When you try to return to stock firmware (and in other cases), there is a chance of getting a brick that even the official recovery utility from Asus will not help you fix.
This will happen if volumes rootfs and rootfs_data remain in partition UBI_DEV (this can happen for various reasons).
The stock bootloader will not attempt to delete volumes rootfs and rootfs_data during the process of restoring stock firmware.
Now, if such a situation arises, the user is required to solder the UART.
I have already seen user messages about this situation occurring a couple of times.
A couple of days ago I came up with a solution to this problem. It is enough to create a special mtk-loader, which at startup will delete all volumes (except the first three) in partition UBI_DEV.
And design the image of this mtk-loader as if it were official firmware from Asus.
Download such images for different routers: https://drive.google.com/drive/folders/19Q9mhO1dmX0t7u7OA35ykQs3f9FxTSiP?usp=sharing
You can use these images through the official utility Asus Rescue.
Source code:
- https://github.com/openwrt-xiaomi/openwrt/commit/14bcdd3d12a69f35e2e8cc27d54cb258f1a00df4
- https://github.com/openwrt-xiaomi/openwrt/commit/f10db8873eab15606ea5d5c03f9a616187df0a8e
logs after using Resue tool with this TRX-image
reset button pressed!
3: Boot System code via Flash (default).
TUF-AX4200 bootloader version: 1.0.0.3
MAC Address: C8:7F:54:78:BB:3E
HwID A
reset button pressed!
## Enter Rescue Mode ##
switch prereq:0
tftpd start
Our IP address is:(192.168.1.1)
Wait for TFTP request...
tftpd open
D D D D D D D D D D D D D D D
Get read request from:(192.168.1.10)
Firmware Restoration assigns IP address: 192.168.1.49
Got ARP REPLY, set eth addr (9c:6b:00:02:b5:42)
Got ARP REQUEST, return our IP
D #
First block received
################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##########################################################
done
RAMtoFLASH
Chk trx magic
Download of 0x281000 bytes completed
Check TRX and write it to FLASH
Solve TRX, ptr=0x46000000
## Booting kernel from Legacy Image at 46000000 ...
Image Name:
Image Type: AArch64 Linux Kernel Image (uncompressed)
Data Size: 333384 Bytes = 325.6 KiB
Load Address: 00000000
Entry Point: 00000000
Verifying Checksum ... OK
Erase kernel block !!
From c060f000 To c0890000 (2625536/h:281000)
0x280fc0 bytes written to volume linux
Volume linux2 not found!
ra_flash_erase_write: write volume [linux2] fail. (r = 19)
Write 2nd firmware fail. (r = 19)
rescue failed! (19)
resetting ...
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 0209 [010F]
Jump to BL
NOTICE: BL2: v2.6(release):
NOTICE: BL2: Built : 14:46:08, Jul 22 2022
NOTICE: WDT: disabled
NOTICE: CPU: MT7986 (2000MHz)
NOTICE: EMI: Using DDR3 settings
NOTICE: EMI: Detected DRAM size: 512MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: SPI_NAND parses attributes from parameter page.
NOTICE: SPI_NAND Detected ID 0xef
NOTICE: Page size 2048, Block size 131072, size 268435456
NOTICE: BL2: Booting BL31
NOTICE: BL31: v2.6(release):
NOTICE: BL31: Built : 14:46:14, Jul 22 2022
U-Boot 2022.04-rc1 (Mar 29 2023 - 14:13:33 +0800)
TUF-AX4200 bootloader version: 1.0.0.3
CPU: MediaTek MT7986
Model: mt7986-rfb
DRAM: 512 MiB
Core: 43 devices, 15 uclasses, devicetree: embed
MMC: mmc@11230000: 0
Loading Environment from MTD...
SPINAND raw ID: 00 EF AA 22
spi-nand: spi_nand spi_nand@1: Winbond W25N02KV SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128, ECC strength 8/512, custom ECC status.
*** Warning - bad CRC, using default environment
In: serial@11002000
Out: serial@11002000
Err: serial@11002000
ASUS TUF-AX4200 gpio/led init
Net:
Warning: ethernet1@15100000 (eth0) using random MAC address - ea:9a:de:28:a1:11
eth0: ethernet1@15100000
Warning: ethernet0@15100000 (eth1) using random MAC address - de:9c:61:21:1f:ca
, eth1: ethernet0@15100000
ubi0: attaching mtd4
ubi0: scanning is finished
ubi0: attached mtd4 (name "UBI_DEV", size 252 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 2016, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 7, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 21/15, WL threshold: 4096, image sequence number: 1864024255
ubi0: available PEBs: 2, total reserved PEBs: 2014, PEBs reserved for bad PEB handling: 40
UBI: vol_id reserved_pebs alignment data_pad vol_type usable_leb_size used_ebs used_bytes last_eb_bytes corrupted upd_marker name_len name
UBI: 0 1 1 0 dynamic 1f000 1 1f000 1f000 0 0 5 nvram
UBI: 1 8 1 0 dynamic 1f000 8 f8000 1f000 0 0 7 Factory
UBI: 2 8 1 0 dynamic 1f000 8 f8000 1f000 0 0 8 Factory2
UBI: 3 2 1 0 dynamic 1f000 2 3e000 1f000 0 0 5 jffs2
UBI: 4 21 1 0 dynamic 1f000 21 3ff000 1f000 0 0 5 linux
UBI: 5 105 1 0 dynamic 1f000 105 1f9b000 1f000 0 0 6 rootfs
UBI: 6 679 1 0 dynamic 1f000 679 c8a7000 1f000 0 0 b rootfs_data
UBI: 7fffefff 2 1 0 dynamic 1f000 2 3e000 2 0 0 d layout volume
UBI volume [linux] id 4 mismatch! (expect 3)
UBI volume [linux] size 3ff000 smaller than 45fe000!
Creating dynamic volume linux2 of size 0x45fe000
ubi0 error: ubi_create_volume: not enough PEBs, only 2 available
ubi0 error: ubi_create_volume: cannot create volume 7, error -28
Create volume linux2 fail. rcode 0xffffffe4
UBI volume [jffs2] id 3 mismatch! (expect 5)
Latest UBI volumes layout.
UBI: vol_id reserved_pebs alignment data_pad vol_type usable_leb_size used_ebs used_bytes last_eb_bytes corrupted upd_marker name_len name
UBI: 0 1 1 0 dynamic 1f000 1 1f000 1f000 0 0 5 nvram
UBI: 1 8 1 0 dynamic 1f000 8 f8000 1f000 0 0 7 Factory
UBI: 2 8 1 0 dynamic 1f000 8 f8000 1f000 0 0 8 Factory2
UBI: 3 2 1 0 dynamic 1f000 2 3e000 1f000 0 0 5 jffs2
UBI: 4 21 1 0 dynamic 1f000 21 3ff000 1f000 0 0 5 linux
UBI: 5 105 1 0 dynamic 1f000 105 1f9b000 1f000 0 0 6 rootfs
UBI: 6 679 1 0 dynamic 1f000 679 c8a7000 1f000 0 0 b rootfs_data
UBI: 7fffefff 2 1 0 dynamic 1f000 2 3e000 2 0 0 d layout volume
Read 1015808 bytes from volume Factory to 000000005f707ac0
EEPROM set 0: OK (version 106)
Read 1015808 bytes from volume Factory2 to 000000005f707ac0
EEPROM set 1: OK (version 106)
Read 1015808 bytes from volume Factory to 000000005fb455d0
Select EEPROM set 0 at offset 0x0.
Please choose the operation:
1: Load System code to SDRAM via TFTP.
2: Load System code then write to Flash via TFTP.
3: Boot System code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP. 0
3: Boot System code via Flash (default).
TUF-AX4200 bootloader version: 1.0.0.3
MAC Address: C8:7F:54:78:BB:3E
HwID A
Read 40 bytes from volume linux to 0000000046000000
FIT/FDT format image found at 0x46000000,size 0x51608
Read 333360 bytes from volume linux to 0000000046000000
## Loading kernel from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-u-boot
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x460000e8
Data Size: 309449 Bytes = 302.2 KiB
Architecture: AArch64
OS: Linux
Load Address: 0x41e00000
Entry Point: 0x41e00000
Hash algo: crc32
Hash value: c4cfb488
Hash algo: sha1
Hash value: c86d83a59d9ed0315dcc9d0fa5a1716d8036e1c1
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'fdt-1' fdt subimage
Description: ARM64 OpenWrt asus_tuf-ax4200 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x4604baf4
Data Size: 22008 Bytes = 21.5 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: 1724de63
Hash algo: sha1
Hash value: 4f573bff5708d8fb444732bdd23c49022c3b8ce5
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x4604baf4
Volume linux2 not found!
ubi0: detaching mtd4
ubi0: mtd4 is detached
Copy firmware from linux1(c060f000) to linux2(c4c0d000), length 51630
Uncompressing Kernel Image
Loading Device Tree to 000000005f7f3000, end 000000005f7fb5f7 ... OK
volume linux seq: 4
Starting kernel ...
U-Boot 2024.01-OpenWrt-r25402-012be0468c (Mar 02 2024 - 14:26:04 +0000)
CPU: MediaTek MT7986
Model: ASUS TUF-AX4200
DRAM: 512 MiB
Core: 38 devices, 18 uclasses, devicetree: separate
MMC:
Loading Environment from nowhere... OK
In: serial@11002000
Out: serial@11002000
Err: serial@11002000
Loading Environment from nowhere... OK
Net:
Warning: ethernet@15100000 (eth0) using random MAC address - 12:20:f4:c8:b0:a0
eth0: ethernet@15100000
Autoboot in 0 seconds
run ubi_CLEAN
LED 'white:system' not found (err=-19)
LED 'red:wan' not found (err=-19)
spi-nand: spi_nand spi_nand@1: Winbond SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
run ubi_clean
Remove UBI volume linux (id 4)
Volume linux2 not found!
Remove UBI volume rootfs (id 5)
Remove UBI volume rootfs_data (id 6)
Remove UBI volume jffs2 (id 3)
MT7986>
logs after cleaning UBI_DEV
MT7986> reset
resetting ...
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 0209 [010F]
Jump to BL
NOTICE: BL2: v2.6(release):
NOTICE: BL2: Built : 14:46:08, Jul 22 2022
NOTICE: WDT: disabled
NOTICE: CPU: MT7986 (2000MHz)
NOTICE: EMI: Using DDR3 settings
NOTICE: EMI: Detected DRAM size: 512MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: SPI_NAND parses attributes from parameter page.
NOTICE: SPI_NAND Detected ID 0xef
NOTICE: Page size 2048, Block size 131072, size 268435456
NOTICE: BL2: Booting BL31
NOTICE: BL31: v2.6(release):
NOTICE: BL31: Built : 14:46:14, Jul 22 2022
U-Boot 2022.04-rc1 (Mar 29 2023 - 14:13:33 +0800)
TUF-AX4200 bootloader version: 1.0.0.3
CPU: MediaTek MT7986
Model: mt7986-rfb
DRAM: 512 MiB
Core: 43 devices, 15 uclasses, devicetree: embed
MMC: mmc@11230000: 0
Loading Environment from MTD...
SPINAND raw ID: 00 EF AA 22
spi-nand: spi_nand spi_nand@1: Winbond W25N02KV SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128, ECC strength 8/512, custom ECC status.
*** Warning - bad CRC, using default environment
In: serial@11002000
Out: serial@11002000
Err: serial@11002000
ASUS TUF-AX4200 gpio/led init
Net:
Warning: ethernet1@15100000 (eth0) using random MAC address - 36:29:51:fb:e6:67
eth0: ethernet1@15100000
Warning: ethernet0@15100000 (eth1) using random MAC address - 0e:f9:84:af:68:fa
, eth1: ethernet0@15100000
ubi0: attaching mtd4
ubi0: scanning is finished
ubi0: attached mtd4 (name "UBI_DEV", size 252 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 2016, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 21/15, WL threshold: 4096, image sequence number: 1864024255
ubi0: available PEBs: 1955, total reserved PEBs: 61, PEBs reserved for bad PEB handling: 40
UBI: vol_id reserved_pebs alignment data_pad vol_type usable_leb_size used_ebs used_bytes last_eb_bytes corrupted upd_marker name_len name
UBI: 0 1 1 0 dynamic 1f000 1 1f000 1f000 0 0 5 nvram
UBI: 1 8 1 0 dynamic 1f000 8 f8000 1f000 0 0 7 Factory
UBI: 2 8 1 0 dynamic 1f000 8 f8000 1f000 0 0 8 Factory2
UBI: 7fffefff 2 1 0 dynamic 1f000 2 3e000 2 0 0 d layout volume
Creating dynamic volume linux of size 0x45fe000
Creating dynamic volume linux2 of size 0x45fe000
No size specified -> Using max size (0x60c1000)
Creating dynamic volume jffs2 of size 0x60c1000
Latest UBI volumes layout.
UBI: vol_id reserved_pebs alignment data_pad vol_type usable_leb_size used_ebs used_bytes last_eb_bytes corrupted upd_marker name_len name
UBI: 0 1 1 0 dynamic 1f000 1 1f000 1f000 0 0 5 nvram
UBI: 1 8 1 0 dynamic 1f000 8 f8000 1f000 0 0 7 Factory
UBI: 2 8 1 0 dynamic 1f000 8 f8000 1f000 0 0 8 Factory2
UBI: 3 242 1 0 dynamic 1f000 242 45fe000 1f000 0 0 5 linux
UBI: 4 242 1 0 dynamic 1f000 242 45fe000 1f000 0 0 6 linux2
UBI: 5 31f 1 0 dynamic 1f000 31f 60c1000 1f000 0 0 5 jffs2
UBI: 7fffefff 2 1 0 dynamic 1f000 2 3e000 2 0 0 d layout volume