Reseting Archer C7 AC1750v5 to Stock Firmware

[Sysgone]

Hi,
I want to restore the factory firmware but I have a problem with the file / partition size.
After install OpenWRT i see on console:

...
flash size 16MB, sector count = 256
Flash: **16 MB**
...

root@OpenWrt:~# **df -h**
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 **2.8M**      2.8M         0 100% /rom
tmpfs                    60.8M    308.0K     60.5M   0% /tmp
/dev/mtdblock9           **10.7M**    432.0K     10.3M   4% /overlay
overlayfs:/overlay       10.7M    432.0K     10.3M   4% /
tmpfs                   512.0K         0    512.0K   0% /dev

root@OpenWrt:~# **cat /proc/mtd** 
dev:    size   erasesize  name
mtd0: 00020000 00010000 "factory-uboot"
mtd1: 00020000 00010000 "u-boot"
mtd2: 00010000 00010000 "partition-table"
mtd3: 00010000 00010000 "art"
mtd4: 00020000 00010000 "info"
mtd5: 00040000 00010000 "user-config"
mtd6: 00f00000 00010000 "firmware"
mtd7: 00190000 00010000 "kernel"
mtd8: 00d70000 00010000 "rootfs"
mtd9: 00ab0000 00010000 "rootfs_data"
mtd10: 00010000 00010000 "default-config"

If i try to restore openwrt*.bin via tftp method, all works well, but when I try with stock firmware or dd-wrt, I see problem with download file.

Filename 'ArcherC7v5_tp_recovery.bin'.
Load address: 0x80060000
Loading: #################################################################
...
 #############################################Tftp server tranfer fail!
tftpboot firmware failed, now start normally.
[NM_Error](nm_api_checkInteger) 00384: extra-para:01 01

Maybe this is file size problem?

openwrt-19.07.0-ath79-generic-tplink_archer-c7-v5-squashfs-factory.bin 4488316 ( 4MB )
openwrt-18.06.1-ar71xx-generic-archer-c7-v5-squashfs-factory.bin 3997406 ( 4MB )

factory-to-ddwrt.bin 14150584 ( 14MB )
Archer C7(EU)_V5_190726.bin 15567490 ( 14MB )

Where restore procedure saving file? Maybe there is no place for that?
When I split stock firmware to 4MB, download finish OK ( I just check tftp downloading, I didn't count on booting the system )

Filename 'ArcherC7v5_tp_recovery.bin'.
Load address: 0x80060000
Loading: #################################################################
...
 ########################################
**done**
Bytes transferred = 4194304 (400000 hex)
Firmware downloaded... filesize = 0x400000 fileaddr = 0x80060000.
[NM_Error](nm_tpFirmwareCheck) 01402: The file's length is bad(buf:4194304 fileLen15567490)
recovery failed.

So 4MB file was downloaded correctly.

My questions are:

• how to increase space for downloaded stock image?
• where tftp saving downloaded file?

I havn't running TX line to console, RX only, I can run only via ssh.
regards
Sysgone

[DjiPi]

Welcome!

There is a thread about the V5 here, that points to wiki documentation. Take a look if it helps you get back to stock:

Tp-link Archer C7 V5 - Revert firmware to factory

Good Morning. I have a Tp-link Archer C7 V5 router. Yesterday I did the firmware update for the latest version of OpenWRT. It worked out perfectly. My question is: How do I go back to the original factory version of tp-link? I tried to flash with the latest .bin firmware, however, from the error. Any tips? Thankful!

You need to strip vendor info and Uboot from the stock firmware first. This procedure is documented in the wiki (using dd)

[Sysgone]

I try but the best I could get was:

## Booting image at 9f0c0000 ...
   Image Name:   MIPS OpenWrt Linux-3.3.8
   Created:      2019-07-26   7:46:14 UTC
   Image Type:   MIPS Linux Multi-File Image (lzma compressed)
   Data Size:    1088500 Bytes =  1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Contents:
   Image 0:  1088492 Bytes =  1 MB
   Verifying Checksum at 0x9f0c0040 ...OK
   Uncompressing Multi-File Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 3.3.8 (leo@leo-MS-7529) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Mon May 20 18:53:02 CST 2019
[    0.000000] bootconsole [early0] enabled
...
[    0.000000] Kernel command line:  console=ttyS0,115200 board=AP152 rootfstype=squashfs init=/etc/preinit mtdparts=spi0.0:128k(factory-uboot),192k(u-boot),64k(ART),1536k(uImage),14464k@0xd
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 126220k/131072k available (2324k kernel code, 4852k reserved, 584k data, 180k init, 0k highmem)
...
[    0.450000] 5 cmdlinepart partitions found on MTD device spi0.0
[    0.460000] Creating 5 MTD partitions on "spi0.0":
[    0.460000] 0x000000000000-0x000000020000 : "factory-uboot"
[    0.470000] 0x000000020000-0x000000050000 : "u-boot"
[    0.480000] 0x000000050000-0x000000060000 : "ART"
[    0.480000] 0x000000060000-0x0000001e0000 : "uImage"
[    0.490000] 0x0000001e0000-0x000001000000 : "rootfs"
[    0.500000] mtd: partition "rootfs" set to be root filesystem
...
[    1.230000] VFS: Cannot open root device "(null)" or unknown-block(31,4)
[    1.240000] Please append a correct "root=" boot option; here are the available partitions:
[    1.250000] 1f00             128 mtdblock0  (driver?)
[    1.250000] 1f01             192 mtdblock1  (driver?)
[    1.260000] 1f02              64 mtdblock2  (driver?)
[    1.270000] 1f03            1536 mtdblock3  (driver?)
[    1.270000] 1f04           14464 mtdblock4  (driver?)
[    1.280000] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,4)

I check offset by binwalk

binwalk Archer\ C7\(EU\)_V5_190726.bin 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
21876         0x5574          U-Boot version string, "U-Boot 1.1.4-g4480d5f9-dirty (May 20 2019 - 18:45:16)"
21940         0x55B4          CRC32 polynomial table, big endian
23232         0x5AC0          uImage header, header size: 64 bytes, header CRC: 0x386C2BD5, created: 2019-05-20 10:45:17, image size: 41162 bytes, Data Address: 0x80010000, Entry Point: 0x80010000, data CRC: 0xC9CD1E38, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image"
23296         0x5B00          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 97476 bytes
64968         0xFDC8          XML document, version: "1.0"
78448         0x13270         uImage header, header size: 64 bytes, header CRC: 0x78A267FF, created: 2019-07-26 07:46:14, image size: 1088500 bytes, Data Address: 0x80060000, Entry Point: 0x80060000, data CRC: 0xBB9D4F94, OS: Linux, CPU: MIPS, image type: Multi-File Image, compression type: lzma, image name: "MIPS OpenWrt Linux-3.3.8"
78520         0x132B8         LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 3164228 bytes
1167013       0x11CEA5        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 14388306 bytes, 2541 inodes, blocksize: 65536 bytes, created: 2019-07-26 07:51:38
15555328      0xED5B00        gzip compressed data, from Unix, last modified: 2019-07-26 07:51:41

and cut images by dd:

dd if=Archer\ C7\(EU\)_V5_190726/Archer\ C7\(EU\)_V5_190726.bin of=firmware.bin bs=1 skip=23232

of course after cut, I move firmware.bin to ArcherC7v5_tp_recovery.bin

[fced]

Hello
Have you successfully reverted your Archer C7 v5 to factory firmware ? I tried but without success, any help would be appreciated, thanks ...

[DjiPi]

This doesn't look right for the cut. As documented it should be:

dd if=original.bin of=stripped.bin skip=257 bs=512

Do the cut on an old TP-Link firmware.

Tp-link Archer C7 V5 - Revert firmware to factory

@Helder, welcome to the community! https://openwrt.org/toh/tp-link/archer-c5-c7-wdr7500#return_to_factory_firmware

[filippobistaffa]

How is it supposed to look like after the cut?
I am currently using the documented dd command on the oldest available version for V5, i.e., Archer C7(EU)_V5_201030.

Before the cut:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
21876         0x5574          U-Boot version string, "U-Boot 1.1.4-gbec4c55d-dirty (Oct 20 2020 - 22:43:09)"
21940         0x55B4          CRC32 polynomial table, big endian
23232         0x5AC0          uImage header, header size: 64 bytes, header CRC: 0xAA7490A7, created: 2020-10-20 14:43:11, image size: 41172 bytes, Data Address: 0x80010000, Entry Point: 0x80010000, data CRC: 0x1D89B83A, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image"
23296         0x5B00          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 97476 bytes
65041         0xFE11          XML document, version: "1.0"
78731         0x1338B         uImage header, header size: 64 bytes, header CRC: 0xD2250C62, created: 2020-10-20 14:54:37, image size: 1088171 bytes, Data Address: 0x80060000, Entry Point: 0x80060000, data CRC: 0x1ED05219, OS: Linux, CPU: MIPS, image type: Multi-File Image, compression type: lzma, image name: "MIPS OpenWrt Linux-3.3.8"
78803         0x133D3         LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 3164228 bytes
1166967       0x11CE77        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 14378698 bytes, 2589 inodes, blocksize: 65536 bytes, created: 2020-10-30 07:26:36
15545674      0xED354A        gzip compressed data, from Unix, last modified: 2020-10-21 00:31:07

After the cut:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
1035383       0xFCC77         Squashfs filesystem, little endian, version 4.0, compression:xz, size: 14378698 bytes, 2589 inodes, blocksize: 65536 bytes, created: 2020-10-30 07:26:36
15414090      0xEB334A        gzip compressed data, from Unix, last modified: 2020-10-21 00:31:07

[filippobistaffa]

I understand your point "in theory", but the size of factory images is not even always the same, for instance, comparing the 19.07.7 and snapshot images on this page.

[slh]

O.k., then they've changed the firmware syntax for v5.

[filippobistaffa]

For anyone out there trying to restore the OEM firmware on the Archer c7 v5, forget about the "stripping" method (I believe the instructions and the sizes mentioned here are not valid anymore, at least for v5).
Instead, go directly with the "tftp" method, it worked flawlessly for me and I think it might be safer as well, as the risk of bricking the router is much lower (if you do something wrong, you won't flash anything).