EAP225 v1 firmware

Now I tried to use EAP245 v1 firmware on my EAP225 v1 device.

Since I'm quite new to OpenWrt (I have only one device, a TL-WDR4300, running OpenWrt), let me state exactly which steps I took. Mayby I made a mistake somewhere.

Or it is just not possible to upgrade a EAP225 v1 device with EAP245 v1 firmware. :thinking:

First of all I gain access to the device by changing the username into ;/usr/sbin/telnetd -l/bin/sh& and changing it back to admin directly after that.

I confirm access by typing
# telnet {device-ip}
into a terminal.

Then I change properties of /tmp by

# chmod 777 /tmp

In another terminal tab I put

# ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@{devie-ip} "dd if=/usr/bin/uclited" > uclited

and the password I used when changing the username of the device.

Then,

# cp uclited uclited-patched
# echo "000d2264: 24020000 00000000" | xxd -r - uclited-patched

The command

# sha256sum uclited*

gives this output:

d7b6af4e0416e05265251abb697a07340bbb12eb75ec4f92caef02a43b5bf60a  uclited
13ed1ddea2c7b66a1039d55a72f68bd63f05c328e33599816d48d53dadc6c686  uclited-patched

Then I run

# xxd -g4 -l8 -s860772 uclited-patched
# ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@{devie-ip} "dd of=/tmp/uclited" < uclited-patched
# ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@{devie-ip} "dd of=/tmp/upgrade.bin" < openwrt-ath79-generic-tplink_eap245-v1-squashfs-factory.bin

In the 'telnet'-tab I run

# chmod +x /tmp/uclited && /tmp/uclited -u

giving the following output:

Begin Debug Mode Fireware Upgrade
Upgrade fireware size is 5267795 bytes
Upgrade fireware md5 checksum is correct!
Process 13868 Catch signal 11: 
  code = 1      errno = 0
Dump regs:
   pc: 76fca76c  
 zero: 00000000     at: 00cc9a5a     v0: 7ff72278     v1: 00000000  
   a0: 7ff72278     a1: 00000000     a2: 00000014     a3: 00000a40  
   t0: 00000014     t1: 00000000     t2: 00000001     t3: 00566383  
   t4: fffffffe     t5: 00000001     t6: 00000000     t7: 00000400  
   s0: 7ff72278     s1: 00000003     s2: 00000020     s3: 00000030  
   s4: 0057aaac     s5: 007acca0     s6: 00000005     s7: 007acca0  
   t8: 00000010     t9: 76fca720     k0: 0a0a0a0a     k1: 00000000  
   gp: 005b2d20     sp: 7ff72240  fp/s8: 00000003     ra: 004c06c0  
Dump mem stack: 
 (STACK: 0x7ff53000 ~ 0x7ff74000 SP: 0x7ff72240)
 0x7ff72240: 00000000 00000000 00000000 00000000 005b2d20 00000000 00000000 004c5f24 
 0x7ff72260: 00000000 00000000 00000000 00000000 005b2d20 00000000 00000000 00000000 
 0x7ff72280: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 
 0x7ff722a0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 
 0x7ff722c0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 
 0x7ff722e0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 
 0x7ff72300: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 
 0x7ff72320: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 
 0x7ff72340: ......
Dump call stack:
  #00  pc 0002d76c  /lib/libuClibc-0.9.30.so (memcpy+76)
  #01  pc 000c06b8  /tmp/uclited (ucCluster_getCfg+40)
  #02  pc 000c5f1c  /tmp/uclited (swIsClusterMode+64)
  #03  pc 000d1b0c  /tmp/uclited (nm_checkUpdateContent+668)
  #04  pc 000d2354  /tmp/uclited (nm_buildUpgradeStruct+1268)
  #05  pc 00138428  /tmp/uclited (uclite_upgrade_debug+520)
  #06  pc 001386e4  /tmp/uclited (main+276)
  #07  pc 0004f858  /lib/libuClibc-0.9.30.so (__uClibc_main+600)
Exiting...

When I rerun it, the output is:

Begin Debug Mode Fireware Upgrade
Upgrade fireware size is 5267795 bytes
Upgrade fireware md5 checksum is not correct!

The same has been reported by Knogle.

Does anyone have any idea on how to circumvent this?