Can't boot tftp recovery Archer C6 v2

theothercurtis · June 6, 2019, 2:22pm

I've been working through a similar problem and I've made it a step further than you, @jlighty. I am using c6 v2(US) version though.

I have tftp server setup at 192.168.0.66 - through tcpdump I can see that during the boot process, with reset button depressed, the router sends a tftp RRQ packet to tftp server:

192.168.0.86.1721 > 192.168.0.66.69: [no cksum]  45 RRQ "ArcherA6v2_tp_recovery.bin" octet timeout 5

based on this request, I have renamed the factory squashfs snapshot .bin file to "ArcherA6v2_tp_recovery.bin" (note A6, not C6)

At this point, I can see that the bin file is being downloaded to the router (tcpdump shows tftp data & ack packets back and forth between router and tftp server), after the file is downloaded to the router though, it just boots back to the stock TP-Link firmware. It seems the downloaded file is being rejected by the router for some reason. I have tried the factory image, the upgrade image, as well as the initramfs image (all renamed to ArcherA6v2_tp_recovery.bin) and I get the same behavior with each. The router refuses to boot the tftp image and boots the stock firmware.

I opened the router and there are no obvious serial connections - I was going to try my hand at soldering on a JTAG connector but it appears to be beyond my skill.

I am happy to experiment on this router if anyone has any additional suggestions or hints.

I hope this helps others (I see that most references to Archer C6 are for the EU version, so hopefully the above info on the filename the router is looking for at recovery time helps you all.)

mk24 · June 6, 2019, 3:03pm

Likely the built images have region "EU" thus get rejected by your US version. Also if it's like the A7 the factory header is different but once running OpenWrt you can go to C firmware since the hardware is the same.

I would connect serial and try a direct flash of a sysupgrade.

theothercurtis · June 6, 2019, 3:31pm

Thanks @mk24 - I cracked the case and see no obvious serial connect option. Any pointers?

zeldalink · June 6, 2019, 6:34pm

I have the same problem with an Archer C6 v2 EU tried a lot to get openwrt on there but i have no idea how to continue now. I tried with web but get invalid file type. I tried with tftp on mac and windows but both i don't see that they recieve any requests. Tried various times to hold the reset button but nothing. Any help would be really appreciated.
I have firmware version [Archer C6(EU)_V2_190115] atm.
In the notes tp-link mentions:
2. As we have added new functions in this version of firmware, once you have upgraded to this firmware, you will not be able to downgrade to the old one.

I think this has something to do that we cannot flash it trough the normal ways.

jlighty · June 6, 2019, 7:47pm

@zeldalink I've got the same firmware version before switching to openwrt.
You can try different Linux live CD and maybe you will be able to see these ARP packets.
Once you see them you can setup the TFTP server.
The recovery procedure :

power off the router
keep the reset button pressed
power on the router
when the WPS LED lights up, release the reset button

zeldalink · June 13, 2019, 6:44pm

It worked after some tries. what helped for me was the following:
Power up your router.
Press the reset button.
Press power button off and immediately on. (keep reset pressed)
When the WPS licht was on release the reset button.
I Had the router plugged in to my PC and had the script running you provided.
That solved my issue with not able to boot tftp.
I have no idee if the power on part was really needed but tried over 10 times without and that did not work.

bam80 · June 22, 2019, 1:54am

@theothercurtis what tcpdump command did you use to grab that output?

theothercurtis · June 22, 2019, 2:21am

I added a sub-interface (eth0.100) on a raspberry pi i had, and installed tftpd, xinetd, etc. I connected the archer c6 and the raspberry pi to a switch, placed the ports in the same vlan. During the boot process of the archer c6 i ran the following command in the raspberry pi (tftpd server) :

sudo tcpdump -vvxxni eth0.100 port 69

This will catch the control packet (file request) but then when the file transfer occurs it happens on alternate dynamic ports, so the above command won't see the file transfer itself. So we can just run :

sudo tcpdump -vvxxni eth0.100

Which will gather all traffic on that interface, so you can save it to a file with :

sudo tcpdump -vvxxni eth0.100 -w file.pcap

Then download file.pcap and open in wireshark for review / filtering.

Hope this helps

bam80 · June 22, 2019, 4:14pm

@theothercurtis thanks. You still haven't managed to flash your US router, have you?

gvl · June 22, 2019, 8:44pm

The US A6v2 has a 16MB flash with a different partition layout. It's expected the OpenWrt binary to be rejected by the TFTP recovery, as the US unit is not in the supported list in the binary. Don't try to force it, as you might brick your device, and as you mentioned there's no serial console on the board, not event some TPs remotely close to something like uart interface. Adding support for the US A6v2 should not be a difficult task now when TP-Link published a firmware update binary for the A6v2(US).

bam80 · July 19, 2019, 8:52am

If support is added to A6v2(US), will it be flashable through vendor Web GUI, or TFTP is the only method to flash?

UPDATE:
Ok I flashed my Archer C6v2(RU).

Essential part here was the presence of intermediate device between the router and PC (switch, hub, another router) - otherwise, the PC might just not be in time to wake up it's Ethernet interface for pick up TFTP packets of the recovery sequence.

tmomas · June 30, 2019, 3:03pm

A post was merged into an existing topic: TP-Link Archer C6 V2 - Revert to Stock firmware

tmomas · July 20, 2019, 6:35am

12 posts were split to a new topic: 19.07 build for Archer C6 v2

ender · July 19, 2019, 8:55am

I've been trying to flash my C6 v2 (EU), but I can't seem to get the tftp method to work. I have a switch between C6 and the computer, IP set to 192.168.0.66 and tftpd64 running, but nothing happens when I hold down the reset button and power up the router - even if I capture with Wireshark, I can't see any packets on the interface.

Any ideas?

bam80 · July 19, 2019, 9:13am

Did you carefully follow instructions here?

Do you see any packets when the router boots up?

ender · July 19, 2019, 9:20am

Yes. The WPS LED lights up about 4 seconds after powering on the router, at which time I release the reset button, however the router just appears to proceed with normal boot sequence then.

Nothing at all until the router starts sending gratuitous ARP for its IP.

bam80 · July 19, 2019, 9:27am

Try to experiment with the time when you release the reset button.
I suppose you connected PC and the router to the same Ethernet segment.

ender · July 19, 2019, 9:36am

OK, got it to work - looks like the switch I was using (some Asus 5-port gbit switch) took too long to negotiate the link. Had to dig out an ancient Allied Telesyn 10/100 switch.

bam80 · July 19, 2019, 11:00am

Yeah, the switch I used was rather old too

tmomas · July 29, 2019, 11:00am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.