Back to Stock Factory Firmware Linksys E4200 V2? OpenWrt FW to Linksys FW

Installing and Using OpenWrt
61

I have just done some testing on my E4200v2 and I see the exact same behaviour as Bobcamo.

Before doing this, both my partitions were on 18.06.

I tried flashing in the Luci UI, and go the same error Bob mentioned.

19
Screen Shot 2019-02-19 at 20.54.19.png1002×783 238 KB

Then I scp'd the img file over and ran

cd /tmp
sysupgrade -F -n /tmp/FW_E4200v2_2.1.41.164606.img

inspired by this post.

Here is the result from the above command:

# here is the output from that command:
Image metadata not found
Image check 'fwtool_check_image' failed but --force given - will update anyway!
Commencing upgrade. Closing all shell sessions.
Connection to 192.168.1.1 closed by remote host.
Connection to 192.168.1.1 closed.

And same as Bob, the router goes into light breathing mode forever.

1 Like
62

Are there any MTD expert here that could tell me how to dump my working partition firmware for fbradyirl and Bobcamo? Maybe they can restore my firmware dump after.

(I do not have serial access)

Partition 1: offset 0x200000, size 0x1a00000, name "kernel1"
Partition 2: offset 0x1c00000, size 0x1a00000, name "kernel2"

63

what do you mean? using the 18.06.1 if that's what your asking.

@fbradyirl
oh thank god i'm not the only one... sucks... but yeah lol.
also, that is the exact command line that shows when i hit enter. but also pops that.disconnect windows

64

I do believe they'll need certain information regarding board and certain params also that are related to their model. They would need to do a serial connection too, and edit a compatible mtd partition very dangerous if you don't know what your doing.
Edited: Has anyone tried the dd command on the linksys.img image then using the sysupgrade technique?

65

I believe that these information are stored in another partition than the kernel partition (I assume you are referring to MAC and board info).

I still believe that it doesn't require serial since we would be writing to another inactive partition. Maybe MTD is not the right tool, dd the mounted partition might be the way.

66

maybe remove the check from keep settings,and do a reset again, or remove check then proceed the flash new firmware image.

67

that didn't matter on my end. tried both.

68

Same. Doesn't make a difference.

I also just tried installing the "non-cloud" firmware and get the same results.

root@OpenWrt:/tmp# sysupgrade -F -n FW_E4200_2.0.37.131047.SSA
Image metadata not found
Image check 'fwtool_check_image' failed but --force given - will update anyway!
Commencing upgrade. Closing all shell sessions.
Connection to 192.168.1.1 closed by remote host.
Connection to 192.168.1.1 closed.
69

Can you tell me what partitions are mounted on your router (I don't have access to my E4200 right now)? There should be "kernel" and maybe something like "alt_kernel".

70

This any use?

root@OpenWrt:/mnt# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00080000 00020000 "u-boot"
mtd1: 00020000 00020000 "u_env"
mtd2: 00020000 00020000 "s_env"
mtd3: 002a0000 00020000 "kernel1"
mtd4: 01760000 00020000 "ubi"
mtd5: 002a0000 00020000 "kernel2"
mtd6: 01760000 00020000 "rootfs2"
mtd7: 04a00000 00020000 "syscfg"
mtd8: 00140000 00020000 "unused"
root@OpenWrt:/mnt#
71

Yes. I will try to dd my Linksys partition tonight and create a dump. Then I think you'll be able to write this dump using mtd or sysupgrade. I'll check to see if it matches the .IMG file too.

72

do i just run this command in putty /mnt# cat /proc/mtd
to get that info? was gonna post mine too just in case.

73

Just

cat /proc/mtd

75 
root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00080000 00020000 "u-boot"
mtd1: 00020000 00020000 "u_env"
mtd2: 00020000 00020000 "s_env"
mtd3: 002a0000 00020000 "kernel1"
mtd4: 01760000 00020000 "ubi"
mtd5: 002a0000 00020000 "kernel2"
mtd6: 01760000 00020000 "rootfs2"
mtd7: 04a00000 00020000 "syscfg"
mtd8: 00140000 00020000 "unused"

should i past that second code mentioned with the fw_printenv?

76

Not needed right now. And you need to clean up the fw_printenv command to remove MAC if you care about your data.

77

lol, hence why i asked since i noticed that.

78

I just tried downgrading to the lede-17.01.6-kirkwood-linksys-viper-squashfs-factory.bin image and that also fails for me (using -F).

79

Factory version?

Investigation with binwalk shows the "factory" OpenWrt and the official firmware are direct images of the flash, but the OpenWrt .sysupgrade (despite being named .bin instead of .tar) is a tarfile with the kernel and rootfs separate.

The problem here is that it is NAND flash. If there are any bad blocks involved you can't just blast it into the mtd partition.

So if it were my router (and for some bizarre reason I really wanted to go back to stock), I would try deconstructing the factory image then rebuilding it as a sysupgrade compatible tarfile.

80 

mtd0: 00080000 00020000 "u-boot"
mtd1: 00020000 00020000 "u_env"
mtd2: 00020000 00020000 "s_env"
mtd3: 002a0000 00020000 "kernel1"
mtd4: 01760000 00020000 "rootfs1"
mtd5: 002a0000 00020000 "kernel2"
mtd6: 01760000 00020000 "ubi"
mtd7: 04a00000 00020000 "syscfg"
mtd8: 00140000 00020000 "unused"
 
difference in mine is rootfs1 as I'm seeing rootfs2 the previous posts.
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r9360-f948aa4d4f
81

Dictated by which is current. Flash details