TP-Link Archer C2 AC750 v1 on unofficial firmware

MordiSacks · January 26, 2024, 12:22pm

Hi,
I have several TP-Link Archer C2 AC750 v1 devices
all on an Israeli specific firmware

FW Version -
0.9.1 1.0 v0032.1 Build 150327 Rel. 45223n

HW Version -
Archer C2 v1 00000000

and cannot be update to latest available firmware from TP-LINK (error 4503)
TP-Link refers me to the importar for updates and they did not respond.

The tftp recovery method from

does not load
I assume this is because the U-boot is different.

Anyone has any Idea what can I do?

Thank you.

frollic · January 26, 2024, 12:27pm

without any error message(s), not really ...

MordiSacks · January 26, 2024, 5:11pm

What kind of error message can I provide?

As far as official firmware upgrade it just gives error 4503
as for TFTP recovery, it just hangs and never reboots (waited 45 minutes, docs state 20-25)

maurer · January 26, 2024, 5:30pm

From a serial console

MordiSacks · January 26, 2024, 6:05pm

I don't have a serial connector.

maurer · January 26, 2024, 6:07pm

You can order one the're quite cheap

MordiSacks · January 26, 2024, 6:36pm

I ordered this
https://www.amazon.com/dp/B07WX2DSVB

and this for

I Guess there is nothing else to do but to wait for it to arrive

psherman · January 26, 2024, 6:39pm

That is not a serial adapter. You've ordered a flash chip programmer. Could also be useful, but this is not what was being discussed.

You need a USB-serial (TTL) adapter... there are tons of variants, here's just one example

MordiSacks · January 26, 2024, 6:42pm

I put 2 links, don't know why only one shows up, this is the second one

psherman · January 26, 2024, 6:44pm

ah... ok.... I missed the other link (it's there but didn't make a preview, and I overlooked it.).

You should be all good with that adapter.

MordiSacks · January 26, 2024, 6:50pm

Thank you for confirming this should work for me.

It will take a month to get here so, I guess I will report back then.

It just occurred to me to ask here, I have a cisco rj45 console to usb,
I tried to read the device with it but know luck, should this be possible?, the hip it uses is an FT232 chip (I measured the voltage coming out of it and it was 6V+ , that does not seem right to me)

psherman · January 26, 2024, 6:55pm

This is almost certainly RS232 serial, not TTL. Don't use it on your router -- you may damage the router if it sees RS232 voltages which go positive and negative: (-3 to -15 V) to (+3 to +15V).

frollic · January 26, 2024, 6:56pm

I have the DSD Tech USB TTL, it's good, unless you want to use it on ZTE MF28*

MordiSacks · January 26, 2024, 6:58pm

Yes it is RS232 now I understand
Thank you.

MordiSacks · February 19, 2024, 4:46pm

Ok, the serial adapter arrived and I managed to connect it, Iv'e got logs!

There is a lot of data in the logs i'm putting here just what I think now is relevant

Boot

U-Boot 1.1.3 (Jun 23 2014 - 15:15:14)


Board: Ralink APSoC DRAM:  64 MB

relocate_code Pointer at: 83fb0000

enable ephy clock...done. rf reg 29 = 5

SSC disabled.

------------------

 Archer C2 v1.0.0

------------------

spi_wait_nsec: 29

spi device id: c2 20 17 c2 20 (2017c220)

find flash: MX25L6405D

============================================

Ralink UBoot Version: 4.1.2.0

--------------------------------------------

ASIC 7620_MP (Port5<->GigaSW)

DRAM component: 512 Mbits DDR, width 16

DRAM bus: 16 bit

Total memory: 64 MBytes

Flash component: SPI Flash

Date:Jun 23 2014  Time:15:15:14

============================================

And what show when I try to upgrade to latest TP-link firmware

Rcv Wcid(4) AddBAReq
Start Seq = 00000000
RTMP_TimerListAdd: add timer obj c0a55724!
[ rsl_sys_updateFirmware ] 1197:  Firmware Additional SoftwareVersion check failed

[ rdp_updateFirmware ] 337:  perror:4503
MulticastFilterTableInsertEntry: already in Members list.

Edit: added tftp recovery attempt log


U-Boot 1.1.3 (Jun 23 2014 - 15:15:14)


Board: Ralink APSoC DRAM:  64 MB

relocate_code Pointer at: 83fb0000

enable ephy clock...done. rf reg 29 = 5

SSC disabled.

------------------

 Archer C2 v1.0.0 

------------------

spi_wait_nsec: 29 

spi device id: c2 20 17 c2 20 (2017c220)

find flash: MX25L6405D

============================================ 

Ralink UBoot Version: 4.1.2.0

-------------------------------------------- 

ASIC 7620_MP (Port5<->GigaSW)

DRAM component: 512 Mbits DDR, width 16

DRAM bus: 16 bit

Total memory: 64 MBytes

Flash component: SPI Flash

Date:Jun 23 2014  Time:15:15:14

============================================ 

icache: sets:512, ways:4, linesz:32 ,total:65536

dcache: sets:256, ways:4, linesz:32 ,total:32768 


 ##### The CPU freq = 580 MHZ #### 

 estimate memory size =64 Mbytes

..................................................

starting recovery...

TODO, Read MAC Address from Flash


rt_rtl8367_init(1363):Begin


RTL8367RB is ready now!

rt_rtl8367_init(1404):Call Func rt_rtl8367_enableRgmii()

rt_rtl8367_enableRgmii(931):Begin


 netboot_common, argc= 3 


 NetTxPacket = 0x83FE57C0 


 KSEG1ADDR(NetTxPacket) = 0xA3FE57C0 


 NetLoop,call eth_halt ! 


 NetLoop,call eth_init ! 

Trying Eth0 (10/100-M)


 Waitting for RX_DMA_BUSY status Start... done



 ETH_STATE_ACTIVE!! 

TFTP from server 192.168.0.66; our IP address is 192.168.0.1

Filename 'ArcherC2V1_tp_recovery.bin'.


 TIMEOUT_COUNT=10,Load address: 0x80060000

Loading: *T T T Got ARP REPLY, set server/gtwy eth addr (30:52:00:00:00:00)

Got it

#T T #T ###T Got ARP REQUEST, return our IP

T #T T 

Retry count exceeded; starting again

do_bootm:argc=2, addr=0xbc020000

## Booting image at bc020000 ...

   Uncompressing Kernel Image ... OK

No initrd

## Transferring control to Linux (at address 8000c150) ...

## Giving linux memsize in MB, 64


Starting kernel ...

tftp server log

Using Port 69
Server started
spawning fork: 116048 to handle new request
Prossessng client READ request for ArcherC2V1_tp_recovery.bin
Sending Data: [1] Sent
Waiting for response..done
Sending Data: [2] Sent
Waiting for response..done
Sending Data: [3] Sent
Waiting for response..done
Sending Data: [4] Sent
Waiting for response..done
Sending Data: [5] Sent
Waiting for response..done
Sending Data: [6] Sent
Waiting for response..done
Sending Data: [7] Sent
Waiting for response..done
Sending Data: [8] Sent
Waiting for response..done
Sending Data: [9] Sent
Waiting for response..done
Sending Data: [10] Sent
Waiting for response..done
Sending Data: [11] Sent
Waiting for response..done
Sending Data: [12] Sent
Waiting for response..done
Sending Data: [13] Sent
Waiting for response..done
Sending Data: [14] Sent
Waiting for response..done
Sending Data: [15] Sent
Waiting for response..done
Sending Data: [16] Sent
Waiting for response..done
Sending Data: [17] Sent
Waiting for response..done
Sending Data: [18] Sent
Waiting for response..done
Sending Data: [19] Sent
Waiting for response..done
Sending Data: [20] Sent
Waiting for response..done
Sending Data: [21] Sent
Waiting for response..done
Sending Data: [22] Sent
Waiting for response..done
Sending Data: [23] Sent
Waiting for response..done
Sending Data: [24] Sent
Waiting for response..done
Sending Data: [25] Sent
Waiting for response..done
Sending Data: [26] Sent
Waiting for response..done
Sending Data: [27] Sent
Waiting for response..done
Sending Data: [28] Sent
Waiting for response..done
Sending Data: [29] Sent
Waiting for response..done
Sending Data: [30] Sent
Waiting for response..done
Sending Data: [31] Sent
Waiting for response..done
Sending Data: [32] Sent
Waiting for response..done
Sending Data: [33] Sent
Waiting for response..done
Sending Data: [34] Sent
Waiting for response..done
Sending Data: [35] Sent
Waiting for response..done
Sending Data: [36] Sent
Waiting for response..done
Sending Data: [37] Sent
Waiting for response..done
Sending Data: [38] Sent
Waiting for response..done
Sending Data: [39] Sent
Waiting for response..done
Sending Data: [40] Sent
Waiting for response..done
Sending Data: [41] Sent
Waiting for response..done
Sending Data: [42] Sent
Waiting for response..done
Sending Data: [43] Sent
Waiting for response..done
Sending Data: [44] Sent
Waiting for response..done
Sending Data: [45] Sent
Waiting for response..done
Sending Data: [46] Sent
Waiting for response..done
Sending Data: [47] Sent
Waiting for response..done
Sending Data: [48] Sent
Waiting for response..done
Sending Data: [49] Sent
Waiting for response..done
Sending Data: [50] Sent
Waiting for response..done
Sending Data: [51] Sent
Waiting for response..done
Sending Data: [52] Sent
Waiting for response..done
Sending Data: [53] Sent
Waiting for response..done
Sending Data: [54] Sent
Waiting for response..done
Sending Data: [55] Sent
Waiting for response..done
Sending Data: [56] Sent
Waiting for response..done
Timeout detected
Sending Data: [56] Sent
Waiting for response..done
Timeout detected
Sending Data: [56] Sent
Waiting for response..done
Timeout detected
Sending Data: [56] Sent
Waiting for response..done
Timeout detected
Sending Data: [56] Sent
Waiting for response..done
Timeout detected
Sending Data: [56] Sent
Waiting for response..done
Timeout detected
Sending Data: [56] Sent
Waiting for response..done
Timeout detected
Sending Data: [56] Sent
Waiting for response..done
Timeout detected
Sending Data: [56] Sent
Waiting for response..done
Timeout detected
Sending Data: [56] Sent
Waiting for response..done
Timeout detected
Sending Data: [56] Sent
Waiting for response..done
Timeout detected
Sending Data: [56] Sent
Waiting for response..done
Timeout detected
Failed to handle client request
Done processing client request

I have tried to use a switch and lowering my speed to half duplex 10 MB

If you want me to add any more logs I will.

What next?
Thank you.

@frollic

MordiSacks · February 19, 2024, 10:10pm

Ok, loaded the image over the serial connection as described here
https://forum.archive.openwrt.org/viewtopic.php?id=52625&p=8
And it worked, I'm finally on OpenWRT!