How to get TPLINK_HWID and similar parameters for a new target?

Hi,

I have a TP-Link MR200v3 router, which is not currently supported by OpenWRT (AFAICT v1, v5 and possibly v6 revisions are either supported or planned in future releases).

Hardware-wise it's similar to v4, i.e. has the same SoC and (possibly) LTE modem. v4 support is something that is/was being worked on by Lochnair, mrhaav and possibly other developers.

I would like to try my luck with building an image for v3, but for that I need a couple of things in the mt76x8.mk file. Namely the TPLINK_ parameters.

v1 has the following in the target (in another .mk file):

  TPLINK_HWID := 0xd7500001
  TPLINK_HWREV := 0x4a

v5 has this:

  TPLINK_HWID := 0x20000005
  TPLINK_HWREV := 0x5
  TPLINK_HWREVADD := 0x5

v4 in a branch by Lochnair has

  TPLINK_HWID := 0x001D589B
  TPLINK_HWREV := 0x93
  TPLINK_HWREVADD := 0x13
  TPLINK_HVERSION := 3

How are these values obtained for the target? Is this something that is extracted from the OEM firmware? What could the values be for the MR200v3 target?

Check out mktplinkfw2.c in the firmware-utils repository to get an overview of the structure of the firmware header. You should then be able to extract the values from the OEM firmware upgrade file.

This only works if the image format is the same. Sometimes, TP-Link changes firmware structure between revisions (RE200v1 uses a completely different image format than RE200v2).

I have previously tried inspecting V3...V5 images with mktplinkfw/mktplinkfw2 utility only to get an error that the header is wrong:


$ ./mktplinkfw2 -i ../../../Archer_MR200v5_1.2.0_0.9.1_up_boot\(210120\)_Release_2021-01-20_18.48.42.bin 
File name              : ../../../Archer_MR200v5_1.2.0_0.9.1_up_boot(210120)_Release_2021-01-20_18.48.42.bin
File size              : 0x033d6efa / 54357754 bytes
[mktplinkfw2] *** error: file does not seem to have V2/V3 header!

$ ./mktplinkfw2 -i ../../../LTE_GATEWAY_1.19.0_0.9.1_up_boot\(210201\)_all_2021-02-01_19.17.11.bin 
File name              : ../../../LTE_GATEWAY_1.19.0_0.9.1_up_boot(210201)_all_2021-02-01_19.17.11.bin
File size              : 0x0344a98e / 54831502 bytes
[mktplinkfw2] *** error: file does not seem to have V2/V3 header!

$ ./mktplinkfw2 -i ../../../LTE_GATEWAYv3_1.9.0_0.9.1_up_boot\(190307\)_2019-03-07_15.29.34.bin 
File name              : ../../../LTE_GATEWAYv3_1.9.0_0.9.1_up_boot(190307)_2019-03-07_15.29.34.bin
File size              : 0x0341a65a / 54634074 bytes
[mktplinkfw2] *** error: file does not seem to have V2/V3 header!

Just out of curiosity tried inspecting the v1 image today, and got sort of success:

$ ./mktplinkfw2 -i ../../../Archer\ MR200v1_0.9.1_1.2_up_boot_v004a.0\ Build\ 180502\ Rel.53881n.bin File name              : ../../../Archer MR200v1_0.9.1_1.2_up_boot_v004a.0 Build 180502 Rel.53881n.bin
File size              : 0x021f03d9 / 35587033 bytes
Version 2 Header size  : 0x00000200 /      512 bytes
Header MD5Sum1         : 7a 3e 69 86 34 3a e6 dc e5 4a 05 f1 cb 02 a5 8f (ok)
Header MD5Sum2         : ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff (purpose yet unknown, unchecked here)

Firmware version       : ver. 2.0
Hardware ID            : 0xd7500001
Hardware Revision      : 0x0000004a
Additional HW Version  : 0x00000001
Software version       : 0.9.1-1.2

Kernel data offset     : 0x00000200 /      512 bytes
Kernel data length     : 0x001363f0 /  1270768 bytes
Kernel load address    : 0x00000080
Kernel entry point     : 0x50c10080
Rootfs data offset     : 0x00140000 /  1310720 bytes
Rootfs data length     : 0x00487000 /  4747264 bytes
Boot loader data offset: 0x00000000 /        0 bytes
Boot loader data length: 0x0001d6ac /   120492 bytes
Total firmware length  : 0x007d0200 /  8192512 bytes

And it sort of makes sense, cause the magic number 0xd7500001 can be found in the bin file using a hex editor.
Numbers 0x20000005 and 0x001D589B however cannot be found in v5 and v4 images respectively.
So it seems that simply having an overview of the structure of the header accepted by mktplinkfw2 unfortunately doesn't seem to help me in my endeavor.
What would really help is someone pointing at the place/offset/tool used to get, e.g., TPLINK_HWID := 0x20000005 for v5 target.

I checked the firmware upgrade file: your device has a v3 header which is, AFAICT, not supported by the OpenWrt tools. See https://github.com/xdarklight/mktplinkfw3 for details.