash chip in their BOM (bill of materials) and they will randomly use whatever part is available. You got the Macronix part.

1 Like

Anyway, a bit of advice. When modifying firmware, it is very easy to make a mistake and end up having no backup of the original firmware. This is one thing you will really want to avoid. So make sure to save the original firmware into location where you can find it, name the file in a way that leaves no doubts, and never modify it directly - always work on a copy.

2 Likes

You certainly need to first back up last 3 64kB blocks

They contain radio calibration data and MAC addresses.
Recommend first recovering to OEM FW, then do the OpenWrt correct way.

2 Likes


I am not sure if this is the correct readout I might need to desolder it since the clips are not good I can't always attach it correctly.

If the software can do verification, you can use that function. If not, you could read the firmware twice and then use something like HxD to compare the files. Or even simpler: calculate checksums and compare them. If no differences are found, you can be sure that the read was successful.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.