Help Needed: Bricked TP-Link RE650v2 After OpenWrt Flash via Web Interface

Installing and Using OpenWrt
1

Hi all,

I’m hoping to get some help with a TP-Link RE650v2 WiFi range extender that I believe has been bricked after attempting to flash OpenWrt v23.05.4. I performed the flash using the web interface over WiFi.

Current Device Behavior:

  • After powering on, the power LED is solid blue, and all other LEDs remain off.
  • The device no longer broadcasts a SSID.
  • When I attempt to connect the extender to my home network using WPS, the power LED starts flashing, but eventually goes solid blue again without any success in pairing.

Recovery Attempts:

  • I've tried a hard reset and WPS pairing, but the device remains unresponsive and doesn’t broadcast any SSID.
  • I haven't tried any serial connection or TFTP recovery yet, as I'm hoping to find an easier fix.

Additional Info:

  • Device: TP-Link RE650v2
  • Flash Method: Web interface over WiFi
  • SPI chip: W25Q64JV – I’ve dumped the contents of the 8MB chip in case this is helpful for troubleshooting or recovery.
  • Goal: Ideally, I’d like to recover the device to OpenWrt, but restoring the stock firmware would be great too.

SPI Chip Dump: https://drive.google.com/file/d/1eVej5f9MpGM5ncuCCb3dPN7t1gpXH0wD/view?usp=drivesdk

I would really appreciate any guidance on how to unbrick the device, or if there are any recovery methods I can try next.

Thank you so much for your help and time!

2

Why did you assume, the device is bricked, besides this?

Did you try to connect to it via LAN?

3

this is kind of normal, post flash.

4

Check which file you uploaded via web interface. SPI chip starts with uboot, should be possible to tftp-boot or recover to OEM image.

5

I began to suspect the device was bricked once I noticed the power LED flashing, as this supposedly indicates some sort of boot failure or recovery mode.

I have not yet attempted to connect to the device via the RJ45 connector, but will attempt this later today. Are there any particular instructions on how to perform a recovery or firmware re-flash via this LAN connection?

6

I initially thought the same and was wondering if the device was taking a long time to initialise (30+ minutes). However, after failing to connect to my wireless network via WPS and noticing the flashing power LED, I began to believe the device was bricked.

7

The file uploaded using the web interface was openwrt-23.05.4-ramips-mt7621-tplink_re650-v2-squashfs-factory.bin.

As I have not performed this procedure before, are there any good guides or tutorials I can follow with regards to using TFTP to recover my specific model of WiFi range extender?

8

Just an update:

I have attempted to connect the RE650 v2 to my computer via LAN. Following a generic set of instructions online, I set the IP address of my Ethernet port to 192.168.0.66 and attempted to communicate with the device using TFTPD64. Unfortunately, despite all combinations of holding the reset button and powering on the device, I cannot seem to establish a connection.

As it stands, the only sign of life is that Windows reports some sort of communication with the RE650 v2 in the form of sending and receiving some form of data as visible within the "Ethernet Status" window.

I have included a screenshot from my computer in case this proves useful.

Ethernet_Status
Ethernet_Status541×652 21.6 KB

9

For the sake of completion, here are the relevant ethernet connection details as reported by Windows.

Network_Connection_Details
Network_Connection_Details544×672 23.1 KB

10

Another Update:

I attempted to establish a serial connection with the device using these specifications:

  • Baud Rate: 57,600
  • Data Bits: 8
  • Stop Bits: 1
  • Parity: None

Unfortunately, I cannot see any output on my serial monitor. I have checked the quality of my connections with a multimeter and ensured my serial to USB adapter works. I have also tried using several other common Baud rates.

I am now completely out of ideas short of flashing the SPI chip with someone else's dump, but I cannot seem to find a dump of a working RE650v2 anywhere online.

Serial
Serial1536×2048 367 KB

11

You can get one from tplink, all caldata are by the end of flash while fw update starts from or after bootloader.

12

Hi @brada4,

Thanks so much for your response.

Would you be willing to guide me through how to perform this? I downloaded the official TP-Link firmware file for the device, but it looks completely different within a hex editor when compared with the SPI chip binary dump I performed earlier. The file sizes also do not match.

I am very new to this and am not sure how to process the official firmware binary into a format for SPI chip reflashing.

Thanks!

13

I did not read much though. If web recovery is present it should be reachable booting with button pressed or powering off 3 or 5 times during first 10s of boot.

If there is tftp loader then you need to capture traffic and set up tftp server according to the requests coming out of router with tplink firmware.
"new logo" is called "safeloader" in these parts - OEM firmware and OpenWRT factory has an info block upfront the flash image describing supported platforms, and the OEM menus check that you dont flash incompatible image.

14

Unfortunately, I was unable to resolve this issue and ultimately purchased a new AC2600 RE650 v2.

To assist anyone who might face a similar situation in the future, I dumped the contents of the SPI chip from the new device before powering it on for the first time, ensuring a "clean factory-default" image was captured.

You can download the dump here.

Thank you all for your efforts!