GL.iNet GL-MT3000 Flash recovery using CH341

Hi everyone,

I have a flash and the boot stops at “system halt!”, so the flash need recovery.

I bought CH341 Programmer but I’ve not used it yet till I u understand in details how it works.

I watched a YouTube video where the CH341 programmer software is used to erase the flash and then the person write an openwrt new image file. and that was it, no boot loader was uploaded to the flash

I wonder why does not he (using CH341) write the bootloader to the flash first then write the openwrt image? Does not CH341 programmer erase the boot loader at the erase step ?

Openwrt usually don't ship with a bootloader, since it's already there.
There are some exceptions though, like x86.

Depends on what you told it to erase ?

He just attached the flash to CH341 then pressed erase. That was it, nothing else!

Then I guess "he" erased it all ?

That was what I guessed too
But erasing it all means he needs to write u-boot first, right?

Yes, but you also need the ART and uboot env partitions, which contains the wifi calibration data and uboot config.

Hope you made a backup before erasing the flash.

I have not started using CH341 programmer yet. and unfortunately I did not backup the flash contents

My router is bricked after upgrade of openwrt, The boot stops at “system halt” message, that was why I bought CH341 programmer

System Halt is a kernel message (usually), can you scroll back to see the actual error message (like: VFS: unable to mount rootfs). If that's the case, then your boot loader is still fine and you shouldn't need a programmer.

Knowing your router model would also help...

Here are all the logs from the UART serial (that is all, nothing else come after "system halt" below):

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 3903 0041
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 102C 0000
F5: 480A 0031
00: 1005 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 3903 0041
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 102C 0000
01: 102A 0001
02: 1005 0000
BP: 2000 00C0 [0001]
EC: 0000 0000 [1000]
T0: 0000 00ED [010F]
System halt!

it happened after I upgraded the image from U-Boot menu, the router is GLiNet MT3000

I do not think it is kernel issue; u-boot is not loading anymore, just above messages appear. any support in this issue is very appreciated.

GL.iNet ships two different images for this model. One is for flashing in the web UI, the other one is for U-Boot.
If you gave U-Boot the wrong one, it's very likely that it blindly overwrote the whole flash, leaving you without bootloader and Wi-Fi calibration data.

Although, depending on the partition layout and what exactly the bootloader does when writing the image, there might be some change to retrieve the calibration data, if it's located at the end of the flash. But that's a big if.

You can probably write U-Boot version of the firmware with CH341, but if the calibration data is lost, wireless will probably never work again.

Oh yes, that's unfortunately not the kernel.

Exactly. Try to flash only U-Boot and leave the rest of the flash as-is. In all cases, do a backup of the whole chip first, maybe you can rescue the calibration area.

1 Like

Thanks for support!
Do you know where I can find the U-Boot image for this router?

I tried to look for it, but I did not find it on GL site or GitHub

I am willing to do so, but I cannot find the right U-Boot image.

On further investigation, it seems that even the U-Boot image does not contain the bootloader:

$ binwalk -b Downloads/openwrt-mt3000-4.2.3-0706-1688622794.img       

0             0x0             UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x800, data offset: 0x1000
264192        0x40800         UBI volume ID header, version: 1, type: 1, volume id: 0, size: 0
266240        0x41000         Flattened device tree, size: 3516099 bytes, version: 17
266472        0x410E8         LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 10502152 bytes
3872376       0x3B1678        Flattened device tree, size: 19057 bytes, version: 17
3888056       0x3B53B8        Unix path: /sys/devices/virtual/thermal/thermal_zone0/temp
3934208       0x3C0800        UBI volume ID header, version: 1, type: 1, volume id: 1, size: 0
3936256       0x3C1000        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 57365943 bytes, 6588 inodes, blocksize: 262144 bytes, created: 2023-07-06 05:09:44
3936366       0x3C106E        xz compressed data

So I can't tell what went wrong during flashing - given this layout of the image, U-Boot obviously didn't expect an bootloader at offset 0x0 (unless you messed around with commands in the serial console).

No idea, maybe their support would be willing to help? You'll most likely need to get help from someone who has a functioning device to try to reconstruct the raw flash image for your device, if it's possible. Since this device is not supported by upstream OpenWrt, we, people on this forum, don't have enough information to assist you in recovery, at least not without full flash dump from a functional device.

Perhaps someone on this forum who has a functional MT3000 can help.
Thank you for your messages in all cases.

Maybe its in factory firmware?

NM, apparently it's supported now.

Can they still use the name OpenWRT if it isn't supported?
because that link I posted links to:

So I can kinda understand the confusion.

Ask the lawyers, but it also depends on the writing.

It is, and it has a snapshot image:

But there are no installation instructions and nobody created a techdata / Wiki page...