TP Link Archer c59 bricked

Installing and Using OpenWrt
1

Hi, I've installed OpenWRT on my Tp Link archer c59 v1 and after a few days of noticing Wifi issues I've decided to go back to stock firmware.
To do so I've connected to the router via WinSCP and upload the .bin to /tmp folder. Then connected via ssh using puty and install .bin with mtd -r write /tmp/original_firmware.bin firmware method
The router rebooted and nothing else happened. Just powe led on, nothing on the others.
So I've tried to do the TFTP method, tried with tp link original fw and same result.
The only thing that works is installing through TFTP method this file: http://downloads.openwrt.org/releases/18.06.2/targets/ar71xx/generic/openwrt-18.06.2-ar71xx-generic-archer-c59-v1-squashfs-factory.bin
After installing that I can access via WinSCP and SSH again.
From there I've tried to install both stock and OpenWRT again but always the same result, Power on LED on, nothing of the rest and the router bricked.
I've also tried to strip the .bin from original fw using dd if=orig.bin of=tplink.bin skip=257 bs=512 , again, nothing happened.
I don't know what else I can do

Any ideas?
Thanks

2

If you can still install OpenWrt via tftp easily, I would first confirm if your WLAN cards are still functional. Because if you succeeded in writing an oversized (non-stripped) OEM firmware to the device in your first attempt, it's very likely that you overwrote the WLAN calibration data that way. Without valid WLAN calibration data, your WLAN cards would be permanently bricked (WLAN calibration data is specific to each individual device), in which case you could stop your efforts and relegate it to future uses as a fancy doorstop, instead of trying any further.

3

I understand. I can't find information on how to do that. Any leads?
Thanks in advance

4

Did you try TFTP flashing the stock? It needs to be unzipped first of course.

A binwalk of the stock firmware .bin (version 160722) suggests to strip off 73579 bytes to get down to the kernel uImage header and have a sysupgrade -n -F compatible file. This is not the typical 128k + 512 bytes. Use a bs=1 and skip=73579.

ubuntu@ubuntu:~/Downloads$ binwalk ArcherC59v1_us-up-ver1-0-0-P1[20160722-rel57649].bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
23268         0x5AE4          U-Boot version string, "U-Boot 1.1.4 (Jul 16 2016 - 18:05:39)"
23316         0x5B14          CRC32 polynomial table, big endian
24620         0x602C          uImage header, header size: 64 bytes, header CRC: 0x997BD18C, created: 2016-07-16 10:05:40, image size: 48666 bytes, Data Address: 0x80010000, Entry Point: 0x80010000, data CRC: 0x7F74637D, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image"
24684         0x606C          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 119204 bytes
73579         0x11F6B         uImage header, header size: 64 bytes, header CRC: 0x71C54FE5, created: 2016-07-19 09:52:32, image size: 1069313 bytes, Data Address: 0x80060000, Entry Point: 0x80060000, data CRC: 0xA67989DB, OS: Linux, CPU: MIPS, image type: Multi-File Image, compression type: lzma, image name: "MIPS OpenWrt Linux-3.3.8"
73651         0x11FB3         LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 3102076 bytes
1142957       0x1170AD        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 10605614 bytes, 3072 inodes, blocksize: 262144 bytes, created: 2016-07-22 07:23:25
11748819      0xB345D3        XML document, version: "1.0"
11758620      0xB36C1C        gzip compressed data, from Unix, last modified: 2016-07-22 08:00:49
5

I tried to TFTP the stock, but nothing happened. I'll try to do the dd with those values you mentioned. Can I install it with mtd or it has to be with sysupgrade?

6

The end result of sysupgrade is a call to mtd, but sysupgrade is considered safer since it does some checks and is sure to use the right mtd partition.

7

Thanks a lot. I'm at the office now, I'll do that when I get home.

8

Unfortunately it didn't work. How can I check what was said about WLAN calibration? Couldn't find any info.

9

If I understood you correctly, you can still install openwrt-18.06.2-ar71xx-generic-archer-c59-v1-squashfs-factory.bin via tftp easily, if so, you can simply try to set up (both!) WLAN cards normally (as AP) and check if they're working. If the calibration data is lost, the wlan cards won't come up (be available). This situation would be the same between OpenWrt and OEM firmware (and permanent), so you can try whatever is easiest to get installed.

10

Well I was able to turn on both radios, 2.4 and 5. It gave me IP and everything. How do I continue from here? It seems that it doesn't like any firmware but the one I mentioned.

11

The safe and lazy solution would be to stick to OpenWrt.

Restoring the OEM firmware should also be possible (with the necessary amount of care - and I definately strongly recommend to backup ART), but is apparently a bit more ambitious. If you want to go this route, you'd have binwalk and your preferred hexeditor (e.g. okteta or hexdump/ hd) in your future, to check in which way openwrt-18.06.2-ar71xx-generic-archer-c59-v1-squashfs-factory.bin and the OEM firmware differ (total size, offsets of kernel/ rootfs, size of the individual hunks) and /bin/dd to make the OEM firmware digestable to the bootloader based tftp client.

Observing the bootloader doing its job, or interfering as needed, with the help of a suitable usb2serial adapter and connecting to the system console might shed some light into the situation.

1 Like
12

So, this is the binwalk result for both:

Archer stock firmware:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
23268         0x5AE4          U-Boot version string, "U-Boot 1.1.4 (Jul 16 2016 - 18:05:39)"
23316         0x5B14          CRC32 polynomial table, big endian
24620         0x602C          uImage header, header size: 64 bytes, header CRC: 0x997BD18C, created: 2016-07-16 10:05:40, image size: 48666 bytes, Data Address: 0x80010000, Entry Point: 0x80010000, data CRC: 0x7F74637D, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image"
24684         0x606C          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 119204 bytes
73579         0x11F6B         uImage header, header size: 64 bytes, header CRC: 0x71C54FE5, created: 2016-07-19 09:52:32, image size: 1069313 bytes, Data Address: 0x80060000, Entry Point: 0x80060000, data CRC: 0xA67989DB, OS: Linux, CPU: MIPS, image type: Multi-File Image, compression type: lzma, image name: "MIPS OpenWrt Linux-3.3.8"
73651         0x11FB3         LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 3102076 bytes
1142957       0x1170AD        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 10605614 bytes, 3072 inodes, blocksize: 262144 bytes, created: 2016-07-22 07:23:25
11748819      0xB345D3        XML document, version: "1.0"
11758620      0xB36C1C        gzip compressed data, from Unix, last modified: 2016-07-22 08:00:49

An this is for the openwrt-18.06.2-ar71xx-generic-archer-c59-v1-squashfs-factory.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
8520          0x2148          uImage header, header size: 64 bytes, header CRC: 0xF5B31DF, created: 2019-01-30 12:21:02, image size: 1376782 bytes, Data Address: 0x80060000, Entry Point: 0x80060000, data CRC: 0x286DCD5F, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS OpenWrt Linux-4.9.152"
8584          0x2188          LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 4390548 bytes
1385366       0x152396        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 2943022 bytes, 1179 inodes, blocksize: 262144 bytes, created: 2019-01-30 12:21:02

I honestly don't know how to dd this to make it match. Can you please help me?

Thanks

13

Anyone? I really have no idea how to dd that file

14

Is there any reason why the method in the page below can't or shouldn't be used?
https://www.tp-link.com/br/support/faq/1482/

15

It doesn't work