Bricked TP-Link RE500 v1, how can I fix it?

Long story short I may or may not have flashed the stock firmware from OpenWRT (stupid me). The extender no longer works, as it turns on with all LEDs and for a short time period it goes off and back on quickly. All this repeats. I can't seem to do TFTP recovery through LAN (can't seem to understand or I may have done it wrong?). I thought by serial method I could recover the extender. I have no skills at soldering and don't even have such tools for it. Could I buy a CH341A flashing programmer and simply flash the stock firmware onto the extender's chip? If not possible with the stock firmware (as I don't have a dump for it nor can I find it, but maybe could modify the stock firmware) can I simply flash the firmware for OpenWRT back onto the extender? If all is possible I may order a CH341A. TTL seems complicated to me, hopefully someone could guide me through it. Thanks!

Edit: RE500 V1 might be similar to RE650 V1 in terms of hardware.
Model: TP-Link RE500 V1 (UK)
BIOS Chip: Winbond 25Q128FSVG

Ok so I have ordered a CH341A USB programmer that comes with a SOP8 flash clip. It will come at around two weeks. I have currently disassembled the extender and can locate the Winbond chip. Currently my concern is regarding what firmware I can/should flash. I am pretty sure that the firmware is corrupted (as I was flashing back to stock firmware through LuCI). I might have to modify MAC address or something.

How did you try to flash back to stock?
In the worst case, you killed U-Boot. If that's the case, you need a full dump of the IC as U-Boot is most of the time not included in a firmware update.

If your U-Boot still works, you just need serial console to recover via TFTP.

Attach serial first and check if you get output. If yes, recover via serial. If not, recover by flashing U-Boot (and only U-Boot!) to the flash first.

I was at OpenWRT 22.03.3 and over there (through LuCl) I was dumb enough to flash the firmware from TP-Link's website. It was still in the flashing process (according to LuCI) but the extender stopped functioning. All the LEDs are on and for a brief moment it flashes. I've got no clue if the U-Boot is damaged. I may attempt the recovery by serial connection and see what I can achieve. I am very new to router related stuff and that includes U-Boot. If I did get a complete dump from another RE500 V1, are the odds high that I can recover it? Also would I have to necessarily solder the header pins (I don't have any soldering tools and got no experience). Thank you very much for the response though!

If you flashed from LuCI, it is very unlikely that you killed U-Boot. However, according to the commit message, you need a specially prepared image to be able to flash via TFTP. It will be easier to flash OpenWrt first and then return to stock with a (prepared!) stock firmware image (tplink-safeloader -z).

https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=ba0f4f0cfddc6f1152273565ec35f2a0bda1e95d

I would be alright going back to OpenWRT, it seems to be less of a hassle considering the fact that I cannot seem to find any guide/dump for the RE500 V1. I also want to avoid doing serial recovery. Any way to simply utilize the SPI programmer, then backup the read contents and modify them. Or the serial way is the only way.

The serial way is the much easier way. Have you already opened the device? If there is a header, there is nothing you need to do apart from plugging in the cables. If there are holes without solder, you can simply stick the cables or the header in there and hold it in place while recovering. You only need to solder if there is solder in ...

1 Like

Yea I have it opened. There are no headers, just holes with no solder. I am relieved to hear that there is hope. Can I simply buy the PL2303HX and with it some header pins and connect it with some jumper wires?

If it's 3.3V: yes. Be sure to connect only Rx, Tx and Gnd.

1 Like

If your PC runs Windows, avoid the PL2303 chip use a FTDI instead.

Can I use a bootable Linux to do the recovery with the PL2303 chip?

Yes that will work.

Ok I've decided to soon order a 'FTDI USB to TTL FT232RL USB Adapter Board for Arduino' and a 'Female to Male Jumper Wire'. Would this be sufficient for the process? I have my own Mini USB cable to connect to my PC and may be able to use Windows.

Edit: Here are the links: Jumper Wire and FTDI USB to TTL FT232RL
Please let me know if this is a good choice, also if I order them they will come very soon (in less than a week).

I thought you've already ordered a CH341A cable?

I have cancelled it :confused:

Edit: There are these jumpers on the FTDI USB to TTL adapter. So I should switch from 5V to 3.3V?

Update: I will receive the FTDI FT232RL USB to TTL and the Female to Male Jumper Wires this weekend, any quick guide to follow to prepare for serial output? The flashing commands for many routers/extenders seem to be different. I have no dump or backup for the stock firmware so I might as well go back to OpenWRT and get things up and running. Thank you!

Connect and see if you get output at all. Then post the output here and we can help you with the next steps.

I should also plug in the extender and power it after connection or should not do that.

The RE500? Yes of course, you won't get any output on serial if it's not powered :wink:
NB: Never connect VCC to the serial cable, only Rx, Tx and Gnd.

I shall do that, also it was mentioned somewhere to switch Rx and Tx. Do I do that or directly connect them to their assigned port? Oh and wire colours (jumper wires of any colour connected to Tx, Rx and Gnd) don't matter right? xD