Can't boot tftp recovery Archer C6 v2

Installing and Using OpenWrt
#1

Hi everyone,

First, I'm sorry for my bad english (i'm french)

Here's my problem : i just bought the Archer C6 Tp Link router (V2).
I want Open WRT on it for experience and DHCP connection (my ISP is Orange Telecom)
I follow this link : https://openwrt.org/toh/hwdata/tp-link/tp-link_archer_c6_v2_eu
I download the openwrt factory firmware et sysupgrade firmware : both of them don't work with web gui. I have error message : "Invalid file type"

So I decide to go with tftp recovery with tftpd64 software for tftp server.
My IP adress is 192.168.0.66 and netmask 255.255.255.0
The BIN file name is "ArcherC6v2_tp_recovery.bin"

I launch tftpd64, i verify directory, i choose correct server interface.
I push the reset button(with a pen), i power on router, i wait 5 secs...and nothing happened. The router boot normally but no tftp....nothing.

I think the problem is i don't know when i have to release the reset button. I search with other routers like C7 or C5 but th boot led sequence is not the same (i think)

On the C6, at Power ON :

  1. Power LED light up a few seconds and then off
  2. Power LED lights up again and blink
  3. Then WiFi LED 2.4 et 5GHZ lights up (Power LED still blinking)
  4. Finally Lan LED lights up

Notice : whe the router is powering on and the power led is up and after a few second down, the server interface in tftpd64 go to 127.0.0.1 (loopback). I don't know if there is a part of the probleme too.

I know some people here succesfully flash Archer C6 to openwrt.

Please help meeeeee.

Thanks in advance :slight_smile:

Archer C6 V2 (EU) bricked/bootloop
#2

From the git-commit that added support for C6 v2:

  1. Keep the reset button pressed until the WPS LED lights up
  2. Wait ~150 seconds to complete flashing
#3

Thanks for reply.

I just retry that twice. And yes i count 150 seconds each time....nothing happened

#4

Hi again.

I try with Ubuntu and tftpd to see if thé problem Cole from Windows 10.

I test my tftp server and it's running fine
But the tftp recovery dont come

So I try with wireshark for understand, and... Nothing.
No tftp specific packet,:slightly_frowning_face:

I dont know what to do...

#5

I have a similar issue with this router : I cannot see any packets (ARP) from the router during the boot.
Strangely using my old eeepc 701 on debian 8, I managed to capture these ARP request each time !
I keep the reset button pressed until the WPS LED lights up then the router sent ARP request to find the host 192.168.0.66.

With my usual laptop (lenovo x230) on many debian versions (from 7 to 9) I wasn't able to catch any packets.
I tried to set the media speed to 10Mbits/s half duplex knowning eeepc has only a 100Mbits/s interface.
But nothing works as expected, I'm still investigating with others laptops/O.S

#6

I manage to get the TFTP recovery with another laptop (debian 9.8).

lspci
01:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 06)

Using this following script I initiate the TFTP recovery

#/bin/bash
USER=myuser
IFNAME=eth0
ip address flush dev $IFNAME
ip address add 192.168.0.66/24 dev $IFNAME
dnsmasq -i $IFNAME --dhcp-range=192.168.0.100,192.168.0.150 \
--dhcp-boot=ArcherC6v2_tp_recovery.bin \
--enable-tftp --tftp-root=/home/$USER/openwrt -d -u $USER -p0 -K --log-dhcp --bootp-dynamic

The file ArcherC6v2_tp_recovery.bin is the latest snapshot factory.

NB: I didn't manage to reach the TFTP sequence on my x230 even by playing the virtualization features...
It seems some packets are dropped or skipped on the network card.

#8

I've been working through a similar problem and I've made it a step further than you, @jlighty. I am using c6 v2(US) version though.

I have tftp server setup at 192.168.0.66 - through tcpdump I can see that during the boot process, with reset button depressed, the router sends a tftp RRQ packet to tftp server:

192.168.0.86.1721 > 192.168.0.66.69: [no cksum]  45 RRQ "ArcherA6v2_tp_recovery.bin" octet timeout 5
  • based on this request, I have renamed the factory squashfs snapshot .bin file to "ArcherA6v2_tp_recovery.bin" (note A6, not C6)

At this point, I can see that the bin file is being downloaded to the router (tcpdump shows tftp data & ack packets back and forth between router and tftp server), after the file is downloaded to the router though, it just boots back to the stock TP-Link firmware. It seems the downloaded file is being rejected by the router for some reason. I have tried the factory image, the upgrade image, as well as the initramfs image (all renamed to ArcherA6v2_tp_recovery.bin) and I get the same behavior with each. The router refuses to boot the tftp image and boots the stock firmware.

I opened the router and there are no obvious serial connections - I was going to try my hand at soldering on a JTAG connector but it appears to be beyond my skill.

I am happy to experiment on this router if anyone has any additional suggestions or hints.

I hope this helps others (I see that most references to Archer C6 are for the EU version, so hopefully the above info on the filename the router is looking for at recovery time helps you all.)

#9

Likely the built images have region "EU" thus get rejected by your US version. Also if it's like the A7 the factory header is different but once running OpenWrt you can go to C firmware since the hardware is the same.

I would connect serial and try a direct flash of a sysupgrade.

#10

Thanks @mk24 - I cracked the case and see no obvious serial connect option. Any pointers?

#11

I have the same problem with an Archer C6 v2 EU tried a lot to get openwrt on there but i have no idea how to continue now. I tried with web but get invalid file type. I tried with tftp on mac and windows but both i don't see that they recieve any requests. Tried various times to hold the reset button but nothing. Any help would be really appreciated.
I have firmware version [Archer C6(EU)_V2_190115] atm.
In the notes tp-link mentions:
2. As we have added new functions in this version of firmware, once you have upgraded to this firmware, you will not be able to downgrade to the old one.

I think this has something to do that we cannot flash it trough the normal ways.

#12

@zeldalink I've got the same firmware version before switching to openwrt.
You can try different Linux live CD and maybe you will be able to see these ARP packets.
Once you see them you can setup the TFTP server.
The recovery procedure :

  • power off the router
  • keep the reset button pressed
  • power on the router
  • when the WPS LED lights up, release the reset button
#13

It worked after some tries. what helped for me was the following:
Power up your router.
Press the reset button.
Press power button off and immediately on. (keep reset pressed)
When the WPS licht was on release the reset button.
I Had the router plugged in to my PC and had the script running you provided.
That solved my issue with not able to boot tftp.
I have no idee if the power on part was really needed but tried over 10 times without and that did not work.

#14

@theothercurtis what tcpdump command did you use to grab that output?

#15

I added a sub-interface (eth0.100) on a raspberry pi i had, and installed tftpd, xinetd, etc. I connected the archer c6 and the raspberry pi to a switch, placed the ports in the same vlan. During the boot process of the archer c6 i ran the following command in the raspberry pi (tftpd server) :

sudo tcpdump -vvxxni eth0.100 port 69

This will catch the control packet (file request) but then when the file transfer occurs it happens on alternate dynamic ports, so the above command won't see the file transfer itself. So we can just run :

sudo tcpdump -vvxxni eth0.100

Which will gather all traffic on that interface, so you can save it to a file with :

sudo tcpdump -vvxxni eth0.100 -w file.pcap

Then download file.pcap and open in wireshark for review / filtering.

Hope this helps

1 Like
#16

@theothercurtis thanks. You still haven't managed to flash your US router, have you?

#17

The US A6v2 has a 16MB flash with a different partition layout. It's expected the OpenWrt binary to be rejected by the TFTP recovery, as the US unit is not in the supported list in the binary. Don't try to force it, as you might brick your device, and as you mentioned there's no serial console on the board, not event some TPs remotely close to something like uart interface. Adding support for the US A6v2 should not be a difficult task now when TP-Link published a firmware update binary for the A6v2(US).

1 Like
#18

If support is added to A6v2(US), will it be flashable through vendor Web GUI, or TFTP is the only method to flash?

UPDATE:
Ok I flashed my Archer C6v2(RU).

Essential part here was the presence of intermediate device between the router and PC (switch, hub, another router) - otherwise, the PC might just not be in time to wake up it's Ethernet interface for pick up TFTP packets of the recovery sequence.

2 Likes
#19

A post was merged into an existing topic: TP-Link Archer C6 V2 - Revert to Stock firmware

#20

12 posts were split to a new topic: 19.07 build for Archer C6 v2

#22

I've been trying to flash my C6 v2 (EU), but I can't seem to get the tftp method to work. I have a switch between C6 and the computer, IP set to 192.168.0.66 and tftpd64 running, but nothing happens when I hold down the reset button and power up the router - even if I capture with Wireshark, I can't see any packets on the interface.

Any ideas?

1 Like