Here're Build for TP-Link Archer C1200-AC1200 the similar problem described and the potential solution to dump stock. So, we need an owner of the stock firmware who can help us and himself for the future. I think we need put somewhere(most likely here https://openwrt.org/toh/tp-link/archer-c5-c7-wdr7500#recovery_using_serial_connection) an note for owners of Archer C7 v5 something like:
BEWARE You may brick your device as others did, help us and yourself !!!
Please contact ... for the instructions how to get stock firmware before you start.
Update. I moved a step closer but this is not the solution as I still have not fixed it.
Below the steps. But I think the reason why I can't fix is that the web interface seems expects a Firmware Recovery file while I'm giving just firmware. I think this just because I see the message in the logs
Firmware Recovery file length : 3997406
The steps:
Once I got a message HTTP server is ready!
Setting 0x181162c0 to 0x41822100
[NM_Error](nm_api_checkInteger) 00384: extra-para:a6 3b
[NM_Error](nm_api_checkInteger) 00389: factory boot check integer flag is not 1.
Hit any key to stop autoboot: 0
Trying eth0
eth0 link down
FAIL
Trying eth0
dup 1 speed 1000
HTTP server is starting at IP: 192.168.0.1
HTTP server is ready!
I opened http://192.168.0.1/ and received router page saying an error happened
I selected same file from tftp server It rebooted and yes! It looks promising!
I specified the password and after reboot when I enter password, it detects that password is correct and then redirects me to a internal page like I logged in then it redirects me back to login page. When I tried to enter incorrect password it clearly showed popup that password incorrect.
I decided to try to flash openwrt from web interface and it did not work as it stops at Starting application at 0x80010000. here's the logs
[NM_Error](nm_api_checkInteger) 00389: factory boot check integer flag is not 1.
Hit any key to stop autoboot: 0
Trying eth0
eth0 link down
FAIL
Trying eth0
dup 1 speed 1000
HTTP server is starting at IP: 192.168.0.1
HTTP server is ready!
Request for: /
Request for: /
Data will be downloaded at 0x80060000 in RAM
Upgrade type: firmware
Upload file size: 3997406 bytes
Loading: #######################################
#######################################
#######################################
###################################
Firmware Recovery file length : 3997406
Firmware process common.
Image verify OK!
Firmware file Verify ok!
product-info:product_name:Archer C7
product_ver:5.0.0
special_id:55530000
[Error]sysmgr_cfg_checkSupportList(): 1023 @ specialId 00000000 NOT Match.
Firmware supports, check OK.
Firmware Recovery check ok!
upgrade_filecheck ok
HTTP upload is done! Upgrading...
do http upgrade
Firmware Recovery file length : 3997406
Firmware process common.
Image verify OK!
Firmware file Verify ok!
product-info:product_name:Archer C7
product_ver:5.0.0
special_id:55530000
[Error]sysmgr_cfg_checkSupportList(): 1023 @ specialId 00000000 NOT Match.
Firmware supports, check OK.
Firmware Recovery check ok!
set integer flag to 0.
##################################################################
Done.
set integer flag to 1.
Firmware Recovery Success!
HTTP ugrade is done! Rebooting...
▒
U-Boot 1.1.4 (Mar 8 2018 - 16:34:18)
ap152 - Dragonfly 1.0
DRAM: 128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 413k for U-Boot at: 87f98000
Reserving 16448k for malloc() at: 86f88000
Reserving 44 Bytes for Board Info at: 86f87fd4
Reserving 36 Bytes for Global Data at: 86f87fb0
Reserving 128k for boot params() at: 86f67fb0
Stack Pointer at: 86f67f98
Now running in RAM - U-Boot at: 87f98000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment
In: serial
Out: serial
Err: serial
Net: ath_gmac_enet_initialize...
Fetching MAC Address from 0x87fbafdc
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:00:29:ac:00:00
eth0 up
eth0
Setting 0x181162c0 to 0x4b962100
[NM_Error](nm_api_checkInteger) 00384: extra-para:01 01
[393]factory boot check integer ok.
factory boot load fs uboot len 33 to addr 0x80010000.
Hit any key to stop autoboot: 0
## Starting application at 0x80010000 ...
Update 2.
Did an attempt to flash a latest tplink firmware https://static.tp-link.com/2018/201805/20180518/Archer%20C7(US)_V5_180425.zip
after update and reload entered a password and same problem it asks again for a password, but this time I pressed some keys in the Putty and I got a to a terminal as a root.
BusyBox v1.19.4 (2017-12-14 11:10:02 HKT) built-in shell (ash)
Enter 'help' for a list of built-in commands.
MM NM MMMMMMM M M
$MMMMM MMMMM MMMMMMMMMMM MMM MMM
MMMMMMMM MM MMMMM. MMMMM:MMMMMM: MMMM MMMMM
MMMM= MMMMMM MMM MMMM MMMMM MMMM MMMMMM MMMM MMMMM'
MMMM= MMMMM MMMM MM MMMMM MMMM MMMM MMMMNMMMMM
MMMM= MMMM MMMMM MMMMM MMMM MMMM MMMMMMMM
MMMM= MMMM MMMMMM MMMMM MMMM MMMM MMMMMMMMM
MMMM= MMMM MMMMM, NMMMMMMMM MMMM MMMM MMMMMMMMMMM
MMMM= MMMM MMMMMM MMMMMMMM MMMM MMMM MMMM MMMMMM
MMMM= MMMM MM MMMM MMMM MMMM MMMM MMMM MMMM
MMMM$ ,MMMMM MMMMM MMMM MMM MMMM MMMMM MMMM MMMM
MMMMMMM: MMMMMMM M MMMMMMMMMMMM MMMMMMM MMMMMMM
MMMMMM MMMMN M MMMMMMMMM MMMM MMMM
MMMM M MMMMMMM M M
M
---------------------------------------------------------------
For those about to rock... (%C, %R)
---------------------------------------------------------------
root@ArcherC7v5:/#
Found interesting files
root@ArcherC7v5:/etc# cat openwrt_version
%V
root@ArcherC7v5:/etc# cat openwrt_release
DISTRIB_ID="%D"
DISTRIB_RELEASE="%C"
DISTRIB_REVISION="%R"
DISTRIB_CODENAME="%n"
DISTRIB_TARGET="%S"
DISTRIB_DESCRIPTION="%D %N %V"
root@ArcherC7v5:/etc#
root@ArcherC7v5:/etc#
