Now I tried to use EAP245 v1 firmware on my EAP225 v1 device.
Since I'm quite new to OpenWrt (I have only one device, a TL-WDR4300, running OpenWrt), let me state exactly which steps I took. Mayby I made a mistake somewhere.
Or it is just not possible to upgrade a EAP225 v1 device with EAP245 v1 firmware.
First of all I gain access to the device by changing the username into ;/usr/sbin/telnetd -l/bin/sh&
and changing it back to admin directly after that.
I confirm access by typing
# telnet {device-ip}
into a terminal.
Then I change properties of /tmp
by
# chmod 777 /tmp
In another terminal tab I put
# ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@{devie-ip} "dd if=/usr/bin/uclited" > uclited
and the password I used when changing the username of the device.
Then,
# cp uclited uclited-patched
# echo "000d2264: 24020000 00000000" | xxd -r - uclited-patched
The command
# sha256sum uclited*
gives this output:
d7b6af4e0416e05265251abb697a07340bbb12eb75ec4f92caef02a43b5bf60a uclited
13ed1ddea2c7b66a1039d55a72f68bd63f05c328e33599816d48d53dadc6c686 uclited-patched
Then I run
# xxd -g4 -l8 -s860772 uclited-patched
# ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@{devie-ip} "dd of=/tmp/uclited" < uclited-patched
# ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@{devie-ip} "dd of=/tmp/upgrade.bin" < openwrt-ath79-generic-tplink_eap245-v1-squashfs-factory.bin
In the 'telnet'-tab I run
# chmod +x /tmp/uclited && /tmp/uclited -u
giving the following output:
Begin Debug Mode Fireware Upgrade
Upgrade fireware size is 5267795 bytes
Upgrade fireware md5 checksum is correct!
Process 13868 Catch signal 11:
code = 1 errno = 0
Dump regs:
pc: 76fca76c
zero: 00000000 at: 00cc9a5a v0: 7ff72278 v1: 00000000
a0: 7ff72278 a1: 00000000 a2: 00000014 a3: 00000a40
t0: 00000014 t1: 00000000 t2: 00000001 t3: 00566383
t4: fffffffe t5: 00000001 t6: 00000000 t7: 00000400
s0: 7ff72278 s1: 00000003 s2: 00000020 s3: 00000030
s4: 0057aaac s5: 007acca0 s6: 00000005 s7: 007acca0
t8: 00000010 t9: 76fca720 k0: 0a0a0a0a k1: 00000000
gp: 005b2d20 sp: 7ff72240 fp/s8: 00000003 ra: 004c06c0
Dump mem stack:
(STACK: 0x7ff53000 ~ 0x7ff74000 SP: 0x7ff72240)
0x7ff72240: 00000000 00000000 00000000 00000000 005b2d20 00000000 00000000 004c5f24
0x7ff72260: 00000000 00000000 00000000 00000000 005b2d20 00000000 00000000 00000000
0x7ff72280: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0x7ff722a0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0x7ff722c0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0x7ff722e0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0x7ff72300: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0x7ff72320: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0x7ff72340: ......
Dump call stack:
#00 pc 0002d76c /lib/libuClibc-0.9.30.so (memcpy+76)
#01 pc 000c06b8 /tmp/uclited (ucCluster_getCfg+40)
#02 pc 000c5f1c /tmp/uclited (swIsClusterMode+64)
#03 pc 000d1b0c /tmp/uclited (nm_checkUpdateContent+668)
#04 pc 000d2354 /tmp/uclited (nm_buildUpgradeStruct+1268)
#05 pc 00138428 /tmp/uclited (uclite_upgrade_debug+520)
#06 pc 001386e4 /tmp/uclited (main+276)
#07 pc 0004f858 /lib/libuClibc-0.9.30.so (__uClibc_main+600)
Exiting...
When I rerun it, the output is:
Begin Debug Mode Fireware Upgrade
Upgrade fireware size is 5267795 bytes
Upgrade fireware md5 checksum is not correct!
The same has been reported by Knogle.
Does anyone have any idea on how to circumvent this?