Looking for info and possibility of (future) support of TP-Link Omada er605 Router

[ZexMaxwell001]

@LittleChip @frollic I just ordered a USB TTL and I'll also look into my ER605.
An OpenWRT ER605 would be really helpful in my case since I need better management for the Starlink dish. I'll post again with your photo requests and see what else I can learn in parallel of LittleChip.
Pray for me, for my inexperience with router hardware might brick my device.... any Documentation on the matter would be helpful. but I will also be looking myself.

[LittleChip]

Found out a bit more, but pretty much ended my idea of enabling some additional capabilities in the firmware things like ssh

If you factory reset, you have a few seconds to login as root without a password as the router first boots.

The password is then set and is always the same and looks to be some type of h/w id.
On the device i have its always the same

any changes made after logging in as root are lost on reboot

[LittleChip]

any ideas of what we could try next ?

[LittleChip]

As requested i have uploaded pictures of the board and the header. The location R2 need to be shorted as does R5 to enable RX and TX.

The closest router supported by openwrt looks to be the tplink Archer A6, same cpu , flash size and also has gig ports. I tried to flash the image but got refused both via the web and u-boot any ideas of the next step to enable openwrt on the board.

any recommendations

[frollic]

@LittleChip

I tried to flash the image but got refused both via the web and u-boot

what was the error msg in uboot, the same bad magic number ?

[mk24]

Don't flash anything yet. TFTP load (into RAM) and boot up initramfs builds using uboot. These run in RAM so it won't brick your router with an improper flash.

A vital thing that has to be compatible when trying to run existing firmware made for one model on a new unsupported model is the partition table:

@LittleChip

1.728000] Creating 14 MTD partitions on "raspi":
[    1.732000] 0x000000000000-0x000000040000 : "bootloader"
[    1.740000] 0x000000040000-0x000000070000 : "bootloader-fs"
[    1.744000] 0x000000070000-0x000000080000 : "extra-para"
[    1.752000] 0x000000080000-0x000000200000 : "kernel"
[    1.760000] 0x000000200000-0x000000df0000 : "rootfs"
[    1.764000] mtd: device 4 (rootfs) set to be root filesystem
[    1.768000] 0x000000df0000-0x000000e10000 : "panic-oops"
[    1.776000] 0x000000e10000-0x000000e20000 : "partition-table"
[    1.784000] 0x000000e20000-0x000000e30000 : "device-info"
[    1.788000] 0x000000e30000-0x000000e40000 : "support-list"
[    1.796000] 0x000000e40000-0x000000e50000 : "firmware-info"
[    1.804000] 0x000000e50000-0x000000e60000 : "tddp"
[    1.808000] 0x000000e60000-0x000000e80000 : "log"
[    1.816000] 0x000000e80000-0x000001000000 : "rootfs_data"
[    1.820000] 0x000000000000-0x000001000000 : "firmware"

This is a real mess and you're almost certainly going to need a custom dts file build to support it. If you make a partition for OpenWrt called "firmware" as starting where the bootloader boots (0x80000) and a contiguous block up to the last thing that the stock firmware may still need (0xe10000). it should handle parting out the kernel, rootfs, and rootfs-data all in that block. Note that the factory rootfs-data is only 1.5 MB and not contiguous, so you're going to have to abandon it as unusable space.

[xloem]

Thank you for your work here. If there is anyhing we can do or provide to help things move forward, please let us know.

It would likely be a little helpful to have images of the stock firmware linked.

It sounds like a next step is to craft a custom dts file for the new partition layout in some basic way.

When I encounter something like this and have a lot of time on my hands, I add serial output calls to very early boot steps, so I can troubleshoot where things start failing,

[hecatae]

There's 4 different versions:

Download for ER605 | TP-Link United Kingdom

V1, V1.60, V2, V2.6

Looks like they only provide current firmware via the Omada controller

[hn0]

On other country pages the firmware is linked, maybe this helps.
eg. for US: Download for ER605 | TP-Link

[hecatae]

Did you ever try operation 1:

1: Load system code to SDRAM via TFTP.

[nithino]

I am also interested in this. I have an ER605 router. Please tell me how can I help.

[OranguTech]

Oh wow - something in my profile setup means I never saw that there were new replies here! I've more recently dabbled w/ hardware hacking, learning about how to connect w/ UART, etc. I recently saw one of these up for auction and almost grabbed a second one to test/play with. (I can't jeopardize the current one feeding the house unless I have a solid backup ready to go.)

I too am willing to help once I get either a new device in place or a secondary ER605/TL-R605. I will try to make some progress soon. (But first I'd need to get a working Build Environment up and running)

I've looked before, but any chance there's a "Porting OpenWRT to new hardware" tips'n'tricks for dummies?

[hecatae]

I can pick one of these up for not much money, anything you need if I do?

[hecatae]

V1 has 16mb flash 128mb ram
V2 has 128mb flash 256mb ram

[kolya]

Hi

I was trying to make play with v2 version this device and was able to run current openwrt build with the initramfs build.

Unfortunately I also managed to wipe out firmware (ubi) partition on the flash.
I can still get to the bootloader (via UART) but no further.
It looks like builtin bootloader needs extra-para/extra-para.b and device-info/device-info.b volumes to be present in order for it to boot. These partitions are not present in the firmware that is distributed by TP-link.

I would really appreciate if someone could dump those partitions and DM them to me.

Thanks in advance!

[Klingon]

Thanks for the info, yesterday I bought V2 version.

Hope someday will work with OpenWRT!!

[kolya]

Here is a PR to add some basic support: https://github.com/openwrt/openwrt/pull/11517

Unfortunately it still requires HW mod to attach UART console. I do not think I will be able to add support for 'oem-compatible' images unless I can find dump of original flash for this device.

[Klingon]

Tomorrow I'll receive my ER605-V2, is there any way to get what you need without "opening" my device?

[kolya]

I do not think it is possible to dump the partition without opening the device, unfortunately.
Even though oem firmware seems to be using openwrt the partition dumping feature is disabled, I think... Also as far as I understand it doesn't have ssh access.

[richh]

Been toying with the entire product line (ER605, ER7206 and ER8411). The root password is generated within init script /etc/init.d/dropbear and is based on the unit's MAC address and the chosen webgui password. It's possible to break root on stock firmware as follows without needing to lift the lid:

1. Do the initial config through the web interface - create a username/password and login - suggest to use admin for username to keep things simple.

2. Enable "Remote assistance" in the System Tools -> Diagnostics -> Remote Assistance menu. This opens up SSH access on the local LAN within iptables.

3. Generate the root password as follows, using the MAC printed on the bottom of the unit:

echo -n "AA:BB:CC:DD:EE:FFusername" | md5sum | cut -b 1-16

e.g. for MAC address A1:B2:C3:D4:E5:F6 and webgui username admin:

echo -n "A1:B2:C3:D4:E5:F6admin" | md5sum | cut -b 1-16

The resulting 16 character string is the root password to use via ssh