EAP245 V3 bricked

[bkdwt]

Hello guys! I tried the last snapshot on my EAP245 V3, but the firmware is bugged with slow 5GHz speeds, so I tried to revert to original firmware from Tplink using uploading via Luci GUI with -f option.

Now my EAP245 are bricked but I get the green light, but I can't get acess. I don't have a computer for now, only my S9+ with a hub and using a RJ45 cable.

Any ideas on how to reverse this without using a serial port? Thanks in advance!

[lleachii]

@bkdwt

I don't have a computer

@bkdwt

without using a serial port

Is this a trick question?

Your device page says no:

https://openwrt.org/toh/tp-link/tp-link_eap245_v3#debricking

...and TFTP information (if any) is missing.

@bkdwt

only my S9+ with a hub and using a RJ45 cable

So to be clear, this means you only have a mobile device...with wired Ethernet?

@bkdwt

Any ideas on how to reverse this without using a serial port?

Actually, I assume it's because you think it's difficult or because you don't have a serial cable; but be advised, the serial port is semi-disabled from the factory anyway:

@ted_plum

On the underside of the board, there's a unpopulated R225 resistor that was able to connect to to get 115200 baud 8n1 UART output. I need to bridge solder it, but it at least works by holding a jumper wire against it.

I would advice booting the device while holding the reset button and running software such as Wireshark. This is to see if the device is making some kind of TFTP request.

[bkdwt]

@lleachii

So to be clear, this means you only have a mobile device...with wired Ethernet?

Yes

@lleachii

Actually, I assume it's because you think it's difficult or because you don't have a serial cable; but be advised, the serial port is semi-disabled from the factory anyway:

I don't have a serial cable

@lleachii

I would advice booting the device while holding the reset button and running software such as Wireshark. This is to see if the device is making some kind of TFTP request.

Many thanks! I'll try to get a laptop to try this.

[svanheule]

If you flashed TP-Link's firmware image as is, you've got a soft-brick now. Their firmware image uses a custom format, and cannot be written directly to flash (which is what sysupgrade does). You would need to build tplink-safeloader from the OpenWrt sources to convert a TP-Link firmware file into a valid OpenWrt firmware file.

@lleachii

I would advice booting the device while holding the reset button and running software such as Wireshark. This is to see if the device is making some kind of TFTP request.

I'm not entirely sure anymore, but I think this device will launch a failsafe web server at the default address (192.168.1.1) if it fails to boot. This failsafe page should accept TP-Link images.

Adding OpenWrt support for TP-Link EAP245

The HTTP recovery can be started from the first bootloader. Interrupt by holding CTRL+B on boot and then run httpd (so you need to solder to access the serial port). They messed up their units when calling usleep (both in the v1 and v3), so instead of waiting 2s, it only waits for 200ms... There's also the fwrecon command. It's possible this can be called either directly, or is used by the httpd after uploading a firmware. This command's code seems to indicate that it does in fact perform a fi…

Adding OpenWrt support for TP-Link EAP245

I'm hoping someone can help. I've got myself in a bit of a "bad place" with my EAP245 v3... I loaded up OpenWRT. Then something happened and the unit will not boot cleanly anymore. I tried the reset button and having it pull the TP-Link firmware via tftp. I tried loading the TP-Link Firmware via the Recovery Web Interface (will not take). I can Ctrl-B and then boot OpenWrt with the "bootelf 0x9f0c0000" command. I have access via UART port to the console. Boot shows me this and goes directly t…

[bkdwt]

Ok. Tried with TFTP but no luck. I don't get any signal from EAP.

Wireshark only gives me a 169.XXX.XXX.XXX IP from EAP. I think the way will be to contact TP-Link and explain the situation.

[bkdwt]

I contacted Tp Link support, but it doesn't help at all. So, what serial cable you guys recommend? I think this is the only option now.

[frollic]

https://www.amazon.com/gp/product/B07WX2DSVB/ worked well for me.

[bkdwt]

Thanks! I'll see if a get this on Aliexpress on here in Brazil.

[bkdwt]

Good news, my friends! Finally I was able to send the original Tplink firmware via tftp by configuring the network card with IP 192.168.1.100.

Now I waiting to the led change from light green to dark green. For now, no wireless network from EAP.

EDIT: ok, ping for 192.168.1.1 works and now I get the page for send the firmware via browser on 192.168.1.1.

EDIT2: ok, send two times the firmware via failsafe web server but for some reason the device doesn't reboot and still in failsafe mode, even with "firmware upgrade success".

I'll try again with tftp method.

EDIT3: well, the problem persist with the tftp method. Any advices?

[Stefan1]

Did you use the correct regional firmware version ?

[bkdwt]

Of course

Also, I can't flash the openwrt factory using the tplink failsafe page.

[Stefan1]

Does

@bkdwt

can't flash

mean identical symptoms:

@bkdwt

send two times the firmware via failsafe web server but for some reason the device doesn't reboot and still in failsafe mode, even with "firmware upgrade success".

?

[svanheule]

@bkdwt

Also, I can't flash the openwrt factory using the tplink failsafe page.

It seems likely the failsafe page also does signature verification on the firmware image. The OpenWrt factory image doesn't actually have a valid signature, so this would always fail.

[bkdwt]

When accessing the Tp Link recovery page to flash the factory firmware, after flash nothing happens. Upon restart, the device remains in recovery mode. Still giving me a 169.xx IP.

[bkdwt]

I tried telnet to 192.168.1.1 to disable this, but I can't get into device.

[svanheule]

Telnet isn't normally available on this device, unless you find a way to start it as root (I haven't)

If the IP address of your computer/smartphone is 169.254.x.y address, then this is a link-local address, and is assigned by the operating system itself because there is no DHCP server available. Like you noted earlier, you need to assign yourself another address in the 192.168.1.0/24 subnet to be able to access the failsafe page.

That being said, it is still odd that even the failsafe page fails to restore the device to a working state.

[dlakelan]

@svanheule

That being said, it is still odd that even the failsafe page fails to restore the device to a working state.

The device is an access point with no DHCP server normally. It would not normally be the case that you could connect a laptop and get a dhcp response. After reflashing factory firmware, @bkdwt should follow instructions from factory installation manual to configure the device... Which I think means connecting via wireless! Or at a minimum, setting a static IP and connecting on an appropriate default IP network.

[bkdwt]

Wireless is still unavailable, so that means the device is still in recovery mode. When it was working, I got access to it through IP 192.168.0.254.

[dlakelan]

To get access you will need to static assign your laptop to something like 192.168.0.2 the EAP running tp-link firmware won't provide an ip via DHCP.

[bkdwt]

This doesn't work. I already tried.

The problem is that the device remains inoperative.