Support for TP-Link Touch P5

Hello everyone!

I have TP-Link Touch P5
I found some information on wikidevi: Touch P5
Also there is similar model to it: RE590T

But unfortunately there is no custom firmware available for this good routers :frowning:
As I can see, it's pretty fast, contains two ARM cores plenty of ram and a touchscreen.

How to connect to ssh

I was playing with router and default firmware for a couple of days and there is ssh root shell available on router.
Here is the way how to get it:

  • You should reset router settings to default and not changing default password, so main login account supposed to be admin:admin.
    I don't know why, but they broke authentication in dropbear binary, so it works only with this credentials.
  • After that, you're able to use ssh by default port and router ip address.
    Important note: if you'll reset router, rsa keys will be different, so you can just delete them from your local .ssh/known_hosts file
  • gifcast_181105221118
  • It seems this router works on QS DK fork, which is fork from OpenWRT probably

Firmware changes

Unfortunately I wasn't able to find out how to change anything in firmware, because it's mounted in read-only.
If someone will help me with that, I'll be very thankful! :slight_smile:

root@Akronite:~# mount
/dev/mtdblock2 on / type squashfs (ro,noatime)
devtmpfs on /dev type devtmpfs (rw,relatime,size=127496k,nr_inodes=31874,mode=755)
proc on /proc type proc (rw,noatime)
sysfs on /sys type sysfs (rw,noatime)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noatime)
devpts on /dev/pts type devpts (rw,noatime,mode=600)
root on /overlay type tmpfs (rw,noatime,mode=755)
/dev/mtdblock2 on /mnt type squashfs (ro,noatime)
root on /mnt type tmpfs (rw,noatime,mode=755)
none on /etc type ramfs (rw,relatime)
none on /lib/wifi type ramfs (rw,relatime)
none on /usr/lib/lua type ramfs (rw,relatime)
none on /proc/bus/usb type usbfs (rw,relatime)

Also I found that there is big amount of data stored in nvram.

root@Akronite:~# nvrammanager -s
partition 01: name = fs-uboot        , base = 0x00000000, size = 0x00040000 Bytes, usedFlag = 1
partition 02: name = os-image1       , base = 0x00040000, size = 0x00200000 Bytes, usedFlag = 1
partition 03: name = file-system1    , base = 0x00240000, size = 0x00c00000 Bytes, usedFlag = 1
partition 04: name = default-mac     , base = 0x00e40000, size = 0x00000200 Bytes, usedFlag = 1
partition 05: name = pin             , base = 0x00e40200, size = 0x00000200 Bytes, usedFlag = 1
partition 06: name = product-info    , base = 0x00e40400, size = 0x0000fc00 Bytes, usedFlag = 1
partition 07: name = partition-table , base = 0x00e50000, size = 0x00010000 Bytes, usedFlag = 1
partition 08: name = soft-version    , base = 0x00e60000, size = 0x00010000 Bytes, usedFlag = 1
partition 09: name = support-list    , base = 0x00e70000, size = 0x00010000 Bytes, usedFlag = 1
partition 10: name = profile1        , base = 0x00e80000, size = 0x00010000 Bytes, usedFlag = 1
partition 11: name = default-config1 , base = 0x00e90000, size = 0x00010000 Bytes, usedFlag = 1
partition 12: name = user-config1    , base = 0x00ea0000, size = 0x00040000 Bytes, usedFlag = 1
partition 13: name = qos-db          , base = 0x00ee0000, size = 0x00040000 Bytes, usedFlag = 1
partition 14: name = log             , base = 0x00fc0000, size = 0x00020000 Bytes, usedFlag = 1
partition 15: name = radio_bk        , base = 0x00fe0000, size = 0x00010000 Bytes, usedFlag = 1
partition 16: name = os-image2       , base = 0x01040000, size = 0x00200000 Bytes, usedFlag = 1
partition 17: name = file-system2    , base = 0x01240000, size = 0x00500000 Bytes, usedFlag = 1
partition 18: name = user-config2    , base = 0x01770000, size = 0x00010000 Bytes, usedFlag = 1
partition 19: name = default-config2 , base = 0x01780000, size = 0x00010000 Bytes, usedFlag = 1
partition 20: name = profile2        , base = 0x01790000, size = 0x00000400 Bytes, usedFlag = 1
partition 21: name = mcu             , base = 0x01800000, size = 0x007f0000 Bytes, usedFlag = 1
partition 22: name = radio           , base = 0x01ff0000, size = 0x00010000 Bytes, usedFlag = 1
partition 23: name =                 , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 24: name =                 , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 25: name =                 , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 26: name =                 , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 27: name =                 , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 28: name =                 , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 29: name =                 , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 30: name =                 , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 31: name =                 , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0
partition 32: name =                 , base = 0x00000000, size = 0x00000000 Bytes, usedFlag = 0

Please help me to figure out how I can make any changes to firmware. I would appreciate any help.
Feel free to ask questions or requests for additional information. I just don't know what might be needed...

Some additional information about the router TP-Link Touch P5

root@Akronite:~# cat /proc/cpuinfo 
Processor	: ARMv7 Processor rev 0 (v7l)
processor	: 0
BogoMIPS	: 1998.84

processor	: 1
BogoMIPS	: 1992.29

Features	: swp half thumb fastmult edsp 
CPU implementer	: 0x41
CPU architecture: 7
CPU variant	: 0x3
CPU part	: 0xc09
CPU revision	: 0

Hardware	: Northstar Prototype
Revision	: 0000
Serial		: 0000000000000000
root@Akronite:~# cat /proc/meminfo 
MemTotal:         255216 kB
MemFree:          174436 kB
Buffers:            8804 kB
Cached:            35364 kB
SwapCached:            0 kB
Active:            18700 kB
Inactive:          31748 kB
Active(anon):       6632 kB
Inactive(anon):      736 kB
Active(file):      12068 kB
Inactive(file):    31012 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          6296 kB
Mapped:             4816 kB
Shmem:              1088 kB
Slab:              12492 kB
SReclaimable:       2400 kB
SUnreclaim:        10092 kB
KernelStack:         584 kB
PageTables:          604 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:      127608 kB
Committed_AS:      17504 kB
VmallocTotal:     516096 kB
VmallocUsed:       34380 kB
VmallocChunk:     436456 kB
root@Akronite:~# lsblk
NAME      MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
mtdblock0  31:0    0   256K  0 disk 
mtdblock1  31:1    0  15.7M  0 disk 
mtdblock2  31:2    0  13.7M  0 disk /
mtdblock3  31:3    0   128K  0 disk 
mtdblock4  31:4    0    64K  0 disk 
root@Akronite:~# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00040000 00010000 "boot"
mtd1: 00fb0000 00010000 "linux"
mtd2: 00db0000 00010000 "rootfs"
mtd3: 00020000 00010000 "log"
mtd4: 00010000 00010000 "nvram"

First thing I would do is "dump" the flash and nvram to files and put them somewhere very, very safe!

I made copy of mtdblocks with dd
and nvram stuff with nvrammanager -r

I was thinking to upload them here, but forum allows uploading only images

Interesting that mtdblock1 and mtdblock2 is really similar SquashFS files
I was thinking that maybe mtdblock1 might be something like "root" fs and mtdblock2 like "overlay" fs.
But unfortunately only mtdblock2 is mounted in /(root) and it's read-only.

Is it possible somehow check mtdblocks and compare with dumps by using md5 or something like that? I have binary md5sum on router.

binwalk is a pretty useful tool, along with potentially unsquashfs

I was using binwalk -e for extracting mtdblocks but I wasn't able to find something helpful... but probably I'm not looking in proper side...
Also there is few SquashFS was laying down in nvram
here is some information

$ file 0* 1* 2*
01: data
02: data
03: Squashfs filesystem, little endian, version 4.0, 11136040 bytes, 2320 inodes, blocksize: 131072 bytes, created: Thu Jan  7 02:02:22 2016
04: ASCII text, with no line terminators
05: ASCII text
06: ASCII text
07: ISO-8859 text
08: ASCII text, with no line terminators
09: ASCII text
10: SysEx File -
11: data
12: data
13: data
14: data
15: data
16: data
17: Squashfs filesystem, little endian, version 4.0, 5040580 bytes, 593 inodes, blocksize: 131072 bytes, created: Thu Jan  7 03:22:01 2016
18: empty
19: data
20: data
21: data
22: data

Probably second squashfs (#17) is something that display using, but I'm not really sure. It just looks different from mtdblocks

Here is output from binwalk

$ binwalk 0* 1* 2*   

01
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
147460        0x24004         LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 299576 bytes

02
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             TRX firmware header, little endian, image size: 1921024 bytes, CRC32: 0x6BC32430, flags: 0x0, version: 1, header size: 28 bytes, loader offset: 0x1C, linux kernel offset: 0x0, rootfs offset: 0x0
28            0x1C            LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 4579552 bytes

03
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Squashfs filesystem, little endian, version 4.0, compression:xz, size: 11136040 bytes, 2320 inodes, blocksize: 131072 bytes, created: 2016-01-07 02:02:22

04
nothing

05
nothing

06
nothing

07
nothing

08
nothing

09
nothing

10
nothing

11
nothing

12
nothing

13
nothing

14
nothing

15
nothing

16
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             TRX firmware header, little endian, image size: 1748992 bytes, CRC32: 0x18004EF, flags: 0x0, version: 1, header size: 28 bytes, loader offset: 0x1C, linux kernel offset: 0x0, rootfs offset: 0x0
28            0x1C            LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 4291328 bytes

17
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Squashfs filesystem, little endian, version 4.0, compression:xz, size: 5040580 bytes, 593 inodes, blocksize: 131072 bytes, created: 2016-01-07 03:22:01

18
nothing

19
nothing

20
nothing

21
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
1646240       0x191EA0        CRC32 polynomial table, little endian
1760839       0x1ADE47        Unix path: /www.tp-link.com/en/Support/.
2250562       0x225742        PC bitmap, Windows 3.x format,, 480 x 272 x 32
2772858       0x2A4F7A        PC bitmap, Windows 3.x format,, 480 x 272 x 24
3164594       0x3049B2        PC bitmap, Windows 3.x format,, 184 x 80 x 32

22
nothing

I also found that default firmware contains opkg but opkg update doesn't works
Here is default /etc/opkg.conf

$ cat /etc/opkg.conf 
src/gz attitude_adjustment http://downloads.openwrt.org/attitude_adjustment/12.09-rc1/model_brcm_bcm470x/generic/packages
dest root /
dest ram /tmp
lists_dir ext /var/opkg-lists
option overlay_root /overlay

Probably firmware based on 12.09-rc1. But everywhere I saw that firmware is from 2016... Why they was using release candidate ¯\_(ツ)_/¯

Also as I can see there is TP-Link Archer C1200 which might have same firmware that I have.

Hello @everyone!
Finally I've some news about this cool router.
I found a way how to make changes to main rootfs.

How to connect by ssh described above.
So there is steps:

  1. Making backup of third partition (partition 03: name = file-system1) with command on router
    nvrammanager -r /tmp/03 -p file-system1
  2. Copying this file to your main PC. For example run this on your main PC
    scp admin@192.168.0.1:/tmp/03 ~/03
  3. You will have file 03 in your home directory. Of course you can replace path on your PC from ~/03 to something other. After that you need to unsquash file with command
    unsquashfs 03
  4. This will create a new folder squashfs-root close to file 03
  5. Make some changes you need. For example first changes I made is replaced empty files in etc/dropbear
  6. For squash it back you need to use xz compression and all files supposed to be owned by root
    mksquashfs squashfs-root 03-new -comp xz -all-root
  7. New file 03-new will be probably smaller than main 03 but it's mainly because there is ff ff ff ff in the end of file. Without them, files will has almost identical size.
  8. To upload file back from PC you need to use scp again
    scp ~/03-new admin@192.168.0.1:/tmp/03-new
  9. Login again to the router and to flash this new image use command on router
    nvrammanager -w /tmp/03-new -p file-system1
  10. Don't worry flashing might take some time (up to 3 min). After flashing just reboot your router with
    reboot

I've used mksquashfs version 4.3-git (2017/11/29) It was provided in my Manjaro distro.

1 Like

Also additional information. I was able to run packages from here http://pkg.entware.net/binaries/armv7/Packages.html
There is some tricks needs to be done to enable /opt but when you have libraries packages seems works pretty well. I've tested htop, python3, busybox and also played crawl on the router a bit. Everything looks well.
Maybe if it's needed for someone, I'll create a guide about that.

I have this router and would love it if you could create a guide to install packages on there. Specifically python2 in my case

1 Like

Was you able to make any changes in your firmware already, like I described in next message?

If yes, please provide image of firmware that you have right now...

I'm not available until Wednesday unfortunately, but I would really like to help you with your router.
I will try to create guide about installing packages as soon as possible, when I will have access to my router...

The only thing that I can tell now:
You need to make somehow mounting your flash drive to folder /opt after booting.
It means that probably you need to format it properly and maybe create some scripts that will launch at start. This is why you really need to figure out how to make changes to firmware.
After that as I remember I was using alternative script from here for armv7 (kernel >= 2.6.36) https://github.com/Entware/Entware/wiki/Alternative-install-vs-standard
if opkg from Entware will be available, you will be able to install some packages including python for python2 or anything else.

And of course, feel free to ask questions :slight_smile:

I was able to make changes to a couple files using the method you described in your earlier post. All I did was edit a dnsmasq configuration file to see if my changes would be saved or not, and it turned out that they were saved!
Since then, I have remedied my original problem that was making me want/need to edit the firmware of this router. I have a different router that I am using primarily altogether, so this would just be a learning project for me.
That being said, I have a lot of learning to do; I don't even know where I would begin if I wanted to make scripts that do what you're describing. However, I am interested in learning more, and if you can make a little guide describing how to do this, I would be grateful! I'm a pretty quick learner, and I know my way around a computer better than the average person might (at least I think so)