HooToo HT-TM01 - How to flash Stock Firmware?

19.04 is just a typo! :sweat_smile: I meant to 19.07.4!

But any OpenWrt release (but not the master) will do!

Ah nice!
Yeah I tried another approach someone else suggested using "kmod-mtd-rw" buuuuut...

Installing kmod-mtd-rw (4.14.195+git-20160214-1) to root...
Collected errors:
 * verify_pkg_installable: Only have 0kb available on filesystem /overlay, pkg kmod-mtd-rw needs 2
 * opkg_install_cmd: Cannot install package kmod-mtd-rw.

EDIT: After flashing a SysUpgrade image of 19.07.4 (same version) it suddenly worked again. Seems like one of the partitions was partly damaged and that fixed it.


Did you have a success?

Btw. I was wrong here:

You had to concatenate these partitions and flash as Kernal.bin through TFTP:

  • Kernel_RootFS
  • params
  • user_backup
  • user and
  • Rootfs

with other words: mtd4.bin + mtd5.bin + mtd6.bin + mtd7.bin + mtd8.bin!

dev:    size   erasesize  name
mtd0: 00800000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 00180000 00010000 "Kernel_RootFS"
mtd5: 00010000 00010000 "params"
mtd6: 00010000 00010000 "user_backup"
mtd7: 00010000 00010000 "user"
mtd8: 00600000 00010000 "Rootfs"

I haven't tried the kmod-mtd-rw yet cause my understanding of it is that it only makes it temporarily writeable while still booted into OpenWrt? Could be wrong tho...

And I tried combining mtd4 to 8 now (hope Windows copy command doesn't add any weird bytes here...) and it doesn't seem to work either. Does the same, initiates the transfer but acts as if it finished just 1 second later.

Try with /b:

copy /b mtd4.bin+mtd5.bin+mtd6.bin+mtd7.bin+mtd8.bin Kernal.bin

But yeah, maybe there is a size check. :man_shrugging:

Try that kmod-mtd-write and write that 192 kB sized mtd1.bin from my backup to your u-boot partition!

mtd write /tmp/mtd1.bin u-boot

Okay! Seems like kmod-mtd-rw, then unlock and then a write ot mtd1 to u-boot worked and I was able to boot with a new bootloader now! Looking in Wireshark now it does ask for "Who has" so it looks promising :smiley:

Now... Do I have to just flash kernel since mtd8 is already included there or do I still have to rename mtd8 to rootfs and flash that too?

Original u-boot searches for kernel and rootfs.

This could then be used as an backup to create an images to get back to the OEM firmware:

copy /b mtd4.bin+mtd5.bin+mtd6.bin+mtd7.bin kernel
copy mtd8.bin rootfs

Source: https://openwrt.org/toh/ravpower/ravpower_rp-wd03#execute_script_with_oem_firmware

1 Like

I think this is looking promising!!!

1 Like

YUP! Damn! I never thought I'd see this device work again, awesome!

Thanks so much for your help man! After many, MANY years of not being able to use that thing anymore it finally comes back to life as it's supposed to be :slight_smile: I'll definitely put the stuff we talked about here in my blog for other people to easily find and being able to follow it too in case theirs is/was also as screwed up as mine!

TripMate-0E58 ... very interesting. :thinking:
This is my device's MAC.
Please try factory reset on your device! Hold reset for a long time (30s? 1min?) while the TripMate is powered on.

It was easy, wasn't it?

  • get OEM u-boot binary
  • flash it with the help of kmod-mtd-rw and write
  • set up a TFTP recovery environment
  • get kernel and rootfs
    • from someone else's backup
    • extract from stock firmware upgrade file (with nice tools)

But don't forget to note how important that backup directory is! :wink:

And create a new for yourself with EnterRouterMode.sh (saved at pendrive's root directory) below:



if [ -r $FWFIRMWARE ]; then
elif [ -r $FWCFPT ]; then

readfwinfo() {
	grep $1 $FWINFO | cut -d= -f2

WORKDIR=`find /data -name EnterRouterMode.sh`/..

CURFILE=`readfwinfo CURFILE`
CURVER=`readfwinfo CURVER`
VENDOR=`readfwinfo VENDOR`

mkdir -p backup-${FWBACKUPPREFIX}

if ! (md5sum -s -c mtd.md5sum); then
	for mtd in `grep  ^mtd /proc/mtd | cut -d: -f1`; do
		dd if=/dev/$mtd of=$mtd.bin
	cp $FWINFO fwinfo.txt
	echo $FWINFO > fwinfo-filename.txt
	cp /proc/mtd mtd.txt
	md5sum mtd*.bin *.txt > mtd.md5sum
	dmesg > dmesg.txt
	ip a > ip_a.txt
	env > env.txt
	get_mtd_sn > mtd_sn.txt
	cat > readme.txt <<EOM
This directory contains a backup from your $VENDOR device.

Put it to a safe place!

cd ..

# nvram_get > $SDCARD/nvram_get.txt
# nvram_get rt2860_nvram_show >> $SDCARD/nvram_get.txt
# nvram_get show >> $SDCARD/nvram_get.txt
# nvram_get chkcrc >> $SDCARD/nvram_get.txt
# nvram_get gen > $SDCARD/nvram_get_gen.txt

/etc/init.d/teld.sh restart
1 Like

(@EpicLPer, you responded in the wrong thread! :wink: )

Thanks for testing!

I know heh :smiley: But yeah I'll try that later on.

@xabolcs , Thanks for providing all of the files and information. I have the exact problem you guys were talking about. If the offer still stands, could you make that custom sysupgrade.bin? It's a bit over my head.

Hello @hashcraft95!

Using an official 19.07.x release is easier than a random custom build from a random community member.


  • sysupgrade to latest 19.07 (e.g. openwrt-19.07.4-ramips-rt305x-ht-tm02-squashfs-sysupgrade.bin),
  • install kmod-mtd-rw
  • insmod it: insmod mtd-rw i_want_a_brick=1

And you are there: with writable partitions.

Instead that custom sysupgrade I could provide a script later, which would flash the original Bootloader back to the device.

1 Like

Insmod was my missing link, I got it up and running stock. Thanks so much!

1 Like

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.

Problem is that this would close the topic in a few days which I don’t want in case people have problems and wanna ask things :wink:

I prefer marking this as solved too ... but before that, it would be nice to:

  • create a minimal HooToo HT-TM01 device page on Wiki - independently from that HT-TM02
    • document the steps of this "Revert to Stock, but from wingspinner's build"
    • link this topic for the details
  • create a new backup archive:
    • readme.txt - with the steps
    • Bootloader.bin, Kernel_RootFS.bin, params.bin, Rootfs.bin
    • answer your wingspinner issue #21: where/how to edit that params.bin
  • put the new backup archive to archive.org (like TL-WR1043ND v4 EEPROM dump)

Yep that’s why I’m holding off for now :slight_smile: Until everything’s set up so others can easily follow along in case theirs is screwed up too.
I guess there’s no way to supply a sysupgrade image for people already on a working OpenWrt to easily revert? And then additional steps for people who screwed their install up beyond repair :slight_smile:

Feel free to add usefull information about this device.

1 Like