HooToo HT-TM01 - How to flash Stock Firmware?

I have a backup for you, @EpicLPer!

Are you still interested?

1 Like

Heya! Yeah, still interested :slight_smile: Would be awesome!

OK!

I'll provide a gdrive link with files for TFTP recovery in a few hours.
Until then, please setup your TFTP recovery environment!

... few hours later ...

Here are the files: backup-fw-WiFiDGRJ-HooToo-TM01-2.000.022-8850118661

I created those files with EnterRouterMode.sh

Use mtd4.bin (+ optionally mtd5.bin + mtd6.bin + mtd7.bin if it doesn't work) as kernel and mtd8.bin as rootfs for the TFTP recovery.

That's the usual "Pressing reset while powering on the device" stuff with TFTP server at 10.10.10.254.

Thanks a lot man! Now I have to figure out how to actually flash those correctly ^^

For instructions, see:

For TFTP Server you could use OpenTFTPServer for Windows, or sudo dnsmasq for Linux.

I tried this now but it never seems to look for those 2 files. Wireshark also only gives me constant "Who has 10.10.10.3?" Broadcasts. Is it maybe another IP it's looking for?

Okay, seem like the OpenWRT on my device is kinda old. The actual IP of it is 10.10.10.123 and it's looking for 10.10.10.3 running the TFTP server. The files are also called Kernal.bin and firmware.bin apparently.

Looks like your U-Boot isn't the stock u-boot, is it?

With my u-boot (mtd1.bin from the backup):
Server IP is 10.10.10.254:

$ ip address show enx34298f903e25 
4: enx34298f903e25: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 34:29:8f:90:3e:25 brd ff:ff:ff:ff:ff:ff
    inet 10.10.10.254/24 brd 10.10.10.255 scope global noprefixroute enx34298f903e25
       valid_lft forever preferred_lft forever
    inet6 fe80::3629:8fff:fe90:3e25/64 scope link 
       valid_lft forever preferred_lft forever

And the filename is kernel

$ sudo dnsmasq --no-daemon --port=0 --enable-tftp --tftp-root=/tmp
dnsmasq: started, version 2.79 DNS disabled
dnsmasq: compile time options: IPv6 GNU-getopt DBus i18n IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset auth DNSSEC loop-detect inotify
dnsmasq-tftp: TFTP root is /tmp 
dnsmasq-tftp: file /tmp/kernel not found
dnsmasq-tftp: file /tmp/kernel not found
dnsmasq-tftp: file /tmp/kernel not found
dnsmasq-tftp: file /tmp/kernel not found

Not sure. I've used the upload from the OpenWRT Wiki (or was it GitHub?) back in the days, not even sure when exactly. It seems to have flashed the Kernal.bin now, but when I turn it on all it does is flash the Blue LED on for ~5 seconds, then off for about a second, then on again for ~5 seconds and repeats that constantly.

I think I've properly bricked it now :thinking:

Just noticed, whenever it flashes off it seems to reboot since the Network connection gets interrupted. Then the LED turns on again and it connects again just to repeat constantly.
When I hold the Reset Button I can still enter the recovery mode and it still keeps looking for the Kernal.bin file so not all is lost apparently!

EDIT: I got the instructions that work for this one from here: https://forum.archive.openwrt.org/viewtopic.php?id=53014&p=13#p293127
Post #311

1 Like

It would be nice to know where it flashes those Kernal.bin and firwmare.bin files. :thinking:

To recovery, you could try to install latest 19.07.4 as Kernal.bin:

I'm actually sorry, misunderstood one thing from the Forum post I linked above as an Edit. It's ONLY "Kernal.bin", not "firmware.bin". The guy who wrote this mentioned to rename firmware to Kernal, I interpreted those as 2 different files, sorry :slight_smile:

1 Like

OK, no problem here!

Then try the 19.07 sysupgrade file as Kernal.bin! If it doesn't boot, you had to try the old ones from wingspinner!

Okay with the Kernel file you posted last it seems to boot back to OpenWRT again, nice! So it was indeed some old Kern(a/e)l I think?

Anyways. Not sure what to do now tho :frowning:

Concatenate all the files from mtd4.bin to mtd8.bin, and TFTP it!

Hm... It's still asking for 10.10.10.3, not 10.10.10.254 when powering it on, waiting for the first LED and then pressing and holding Reset. It also goes into that mode rather fast, only takes about 3 seconds holding down the Reset Button before it starts searching for those files :thinking:

Also, just found this in the forum thread linked earlier which explains why I have those weird IP Addresses it keeps looking for, apparently I have another bootloader?

Another difference is that the HooToo factory bootloader runs tftp on
10.10.10.128 (client) and 10.10.10.254 (server) looking for "kernel" and
"rootfs" files. The above steps are a merger of the two assuming the
running bootloader is OpenWRT u-boot image.

Now I wonder on how to get a different bootloader onto this thing to get it back to stock. I mean, I can already boot into OpenWRT so it shouldn't be too difficult now I guess?

Do you have OEM firmware now? Or you still have OpenWrt on your device?

Did you try flashing mtd1+mtd2+mtd3+mtd4+mtd5+mtd6+mtd7+mtd8 concatenated as Kernal.bin?

If I try that the TFTP transfer finishes in just a few moments and doesn't seem to actually transfer anything.