Hard recovery of the e8450 / RT-3200
If the router's firmware has been damaged beyond the point of simple patching and operation, you can still restore the router to full function as long as you have previously taken a backup of your factory partition. The instructions for doing so are below. Be warned that if something goes wrong with the below, it could leave your router unable to boot and without data at all. Therefore, the steps below should only be followed if you know what you are doing or if you're sure the data has been corrupted beyond resolution by normal firmware installation process and the normal OKD recovery steps.
Additional: If your router really has reached the point that the below is necessary, please consider first submitting the logs as requested a few posts up (Belkin RT3200/Linksys E8450 WiFi AX discussion - #5088 by Underworld) before completing the restoration.
Complete recovery instructions
These instructions are based under the following assumptions:
- The router and your computer are connected to the same network and you can communicate between them.
- The router (through U-Boot) will default to the IP address 192.168.1.1.
- The router expects your computer to be located at IP address 192.168.1.254.
- Your computer must be configured with a TFTP server.
- You have a basic working knowledge of (and access to) the U-Boot prompt.
From your backups, place a copy of the backed-up factory partition for this router in the TFTP folder with the name factory.bin. To find the right backup file, you'll need to know where the factory partition data was stored. The stock and non-UBI OpenWRT firmwares stored the factory data in mtd4. The stable 23.0x OpenWRT e8450 UBI firmwares stored the factory data in mtd2, and the 2024+ snapshot and newer OpenWRT UBI firmwares store it as a UBI volume. In most cases, the factory data will be 1MiB in size.
From the OpenWRT firmware selector, select the e8450 UBI and firmware version 22.03.7. We need the following:
- Download the "preloader.bin" and place it in the TFTP folder with name
openwrt-mediatek-mt7622-linksys_e8450-ubi-preloader.bin.
Note: The preloader is being taken from release 22.03.7 and not from 23.05.x! The reason for this is because as of 2024-08-16, the 23.05.x preloader builds all suffer from the condition known as OKD.
From the OpenWRT firmware selector, select the e8450 UBI and firmware version 23.05.4. We need the following:
- Download the "BL31-UBOOT.FIP" and place it in the TFTP folder with name
openwrt-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip. - Download the "kernel" and place it in the TFTP folder with name
openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb. - Download the sysupgrade file to your preferred download location. This will not be used in TFTP, but will be uploaded via the web interface or via the OpenWRT command line (your preference).
Using the mtk_uartboot tool as per the wiki (https://openwrt.org/toh/linksys/e8450#recovery_from_openwrt_kiss_of_death_okd), follow the steps marked 'did not run the v1.1.1 UBI installer' until you get to a U-Boot prompt.
One at a time, run the below commands to restore data to the necessary partitions. If a step fails, you need to troubleshoot it. Do not proceed on to the next step unless you have received a confirmation message that the data has been written.
Restoring the preloader (BL2)
run boot_tftp_write_bl2
Restoring the fip (and U-Boot)
run boot_tftp_write_fip
Restoring the factory partition
The below instruction will restore your factory partition from the backup. If you are using the surrogate binary from below or a partition from a donor device and wish to retain your original MAC addresses, please instead skip the below command and use the factory restoration steps under the section "Recovery without factory partition".
tftpboot factory.bin && mtd erase factory && mtd write factory $loadaddr 0 $filesize
If you needed to use the alternate steps under "Recovery without factory partition", you would now resume the recovery process here.
Restoring the recovery environment
run boot_tftp_recovery
At the end of the final step, the router may automatically launch the OpenWRT recovery environment. If it does not, it is now safe to issue the reset command and the router will reboot. If all went well, you should now be in the 'initramfs' recovery environment and should upload the sysupgrade file either by web (luci) or by the command line, whichever you prefer. Once the sysupgrade file has been loaded, the router is restored and ready for use.
Recovery without factory partition
If you don't have a backup of your factory partition, you'll need a donor or surrogate in order to recover full functionality. The below linked file is a rebuilt factory partition based around the documentation and data present in the wifi drivers. Please note that it does NOT contain any MAC addresses, and therefore, your router will still randomly assign them.
Since this surrogate is rebuilt from driver information and does not contain all of the data present in a true factory partition, there's a chance that some functionality might not be there or it might not work properly on your device at all. It might even break at some point in the future, should a new driver suddenly require data that isn't there. In other words, this surrogate is for an emergency recovery when all other options fail.
The good news is that it has been tested far enough to ensure it will make and allow connections from devices, and that it lists the same support as was present by the factory.
Place the following file on your TFTP server with the name factory.bin.
https://github.com/grauerfuchs/owrt_device_support/raw/main/e8450_factory_emergency.bin
You can use the file as-is with the recovery instructions above if you don't care about having stable MAC addresses or if you prefer to assign them directly in OpenWRT. However, if you do want to permanently restore your MAC addresses, you'll need to properly update and use the below commands to restore the factory partition instead.
To load the surrogate partition into memory on the router for editing:
tftpboot 0x48000000 factory.bin
Editing a MAC address in device memory through the U-Boot console
The editor commands listed below will set the MAC address byte by byte in an as-displayed order. The last parameter passed to each command is the data that will be set. The addresses are written and stored as hexadecimal values. Please don't forget this when computing the new values.
By default, the MAC address on the router's sticker is the WAN address. From there, increment each address' final value by one to get the LAN, then the 2.4GHz, then the 5GHz addresses.
Setting the WAN MAC address
mw.b 0x4807FFFA 0xe8
mw.b 0x4807FFFB 0x9f
mw.b 0x4807FFFC 0x80
mw.b 0x4807FFFD 0x00
mw.b 0x4807FFFE 0x00
mw.b 0x4807FFFF 0x00
Setting the LAN MAC address
mw.b 0x4807FFF4 0xe8
mw.b 0x4807FFF5 0x9f
mw.b 0x4807FFF6 0x80
mw.b 0x4807FFF7 0x00
mw.b 0x4807FFF8 0x00
mw.b 0x4807FFF9 0x01
Setting the 2.4GHz WiFi MAC address
mw.b 0x48000004 0xe8
mw.b 0x48000005 0x9f
mw.b 0x48000006 0x80
mw.b 0x48000007 0x00
mw.b 0x48000008 0x00
mw.b 0x48000009 0x02
Setting the 5GHz WiFi MAC address
mw.b 0x48005004 0xe8
mw.b 0x48005005 0x9f
mw.b 0x48005006 0x80
mw.b 0x48005007 0x00
mw.b 0x48005008 0x00
mw.b 0x48005009 0x03
Writing the updated factory partition to flash
mtd erase factory && mtd write factory 0x48000000 0 0x80000
From here, continue with the above instructions for restoring the recovery environment.