TP-Link Archer D7 AC1750 - edit rootfs and repack

Hardware Questions and Recommendations
1

Hello

I'm looking for a way to repack squashfs rootfs, extracted from TP-Link Archer D7 AC1750, after that it was correctly unsquashed using this command:
sudo unsquashfs -d mtdblock2_unsquashed mtdblock2.bin
Basically I just edited a couple of file in /rootfs/web folder, then I tried to use this command to repack it:
sudo mksquashfs ./mtdblock2_unsquashed my2_mtdblock2.bin -comp lzma
But trying to write it back with this command:
cat /var/usbdisk/sda1/router/my2_mtdblock2.bin>/dev/mtdblock2
my router got stuck on u-boot.
I been able to restore old mtdblock2, but still not able to create or to use a repacked one.

Any help will be really appreciated. Thanks

2

Using the image builder or full build system would be recommended, rather than manual manipulation.

Both allow you in pre-install custom files.

and a similar approach for the image builder.

The commands used to build the squashfs image can be found in the ./include/ directory of the source tree, driven by parameters in the ./target/linux/<target name>/ directory structure.

See also https://openwrt.org/toh/tp-link/archer-d7 which states (unconfirmed by me)

The router part shares the same hardware with Archer C5 v1 and Archer C7 v2

Edit: Are you trying to modify an OEM firmware image?

1 Like
3

Hi Jeff

Well, the reason for which I opted out for a manual manipulation is related to the double firmware present in the stock file. Archer D7 is actually a Modem/Router and come with 2 firmware repacked in one. So that, I presume, makes things more complicated if I would like to repack everything back.

Here unfortunately there aren't details for what I'm looking for. Just details on how to recover a bricked device.

This instead appears a bit more interesting. I basically would like to just repack rootfs unsquashed partition so to write it back. I need the right instructions to do that using of course all the proper parameters.

Of course any other indication or suggestion is really welcome.

4

yes, I'm trying to edit OEM firmware. Right now I have been able to extract the content from the original firmware, properly unsquashing rootfs. What appears not so clear to me is the way in which should work the reverse process. I have also extracted mtdblock2 directly from the router making a copy of the rootfs partition.

Just to give more details:
sudo unsquashfs -d mtdblock2_unsquashed mtdblock2.bin
produced rootfs content folder with dimension of 23.596.260 byte

cat /dev/mtdblock2> /var/usbdisk/sda1/router/mtdblock2.bin
produced a 15.204.352 byte file (0xE80000) that correspond to the full partition dimension.

sudo mksquashfs ./mtdblock2_unsquashed my_mtdblock2.bin -comp lzma
produced a 5.931.008 byte file, of course is a compressed file also if it slightly different from the one extracted with firmware-mod-kit: rootfs.img 5.971.230 byte

5

Hmm, then yes, the OpenWrt build tools won't directly help you.

"Grasping at straws:"

Have you checked the compression type and block size for the squashfs image?

Do you have serial access to the boot loader?

6

Well this is what come out for mtdblock2.bin (the one directly copied from the device file size 15.204.352 byte)

sudo unsquashfs -stat mtdblock2.bin

Found a valid SQUASHFS 4:0 superblock on mtdblock2.bin.
Creation or last append time Thu May 14 03:14:36 2015
Filesystem size 5731.28 Kbytes (5.60 Mbytes)
Compression lzma
Block size 131072
Filesystem is exportable via NFS
Inodes are compressed
Data is compressed
Fragments are compressed
Always-use-fragments option is not specified
Xattrs are compressed
Duplicates are removed
Number of fragments 47
Number of inodes 513
Number of ids 1

This is what come out from rootfs.img, image extracted from original firmware with firmware-mod-kit (5.971.230 byte file size)

sudo unsquashfs -stat rootfs.img

Found a valid SQUASHFS 4:0 superblock on rootfs.img.
Creation or last append time Thu May 14 03:14:36 2015
Filesystem size 5731.28 Kbytes (5.60 Mbytes)
Compression lzma
Block size 131072
Filesystem is exportable via NFS
Inodes are compressed
Data is compressed
Fragments are compressed
Always-use-fragments option is not specified
Xattrs are compressed
Duplicates are removed
Number of fragments 47
Number of inodes 513
Number of ids 1

This is what come out from squashed file my_mtdblock2.bin (file size 5.931.008 byte)

sudo unsquashfs -stat my_mtdblock2.bin

Found a valid SQUASHFS 4:0 superblock on my_mtdblock2.bin.
Creation or last append time Thu Mar 21 16:15:04 2019
Filesystem size 5791.67 Kbytes (5.66 Mbytes)
Compression lzma
Block size 131072
Filesystem is exportable via NFS
Inodes are compressed
Data is compressed
Fragments are compressed
Always-use-fragments option is not specified
Xattrs are compressed
Duplicates are removed
Number of fragments 47
Number of inodes 513
Number of ids 1

It's possible to see that actual file size is the same in the image extracted from device "mtdblock2.bin" and the one extracted with firmware-mod-kit "rootfs.img".
Slightly bigger the one produced with mksquashfs "my_mtdblock2.bin", with actually no changes to rootfs content.

To be honest I really don't know if this can be the problem, so it is related to mksquashfs, or there is some other kind of step to do. I read on some forum that there is the need to add a kind checksum digit. I would like to have some clear indication on what are the right steps to do.

7

IMG_20190328_010422
IMG_20190328_0104222016×1512 474 KB

yes :stuck_out_tongue_closed_eyes:

2 Likes
8

Hey, would you please explain how you took off the front clip and how to open the case without damaging? In the Wiki it is very unspecific...

9

You need to remove before the silver gray plastic decoration above the lid, be careful because it's quite fragile. Under you'll find an hidden screw and then you should try to open the lid starting from a side, it's really well attached.
However the unmount process is not really easy so it can take a while to understand how to open without damaging it.

1 Like