Bricked Tp-Link EAP 265HD / EAP245v3/

Hello all my adventure started in another thread but I decided to make a new one for reference.

So I own a TP-Link 265 HD (glorified EAP245 v3 with tweaked tplink firmware to allow more clients)Everything was working great with the OpenWRT 245 firmware. I had a play with one of the online image builders trying to strip down packages and seem to have bricked the device.

So I've soldered a header on and linked the left two pads inside the white box on the picture below not sure if I need to pull down to gnd (link the right two pads)

anyway using putty at the settings described on the eap245 wiki and don't seem to be able to make a connection on the two left most pins the wiki spoke of a pin out on the back of the board but I don't seem to be able to find it anyone have any ideas?

Ok I really need to learn to read better but the wiki could do with some updating and clearer wording for idiots like myself.
So I was missing the bridge on r225 which was under the one IC cover on the rear, managed to get into the router via serial using putty now I need to set up tftp(no idea what I'm doing). will update photos and try get some better images incase someone wants to update the wiki.

So I have the serial open and a tftp server set up but the ath soc is asking for a .IMG file and all I seem to have are .bin

It's just a file name...

If you have access to serial bootloader, first try to print/save/copy as much info from there you can get even the bootloader info.

It might also be possible to see from serial why it won't boot the new firmware you flashed or stops booting!

Start with things as help or printenv or similar named getenv before you wipe important environment variables and values.

EDIT, did you use this device page:

It's just a file name...

For tftp in general it is needed to use the "initramfs" image and renaming the factory or sysupgrade would not work.

Ok so screenshot everything: check

Yes I used the eap245v3 data as it's only the sticker some filenames and tp-links own firmware that's any different.

I just got the Comfast ew72 ap and can't flash that either something to do with saved settings....

Really do i start a new thread? That will be the 3rd today nahh I've set it up with the own setting for now I'll get back to trying to fix this tp-link 1st

So back at it I made the mistake of doing a ram test when looking through the serial options it's been testing probably an hour or so and I'm at 28mb of 128 and too scared to stop it while waiting I got a message from a developer about this.

Not even sure what to do with this info but I don't feel like copy and paste is the right choice anyone can dull it down for me where would I even find the correct hex code to replace 0x8 on the above.


Could you post / copy more info where/when it stops or refuses booting the bricked router from serial u-boot?

It's 2am here now so I won't be doing anymore tonight.
I think I'm having issues with my tftp server so I'll try set one up either on my firewall or on a Linux vm tomorrow and try again.

Here's the first set of data the uboot log showed

U-Boot 1.1.4--LSDK-10.2-00082-4 (Mar 19 2018 - 14:55:50)

board956x - Dragonfly 1.0DRAM:
ath_ddr_initial_config(287): (ddr2 init)
ath_ddr_initial_config: DDR_EMR2_ADDRESS=0x180000bc, EMR2 value=0x80
ath_sys_frequency: ref_clk 25000000
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0xe, 0xe, 0xe, 0xe)
128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 454k for U-Boot at: 87f8c000
Reserving 192k for malloc() at: 87f5c000
Reserving 44 Bytes for Board Info at: 87f5bfd4
Reserving 36 Bytes for Global Data at: 87f5bfb0
Reserving 128k for boot params() at: 87f3bfb0
Stack Pointer at: 87f3bf98
Now running in RAM - U-Boot at: 87f8c000
Flash Manuf Id 0x1c, DeviceId0 0x70, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Setting 0x181162c0 to 0x40802100
Hit Ctrl+B to stop autoboot:  0
factory boot check integer ok.
factory boot load fs uboot len 262144 to addr 0x81000000.
## Starting application at 0x81000000 ...

It goes on for a bit but the weird thing is it's all commands with the first letters missing

ath> U-Boot 1.1.4--LSDK-10.2-00082-4 (Mar 19 2018 - 14:55:50)
Unknown command 'U-Boot' - try 'help'
ath> initial_config(287): (ddr2 init)
Unknown command 'initial_config(287):' - try 'help'
ath> 2 value=0x80
Unknown command '2' - try 'help'
ath> _sys_frequency: cpu 775 ddr 650 ahb 258
Unknown command '_sys_frequency:' - try 'help'
ath> usable for U-Boot at: 88000000
Unknown command 'usable' - try 'help'
ath> rving 192k for malloc() at: 87f5c000
Unknown command 'rving' - try 'help'
ath> bfd4
Unknown command 'bfd4' - try 'help'
ath> 5bfb0
Unknown command '5bfb0' - try 'help'
ath> b0
Unknown command 'b0' - try 'help'
ath> n RAM - U-Boot at: 87f8c000
nm      - memory modify (constant address)

ath> size 16MB, sector count = 256
Unknown command 'size' - try 'help'
ath>  default environment
Unknown command 'default' - try 'help'
ath> etting 0x181162c0 to 0x40802100
Unknown command 'etting' - try 'help'
ath> t check integer ok.
tftpboot- boot image via network using TFTP protocol

ath> g application at 0x81000000 ...
## Starting application at 0x0000000A ...

Currently your u-boot ath> prompt is riddled with commands probably by copy paste mistake it should just say ath> after CTRL-B.

Or your serial output TX is poisining your RX serial input traffic (if you didn't copy paste it yourself). Are your solderings clean as in no electric shorts, or try different ttl reader or software client/setting???

That's what it looks like without ctrl b, joints are clean from the looks of it, if I ctrl b it works fine but if I leave uboot run I get all these unknown command errors

So trying to change file names and let the serial do the work was getting me no where I downloaded the initramfs file again, named it just as initramfs.bin, put it in a tftp server root and used

tftpboot 0x80800000 initramfs.bin
elfboot 0x80800000

And it worked! already did the sysupgrade and set it up as a dumb Ap will do the fine tuning another time, moving on to the Comfast ew72's now.
Many thanks all.

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.