Looking for info and possibility of (future) support of TP-Link Omada er605 v2 Router

For Developers
344

Finally, I was successful in going back to stock firmware.

As others have mentioned, the only way I could go back was using the UART and the MTD3 backup saved using @chill1Penguin script before migrating to OpenWRT on this unit. I'll post a super basic but detailed step by step for anyone interested in returning to stock firmware via UART using Windows tools.

Before starting, you'll need some things:

  1. Physically connect ER605 UART interface
  2. Connect a cheap USB to TTL to the ER605 UART interface
  3. Install a serial terminal and connect at 115200 baud
  4. Install a TFTP server and host your MTD3 backup there

If this setup is trivial to you ignore the following 1-4 instructions, if not continue reading:

///////////////////////////////////////////DETAILS/////////////////////////////////////////////////////

  1. Open the unit and solder a jumper over R2 and R5 pads, as @r5e mentioned in this post:
  1. Connect a USB to TTL adapter to your PC and install it's drivers (cheap ones from Amazon will do, mine uses CH341A chipset). It'll show up as a COM port (in this case COM3).

Locate header J1 on the ER605's PCB, and using the previous picture as guide (counting from RIGHT to LEFT as shown in the picture) connect pad 1 to RXD, pad 2 to TXD and pad 3 to GND on the USB to TTL adapter. Leave pad 4 (leftmost in the quoted picture) disconnected.

  1. Install Teraterm on your PC and run it.

New connection > Serial > Port: COM3 (make sure to select the correct COM port you just installed). Click "OK"

Go to Setup > Serial port... and change Speed to 115200. Click "New Setting"

You are ready to use ER605's UART, but before powering on the unit we need to set up a TFTP server to send our MTD3 backup to the unit

  1. Download Open TFTP Server and install it on your PC.

Connect LAN5 on the ER605 to your ethernet adapter, and change your IP address to 192.168.0.146

Copy your MTD3 backup to Open TFTP Server's root directory (in this case i named it mtd3.img) and run RunStandAloneMT.bat

///////////////////////////////////////////DETAILS/////////////////////////////////////////////////////

Go to Teraterm session and power up the ER605. Wait until you see U-Boot's boot selection menu:

  *** U-Boot Boot Menu ***

     1. Startup system (Default)
     2. Upgrade firmware
     3. Upgrade bootloader
     4. Upgrade bootloader (advanced mode)
     5. Load image
     0. U-Boot console


  Press UP/DOWN to move, ENTER to select

Select option 2. Upgrade Firmware (Alternatively you can boot to U-Boot console > run enphy > mtkupgrade fw)

Follow the on screen instructions, in my case:

*** Upgrading Firmware ***

Available load methods:
    0 - TFTP client (Default)
    1 - Xmodem
    2 - Ymodem
    3 - Kermit
    4 - S-Record

Select (enter for default): 0

Input U-Boot's IP address: 192.168.0.10
Input TFTP server's IP address: 192.168.0.146
Input IP netmask: 255.255.255.0
Input file name: mtd3.img

Hit enter and you'll start to download your MTD3 backup to RAM (specifically to 0x80010000 address). The screen will show #### during the transfer, do not interrupt the process. After it finishes it sholud show:

done
Bytes transferred = 130809856 (7cc0000 hex)

*** Loaded 130809856 (0x7cc0000) bytes at 0x80010000 ***

*** Flash erasure [140000-7dfffff] failed! ***

As you see, in my case the Flash memory erasing and writing that should occur after this fails for no aparent reason, so we'll continue manually.

run the command mtdparts and take note of the size and offset for the firmware partition:

=> mtdparts

device nand0 <nand0>, # parts = 5
 #: name                size            offset          mask_flags
 0: u-boot              0x00080000      0x00000000      0
 1: u-boot-env          0x00080000      0x00080000      0
 2: factory             0x00040000      0x00100000      0
 3: firmware            0x07cc0000      0x00140000      0
 4: panic-oops          0x00200000      0x07e00000      0

active partition: nand0,0 - (u-boot) 0x00080000 @ 0x00000000

defaults:
mtdids  : nand0=nand0
mtdparts: mtdparts=nand0:512k(u-boot),512k(u-boot-env),256k(factory),127744k(firmware),2048k(panic-oops)

From this we get that the starting address for the firmware partition on the NAND Flash is 0x00140000, and is (as expected) 0x07cc0000 bytes long.

To erase the flash run the command nand erase (offset - size):

nand erase 0x00140000 0x07cc0000

Finally, to write our MTD3 backup from RAM to Flash we'll use the command nand write (RAM start address - offset - size):

nand write 0x80010000 0x00140000 0x07cc0000

This process will take some minutes, do not interrupt it. You may get the occasional "skipping bad block at 0x########". This is expected, just wait until operation finishes.

Restart your router and you should boot original firmware.

Just to be sure, after I had access to the TP-Link GUI I reflashed the firmware going to:

System tools > Management > Firmware Upgrade

Browse to original firmware version > Upgrade

Thanks to @chill1Penguin @r5e @phrfpeixoto and everyone who offered some help on this topic!

6 Likes