Looking for Totolink X6000R full SPI flash dump

Hardware Questions and Recommendations
1

Hello everyone,

I’m currently trying to recover a Totolink X6000R (MT7981, NOR flash) that became unbootable after a wrong U-Boot / FIP formatting.

What happened

During a manual flashing process, the FIP (BL31 + BL33/U-Boot) was written to an incorrect offset. As a result:

  • BL2 (preloader) still runs
  • DRAM initializes correctly
  • But BL2 fails to locate the FIP, so the board cannot jump to U-Boot anymore

Current boot log stops with:

BL2: Failed to load image id 3 (-2)

Hardware details

  • Device: Totolink X6000R
  • SoC: MediaTek MT7981
  • Flash: SPI NOR 16MB (EN25QX128A)
  • DRAM: 256MB DDR3
  • Boot chain: BL2 → FIP → U-Boot → Linux

What I need

I am looking for:

  • Full SPI flash dump (16MB) from a working Totolink X6000R
    • OR at least:
      • Preloader (BL2)
      • FIP (BL31 + BL33/U-Boot)

This is only for bootloader recovery, and for unbrick my Totolink X6000R.

Notes

  • I Just Try Dumps from other MT7981 devices (Generic Preloader MT7981 and Generic FIP MT7981) are not compatible due to board-specific DDR and NOR layout
  • A dump from the same model (X6000R) is required

If anyone owns this device and is willing to help with a dump, I’d really appreciate it.
I’m also willing to cover any reasonable cost for your help.

Thank you very much :folded_hands:

2

Hi everyone,
I would like to add more technical details and logs to clarify my situation.

This Totolink X6000R (MT7981, NOR flash, DDR3) originally booted fine. The issue started after a wrong format / erase operation during SPI flashing, which caused the FIP region (BL31 + BL33 / U-Boot) to be lost or written at an incorrect offset.

Log 1: Original Totolink X6000R preloader (BL2)

This is the log from the original vendor preloader, which still runs correctly but fails to jump into FIP:

F0: 102B 0000
FA: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [0000]
T0: 0000 022A [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):C8380R_V500-B20221116-24-g6b03f11fe6-dirty
NOTICE:  BL2: Built : 08:44:41, Nov 23 2022
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings, ddr3_freq:1866
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  CPU: MT7981 (1300MHz)

WARNING: Firmware Image Package header check failed.
WARNING: Failed to access image id=3 (-2)
ERROR:   BL2: Failed to load image id 3 (-2)

This shows clearly:

  • Preloader / BL2 is original and functional
  • DRAM init is successful
  • Failure occurs only when loading FIP

Log 2: Generic OpenWrt MT7981 preloader

I also tested a generic MT7981 NOR DDR3 preloader from OpenWrt:

NOTICE:  BL2: v2.13.0(release):OpenWrt v2025.07.11~78a0dfd9-1 (mt7981-nor-ddr3)
NOTICE:  BL2: Built : 00:24:55, Jan  2 2026
NOTICE:  WDT: Cold boot
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)

ERROR:   io_dev_init failed for FIP image id 0 (-2)
ERROR:   Image id 3 open failed with -2
ERROR:   BL2: Failed to load image id 3 (-2)

Result is consistent:

  • Preloader executes correctly
  • DDR passes memory test
  • Boot stops because FIP cannot be opened or found

:small_blue_diamond: Conclusion

  • This is not a DRAM issue
  • This is not a CPU or preloader issue
  • The device fails only because the FIP region is missing or misaligned
  • The board never reaches U-Boot prompt

What I am looking for:

  • A full SPI flash dump from a working Totolink X6000R
  • Or at least a known-good FIP (BL31 + BL33 / U-Boot) from the same model

Using FIP/preloader from generic MT7981 preloader risky due to:

  • board-specific DDR and pinmux config
  • flash layout differences
  • factory data offsets

Even a partial dump is sufficient as long as it contains the correct boot chain.

Any help from X6000R owners or developers would be greatly appreciated.
Thank you :folded_hands:

3

Update:
I’ve successfully obtained a full SPI flash dump of the Totolink X6000R.

The dump was acquired from a replacement unit received through an official Totolink warranty (RMA) process.
The replacement device was brand new and untouched, and I performed a complete backup of the SPI flash before any modification.

The backup includes:

  • Preloader / BL2
  • FIP (BL31 + U-Boot)
  • Factory partition
  • Firmware layout as shipped

You can find the full dump here:
:backhand_index_pointing_right: https://drive.google.com/drive/folders/1X4UhId7mTm3r13N0wRdKQ08YWLUrrf12

Hopefully this helps anyone who has:

  • corrupted FIP
  • broken bootloader
  • bad flash layout
  • or a fully bricked X6000R

Feel free to use it for recovery, analysis, or comparison.
If needed, I can also share notes about the flash layout and offsets.

Thanks to everyone who replied and helped earlier :folded_hands: