I've applied the v5 version's firmware and it worked. So, how do I go back to the stock firmware? I tried the luci way, but it didn't work. It seems to upload the file, but in fact it does nothing.
TFTP ?
https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=b641eb6ecfbfc2c6a488483332d4b5a6ee4c736c
IP and file name might be incorrect, since you're using a v7, not a v5.
1 Like
The thing is, this is my friend's. It was bricked. I solved it by setting up that TFTP server, with the same methods as v5. It worked, for openwrt image.
But on LUCI I upload the TP-Link Stock firmware, it seems to upload but then, goes back to the same page?
So, I tried with the same TFTP way. I put the TP-Link Stock firmare instead of Openwrt tftp image. It seems to accept it by indicating with flashing lights. Then, in a minute it flashes all leds on and off all the time very quickly. All lights turning on and off at a very quick pace. This goes on for 5 minutes, 10 minutes. I restart, still the same. Now I reflashed Openwrt again. Also there doesn't seem to be serial here, at least not an easy way. There is 4 holes but they are filled with aluminum.
drill them, if you need to connect to serial.
Even if I did, then what? Flash is actually 8 MB; but this stock firmware image is 74MB. What to do where? Ima binwalk this firmware out. But dunno what to do loll. Look at this binwalk:
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
40885 0x9FB5 JBOOT STAG header, image id: 6, timestamp 0x18027118, image size: 4019174400 bytes, image JBOOT checksum: 0x60FF, header JBOOT checksum: 0x14
41369 0xA199 JBOOT STAG header, image id: 16, timestamp 0x21240400, image size: 822083624 bytes, image JBOOT checksum: 0xA600, header JBOOT checksum: 0x127
53893 0xD285 JBOOT STAG header, image id: 16, timestamp 0x21100000, image size: 33554576 bytes, image JBOOT checksum: 0x0, header JBOOT checksum: 0x2110
78689 0x13361 JBOOT STAG header, image id: 6, timestamp 0xCB10, image size: 799836416 bytes, image JBOOT checksum: 0x4000, header JBOOT checksum: 0x2110
78757 0x133A5 JBOOT STAG header, image id: 6, timestamp 0x1F00CB10, image size: 554713088 bytes, image JBOOT checksum: 0xA010, header JBOOT checksum: 0xFF00
83424 0x145E0 U-Boot version string, "U-Boot 1.1.3 (Feb 27 2024 - 10:48:27)"
132096 0x20400 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3975112 bytes
1442304 0x160200 Squashfs filesystem, little endian, version 4.0, compression:xz, size: 6742424 bytes, 716 inodes, blocksize: 262144 bytes, created: 2024-02-27 03:18:40
13374804 0xCC1554 XML document, version: "1.0"
13377768 0xCC20E8 ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
13382256 0xCC3270 Certificate in DER format (x509 v3), header length: 4, sequence length: 1187
13383447 0xCC3717 Certificate in DER format (x509 v3), header length: 4, sequence length: 1027
13384478 0xCC3B1E Certificate in DER format (x509 v3), header length: 4, sequence length: 1063
13438612 0xCD0E94 ATAGs msm parition table (msmptbl), version: 55EE73AA,
13490296 0xCDD878 XML document, version: "1.0"
13491868 0xCDDE9C SHA256 hash constants, little endian
13510560 0xCE27A0 XML document, version: "1.0"
13519491 0xCE4A83 UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x800, data offset: 0x1000
15616643 0xEE4A83 ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
15621355 0xEE5CEB Certificate in DER format (x509 v3), header length: 4, sequence length: 1187
15622546 0xEE6192 Certificate in DER format (x509 v3), header length: 4, sequence length: 1027
15623577 0xEE6599 Certificate in DER format (x509 v3), header length: 4, sequence length: 1063
15762895 0xF085CF Unix path: /dev/icbcfg/tz
15970880 0xF3B240 XML document, version: "1.0"
15971745 0xF3B5A1 AES S-Box
15972001 0xF3B6A1 AES Inverse S-Box
15989647 0xF3FB8F SHA256 hash constants, little endian
15991831 0xF40417 DER SHA1 hash
15991943 0xF40487 DER SHA256 hash
15992055 0xF404F7 DER SHA384 hash
16021970 0xF479D2 mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 4bit
16024870 0xF48526 mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 4bit
16143487 0xF6547F Qualcomm SBL1, image addr: ffffffff, image size: 4294967295, code size: 4294967295, sig size: 4294967295, cert chain size: 4294967295, oem_root_cert_sel: 4294967295, oem_num_root_certs: 4294967295
16145535 0xF65C7F Qualcomm SBL1, image addr: ffffffff, image size: 4294967295, code size: 4294967295, sig size: 4294967295, cert chain size: 4294967295, oem_root_cert_sel: 4294967295, oem_num_root_certs: 4294967295
16147583 0xF6647F Qualcomm SBL1, image addr: ffffffff, image size: 4294967295, code size: 4294967295, sig size: 4294967295, cert chain size: 4294967295, oem_root_cert_sel: 4294967295, oem_num_root_certs: 4294967295
16149631 0xF66C7F Qualcomm SBL1, image addr: ffffffff, image size: 4294967295, code size: 4294967295, sig size: 4294967295, cert chain size: 4294967295, oem_root_cert_sel: 4294967295, oem_num_root_certs: 4294967295
16153727 0xF67C7F ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
16158375 0xF68EA7 Certificate in DER format (x509 v3), header length: 4, sequence length: 1187
16159566 0xF6934E Certificate in DER format (x509 v3), header length: 4, sequence length: 1027
16160597 0xF69755 Certificate in DER format (x509 v3), header length: 4, sequence length: 1063
16274559 0xF8547F Qualcomm SBL1, image addr: d00f290c, image size: 3507628307, code size: 689299471, sig size: 3758608653, cert chain size: 3489868075, oem_root_cert_sel: 3489737004, oem_num_root_certs: 3506710829
16294819 0xF8A3A3 Unix path: /dev/icbcfg/boot
16300835 0xF8BB23 Unix path: /dev/icbcfg/boot
16302182 0xF8C066 ESP Image (ESP32): segment count: 10, flash mode: QUOUT, flash speed: 40MHz, flash size: 64MB, entry address: 0x601c4069, hash: none
16366435 0xF9BB63 ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
16487342 0xFB93AE ESP Image (ESP32-C2): segment count: 6, flash mode: QUOUT, flash speed: 20MHz, flash size: 1MB, entry address: 0x2e9d446, hash: sha256
16488871 0xFB99A7 Unix path: /dev/icb/rpm
16506172 0xFBDD3C ESP Image (ESP32): segment count: 1, flash mode: QUIO, flash speed: 40MHz, flash size: 1MB, entry address: 0x62000000, hash: none
16506180 0xFBDD44 ESP Image (ESP32): segment count: 1, flash mode: QUIO, flash speed: 40MHz, flash size: 1MB, entry address: 0x65000000, hash: none
16506512 0xFBDE90 ESP Image (ESP32): segment count: 1, flash mode: QUIO, flash speed: 40MHz, flash size: 1MB, entry address: 0x80000000, hash: none
16523315 0xFC2033 XML document, version: "1.0"
16528365 0xFC33ED ATAGs msm parition table (msmptbl), version: 4, number of paritions: 15
17315261 0x10835BD ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
17319749 0x1084745 Certificate in DER format (x509 v3), header length: 4, sequence length: 1187
17320940 0x1084BEC Certificate in DER format (x509 v3), header length: 4, sequence length: 1027
17321971 0x1084FF3 Certificate in DER format (x509 v3), header length: 4, sequence length: 1063
17356389 0x108D665 ATAGs msm parition table (msmptbl), version: 55EE73AA,
17370525 0x1090D9D ATAGs msm parition table (msmptbl), version: 55EE73AA,
Then it contains the modem fw too.
I thought the issue was connecting to serial.
Hi Bosukes ! Did you eventually sort this out ?
(I'm having the same issue as you described)
nope not at all
I would never recommend the TP-Link MR6400 v7, as there seems to be no way to get back to the stock firmware (OEM firmware from TP-Link) without opening the device and losing the warranty.
You'd rather buy a TP-Link MR6400 v5, for which TP-Link's repository still offers unencrypted firmwares (that you can truncate to fit into your device using dd if=original.bin of=tp_recovery.bin skip=1 bs=512 count=16000 and then use the tftp upload method).
For the TP-Link MR6400 v7 (which has different hardware and requires different drivers than v5), TP-Link doesn't provide any unencrypted firmware.
They only provide encrypted upgrade firmwares (encrypted for code signature checking purposes I guess) which only the web GUI of a running OEM firmware will be able to manipulate on-the-fly (while you upload it to the GUI) :
- decrypting the file being uploaded
- locating the useful parts of the firmware file
- save only the useful parts onto the router
The tftp method won’t be able to perform these steps (and the complete firmware file is too big for the router storage).
In other words :
- if you flash a TP-Link MR6400 v7 with OpenWRT, you can never go back to stock firmware
- if you flash a TP-Link MR6400 v5 with OpenWRT, you can easily go back to stock firmware
In case you have a TP-Link TL-MR6400 v7 anyway :
-
If you want to flash it with OpenWRT (and lose the ability to go back to stock / lose your warranty), this firmware is promising : https://github.com/hkfuertes/mr6400v7-openwrt/releases/
(file namedopenwrt-ramips-mt76x8-tplink_tl-mr6400-v7-squashfs-tftp-recovery.bin)
I still couldn't get Wireguard VPN working, but I must be doing something wrong. -
If needed, you will be able to install a (not fully broken) firmware named
TL-MR6400(EU)v5_1.5.0_0.9.1_[221121-rel62850]_up_boot_Release_2022-11-25_17.18.04.binin tftp recovery mode, provided that your first trim it using thedd if=original.bin of=tp_recovery.bin skip=1 bs=512 count=16000method.
However, this release doesn't contain the required LTE drivers, so no 4G (and maybe other broken functionalities, but at least the web administration GUI loads successfully).
(disclaimer : all this is only my feeling, maybe incorrect, based on my short experience with this device and on what I read on forums)