Badly bricked my TP-Link Aracher C60 v3.0

Hello,

There is always a first time for everything, sometimes when being on hurry spoils everything!

Yesterday I installed openwrt on my C60 v3.0 router, I wanted to reinstall openwrt because I ran out of space while playing with the softwares available to install, so I simply uploaded the same image used for installation using wifi and bingo, the router is broken, I don't understand why.. explanation is welcome.

So, I searched everywhere and found a youtube video explaining how to debrick WR841N_ND V9 and followed what the guy was doing, finally got there and was able to flash the image, stuck at erase and cp.b commands, so the endeavour ended there when I apparently used the incorrect addresses:

tftpboot 80000000 openwrt-19.07.7-ath79-generic-tplink_archer-c60-v3-squashfs-factory.bin
erase 9f010000 +0x478854
cp.b 80000000 9f010000 478854
reset

How can I find the correct addresses for future endeavours? Really I wanted to learn on this part.

As a result, I lost the bootloader on RS-232 as well. I am interested in finding how to restore this router, help appreciated. I need to know what programmer I need to buy, what software to use, how to connect the HW itself, and where to get the files from to be able to restore the poor router :smiley:

Thank you!

when you say you 'lost the bootloader'?

do you get any text when you connect via serial?

when you're asking about the addresses, typically what you want to do is write to the partition that is designated 'kernel' or 'firmware'.

following the tech page for your router: https://openwrt.org/toh/hwdata/tp-link/tp-link_archer_c60_v3

to the commit https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=646d95c374072598fab9e949ef4425177c5c7960

it seems the address you wanted to write to was 0x03000

usually you have to find out the mtd partition layout of the device and then use the address of the aforementioned partition.

The moment I messed up the correct addresses to write to the flash, I no longer see anything on the serial console. Apparently I messed up the whole NVRAM?

man... I should have asked about the correct address before killing the router.. silly me.. What am I supposed to do?

it's a goner, or so i think.

maybe someone else can correct me. but your experience suggests there is no bootloader, and i don't know how to load an image without one (maybe you can jtag but i'm not sure how to do this).

The easiest option would have been to load an initramfs image via tftpboot and then to bootm into it, calling sysupgrade with the correct sysupgrade image from there.

Without bootloader, the only remaining option would be to flash externally with a spi-nor flasher (and desoldering the flash chip), but that would depend on you still having a backup of your wireless calibration data (which is unique to your device and irretrievable), but given the price of a brandnew specimen delivered to your doorstep (and the rather unlikely success in terms of wireless capability), this wouldn't be an economically viable option (10-20 EUR for spi-nor flasher and soic clamp/ cables, >30 EUR for soldering iron and equipment - compared to ~35 EUR for a new device).

Yes, it is not worth it.

Thank you all!