Hi.I have a TP-Link Archer MR200(EU) v2.1 serial 217B347001084, after wrong firmware upgrade suddenly I found that only power led is blinking and it's not working. I think that bootloader is the wrong/corrupt one, only options is to reflash with external ROM flasher. It is soft bricked.
I have read in some guides that command DD could to extract the bootlader from the original firmware. Exemple: cut out the first 0x20200 bytes. (tp-link header+bootloader). I was advised a backup copy from another router (making sure things like serial and MAC are edited).Now, I was hoping that with the binwalk software or the DD command I could solve but at the moment I was only able to extract the old non-functioning bootlader and delete the memory via CH341A programmer. Do you ha some ideas? Thank you very much for your help!!!! I attach the boolader strings...
<LF>
<CR>U-Âoot 1.1.3 (Aõg 14 2°18 - ±4:48:52)<LF>
Boáòd: Raìink APSoC DRAM: 64 MB<LF><CR>òåìocate_code Pointer at: 83fb0000<LF>enable ephy clock...done. rf reg 29 = 5<LF><CR>SSC disabled®Š------------<LF><CR> LTE AC750 v2.0.0<LF><CR>------------------<LF><CR>Now running in RAM - U-Boot at: 83fâ°°°°¬ ÍONITOR BASE: bc000000<LF>
<CR> uboot_end: 00000000 83fcd71c <LF><CR>spéß÷áéôßnsec: 29 <LF><CR>spi device id: c8 40 17 c8 40 (4017c840)<LF><CR>find flasèº ÇIJµQ64C<LF><CR>=====================================½½½½½½½ <LF><CR>Ralink UBoot Version: 4.1.2.0<LF><CR>------------------------------------- <LF><CR>ASIC 7620_MP (Port5<->GigaSW)<LF><CR>DRAM component: 512 Íâéôó DDR, width 16<LF><CR>DRAM bus: 16 bit<LF><CR>Total memory: 64 MBytes<LF><CR>Flasè ãïíðïnent: SPI Flash<LF><CR>Date:Aug 14 2018 Time:14:48:52<LF><CR>============½½½½½½½========================= <LF><CR>icache: sets:512, ways:4, linesz:3² ¬ôïôál:65536<LF><CR>dcache: sets:256, ways:4, linesz:32 ,total:32768 <LF>
£££££ The CPU freq = 580 MHZ #### <LF><CR> estimate memory size =64 MbyteóŠ<LF><CR>BootType = ....®......®....®......®..........®...........®...<LF><CR>starting recovåòù®®®Š<CR>TODO, Råáä ÍÁà Address from Flash<LF>
<CR>rt_rtl8367_init(1363):Begin<LF><CR>rt_rtl8367_init(1376):MT762° ÓÍÉ Énit ERROR<LF>
<CR> netboot_common, aòçã½ ³ <LF>
<CR> NetTxPacket = 0x83FE5DC0 <LF>
<CR> KSEG1ADDR(NetTxPacket) = 0xÁ³ÆŵÄÃ0 <LF>
<CR> NetLoop,call eth_halt ! <LF>
<CR> ÎåôÌïïp,call eth_init ! <LF><CR>Trying Eth0 (10/100-M)<LF>
<CR> Waitting for RXßÄÍÁßÂÕSY status Start... done<LF>
<CR> ETH_STATE_ACTIVE!! <LF><CR>TÆÔÐ æòïm server 192.168.0.66; our IP address is 192.168.1.1<LF><CR>Filename §ÁòãèårC2V1_tp_recovery.bin'.<LF>
<CR> TIMEOUT_COUNT=10,Load address: 0x8°°¶°°°°<LF><CR>Loading: Got ARP REPLY, set server/gtwy eth addr (28:䲺´´º±e:48:80)<LF><CR>Got it<LF><CR>Ô T T T T T T Ô T T <LF><CR>Retry count exceeded; starting againŠ££ Âïoting image at bc020000 ...<LF><CR> Uncompressing Kernel Image ... OK<LF><CR>No éîéôòäŠ<CR>## Transferring control to Linux (at address 8000c150) ...<LF><CR>££ Çéöéîg linux memsize in MB, 64<LF>
<CR>Starting kernel ...<LF>
<CR>怘€à˜†˜ø˜fff˜ø<ACK>~<ACK>†ø<ACK>~f<ACK>xø†ø†ø†æ€˜€æ€˜€<NUL><CAN>f€˜†˜<RS>f˜<CAN>æ˜<ACK>˜<NUL>æ˜f˜<RS>f€˜€Linux version 2.6.36 (tp-link@Sohoidev) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #139 Tue Aug 14 14:52:21 CST 2018
The CPU feqenuce set to 580 MHz
MIPS CPU sleep mode enabled.
PCIE: bypass PCIe DLL.
PCIE: Elastic buffer control: Addr:0x68 -> 0xB4
disable all power about PCIe
CPU revision is: 00019650 (MIPS 24Kc)
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
Normal 0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
Kernel command line: console=ttyS1,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/sbin/init
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=0007c473
Readback ErrCtl register=0007c473
Memory: 61188k/65536k available (2855k kernel code, 4348k reserved, 592k data, 164k init, 0k highmem)
NR_IRQS:128
MTK/Ralink System Tick Counter init... cd:8034bf68, m:214748, s:32
console [ttyS1] enabled
Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
RALINK_GPIOMODE = 1ab11d
RALINK_GPIOMODE = 18b11d
PPLL_CFG1=0xe64000
MT7620 PPLL lock
PPLL_DRV =0x80080504
start PCIe register access
RALINK_PCI_PCICFG_ADDR = 1000f0
*************** MT7620 PCIe RC mode *************
bio: create slab <bio-0> at 0
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI address [0x20200000-0x2020ffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff]
pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff] (PCI address [0x20000000-0x200fffff]
pci 0000:01:00.1: BAR 0: assigned [mem 0x20100000-0x201fffff]
pci 0000:01:00.1: BAR 0: set to [mem 0x20100000-0x201fffff] (PCI address [0x20100000-0x201fffff]
pci 0000:00:00.0: PCI bridge to [bus 01-01]
pci 0000:00:00.0: bridge window [io disabled]
pci 0000:00:00.0: bridge window [mem 0x20000000-0x201fffff]
pci 0000:00:00.0: bridge window [mem pref disabled]
BAR0 at slot 0 = 0
bus=0x0, slot = 0x0
res[0]->start = 0
res[0]->end = 0
res[1]->start = 20200000
res[1]->end = 2020ffff
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=0x1, slot = 0x0
res[0]->start = 20000000
res[0]->end = 200fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=0x1, slot = 0x0
res[0]->start = 20100000
res[0]->end = 201fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
Switching to clocksource Ralink external timer
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
RT3xxx EHCI/OHCI init.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
fuse init (API version 7.15)
msgmni has been set to 119
io scheduler noop registered
io scheduler deadline registered (default)
Ralink gpio driver initialized
Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A
loop: module loaded
deice id : c8 40 17 c8 40 (4017c840)
GD25Q64C(c8 4017c840) (8192 Kbytes)
mtd .name = raspi, .size = 0x00800000 (0M) .erasesize = 0x00000008 (0K) .numeraseregions = 65536
Creating 6 MTD partitions on "raspi":
0x000000000000-0x000000020000 : "boot"
0x000000020000-0x000000160000 : "kernel"
0x000000160000-0x0000007d0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
0x0000007d0000-0x0000007e0000 : "romfile"
0x0000007e0000-0x0000007f0000 : "config"
0x0000007f0000-0x000000800000 : "radio"
Register flash device:flash0
PPP generic driver version 2.4.2
NET: Registered protocol family 24
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Mirror/redirect action on
u32 classifier
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (2868 buckets, 11472 max)
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 164k freed
usb 1-1: new high speed USB device using rt3xxx-ehci and address 2
<CR>starting pid 195, tty '': '/etc/init.d/rcS'
rdm_major = 253
spiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
Read MAC from flash(0x7DF100) ffffffb0-4e-26-5f-ffffffae-ffffffde
SMACCR1 -- : 0x0000b04e
SMACCR0 -- : 0x265faede
Ralink APSoC Ethernet Driver Initilization. v3.0 256 rx/tx descriptors allocated, mtu = 1500!
spiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
Read MAC from flash(0x7DF100) ffffffb0-4e-26-5f-ffffffae-ffffffde
SMACCR1 -- : 0x0000b04e
SMACCR0 -- : 0x265faede
PROC INIT OK!
usbcore: registered new interface driver usbserial
USB Serial support registered for generic
usbserial_generic 1-1:1.0: generic converter detected
usb 1-1: generic converter now attached to ttyUSB0
usbcore: registered new interface driver usbserial_generic
usbserial: USB Serial Driver core
USB Serial support registered for GSM modem (1-port)
usbcore: registered new interface driver option
option: v0.7.2:USB Driver for GSM modems
SCSI subsystem initialized
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver rndis_host
dns_init
domain_name:tplinkmodem.net
Raeth v3.0 (Workqueue)
phy_tx_ring = 0x03f56000, tx_ring = 0xa3f56000
phy_rx_ring0 = 0x03f57000, rx_ring0 = 0xa3f57000
Pseudo Close vlan...
SMACCR1 -- : 0x0000b04e
SMACCR0 -- : 0x265faede
ESW: Link Status Changed - Port5 Link Down
ESW: Link Status Changed - Port0 Link Down
CDMA_CSG_CFG = 81000000
GDMA1_FWD_CFG = 20710000
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
Please press Enter to activate this console. [ dm_readFile ] 2042: can not open xml file /var/tmp/pc/reduced_data_model.xml!, about to open file /etc/reduced_data_model.xml
spiflash_ioctl_read, Read from 0x007e0000 length 0x10000, ret 0, retlen 0x10000
[ oal_sys_readCfgFlash ] 923: User config length is too long - ffffffff
[ dm_loadCfg ] 2438: Read config from flash failed. ret = 1
[ dm_readFile ] 2042: can not open xml file /var/tmp/pc/default_config.xml!, about to open file /etc/default_config.xml
[ parseConfigNode ] 552: Meet unrecognized object node "PhDDNSCfg", skip the node
[ parseConfigNode ] 557: Meet unrecognized parameter node "PhDDNSCfg", skip the node
[ parseConfigNode ] 557: Meet unrecognized parameter node "ProfileList", skip the node
[ parseConfigspiflash_ioctl_read, Read from 0x007df500 length 0x29, ret 0, retlen 0x29
Node ] 5spiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
52: Mespiflash_ioctl_read, Read from 0x007df200 length 0x4, ret 0, retlen 0x4
et unrecogspiflash_ioctl_read, Read from 0x00020000 length 0x200, ret 0, retlen 0x200
nized obspiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
ject node "QueueManagement", skip the node
[ parseConfigNode ] 552: Meet unrecognized object node "X_TP_IPTV", skip the node
[ parseConfigNode ] 552: Meet unrecognized object node "VoiceService", skip the node
[ parseConfigNode ] 557: Meet unrecognized parameter node "VoiceService", skip the node
[ parseConfigNode ] 552: Meet unrecognized object node "StorageService", skip the node
[ parseConfigNode ] 552: Meet unrecognized object node "X_TP_CallFireWallCfg", skip the node
[ parseConfigNode ] 552: Meet unrecognized object node "X_TP_SpeedDialCfg", skip the node
[ parseConfigNode ] 552: Meet unrecognized object node "X_TP_MultiIspDialPlan", skip the node
[ parseConfigNode ] 552: Meet unrecognized object node "X_TP_CallLogCfg", skip the node
[ parseConfigNode ] 552: Meet unrecognized object node "X_TP_SystemUpdate", skip the node
spiflash_ioctl_read, Read from 0x007df200 length 0x4, ret 0, retlen 0x4
[openSerialPort 125] Fail to open serial port /dev/ttyUSB1!
[initSerialPortFd 83] Fail to open /dev/ttyUSB1!, retry_counter= 1
[openSerialPort 125] Fail to open serial port /dev/ttyUSB1!
[initSerialPortFd 83] Fail to open /dev/ttyUSB1!, retry_counter= 2
ESW: Link Status Changed - Port0 Link UP
[openSerialPort 125] Fail to open serial port /dev/ttyUSB1!
[initSerialPortFd 83] Fail to open /dev/ttyUSB1!, retry_counter= 3
[openSerialPort 125] Fail to open serial port /dev/ttyUSB1!
[initSerialPortFd 83] Fail to open /dev/ttyUSB1!, retry_counter= 4
[openSerialPort 125] Fail to open serial port /dev/ttyUSB1!
[initSerialPortFd 83] Fail to open /dev/ttyUSB1!, retry_counter= 5
[openSerialPort 125] Fail to open serial port /dev/ttyUSB1!
[initSerialPortFd 83] Fail to open /dev/ttyUSB1!, retry_counter= 6
[openSerialPort 125] Fail to open serial port /dev/ttyUSB1!
[initSerialPortFd 83] Fail to open /dev/ttyUSB1!, retry_counter= 7`