Cannot unbrick my TP-Link Archer C7 v4 router

Information about my router:
Name: TP-Link Archer C7 AC 1750 v4 (EU version)
Wikidevi: https://wikidevi.com/wiki/TP-LINK_Archer_C7_v4.x

How I bricked my router?
I bricked my router while I was trying to revert back to stock firmware. Previously it was running OpenWRT. I downloaded the original firmware from the TP-Link website, extracted the zip file and transferred it to /tmp directory of the router and ran the command sysupgrade -F /tmp/firmware.zip which bricked my router.
Now when I switch on the router, all the LEDs lights up and turns off.

Steps I followed to unbrick the router:
I downloaded the tftpd64 from the official website and installed on my Windows 10 machine. Configured my ethernet adapter to use 192.168.0.66 and subnet mask to 255.255.255.0 and disabled my wireless adapter. I renamed the stock firmware to ArcherC7v4_tp_recovery.bin. Powered on the router while pressing reset button, router goes to recovery mode and th WPS light turns on.

Here is the screenshot of tftpd sending the firmware.

tftpd64_2019-01-09_08-18-07

The problem is that the stock firmware is too large (14MB) to send in short recovery window of the router. I can flash OpenWRT firmware via this method but not the official or the DD-WRT firmware. Can somebody please help me to unbrick this router?

Thanks :slight_smile:

After few seconds the transfer fails after the WPS light on router turns off.

tftpd64_2019-01-09_08-20-08

Here's the screenshot of logs:

tftpd64_2019-01-09_08-51-18

Have you consulted the guide for flashing the OEM firmware?
https://openwrt.org/toh/tp-link/archer-c5-c7-wdr7500#return_to_factory_firmware

1 Like

You flashed the downloaded file without stripping it (cutting off the first xxx bytes)?

Does this help? Help required to revert to stock TP-Link Archer C7 V4 EU - #7 by mh3g

2 Likes

Since you can load OpenWrt, use it to sysupgrade a stripped stock firmware, and it will be back to stock. It is a good idea with any revert to stock that once the stock firmware boots, use it's web page to revert to factory settings and then again flash the stock firmware unaltered.

Download from TP-Link and unzip on your PC. Do not try to flash the zipped file.

If the stock firmware file does not have "boot" in the name you only strip the first block of 512 bytes. If it does have "boot" in the name you need to strip 257 blocks of 512 bytes.

The strip can be done in place on the router's RAM disk (/tmp) with the dd command.

dd if=orig.bin of=stripped.bin bs=512 skip=1
sysupgrade -n -F stripped.bin

1 Like

I haven't tried stripping the OEM firmware, I will try it out when I get home, thanks for the replies!

The latest stock firmware didn't contained boot soo I stripped 512 bytes, I ran this command in /tmp folder and did sysupgrade. This is the output:

root@OpenWrt:/tmp# sysupgrade -n -F stripped.bin
Image metadata not found
Invalid image type.
Image check 'platform_check_image' failed but --force given - will update anyway!
Commencing upgrade. Closing all shell sessions.

Router is bricked again.

Edit: This was the output of dd command

 dd if=firm.bin of=stripped.bin bs=512 skip=1
29563+1 records in
29563+1 records out

Those record counts don't look right. The output file should be 512 bytes smaller than the input file. I'm not sure what is going on.

I ran the same command on my Linux machine, this was the output:

29563+1 records in
29563+1 records out
15136494 bytes (15 MB, 14 MiB) copied, 0.0584756 s, 259 MB/s

I have tried stripping 512 bytes of both dd-wrt and stock firmware but no luck, the router still bricks after trying to flash stripped firmware file. I also tried with older stock firmware but still failed. If anyone found the solution, please help me

How about running this:

dd if=firm.bin of=stripped.bin bs=1 skip=512

It's the same command with slightly changing the bytes allocation.

This was the output:

dd if=firm.bin of=stripped.bin bs=1 skip=512
15136494+0 records in
15136494+0 records out
15136494 bytes (15 MB, 14 MiB) copied, 25.3578 s, 597 kB/s

Haven't tried flashing though.
But both the files are different, here's the diff between the files

 diff firm.bin stripped.bin

Binary files firm.bin and stripped.bin differ

I'm running the command myself on my router and will let you know if the stripped file is different than original.

Update: I checked the file size and stripped file is 512 bytes less than the original. The output actually shows how much data has been written to the new file.

I flashed the stripped firmware using mtd -r write /tmp/stripped.bin firmware unfortunately this dosen't worked, is there any way to revert it back to stock?

I dont recommend using mtd if sysupgrade is available for your router. The above forum link also states that if the firmware file doesnt contain the word boot in it you can just flash the file to get back to stock.

Have you tried flashing the stock firmware without stripping it?

Yes I did try flashing the unstripped version of stock firmware via sysupgrade but didn't worked.

new devices seem to use completely different type of firmware bundle. looking at Archer C7(EU)_V4_180425.bin i see it contains some env/partitions info in the beginning followed by u-boot image at offset 2014. expecting fw header at 22014 but there was none.
if you had flash dump you could restore that one otherwise it might possible that even u-boot tftp upgrade won't work given there are no other problems with tftp (from first post it can be seen transfer speed is quite low, approx. 500KB/s and it times out eventually while it probably should transfer in a matter of seconds)

I think this is the reason why @random_dude cant flash the stock firmware from recovery procedure. 500kb/s is quite low for Ethernet, maybe a faulty cable or faulty port, try changing the cable and/or Ethernet port if you have more than one. As @psyborg suggested the firmware should transfer in just a couple of seconds. In the 2nd post it says:

TIMEOUT waiting for Ack block #9649

So it is expecting the firmware to be transferred by then but since it does not get enough bytes transferred it fails and restarts the device.

I would suggest to use the official firmware and do not strip it, and if you can try to flash it through the recovery procedure because it will most likely unbrick your device and switch it back to stock. Try to unzip the file if it's in .zip or .rar format and then use the extracted .bin file. Rename it as the router is asking for the file.

I guess debricking would be a lot easier if one has serial access, because then stopping the boot process is rather simple and a couple of commands can write the firmware and switch back to stock.

Thanks for all the replies! I finally flashed stock firmware using my Linux machine, Ubuntu 18.04.1 to be precise.

Here are the steps:

  1. Installed tftp server
    apt install atftpd

  2. Transfer the stock firmware to /srv/tftp

  3. I had other service running on port 69 so I had to kill it by kill command

  4. Start the tftp server
    service atftpd start

  5. Make sure it's running on port 69 by using netstat command.

  6. You can also make sure that it's possible to retrieve the file using tftp command and running get yourFirmware.bin

  7. Make sure to set the static IP address 192.168.0.66 subnet mask as 255.255.255.0 and gateway 192.168.0.1

  8. Finally, turn on the router while pressing the reset button, hold the reset button until the WPS led turns on.

Now wait for a few minutes and ta-da! new firmware is successfully installed.

However I don't know what was wrong with my Windows machine. Thanks for all the help :slight_smile:

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.