I just exchanged my defective deco x20 and in exchange I received the v3.
Going through the existing supported device, can confirm the deco x20 v3 use the same hardware as that of number 14-17.
Can someone help me create an image for my device.
you build the image but how you are gonna flash it?
With safest posssible way.
X20 v3
kernel 3.10.108 and based on OpenWrt 12.09-rc1
_X20 3.0_en_1.0.7 Build 20230413 Rel. 36949_US_EU_JP_B4_EG_up.bin.extracted# binwalk jffs2-root/fs_1/imageuboot
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0xE2299E32, created: 2023-04-13 02:15:42, image size: 144584 bytes, Data Address: 0xA01FB040, Entry Point: 0xA0200000, data CRC: 0x88D24931, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: none, image name: "NAND Flash I"
119212 0x1D1AC CRC32 polynomial table, little endian
120236 0x1D5AC U-Boot version string, "U-Boot 1.1.3 (Apr 13 2023 - 10:15:38)"
WDMyCloud:/mnt/shares/Public/Downloads/_X20 3.0_en_1.0.7 Build 20230413 Rel. 36949_US_EU_JP_B4_EG_up.bin.extracted# binwalk jffs2-root/fs_1/vmlinuz
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0xE88062EE, created: 2023-04-13 02:14:20, image size: 3358613 bytes, Data Address: 0x81001000, Entry Point: 0x81778C60, data CRC: 0x58E55B04, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
64 0x40 LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 11610112 bytes
_X20 3.0_en_1.0.7 Build 20230413 Rel. 36949_US_EU_JP_B4_EG_up.bin.extracted#
All extracted using binwalk . Look like good candidate for OpenWrt support . Go for it
the gpl src is public and they use 15.05 not 12 check above discussion thanks.
bad news for you, you can't do it that way, no one ever flashed or tried openwrt on this model, and currently, there are no webui or ssh vulnerabilities exposed for this model yet, so you have to open it and mess around with the internals.
and asking Tplink support didnt help, if they open-sourced it why not at least give some hints or help ;(
Hi, more than one year later 
Opening the device (v3) and soldering on a serial connection allows you to open.
httpd -start www server for firmware recovery.Which allows uploading bin files via http.
uploading a bin file that has the same chipset gives as stated by device 14-17 gives. ## Error: HTTP upgrade file check failed!
Any tips on how to build the right firmware for this device?
Can you share any details on where you soldered the serial connection?
What firmware did you try to upload ? Perhaps it is checking some hardware identifier or fw-type in the header
According to this article, you don't need to solder anything to access the U-Boot bootloader. There is also a TFTP method available.
Also can you provide details on the firmware.
The firmware has a section at the end which indicates the hardware that it is supported on, so it is likely conflicting:
SupportList:
{product_name:X20,product_ver:3.0.0,special_id:55530000}
{product_name:X20,product_ver:3.0.0,special_id:45550000}
{product_name:X20,product_ver:3.0.0,special_id:42340000}
{product_name:X20,product_ver:3.0.0,special_id:45470000}
{product_name:X20,product_ver:3.0.0,special_id:4A500000}
{product_name:X20,product_ver:3.0.0,special_id:53450000}
{product_name:X25,product_ver:3.0.0,special_id:55530000}
{product_name:W3600,product_ver:3.0.0,special_id:55530000}
soft_ver:1.1.5 Build 20231026 Rel. 62511
fw_id:8D6D6DEFEA941288339DA94E6BC8E286
cfg_ver:X20h3.0.0V1.1.5P1-1387FA6FEDA451D517DB441DD2C16F7B
How did you build your firmware?
I actually own ver 3.0 unit. I would love to test it out.
I just bought a set of 3 units, I haven't tried to build anything yet
The firmware structure is the same as the Mercusys H80X and the TP-Link Deco X50 too - Mercusys h80X / tp-link X50 deco firmware ubinize - which follows the tplink-safeloader.c - https://github.com/openwrt/firmware-utils/blob/master/src/tplink-safeloader.c
From what I can see, the EAP615-WALL is probably the best starting point to get the X20 working for hardware, but the partition layout is more similar to the Deco S4_V2...
GPL Source Code for the v3 (https://static.tp-link.com/upload/gpl-code/2022/202212/20221213/x20v3-gpl.tar.gz) has the following partition layout:
CONFIG_BOOTARGS="flashname=MT7621-NAND mtdparts=MT7621-NAND:0x00100000@0x00000000(uboot)ro,0x00100000@0x00100000(ubootenv),0x00100000@0x00200000(radio),0x02A00000@0x00300000(root0),0x02A00000@0x02D00000(root1),0x00900000@0x05700000(factory_data),0x01100000@0x06000000(runtime_data),128M@0(wholeflash),0x00100000@0x00100000(nvram),0x02A00000@0x00300000(rootfs_0)ro,0x02A00000@0x02D00000(backup) console=ttyS1,115200 root=/dev/mtdblock9 rootfstype=jffs2 init=/etc/preinit printk.time=1 nand0=MT7621-NAND"
You can use the UART on the board, TP1(rx), TP2(tx), and TP4 (ground), and boot can be interrupted with the number 4.
MT7621 # printenv
bootargs=flashname=MT7621-NAND mtdparts=MT7621-NAND:0x00100000@0x00000000(uboot)ro,0x00100000@0x00100000(ubootenv),0x00100000@0x00200000(radio),0x02A00000@0x00300000(root0),0x02A00000@0x02D00000(root1),0x00900000@0x05700000(factory_data),0x01100000@0x06000000(runtime_data),128M@0(wholeflash),0x00100000@0x00100000(nvram),0x02A00000@0x00300000(rootfs_0)ro,0x02A00000@0x02D00000(backup) console=ttyS1,115200 root=/dev/mtdblock9 rootfstype=jffs2 init=/etc/preinit printk.time=1 nand0=MT7621-NAND
bootcmd=tftp
bootdelay=0x1
baudrate=115200
ethaddr="00:AA:BB:CC:DD:10"
ipaddr=192.168.0.1
serverip=192.168.0.5
product_name=X20
vendor_name=TP-LINK
vendor_url=www.tp-link.com
product_language=US
product_id=35922006
product_ver=3.0
special_id=55530000
has_default_mac=1
tp_boot_idx=0
stdin=serial
stdout=serial
stderr=serial
Environment size: 818/4092 bytes
bootlog partitions line up to what shows in uboot:
[ 2.484000] Creating 11 MTD partitions on "MT7621-NAND":
[ 2.488000] 0x000000000000-0x000000100000 : "uboot"
[ 2.496000] 0x000000100000-0x000000200000 : "ubootenv"
[ 2.500000] 0x000000200000-0x000000300000 : "radio"
[ 2.508000] 0x000000300000-0x000002d00000 : "root0"
[ 2.524000] 0x000002d00000-0x000005700000 : "root1"
[ 2.544000] 0x000005700000-0x000006000000 : "factory_data"
[ 2.552000] 0x000006000000-0x000007100000 : "runtime_data"
[ 2.564000] 0x000000000000-0x000007f80000 : "wholeflash"
[ 2.604000] 0x000000100000-0x000000200000 : "nvram"
[ 2.608000] 0x000000300000-0x000002d00000 : "rootfs_0"
[ 2.628000] 0x000002d00000-0x000005700000 : "backup"
It is possible to drop to a failsafe root shell by hitting f followed by enter.
Bootlog from factory - https://pub.microbin.eu/upload/emu-fly-crow
First cut of build, totally untested, but it compiles - https://github.com/dmascord/openwrt/tree/add_tplink_deco_x20
Looks like the other pastebin is not working, so here is another link for the bootlog - https://pastebin.com/h6VBtMKB
Attempting to boot using the recovery HTTP results in the following issue:
Firmware process common.
Firmware verify OK!
firmware(size 0x6d2218) verify pass!
HTTP upload is done! Upgrading...
do http upgrade
[NM_Error](nm_upgradeFirmware) 00494: Verify sig error!
Currently it is possible to boot the initrd image that is built.
a) build from source using my latest commit
b) copy the initrd image into a tftp server directory, as test.bin (for convenience)
c) connect UART and hit 4 while it boots, and it will show a # uboot prompt
d) set your tftp server to be 192.168.0.5
e) type tftpboot in uboot
f) type bootm and hit enter
root@OpenWrt:/# uname -a
Linux OpenWrt 6.6.41 #0 SMP Sun Jul 28 06:11:36 2024 mips GNU/Linux
Current state is that the ubifs can be mounted, but currently only manually by mount -t ubifs /dev/ubi0_0 etc.
Bootlog from openwrt initrd - https://pastebin.com/iMxfdGqb
1 Like
Any chance the v3.6 and the v3 are identical? They share an identical firmware update from the bug fixes, release date, and file size from the tp-link website.
In the world of TP-Link, vX.y usually is the same as vX.
v3.6 and v3 are linked to the same gpl code provided on the tplink website so it's most likely the same. Probably gonna look into installing openwrt into my v3.6.
v3.26 on the other hand looks different as it has different firmware bug fixes, different release date, different file size and it's own gpl code.