Help in unbricking TP-Link Archer C60 V3

Yes I opened the bin file and there is a section: {product_name:Archer C60,product_ver:3.0.0,special_id:45550000} ) <?xml version="1.0" encoding="utf-8"?>
But if I change that version number from 1.0 to 3.1 the checksum fails :frowning:

It's a shame nobody else has been able to offer help, what if you try the very first firmware?

https://static.tp-link.com/2019/201902/20190219/Archer%20C60(EU)_V3.0_190115.zip

Thanks, I think I have, but I'll give it a try, again!

Seems to be difficult to go back to C60 v3 stock firmware:

When I wrote support for the C60 v3, I also found that flashing vendor images via TFTP is not possible.
However, using OpenWrt factory images with TFTP worked for me. I documented that in the commit message here:

Since I did not have a serial console back then, it's quite interesting what you revealed here. So, as I suspected, it looks like TP-Link actually messed something up with their image or u-boot ...

Hi!

Is this log available without a serial connection?

I tried both (EU and US), but no success.

In my specific case, things are a little worse, because there's no proper firmware for the Brazilian version yet:

Ok I've tried (re) re-flashing OpenWrt for the Archer V3 (http://downloads.openwrt.org/releases/19.07.2/targets/ath79/generic/openwrt-19.07.2-ath79-generic-tplink_archer-c60-v2-squashfs-factory.bin) but no success, herewith error just for completion:

TFTP from server 192.168.0.66; our IP address is 192.168.0.86
Filename 'tp_recovery.bin'.
Load address: 0x80800000
Loading: #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #####
done
Bytes transferred = 4684496 (477ad0 hex)
Firmware recovery: FLASH_SIZE = 8 filesize = 0x477ad0.
Reading Partition Table from NVRAM ... OK

Parsing Partition Table ... OK

File Length:4684496
fw type name : .
Firmware process common.

Image verify OK!

Firmware file Verify ok!

[Error]sysmgr_proinfo_buildStruct():  647 @ unknown id(device_name), skip it.
[Error]sysmgr_proinfo_buildStruct():  540 @ should be 2 args (1).
[Error]sysmgr_cfg_checkSupportList():  990 @ 2.0.0 NOT Match.

[Error]sysmgr_cfg_checkSupportList():  990 @ 2.0.0 NOT Match.

[Error]sysmgr_cfg_checkSupportList():  990 @ 2.0.0 NOT Match.

Firmwave not supports, check failed.

[NM_Error](nm_checkUpdateContent) 01172: the firmware is not for this model

[NM_Error](nm_buildUpgradeStruct) 01274: checkUpdateContent failed.

Firmware Invalid!ÿ

U-Boot 1.1.4-gd490e1c1-dirty (Aug 21 2019 - 18:44:04)

ap151 - Dragonfly 1.0

DRAM:  64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 402k for U-Boot at: 83f98000
Reserving 32832k for malloc() at: 81f88000
Reserving 44 Bytes for Board Info at: 81f87fd4
Reserving 36 Bytes for Global Data at: 81f87fb0
Reserving 128k for boot params() at: 81f67fb0
Stack Pointer at: 81f67f98
Now running in RAM - U-Boot at: 83f98000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200 
Dragonfly----> S27 PHY *
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :50
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :50
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :50
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :50
eth1 up
eth0, eth1
Setting 0x181162c0 to 0x82
Reading Partition Table from NVRAM ... OK

Parsing Partition Table ... OK

factory boot check integer ok.

load fs uboot at 0x10000.
Autobooting in 1 seconds
## Starting application at 0x80010000 ...


U-Boot 1.1.4-gd490e1c1-dirty (Aug 21 2019 - 18:43:52)

ap151 - Dragonfly 1.0

DRAM:  64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 120k for U-Boot at: 83fe0000
Reserving 32832k for malloc() at: 81fd0000
Reserving 44 Bytes for Board Info at: 81fcffd4
Reserving 36 Bytes for Global Data at: 81fcffb0
Reserving 128k for boot params() at: 81faffb0
Stack Pointer at: 81faff98
Now running in RAM - U-Boot at: 83fe0000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200 
Dragonfly----> S27 PHY *
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :50
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
eth1 up
eth0, eth1
Setting 0x181162c0 to 0x82
Hit any key to stop autoboot:  0 
## Booting image at 9f030000 ...
Bad Magic Number
ath> 

So I think I'm stuck with this router. I've purchased Archer C7 and it works really well, but I'm not going to risk it again :slight_smile:

I'll check back in a few months and see if there's new stock or openwrt firmware available.

Thanks for everybody's help, it's really comforting!

Regards,
Hein

Seems Image version 19.07.3 is released for this device (V3)
Check it out
https://downloads.openwrt.org/releases/19.07.3/targets/ath79/generic/

friend, the same thing happened to me. my device and Archerc60 v3 (BR)
I tried to install the (EU) version. was in the same boat as you. the solution was to reinstall the version provided by friend @JamesT42 (Archer C60 v3 - is possible to install OpenWrt firmware?), because the version (BR) is not yet available. I followed the steps:

  1. connect serial and type "tpl" in the putty;

  2. configure your ip at 192.168.1.100;

  3. setenv ipaddr 192.168.1.111
    setenv serverip 192.168.1.100

  4. open tftp, add the downloaded firmware with the name "firm.bin" in the current directory location (default location)

  5. tftpboot 0x81000000 firm.bin

  6. erase 0x9f030000 +0x4400b2

  7. cp.b 0x81000000 0x9f030000 0x4400b2

  8. reset

ready, the router will restart and then configure your ip in automatic and go to page 192.168.1.1

1 Like

(curFw_ver, newFw_ver) == (3.0, 1.0)

Is is possible that TP-Link just put the wrong version string into their firmware?

Yes, unbelievable:

C60 v3:

soft_ver:1.0.0 Build 20190115 rel.57239
fw_id:2FEE9F99CEC156429C9861FB268A71E2
SupportList:
{product_name:Archer C60,product_ver:3.0.0,special_id:00000000}
{product_name:Archer C60,product_ver:3.0.0,special_id:45550000}

C60v2:

soft_ver:2.0.0 Build 20161206 rel.60287
fw_id:9B5A36C5BF02AFEAFF5491BE7BACFED3
SupportList:
{product_name:Archer C60,product_ver:2.0.0,special_id:00000000}
{product_name:Archer C60,product_ver:2.0.0,special_id:45550000}

Out of curiosity, I've replaced the string and managed to recalculate the checksum based on the OEM v3 (EU) image. The result is uploaded here:
https://www.adrianschmutzler.net/upload/c60v3final.zip

Can somebody please verify whether this can be flashed via TFTP, I don't own the device anymore.

3 Likes

yea i''m doing it right now
will inform you about the results soon :smile:

1 Like

here are the results bro it works flawless and one more thing i cant link mt tp link id for some reasons ::slight_smile:

@adrianschmutzler Nice! For some reasons I still can't revert back to the original fw, possibly because I have the american model. Do you think you could apply the same patch for the US version available at https://www.tp-link.com/mx/support/download/archer-c60/#Firmware ?

Thank you!

You may try this one:
https://www.adrianschmutzler.net/upload/c60v3usfinal.zip

However, please note:

  • The US image is 260 kB smaller than the EU image, so the device might have different partitioning (didn't check).
  • The firmware had soft_ver 1.0.1 (compared to 1.0.0 for the EU version), so I changed to 3.0.1 (instead of 3.0.0 for the EU version). This might become a problem when flashing OpenWrt again.
1 Like

It worked, I am back on the stock firmware! That's genius, thank you so much!!!

Some notes:

  • maybe part of the size difference is due to the languages that are supported;
  • i'm able to go to back and forth between openwrt and the stock firmware;
  • by reading the source code of openwrt, I was able to understand how to fix the chksum. I applied the same fix to the CA version of the firmware hoping to get the North American radio regulations with a web UI in French. In the end the French is not available but I'm now running a more current version 3.1.0:

In case someone is interested in the CA version: http://dl.free.fr/j3bQ8Ifmi

Update: WARNING: Actually after some tests it looks like I'm not able to install openwrt after having upgraded to the CA version. *** Use at your own risk ***

Hello, could you update RU version too?

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.