TP-LINK RE450 V1 bricked

Hello everyone.

I have bricked my TP-LINK RE450 V1. I had OpenWRT 19.07.5 installed and wanted to go back to original TP-LINK firmware.
I know, stupid mistakes happens all the time. After trying to put back the original firmware in a wrong way, I bricked my RE450.

Now it just boot lops every 2-3 seconds and can't do anything really.

  1. Can you put me in the right direction to try tftp recovery. (I don't know what buttons to press, as it seems no combination works for me)

  2. Second method would be to use flashrom and write the firmware direct to flash chip.
    I can read the content of the flash chip with flashrom utility on raspberrypi, but don't know how to prepare new .bin file (OpenWRT or TP-LINK) to be able to write that file back to flash chip.

Thanks.

Follow Heinz post

Thank you sammo.

Well, I already try that, but while soldering wires on those 3 pads for serial connection I ended up with just 2 of them. I overheated one (TX) and it is just not there anymore.
So, no serial connection for me on that device.

The only hope is that I can write firmware directly to the chip. I ended up with my RE450_bricked.bin and if I binwalk that binary, it is obviusly 2 U-boot loaders on wrong positions.

$ binwalk RE450_bricked.bin 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
14608         0x3910          U-Boot version string, "U-Boot 1.1.4 (Dec 15 2017 - 15:14:42)"
14656         0x3940          CRC32 polynomial table, big endian
15952         0x3E50          uImage header, header size: 64 bytes, header CRC: 0x8555A513, created: 2017-12-15 07:14:42, image size: 39666 bytes, Data Address: 0x80010000, Entry Point: 0x80010000, data CRC: 0xD26A2F81, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image"
16016         0x3E90          LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 106000 bytes
153892        0x25924         U-Boot version string, "U-Boot 1.1.4 (Dec 15 2017 - 15:14:42)"
153940        0x25954         CRC32 polynomial table, big endian
155236        0x25E64         uImage header, header size: 64 bytes, header CRC: 0x8555A513, created: 2017-12-15 07:14:42, image size: 39666 bytes, Data Address: 0x80010000, Entry Point: 0x80010000, data CRC: 0xD26A2F81, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image"
155300        0x25EA4         LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 106000 bytes
194967        0x2F997         TP-Link firmware header, firmware version: 0.0.0, image version: "", product ID: 0x0, product version: 0, kernel load address: 0x0, kernel entry point: 0x80002000, kernel offset: 0, kernel length: 512, rootfs offset: 770417, rootfs length: 0, bootloader offset: 0, bootloader length: 0
195479        0x2FB97         LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 2207564 bytes
965897        0xEBD09         Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 3634385 bytes, 669 inodes, blocksize: 1048576 bytes, created: 2017-12-15 07:25:27
4653056       0x470000        JFFS2 filesystem, big endian

Is it possible to merge somehow this bricked binary from chip with OpenWRT (or original) firmware and than write that newly prepared binary back to chip again?

Update.

After some micro soldering one of the damaged pads, I managed to attach wires for serial communication. After that I successfully restored the original TP-LINK firmware.
I just followed Heinz post.

I'm now again on OpenWrt and finally configured RE450 to my wish. I wanted to use RE450 as range extender and I'm connected to my main wifi router on 2,4 GHz radio. (And not 5 GHz, as 5 GHz signal is not strong enough to provide stable uplink)
On RE450 I'm using relayd and followed documentation:

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.