How to unbrick unifi6 plus AP through USB to Serial TTL part deux

[bishoptf]

There is an older thread where it was talking about unbricking a u6+ unit and I had posted there but thought that a dedicated post would be better. I have a unifi 6 plus that was having a stock firmware issue, controller was showing out of date but would not upgrade. Opened a ticket with Ubiquiti and they had me run a rescue command that essentially made the semi working unit turn into a brick. TFTP recovery does not work and since it was purchased from an unauthorized retailer they are not going to replace the unit. Based on what I have read I have the unit opened up and connected to a serial ttl session, I run linux so its a minicom session.

Here is the current boot session:

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 103F 0000
F3: 0000 0000 [0200]
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [2000]
T0: 0000 01A0 [010F]
Jump to BL

NOTICE: BL2: v2.6(release):
NOTICE: BL2: Built : 15:00:55, Jun 17 2025
NOTICE: WDT: disabled
NOTICE: EMI: Using DDR3 settings

dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a083f1 000003ff 00100000 00000000
1001d040 | 00000000 00000000 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0x8
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 564, worse bit 4, min window 68
Window Sum 568, worse bit 8, min window 68
Window Sum 386, worse bit 2, min window 46
Window Sum 404, worse bit 9, min window 48
Window Sum 396, worse bit 1, min window 48
Window Sum 420, worse bit 9, min window 48
Window Sum 408, worse bit 1, min window 50
Window Sum 428, worse bit 9, min window 52
Window Sum 418, worse bit 3, min window 50
Window Sum 444, worse bit 9, min window 52
Window Sum 428, worse bit 3, min window 50
Window Sum 452, worse bit 9, min window 54
Window Sum 436, worse bit 3, min window 52
Window Sum 446, worse bit 3, min window 54
Window Sum 468, worse bit 9, min window 56
Window Sum 452, worse bit 1, min window 56
Window Sum 470, worse bit 8, min window 58
Window Sum 460, worse bit 1, min window 56
NOTICE: EMI: Detected DRAM size: 256MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: CPU: MT7981 (1300MHz)
ERROR: MSDC: CRC error occured while reading data with cmd=8, arg=0x0
ERROR: MSDC: CRC error occured while reading data with cmd=18, arg=0x3400
ERROR: BL2: Failed to load image id 3 (-2)

That other thread it was mentioned that I may be able to load a BL2 image using mtk_uartboot and following this thread - https://openwrt.org/toh/zyxel/t-56

I see where it is using mtk_uartboot command and loading mt7986-ram-ddr4-bl2.bin but they are also loading a FIP package and not sure what I should use instead. My goal is to try to recover a factory image and see if I can get the unit to boot again.

If anyone can provide some clarity in the mtk_uartboot step as to what additional firmware to use I would be grateful. I have the stock firmware .bin file but not sure if it is even to that point, if I could just at least get it to allow a tftp recovery that would be a huge step.

Thanks

[lleachii]

@bishoptf

There is an older thread where it was talking about unbricking a u6+ unit and I had posted there but thought that a dedicated post would be better.

For others to reference:

How to unbrick unifi6 plus AP through USB to Serial TTL?

Bumping this older thread, I have a U6+ and trying to get it hooked up to a usb ttl to see if I can un-brick it. I saw your original threads where you were getting it working on OpenWrt but just trying to make sure I know the UART pinout. I know I will have to solder pins and that is no big deal just trying to make sure I do not do any additional damage. I have attached a pick of the uart section and using a meter where I see voltage and what I think rx and tx are located just would like to get …

(Especially since you similarly named your thread, and the other is still open.)

@bishoptf

Opened a ticket with Ubiquiti and they had me run a rescue command that essentially made the semi working unit turn into a brick. TFTP recovery does not work and since it was purchased from an unauthorized retailer they are not going to replace the unit.

Are you saying that the bootloader is damaged?

@bishoptf

My goal is to try to recover a factory image and see if I can get the unit to boot again.

If anyone can provide some clarity in the mtk_uartboot step as to what additional firmware to use I would be grateful.

Are you referring to the OpenWrt file listed in the Wiki, or are you looking for OEM Ubiquiti firmware?

[bishoptf]

I assume BL2 error that I am seeing on the serial output indicates that the bootloader is corrupted. Originally that was not the case but something was off with the last installation of the oem firmware. Ubuiquity tech support had me run a rescue script that basically put the device into the current state and now will not continue to support it, lol.

I am trying to recover it to a stock firmware if possible, I would like to recover it vs throwing it into the electronic recycle bin. The last posting on the thread that you linked to and others have mentioned using mtk_uartboot and stated to Try mtk_uartboot as described in https://openwrt.org/toh/zyxel/t-56

I have downloaded mtk_uartboot and looks like I can maybe try to load mt7986-ram-ddr4-bl2.bin in order to recover the bootloader but they are also loading a fip package and not sure outside of the bootloader what else I would need to load.

Just trying to get some help in recovering the device to stock firmware, only place I have found that have played with the unifi 6+ devices and was just hoping someone could explain what I might do to recover, it may be beyond recovery but I wanted to try.

[bishoptf]

Just bumping, anyone have any suggestions, Obi-wan your my only hope,