EAP330 error Help

Good afternoon, I ask for help from the more experienced, I have 2 TPLINK EAP330 (EU) V1, unfortunately I ended up replacing all flash by accident, even erasing the Uboot, I made a full dump of the other EAP of the same model and version with CH341a recorder and re-recorded it on the other, but the same does not work, follow the boot via serial console:

`U-Boot 2012.10.esdk.7 (Jan 22 2016 - 14:32:15)

 *** Warning - bad CRC, using default environment


arm_clk=800MHz, axi_clk=400MHz, apb_clk=200MHz, arm_periph_clk=400MHz

Hit any key to stop autoboot:  0
## Booting kernel from Legacy Image at 04000000 ...
   Image Name:   Linux-2.6.36.4brcmarm
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1399412 Bytes = 1.3 MiB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK
boot_prep_linux commandline: console=ttyS0,115200n8 mem=256M

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
[    0.000000] Linux version 2.6.36.4brcmarm (root@Sohoilinuxbuild) (gcc version 4.5.3 (Buildroot 2012.02) ) #8 SMP PREEMPT Wed May 18 13:53:26 CST 2016
[    0.000000] CPU: ARMv7 Processor [413fc090] revision 0 (ARMv7), cr=10c53c7f
[    0.000000] CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
[    0.000000] Machine: Northstar Prototype
[    0.000000] Ignoring unrecognised tag 0x00000000
[    0.000000] Memory policy: ECC disabled, Data cache writealloc
[    0.000000] PERCPU: Embedded 7 pages/cpu @c8215000 s4832 r8192 d15648 u65536
[    0.000000] pcpu-alloc: s4832 r8192 d15648 u65536 alloc=16*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 60416
[    0.000000] Kernel command line: root=/dev/mtdblock9 console=ttyS0,115200 rootfstype=squashfs
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Memory: 128MB 128MB = 256MB total
[    0.000000] Memory: 255840k/255840k available, 6304k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     DMA     : 0xf7e00000 - 0xffe00000   ( 128 MB)
[    0.000000]     vmalloc : 0xd0800000 - 0xf0000000   ( 504 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xd0000000   ( 256 MB)
[    0.000000]     modules : 0xbf000000 - 0xc0000000   (  16 MB)
[    0.000000]       .init : 0xc0008000 - 0xc0038000   ( 192 kB)
[    0.000000]       .text : 0xc0038000 - 0xc0356000   (3192 kB)
[    0.000000]       .data : 0xc036c000 - 0xc0395520   ( 166 kB)
[    0.000000] SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000]  RCU-based detection of stalled CPUs is disabled.
[    0.000000]  Verbose stalled-CPUs detection is disabled.
[    0.000000] NR_IRQS:256
[    0.000000] MPCORE GIC init
[    0.000000] MPCORE Global Timer Clock 400000005Hz
[    0.000000] Calibrating delay loop... 1599.07 BogoMIPS (lpj=7995392)
[    0.240000] pid_max: default: 32768 minimum: 301
[    0.240000] Mount-cache hash table entries: 512
[    0.240000] CPU: Testing write buffer coherency: ok
[    0.240000] MPCORE Private timer setup CPU0
[    0.240000] Calibrating local timer... 399.845MHz.
[    0.330000] L310: cache controller enabled 16 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x7a130000
[    0.360000] CPU1: Booted secondary processor
[    0.360000] MPCORE Private timer setup CPU1
[    0.590000] Brought up 2 CPUs
[    0.590000] SMP: Total of 2 processors activated (3194.88 BogoMIPS).
[    0.590000] devtmpfs: initialized
[    0.590000] NET: Registered protocol family 16
[    0.590000] CJ++ get spiflash device id = 0xef18
[    0.590000] Found a ST compatible (Windbond) serial flash with 512 64KB blocks; total size 16MB
[    0.590000] Found the UID
[    0.610000] CCA UART Clock Config: Sel=1 Ovr=0 Div=2
[    0.610000] CCA UART Clock rate 50000000Hz
[    0.610000] bio: create slab <bio-0> at 0
[    0.610000] SCSI subsystem initialized
[    0.610000] Switching to clocksource mpcore_gtimer
[    0.610000] NET: Registered protocol family 2
[    0.610000] IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.610000] TCP established hash table entries: 8192 (order: 4, 65536 bytes)
[    0.610000] TCP bind hash table entries: 8192 (order: 4, 98304 bytes)
[    0.610000] TCP: Hash tables configured (established 8192 bind 8192)
[    0.610000] TCP reno registered
[    0.610000] UDP hash table entries: 128 (order: 0, 4096 bytes)
[    0.610000] UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
[    0.610000] NET: Registered protocol family 1
[    0.610000] PCI: no core
[    0.610000] PCI: no core
[    0.610000] PCI: scanning bus 0
[    0.610000] PCI: Fixing up bus 0
[    0.860000] PCIE1 link=1
[    0.860000] Force PCIE RC to GEN1 only
[    0.860000] PCI: Fixing up bus 0
[    0.860000] PCI: bus0: Fast back to back transfers disabled
[    0.860000] PCI: Fixing up bus 1
[    0.860000] PCI: bus1: Fast back to back transfers disabled
[    0.860000] pci 0001:00:00.0: BAR 8: assigned [mem 0x08000000-0x080fffff]
[    0.860000] pci 0001:01:00.0: BAR 0: assigned [mem 0x08000000-0x08007fff 64bit]
[    0.860000] pci 0001:01:00.0: BAR 0: set to [mem 0x08000000-0x08007fff 64bit] (PCI address [0x8000000-0x8007fff]
[    0.860000] pci 0001:00:00.0: PCI bridge to [bus 01-01]
[    0.860000] pci 0001:00:00.0:   bridge window [io  disabled]
[    0.860000] pci 0001:00:00.0:   bridge window [mem 0x08000000-0x080fffff]
[    0.860000] pci 0001:00:00.0:   bridge window [mem pref disabled]
[    1.110000] PCIE2 link=1
[    1.110000] Force PCIE RC to GEN1 only
[    1.110000] PCI: Fixing up bus 0
[    1.110000] PCI: bus0: Fast back to back transfers disabled
[    1.110000] PCI: Fixing up bus 2
[    1.110000] PCI: bus2: Fast back to back transfers disabled
[    1.110000] pci 0002:00:00.0: BAR 8: assigned [mem 0x40000000-0x400fffff]
[    1.110000] pci 0002:02:00.0: BAR 0: assigned [mem 0x40000000-0x40007fff 64bit]
[    1.110000] pci 0002:02:00.0: BAR 0: set to [mem 0x40000000-0x40007fff 64bit] (PCI address [0x40000000-0x40007fff]
[    1.110000] pci 0002:00:00.0: PCI bridge to [bus 02-02]
[    1.110000] pci 0002:00:00.0:   bridge window [io  disabled]
[    1.110000] pci 0002:00:00.0:   bridge window [mem 0x40000000-0x400fffff]
[    1.110000] pci 0002:00:00.0:   bridge window [mem pref disabled]
[    1.360000] PCIE3 link=0
[    1.370000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.370000] JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[    1.370000] msgmni has been set to 499
[    1.370000] io scheduler noop registered
[    1.370000] io scheduler deadline registered (default)
[    1.370000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.370000] serial8250.0: ttyS0 at MMIO 0x18000300 (irq = 117) is a 16550
[    1.910000] console [ttyS0] enabled
[    1.910000] serial8250.0: ttyS1 at MMIO 0x18000400 (irq = 117) is a 16550
[    1.920000] loop: module loaded
[    1.920000] pflash: found no supported devices
[    1.930000] Creating 14 MTD partitions on "bcmsflash":
[    1.930000] 0x000000000000-0x000000100000 : "uboot"
[    1.940000] 0x000000100000-0x000000140000 : "uboot-param"
[    1.940000] 0x000000140000-0x000000141000 : "default-mac"
[    1.950000] 0x000000141000-0x000000143000 : "partition-table"
[    1.960000] 0x000000143000-0x000000144000 : "product-info"
[    1.960000] 0x000000144000-0x000000145000 : "support-list"
[    1.970000] 0x000000146000-0x000000147000 : "soft-version"
[    1.980000] 0x000000147000-0x00000014a000 : "config-tp"
[    1.980000] 0x000000150000-0x000000350000 : "kernel"
[    1.990000] 0x000000350000-0x000000550000 : "rootfs"
[    1.990000] 0x000000550000-0x000000d50000 : "app"
[    2.000000] 0x000000d50000-0x000000f50000 : "jffs2"
[    2.000000] 0x000000f50000-0x000000f70000 : "oops"
[    2.010000] 0x000000ff0000-0x000001000000 : "nvram"
[    2.020000] bcmsflash_mtd_init: call mtdram_setup
[    2.020000] mtdram_setup: mtd_ram_addr = 0x00000000, mtd_ram_size = 0, mtd_where = 2, mtd_result = -1
[    2.030000] bcmsflash_mtd_init: call mtdram_setup over
[    2.040000] bcm_flash_chrdev_init: flash device create,ret :0
[    2.040000] nflash: found no supported devices
[    2.050000] PPP generic driver version 2.4.2
[    2.050000] NET: Registered protocol family 24
[    2.050000] Netfilter messages via NETLINK v0.30.
[    2.060000] nf_conntrack version 0.5.0 (3997 buckets, 15988 max)
[    2.070000] ctnetlink v0.93: registering with nfnetlink.
[    2.070000] xt_time: kernel timezone is -0000
[    2.080000] TCP cubic registered
[    2.080000] NET: Registered protocol family 17
[    2.080000] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
[    2.090000] All bugs added by David S. Miller <davem@redhat.com>
[    2.110000] VFS: Mounted root (squashfs filesystem) readonly on device 31:9.
[    2.120000] devtmpfs: mounted
[    2.130000] Freeing init memory: 192K
/etc/init.d/rcS: line 26: /etc/init.d/S20urandom: Permission denied
/etc/init.d/rcS: line 26: /etc/init.d/S40network: Permission denied
[monitor] DUT already calibrated!
[    3.270000] ip_tables: (C) 2000-2006 Netfilter Core Team
[    8.310000] ctf: module license 'Proprietary' taints kernel.
[    8.320000] Disabling lock debugging due to kernel taint
[    8.390000] et_module_init: passivemode set to 0x0
[    8.400000] et_module_init: txworkq set to 0x0
[    8.400000] et_module_init: et_txq_thresh set to 0x400
[    8.440000] eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.14.105 (r485445)
[   10.160000] wl_module_init: passivemode set to 0x0
[   10.160000] wl_module_init: txworkq set to 0x0
[   10.210000] wlc_exclude_chans_attach(172)
[   10.210000] eth1: Broadcom BCM4360 802.11 Wireless Controller 6.37.14.105_e1.4.1 (r485445)
[   10.220000] PCI: Enabling device 0002:02:00.0 (0140 -> 0142)
[   10.260000] wlc_exclude_chans_attach(172)
[   10.270000] eth2: Broadcom BCM4360 802.11 Wireless Controller 6.37.14.105_e1.4.1 (r485445)
[   10.280000] mtdoops: Attached to MTD device 12
[   10.440000] ---portal module open ok
[monitor] start process scm 268
[scm] info: 2 core core 1 0
[scm] info: 3 cli_server cli_server 2 0
[scm] info: 4 httpd httpd 3 0
[scm] info: 5 gpioCtl gpioCtl 4 0
[scm] info: 6 tpsyslogd tpsyslogd 5 0
[scm] info: 7 eapcs eapcs 6 0
[scm] info: start app [core] core
[monitor] info: recv MSG_SCM_STARTUP core
[monitor] start process core 316
[scm] info: recv the process [core] MSG_APP_STARTUP_OK
[scm] info: start app [cli_server] cli_server
setCpuAffinity:success
[core] Enter normal mode!
partition name :uboot.
partition name :uboot-param.
partition name :default-mac.
partition name :partition-table.
partition name :product-info.
partition name :support-list.
partition name :soft-version.
partition name :config-tp.
partition name :os-image.
partition name :rootfs.
partition name :app.
partition name :jffs2.
partition name :radio.
Product-info region code:0, name:.
Flash region info, code: 276, name: EU.
[monitor] info: recv MSG_SCM_STARTUP cli_server
[monitor] start process cli_server 316
[netif]sys init ok ...
Get l_ifname_hash = 0x1ae3d28
Get l_alias_hash = 0x1ae4d48
ifname: lo
alias: Loopback0
ifname: eth0
alias: gigabitEthernet 1/0/1
ifname: dpsta
!!!Convert ifname to alias failed, copy ifname!!!
alias: dpsta
ifname: eth1
alias: gigabitEthernet 1/0/2
ifname: eth2
alias: gigabitEthernet 1/0/3
[netif]netif start init ok ...
[netif[   12.980000] device eth0.1 entered promiscuous mode
]vl[   12.990000] device eth0 entered promiscuous mode
an sta[   12.990000] br1: port 1(eth0.1) entering learning state
rt [   13.000000] br1: port 1(eth0.1) entering learning state
init ok ...
[netif]ucNetif start init ok ...
ifname: eth0.1
alias: gigabitEthernet 1/0/1-1
ifname: br1
alias: Vlan-interface1
setCpuAffinity:success
[scm] info: recv the process [cli_server] MSG_APP_STARTUP_OK
[scm] info: start app [httpd] httpd


raThread pid(322) tid(74826) created.

<radius>[debug]_radius_entryThread(): 515  -> Enter _radius_entryThread.!!!!!!!!!
<radius>[debug]_radius_init(): 487  -> Enter _radius_init.!!!!!!!!!
<tddp>[debug]swTddpdInit(): 942  -> init tddp

<tddp>[debug]createUdpSock(): 270  -> TDDP: Now listening client request.

0x00000088
0x00000088
0x00000088
0x00000088
0x00000088
0x00000088
0x00000088
0x00000088
[monitor] info: recv MSG_SCM_STARTUP httpd
[monitor] start process httpd 316
Restoring defaults...setCpuAffinity:success
[scm] info: recv the process [httpd] MSG_APP_STARTUP_OK
[scm] info: start app [gpioCtl] gpioCtl
killall: acsd: no process killed
[monitor] info: recv MSG_SCM_STARTUP gpioCtl
[monitor] start process gpioCtl 316
setCpuAffinity:success
acsd: scan in progress ...
usrWebInit
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
[scm] info: recv the process [gpioCtl] MSG_APP_STARTUP_OK
[scm] info: start app [tpsyslogd] tpsyslogd
acsd: scan in progress ...
[monitor] info: recv MSG_SCM_STARTUP tpsyslogd
[monitor] start process tpsyslogd 316
setCpuAffinity:success
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...


ERROR in TAKING MUTEX pid=727 ppid=659 usec=0

acsd: scan in progress ...
acsd: selected channel spec: 0x1001
acsd: Adjusted channel spec: 0x1001
acsd: selected DFS-exit channel spec: 0x1001
acsd: selected channel spec: 0x1001
acsd: Adjusted channel spec: 0x1001
acsd: selected channel spec: 0x1001
acsd: cleanup socket and memory
acsd: exit acsd
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
[scm] info: recv the process [tpsyslogd] MSG_APP_STARTUP_OK
[scm] info: start app [eapcs] eapcs
acsd: selected channel spec: 0xe02a
acsd: Adjusted channel spec: 0xe32a
acsd: selected DFS-exit channel spec: 0xe32a
acsd: selected channel spec: 0xe02a
acsd: Adjusted channel spec: 0xe32a
acsd: selected channel spec: 0xe32a
acsd: scan in progress ...
[monitor] info: recv MSG_SCM_STARTUP eapcs
[monitor] start process eapcs 316
setCpuAffinity:success
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: selected channel spec: 0x1001
acsd: Adjusted channel spec: 0x1001
acsd: selected DFS-exit channel spec: 0x1001
acsd: selected channel spec: 0x1001
acsd: Adjusted channel spec: 0x1001
acsd: selected channel spec: 0x1001
Rsa verify fail.
tddp check uid:
d3 65 20 74 13 1e 2c 33
tddp check public key :
42 67 49 41 41 41 43 6b 41 41 42 53 55 30 45 78 41 41 51 41 41 41 45 41 41 51 44 7a 79 65 57 43 70 55 70 74 63 53 49 72 33 57 75 6b 36 6a 33 77 45 79 47 4c 62 43 61 6c 42 31 32 37 47 65 33 31 35 64 66 69 77 41 56 38 55 66 65 4d 69 39 6d 33 34 78 61 75 4f 36 32 49 4d 4e 50 53 53 6d 35 62 69 4e 43 68 71 4f 2b 65 44 79 4c 47 32 64 53 6e 64 52 41 2b 42 59 6e 68 36 78 46 59 75 39 74 36 50 6b 78 69 4a 52 76 61 75 6d 77 65 6a 51 77 6f 72 6b 30 6f 68 74 58 75 71 42 43 38 6b 34 79 64 31 48 6c 58 63 73 49 2f 72 7a 76 67 5a 30 65 44 6f 6e 35 6d 64 55 7a 51 36 41 63 30 69 4c 41 33 52 58 44 41 6e 67 3d 3d
tddp check sign:
03 4b f5 2a f0 bc 28 e8 f6 d4 cb 30 e1 51 61 0f c3 7c 39 7b 83 a4 4c 86 6f 94 0c 48 ed 63 54 2b 3c bf e3 ff 62 fa 86 9d 5f 15 63 2c be 7c a6 b8 60 ca 2d 68 37 22 cf e3 34 41 41 5e b2 ef f2 98 ad 3e 00 49 fe 04 8d fc b1 20 6b b7 1b 42 fc a4 7a 84 45 b9 97 c4 5e fb a2 2d 7e e0 5b 65 e7 35 6a be ae da e0 85 96 6f 3a 11 52 52 df 49 9c 16 55 e6 32 85 2c aa b1 3c 93 58 03 80 14 94 46 03
please program the sign
[_rtnl_call 245]sys assert failed: !!!nl_wait_for_ack failed, ret = -19!!!
[swNetif_vlanif_del_addrv4 1114]swNetif assert failed: !!!sys_if_del_addrv4 failed!!!
[scm] info: recv the process [eapcs] MSG_APP_STARTUP_OK
[   28.040000] br1: port 1(eth0.1) entering forwarding state
route: SIOCDELRT: No such process`

You should really ask tplink, it's their firmware.

But since uboot's working, you could try to reflash the device.

Sorry for my english, I've already tried to update the firmware, it's still the same, it seems that there is a certificate error.
I had already done this with some router models, copying all the flash and rewriting the other, including changing the MAC addresses in hexadecimal in the recorder program itself, but even without changing the firmware it does not start.

If you have the whole fw on file, you could try to open it, and disable whatever makes it fail, if it's a service/daemon.

It looks like that is the process that "calls home" to cloud-configure it.

If you just copied the whole flash, the clone unit has the same MAC and possibly other unique identifiers as the other one, and their server is not going to like that. Your network will also not work if you try to run both of them at once with the same MAC.

If your intention is to install OpenWrt, this is not a supported model since it has Broadcom wifi chips that don't have open-source drivers.

1 Like

I realized what happens is a failure to verify the rsa key, but unfortunately I don't know how to solve this, given that I don't have an original full dump of my device, only 2 others that I could make a backup via physical programmer. does anyone have an idea how to revive my router? replacing his original mac and serial addresses? thank you very much for your attention.

well, you could start by comparing the flash dumps for the remaining two.
but if it's a RSA key, it won't do you any good.

Like I said, I'd try to kill whatever is trying to call home during boot, and disable it.

thanks for your attention, unfortunately I don't understand enough to modify the rsa check, and another thing I don't understand is why it doesn't recognize the key if a complete dump of the device was made, with uboot and all the rest, it should boot as a clone of another, it even loads the page, however it does not accept any known login and password.