Help... Ubiquiti Unifi AP bricked when tftp flashing, anyone has a rom dump?

Dear all,
I was messing with my UAP and I tried to upload openwrt image by tftp but when the upload is finished, I tripped on the POE and the power is cut. Now the unit is showing orange led constantly, it does not print anything on the serial port, the unit does not answer to ping or tftp command to 192.168.1.20, in fact when connected to the PC (through poe injector) with a lan cable, the PC sees no cable plugged in, no connection nothing. The reset bottom does not put the device into recovery mode, the unit only stuck with orange light...
I guess the only way to remedy this is to flash the rom with a programmer. I do have the programmer. So I wonder if you guys can share me a copy of the original rom dump.
Thanks a lot

Could you specify the model? I have the ac-lite and I'd be happy to help.

1 Like

It is possible to pull out the bootloader image from the stock firmware bin file. It looks like it starts at offset 0x140. The stock firmware files are just images of the flash concatenated with some headers in between.

Be sure to get the ART data out of your flash chip before writing anything. The ART should not have been affected by the interrupted flashing.

All you really need to write is the bootloader then you can boot to TFTP recovery and install the main firmware, and once OpenWrt is running use kmod-mtd-rw to rewrite the ART if necessary.

3 Likes

Ubiquiti UniFi 6 LR here. If you have this model, please let me know what I can do.

1 Like

@mk24 TFTP shouldn't wipe the bootloader should it though? Nor does the OpenWrt image include a bootloader?

Just wondering what the chances are of your bootloader getting corrupted through a power outage when the chip's being written to.

1 Like

It is the SWX-UAP 6545A-UAP. Thanks for the help.

Excellent, I will try it right away.

i had probs with my brand new unifi 6 LR APs and openwrt ( both ended up bricked) .. if you can get it into TFTP mode again following the the OEM guide ( for me it was hold reset, power on the device and it took well over 20 seconds of holding reset in to get it into to TFTP recovery mode.

with my devices , neither was at the 192.168.1.20 address as their instructions stated. I found one was at 192.168.1.33 and the other was at 192.168.1.36 . this was with no DHCP server and only 1 device connected at a time to my POE hub.!!??? no idea why or how .. but i was able to TFTP recover both with OEM fw after finding their IP#

i found them by using an ip scanner.

Sorry to return to you so late. The rom is completely corrupted....(ffs no wonder the orange LED and no boot) I read the flash and it seems to me that the only area with data is between 0x10000 and 0x14FFFF. Everywhere else including the last 64KiB of the chip are FF. So I guess now I really need a complete rom dump or at least the ART partition to hopefully recover this thing :rofl:

Thanks for the suggestions. The TFTP only works when the bootloader of the AP is not dead... But I just found out the rom on my AP is completely corrupted somehow...

Can't find any source on this, some help?

I have that same model. Let me see what is in it now.

1 Like