HooToo HT-TM01 - How to flash Stock Firmware?

Have you destroyed your cal-data partition as well? If so, it may never work as it should.

I really don't know, all I did was to use the OpenWRT script/upgrade package the guy provides which then did its own magic... I have no idea what partition it changes or what exactly it does at all.

Ok, so you flashed a binary for an HT-TM02 on an HT-TM01??

I would very carefully read https://github.com/wingspinner/HooToo-Tripmate-HT-TM02-OpenWRT and hope that you've still got that stick

Useful links: OpenWRT main page http://openwrt.org OpenWRT wiki http://wiki.openwrt.org HT-TM02 thread https://forum.openwrt.org/viewtopic.php?id=53014

The TM02 with the factory software doesn't have enough RAM to untar/ungzip and assemble the complete TM02 flash MTD image for the upgrade so it requires a USB flash stick to use as workspace. So does the new loader. Having a clean USB flash stick plugged in is required.

The first thing the loader does is shutdown various services that might interfere with the flashing process and perhaps free up some RAM. Then it creates a complete backup of the factory flash MTD device written to your USB flash stick. It copys the entire TM02 MTD device as one file as well as each partition seperately to seperate files. The files are named appropriately and will be under the "HT_FLASH" directory on the stick. You can use this to revert back to factory if you wish. I'll writeup some instructions later for this.

(No wonder the PR wasn't accepted -- this device is apparently even worse than most https://openwrt.org/supported_devices/432_warning)

Well, that was years ago when I flashed OpenWRT, that stick even if I still have it has most likely been overwritten and formatted already... Oh well, guess it's game over for me then.

Did you solve your "back to stock" problem?

If not, just reach them out:
and ask for the latest Stock Firmware!

I could help if your device supports TFTP recovery and somebody has the official stock firmware upgrade zip.

I have a backup for you, @EpicLPer!

Are you still interested?

1 Like

Heya! Yeah, still interested :slight_smile: Would be awesome!


I'll provide a gdrive link with files for TFTP recovery in a few hours.
Until then, please setup your TFTP recovery environment!

... few hours later ...

Here are the files: backup-fw-WiFiDGRJ-HooToo-TM01-2.000.022-8850118661

I created those files with EnterRouterMode.sh

Use mtd4.bin (+ optionally mtd5.bin + mtd6.bin + mtd7.bin if it doesn't work) as kernel and mtd8.bin as rootfs for the TFTP recovery.

That's the usual "Pressing reset while powering on the device" stuff with TFTP server at

Thanks a lot man! Now I have to figure out how to actually flash those correctly ^^

For instructions, see:

For TFTP Server you could use OpenTFTPServer for Windows, or sudo dnsmasq for Linux.

I tried this now but it never seems to look for those 2 files. Wireshark also only gives me constant "Who has" Broadcasts. Is it maybe another IP it's looking for?

Okay, seem like the OpenWRT on my device is kinda old. The actual IP of it is and it's looking for running the TFTP server. The files are also called Kernal.bin and firmware.bin apparently.

Looks like your U-Boot isn't the stock u-boot, is it?

With my u-boot (mtd1.bin from the backup):
Server IP is

$ ip address show enx34298f903e25 
4: enx34298f903e25: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 34:29:8f:90:3e:25 brd ff:ff:ff:ff:ff:ff
    inet brd scope global noprefixroute enx34298f903e25
       valid_lft forever preferred_lft forever
    inet6 fe80::3629:8fff:fe90:3e25/64 scope link 
       valid_lft forever preferred_lft forever

And the filename is kernel

$ sudo dnsmasq --no-daemon --port=0 --enable-tftp --tftp-root=/tmp
dnsmasq: started, version 2.79 DNS disabled
dnsmasq: compile time options: IPv6 GNU-getopt DBus i18n IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset auth DNSSEC loop-detect inotify
dnsmasq-tftp: TFTP root is /tmp 
dnsmasq-tftp: file /tmp/kernel not found
dnsmasq-tftp: file /tmp/kernel not found
dnsmasq-tftp: file /tmp/kernel not found
dnsmasq-tftp: file /tmp/kernel not found

Not sure. I've used the upload from the OpenWRT Wiki (or was it GitHub?) back in the days, not even sure when exactly. It seems to have flashed the Kernal.bin now, but when I turn it on all it does is flash the Blue LED on for ~5 seconds, then off for about a second, then on again for ~5 seconds and repeats that constantly.

I think I've properly bricked it now :thinking:

Just noticed, whenever it flashes off it seems to reboot since the Network connection gets interrupted. Then the LED turns on again and it connects again just to repeat constantly.
When I hold the Reset Button I can still enter the recovery mode and it still keeps looking for the Kernal.bin file so not all is lost apparently!

EDIT: I got the instructions that work for this one from here: https://forum.archive.openwrt.org/viewtopic.php?id=53014&p=13#p293127
Post #311

1 Like

It would be nice to know where it flashes those Kernal.bin and firwmare.bin files. :thinking:

To recovery, you could try to install latest 19.07.4 as Kernal.bin:

I'm actually sorry, misunderstood one thing from the Forum post I linked above as an Edit. It's ONLY "Kernal.bin", not "firmware.bin". The guy who wrote this mentioned to rename firmware to Kernal, I interpreted those as 2 different files, sorry :slight_smile:

1 Like

OK, no problem here!

Then try the 19.07 sysupgrade file as Kernal.bin! If it doesn't boot, you had to try the old ones from wingspinner!

Okay with the Kernel file you posted last it seems to boot back to OpenWRT again, nice! So it was indeed some old Kern(a/e)l I think?

Anyways. Not sure what to do now tho :frowning: