Tp-Link Archer MR20(EU) V2.1 S/N 217B347001084 - Bootloader demaged

Hi.I have a TP-Link Archer MR200(EU) v2.1 serial 217B347001084, after wrong firmware upgrade suddenly I found that only power led is blinking and it's not working. I think that bootloader is the wrong/corrupt one, only options is to reflash with external ROM flasher. It is soft bricked.
I have read in some guides that command DD could to extract the bootlader from the original firmware. Exemple: cut out the first 0x20200 bytes. (tp-link header+bootloader). I was advised a backup copy from another router (making sure things like serial and MAC are edited).Now, I was hoping that with the binwalk software or the DD command I could solve but at the moment I was only able to extract the old non-functioning bootlader and delete the memory via CH341A programmer. Do you ha some ideas? Thank you very much for your help!!!! I attach the boolader strings...

<LF>
<CR>U-Âoot 1.1.3 (Aõg 14 2°18 - ±4:48:52)<LF>
Boáòd: Raìink APSoC DRAM:  64 MB<LF><CR>òåìocate_code Pointer at: 83fb0000<LF>enable ephy clock...done. rf reg 29 = 5<LF><CR>SSC disabled®Š­­­­­­------------<LF><CR>  LTE AC750 v2.0.0<LF><CR>------------------<LF><CR>Now running in RAM - U-Boot at: 83fâ°°°°¬ ÍONITOR BASE: bc000000<LF>
<CR> uboot_end: 00000000   83fcd71c <LF><CR>spéß÷áéôßnsec: 29 <LF><CR>spi device id: c8 40 17 c8 40 (4017c840)<LF><CR>find flasèº ÇIJµQ64C<LF><CR>=====================================½½½½½½½ <LF><CR>Ralink UBoot Version: 4.1.2.0<LF><CR>----------------------------­­­­­­­--------- <LF><CR>ASIC 7620_MP (Port5<->GigaSW)<LF><CR>DRAM component: 512 Íâéôó DDR, width 16<LF><CR>DRAM bus: 16 bit<LF><CR>Total memory: 64 MBytes<LF><CR>Flasè ãïíðïnent: SPI Flash<LF><CR>Date:Aug 14 2018  Time:14:48:52<LF><CR>============½½½½½½½========================= <LF><CR>icache: sets:512, ways:4, linesz:3² ¬ôïôál:65536<LF><CR>dcache: sets:256, ways:4, linesz:32 ,total:32768 <LF>
 £££££ The CPU freq = 580 MHZ #### <LF><CR> estimate memory size =64 MbyteóŠ<LF><CR>BootType = ....®......®....®......®..........®...........®...<LF><CR>starting recovåòù®®®Š<CR>TODO, Råáä ÍÁà Address from Flash<LF>
<CR>rt_rtl8367_init(1363):Begin<LF><CR>rt_rtl8367_init(1376):MT762° ÓÍÉ Énit ERROR<LF>
<CR> netboot_common, aòçã½ ³ <LF>
<CR> NetTxPacket = 0x83FE5DC0 <LF>
<CR> KSEG1ADDR(NetTxPacket) = 0xÁ³ÆŵÄÃ0 <LF>
<CR> NetLoop,call eth_halt ! <LF>
<CR> ÎåôÌïïp,call eth_init ! <LF><CR>Trying Eth0 (10/100-M)<LF>
<CR> Waitting for RXßÄÍÁßÂÕSY status Start... done<LF>

<CR> ETH_STATE_ACTIVE!! <LF><CR>TÆÔÐ æòïm server 192.168.0.66; our IP address is 192.168.1.1<LF><CR>Filename §ÁòãèårC2V1_tp_recovery.bin'.<LF>
<CR> TIMEOUT_COUNT=10,Load address: 0x8°°¶°°°°<LF><CR>Loading: Got ARP REPLY, set server/gtwy eth addr (28:䲺´´º±e:48:80)<LF><CR>Got it<LF><CR>Ô T T T T T T Ô T T <LF><CR>Retry count exceeded; starting againŠ££ Âïoting image at bc020000 ...<LF><CR>   Uncompressing Kernel Image ... OK<LF><CR>No éîéôòäŠ<CR>## Transferring control to Linux (at address 8000c150) ...<LF><CR>££ Çéöéîg linux memsize in MB, 64<LF>
<CR>Starting kernel ...<LF>
<CR>怘€à˜†˜ø˜fff˜ø<ACK>~<ACK>†ø<ACK>~f<ACK>xø†ø†ø†æ€˜€æ€˜€<NUL><CAN>f€˜†˜<RS>f˜<CAN>æ˜<ACK>˜<NUL>æ˜f˜<RS>f€˜€Linux version 2.6.36 (tp-link@Sohoidev) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #139 Tue Aug 14 14:52:21 CST 2018

 The CPU feqenuce set to 580 MHz

 MIPS CPU sleep mode enabled.
 PCIE: bypass PCIe DLL.
 PCIE: Elastic buffer control: Addr:0x68 -> 0xB4
 disable all power about PCIe
CPU revision is: 00019650 (MIPS 24Kc)
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS1,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/sbin/init
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=0007c473
Readback ErrCtl register=0007c473
Memory: 61188k/65536k available (2855k kernel code, 4348k reserved, 592k data, 164k init, 0k highmem)
NR_IRQS:128
MTK/Ralink System Tick Counter init... cd:8034bf68, m:214748, s:32
console [ttyS1] enabled
Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
RALINK_GPIOMODE = 1ab11d
RALINK_GPIOMODE = 18b11d
PPLL_CFG1=0xe64000
MT7620 PPLL lock
PPLL_DRV =0x80080504
start PCIe register access
RALINK_PCI_PCICFG_ADDR = 1000f0

*************** MT7620 PCIe RC mode *************
bio: create slab <bio-0> at 0
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI address [0x20200000-0x2020ffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff]
pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff] (PCI address [0x20000000-0x200fffff]
pci 0000:01:00.1: BAR 0: assigned [mem 0x20100000-0x201fffff]
pci 0000:01:00.1: BAR 0: set to [mem 0x20100000-0x201fffff] (PCI address [0x20100000-0x201fffff]
pci 0000:00:00.0: PCI bridge to [bus 01-01]
pci 0000:00:00.0:   bridge window [io  disabled]
pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
pci 0000:00:00.0:   bridge window [mem pref disabled]
BAR0 at slot 0 = 0
bus=0x0, slot = 0x0
res[0]->start = 0
res[0]->end = 0
res[1]->start = 20200000
res[1]->end = 2020ffff
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=0x1, slot = 0x0
res[0]->start = 20000000
res[0]->end = 200fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=0x1, slot = 0x0
res[0]->start = 20100000
res[0]->end = 201fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
Switching to clocksource Ralink external timer
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
RT3xxx EHCI/OHCI init.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
fuse init (API version 7.15)
msgmni has been set to 119
io scheduler noop registered
io scheduler deadline registered (default)
Ralink gpio driver initialized
Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A
loop: module loaded
deice id : c8 40 17 c8 40 (4017c840)
GD25Q64C(c8 4017c840) (8192 Kbytes)
mtd .name = raspi, .size = 0x00800000 (0M) .erasesize = 0x00000008 (0K) .numeraseregions = 65536
Creating 6 MTD partitions on "raspi":
0x000000000000-0x000000020000 : "boot"
0x000000020000-0x000000160000 : "kernel"
0x000000160000-0x0000007d0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
0x0000007d0000-0x0000007e0000 : "romfile"
0x0000007e0000-0x0000007f0000 : "config"
0x0000007f0000-0x000000800000 : "radio"
Register flash device:flash0
PPP generic driver version 2.4.2
NET: Registered protocol family 24
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Mirror/redirect action on
u32 classifier
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (2868 buckets, 11472 max)
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 164k freed
usb 1-1: new high speed USB device using rt3xxx-ehci and address 2
<CR>starting pid 195, tty '': '/etc/init.d/rcS'
rdm_major = 253
spiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
Read MAC from flash(0x7DF100) ffffffb0-4e-26-5f-ffffffae-ffffffde
SMACCR1 -- : 0x0000b04e
SMACCR0 -- : 0x265faede
Ralink APSoC Ethernet Driver Initilization. v3.0  256 rx/tx descriptors allocated, mtu = 1500!
spiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
Read MAC from flash(0x7DF100) ffffffb0-4e-26-5f-ffffffae-ffffffde
SMACCR1 -- : 0x0000b04e
SMACCR0 -- : 0x265faede
PROC INIT OK!
usbcore: registered new interface driver usbserial
USB Serial support registered for generic
usbserial_generic 1-1:1.0: generic converter detected
usb 1-1: generic converter now attached to ttyUSB0
usbcore: registered new interface driver usbserial_generic
usbserial: USB Serial Driver core
USB Serial support registered for GSM modem (1-port)
usbcore: registered new interface driver option
option: v0.7.2:USB Driver for GSM modems
SCSI subsystem initialized
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver rndis_host
dns_init
domain_name:tplinkmodem.net
Raeth v3.0 (Workqueue)

phy_tx_ring = 0x03f56000, tx_ring = 0xa3f56000

phy_rx_ring0 = 0x03f57000, rx_ring0 = 0xa3f57000
Pseudo Close vlan...
SMACCR1 -- : 0x0000b04e
SMACCR0 -- : 0x265faede
ESW: Link Status Changed - Port5 Link Down
ESW: Link Status Changed - Port0 Link Down
CDMA_CSG_CFG = 81000000
GDMA1_FWD_CFG = 20710000
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0

Please press Enter to activate this console. [ dm_readFile ] 2042:  can not open xml file /var/tmp/pc/reduced_data_model.xml!, about to open file /etc/reduced_data_model.xml
spiflash_ioctl_read, Read from 0x007e0000 length 0x10000, ret 0, retlen 0x10000
[ oal_sys_readCfgFlash ] 923:  User config length is too long - ffffffff

[ dm_loadCfg ] 2438:  Read config from flash failed. ret = 1
[ dm_readFile ] 2042:  can not open xml file /var/tmp/pc/default_config.xml!, about to open file /etc/default_config.xml
[ parseConfigNode ] 552:  Meet unrecognized object node "PhDDNSCfg", skip the node
[ parseConfigNode ] 557:  Meet unrecognized parameter node "PhDDNSCfg", skip the node
[ parseConfigNode ] 557:  Meet unrecognized parameter node "ProfileList", skip the node
[ parseConfigspiflash_ioctl_read, Read from 0x007df500 length 0x29, ret 0, retlen 0x29
Node ] 5spiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
52:  Mespiflash_ioctl_read, Read from 0x007df200 length 0x4, ret 0, retlen 0x4
et unrecogspiflash_ioctl_read, Read from 0x00020000 length 0x200, ret 0, retlen 0x200
nized obspiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
ject node "QueueManagement", skip the node
[ parseConfigNode ] 552:  Meet unrecognized object node "X_TP_IPTV", skip the node
[ parseConfigNode ] 552:  Meet unrecognized object node "VoiceService", skip the node
[ parseConfigNode ] 557:  Meet unrecognized parameter node "VoiceService", skip the node
[ parseConfigNode ] 552:  Meet unrecognized object node "StorageService", skip the node
[ parseConfigNode ] 552:  Meet unrecognized object node "X_TP_CallFireWallCfg", skip the node
[ parseConfigNode ] 552:  Meet unrecognized object node "X_TP_SpeedDialCfg", skip the node
[ parseConfigNode ] 552:  Meet unrecognized object node "X_TP_MultiIspDialPlan", skip the node
[ parseConfigNode ] 552:  Meet unrecognized object node "X_TP_CallLogCfg", skip the node
[ parseConfigNode ] 552:  Meet unrecognized object node "X_TP_SystemUpdate", skip the node
spiflash_ioctl_read, Read from 0x007df200 length 0x4, ret 0, retlen 0x4
[openSerialPort 125] Fail to open serial port /dev/ttyUSB1!
[initSerialPortFd 83] Fail to open /dev/ttyUSB1!, retry_counter= 1
[openSerialPort 125] Fail to open serial port /dev/ttyUSB1!
[initSerialPortFd 83] Fail to open /dev/ttyUSB1!, retry_counter= 2
ESW: Link Status Changed - Port0 Link UP
[openSerialPort 125] Fail to open serial port /dev/ttyUSB1!
[initSerialPortFd 83] Fail to open /dev/ttyUSB1!, retry_counter= 3
[openSerialPort 125] Fail to open serial port /dev/ttyUSB1!
[initSerialPortFd 83] Fail to open /dev/ttyUSB1!, retry_counter= 4
[openSerialPort 125] Fail to open serial port /dev/ttyUSB1!
[initSerialPortFd 83] Fail to open /dev/ttyUSB1!, retry_counter= 5
[openSerialPort 125] Fail to open serial port /dev/ttyUSB1!
[initSerialPortFd 83] Fail to open /dev/ttyUSB1!, retry_counter= 6
[openSerialPort 125] Fail to open serial port /dev/ttyUSB1!
[initSerialPortFd 83] Fail to open /dev/ttyUSB1!, retry_counter= 7`

The very first thing you should do, before anything else at all, is backing up everything you can from your device, the whole flash and the wireless calibration data in particular (as this is irreplaceably unique to your device). Don't let yourself get trigger-happy and flash just something else, make a backup first and ensure to re-insert the device data for your very own device.

1 Like