EAP225-Wall recovery


Managed to brick a EAP225-Wall by doing a batch upgrade, forgetting that one was "daisy chained" off another using POE, as a result the parent rebooted while the now dead one was upgrading.

Anyway, have manged to get access to it via the console port on the board - soldered a connector to it and have got it to upload tftp files.

when using TFTPBOOT it looks for a file called 0101A8C0.img

I have tried uploading the firmware file from TP-Link but it just comes back with the prompt and the log shows: ## No elf image at address 0x9f040000

I have used binwalk to extract the elf file and uploaded that - same.
it also extracted the Squashfs and gz file - all hve the same effect.

I have tried uploading the files and copying them to the boot memory address and resetting - it goes back to a boot loop.

I am sure I am doing something stupid -

Any thoughts on how to recover?

Much appreciated,


If you have TFTP access, you should be able to download an initramfs:

setenv ipaddr # default, change as required
setenv serverip # default, change as required
tftp 0x80800000 initramfs.bin
bootelf $fileaddr

Be careful when using the serial console of the EAP225-Wall. The PoE power supply isn't isolated, so VCC is actually connected to remote 48V, with floating ground. Ideally, you should use an isolated UART. If you don't have this, be sure not to tie the ground of the PoE power sourcing equipment to the one of your UART. Otherwise you'll end up like me, with a fried device :frowning:

1 Like

Managed to get it back - ended up powering the EAP225-Wal using a POE to power it and a USB UART but did not connect the power so only the RX, TX and GND.

Eventually managed to get an original firmware and extracted the various files using binwalker and then using a linux machine and tplink_safeloader.c (couldn't get it to compile in Windows due to missing repositories so threw up a virtual Unbutu machine and complied/ran it then).

The resulting file uploaded to the EAP225-wall at the correct memory address recovered the unit back to stock!.

one thing I learnt was to not batch upgrade if they are daisy chained using POE!

Thanks for getting back, info around the POE is useful - I just never hooked up the VCC so managed not to blow anything (by luck!),


1 Like

Glad to hear you were able to unbrick your device!

I accidentally created a ground loop over my USB bus, by having the EAP225's UART connected (data lines and ground) on one port, and an internal UART (also only data and ground) of my PoE switch on another port. This caused the PoE 0V to be tied to logic GND in the AP. The moment I plugged the AP in to my switch, VCC in the AP became 48V~54V, and things went boom (at a microscopic level). So I guess there's lesson learned here for everyone :slight_smile:

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.