TP-Link Archer C6 V3.2 EU: bricked after sysupgrade, no TFTP traffic

Hello everyone.
I've been using OpenWRT ever since my TP-Link Archer C6 got official support for it in 22.03. While I'm by no means expert with Linux (in fact much of what I know came from using OpenWRT itself), I am a power user and have even been using my own built images for a far amount of time, and have been able to diagnose and fix any kind of issue until now, even de-bricking my smartphone.

However, today I pushed a freshly-made sysupgrade image to the router and it didn't come back alive.
To cut to the chase, I can't unbrick via TFTP. The router seems to not even attempt to connect to a TFTP server, and TFTPD64 doesn't register any access in its logs Wireshark does capture packets but none are of TFTP:

https://kogarou.s-ul.eu/sfqF5HYX.png can't embed a second image

I've set the NIC connected to the router to use 192.168.0.66 and 192.168.0.5 for itself, with and without gateway set to 192.168.0.1, and have tried to use both the LAN1 and the WAN ports.
4 hours of lurking existing threads, wiki pages, youtube videos, and blogposts have got me nowhere. I am stumped.
I do not have a JTAG or soldering equipment (I assume it needs soldered wires).
What should I do?

Tried getting into the web recovery, TFTP seems to be a no go without serial.

Have you tried TFTP on 192.168.1.66 / 1.5 instead of 0? I found one of my routers was listening there.

Tried it now, the packets captured change in amount/types but still no TFTP. I've also just noticed all of the packets' source is my PC and not the router.
I'm going to get a 5 euro UART ASAP,in another thread about this exact issue, the user dsouza reported he got a good wire connection without soldering. Hopefully I'll have the same luck.

Let me know how you get on. I now have a bricked C7 that may need the same treatment. Never ventured inside a router before. What UART did you buy?

If you read this post/saved for later right when I originally posted, READ/SAVE AGAIN. I corrected some important information!!!!!!!!!!!
Before everything: You need to be comfortable enough with doing the steps, changing network settings etc. Don't be afraid you will explode your router, just do everything slowly and re-read everything before turning things on. If you really can't do this, ask someone else to do this for you.

To summarize in a single post:
Open the router as shown in this video: https://www.youtube.com/watch?v=z_2M_CDdTho . Without proper tools you will need more care in applying force, but you likely don't care if some things break at this point anyway.
You need a UART with 3.3V. DO NOT USE 5V IT WILL DAMAGE THE BOARD. I bought one with a CH340G (searching for this is enough, it doesn't matter the brand). Anything works as long as it works with 3.3V signaling. If it does both 3.3V and 5V you NEED to change the jumper for the correct voltage accordingly OR ELSE YOU WILL DAMAGE THE BOARD. Here's an image of the one I bought locally:
.
Notice that in this image the jumper is set to 5V.
You might need drivers for the UART. https://learn.sparkfun.com/tutorials/how-to-install-ch340-drivers/all has them. I used the Zip and installed them the old-fashioned way. If you're not a Windows boomer use the EXE one

With the UART disconnected from the PC and the router OFF, wire the wires to the router and the UART like this (open the image in a new tab if needed):

This is how the setup should look:

You do not need to solder the pins to the board!!! You can get good contact without much effort with some slight trial and error. The header pins in which you plug the leads are not thick enough to make contact properly when straight. you need to have them at an angle with the router board. I can't remember if the light goes up when the router is turned on, but if I recall correctly from yesterday, the moment you see the TXD LED light up (if it has one), its good to go. Otherwise you will be just playing around with the pins in the holes to see the LED going on and off. Make sure the wires are not moving in any way or shape, just put something non-conductive and heavy on top of them. For me, ironically enough taping it down with electric tape wasn't useful, but using the small roll itself did it.

Install PuTTY, have it set up like this:
.
Change the COM port number to the one your UART was set-up by Windows to use.
Plug the UART to the PC and open the session. Turn on the router. In about less than 5 seconds you should be able to see a bunch of garbage and then this:

▒▒▒▒fff▒▒▒▒f▒fff▒▒▒xxxx▒▒f▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒

U-Boot 1.1.3 (May 13 2020 - 19:39:06)

Board: Ralink APSoC DRAM:  128 MB
relocate_code Pointer at: 87f58000

Config XHCI 40M PLL
******************************
Software System Reset Occurred
******************************
flash manufacture id: ef, device id 40 18
find flash: W25Q128BV
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: SPI Flash
Date:May 13 2020  Time:19:39:06
============================================
THIS IS uboot
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =128 Mbytes

Press '4' or 't' to break the booting process

Press 'x' to enter recovery web server

Press X until the TTY says it started an HTTP server.
If text doesn't appear on screen, check your wiring and if the pins are making contact properly.
For me the router launched an HTTP server on 192.168.0.1 (it says on the console which IP it's using). Set your NIC IPv4 settings like this if so:
.
If the router launched the server at another address, change accordingly. Connect your NIC to the router with any 8P8C cable, any of the ports should do.
Upload a firmware. This is where you can easily go back to the OEM firmware if you so desire. If you want to stay on OpenWRT, flash a *-factory.bin image. For me it would be tplink_archer-c6-v3-squashfs-factory.bin.
Wait a bit for it to flash. The TTY will tell you everything it's doing. If you're not flashing an OEM image the webpage progress tracker will be unreliable. There is nothing wrong it it.
After TTY says its rebooting, change your IP back to anything on 192.168.1.X with 192.168.1.1 as the gateway, in a minute or two the router will be online

1 Like

Very nice walkthrough, I will probably use major parts of it to recover a handfull of bricked AX23s in the upcoming week. Thanks!

Take a closer look at the photo here:

Now take a look at yours. Did you notice how the photo in your post is upside down compared to the one linked in post #5?

1 Like

Thanks for pointing this crass mistake of mine out. I had taken all of the photos yesterday as I was unbricking the router, and those photos of the setup show the wiring done incorrectly on the router side , out of fatigue.....
In writing of this post I got confused by my own mistakes of yesterday and got the wiring completely wrong. This is a prime example of "Everyone was wrong and I was the only one right! Oh, am I really the one driving on the wrong lane?". Oops
Give me me a bit of time to write and edit the images accordingly along with new photos of the setup finished (done). Thanks!!

Did you notice how the photo in your post is upside down compared to the one linked in post #5?

Yes, I put it in the image upside down, so that it has the Ground pins just on one side. For sanity check I just plugged everything again right now to see if it works correctly, and it does.