TP-Link WA850RE v2.0 Bricked

Installing and Using OpenWrt
37

I have been able to restore it :smiley:, but with firmware openwrt 18.06.5 sysupgrade. I think that with stock firmware is also restorable.
NOTE: I can't save the config settings with openwrt, erase all turning off the device.

wa850reSerial.2

wa850reSerial
wa850reSerial772×923 206 KB

  1. You have to bridge 2 points (try it first with Tx and test it, after Rx).
    Note: you'll need usb to rs232 ttl converter module, pins working at 3.3V (TTL level voltage).

  2. Setting ip pc to 192.168.1.10, run tftp server (tftpd32) on ethernet interface, download lastest firmware openwrt 18.06.5 sysupgrade version, rename to firm.bin (for easy use).
    Note: data (firmware) is sent on ethernet interface, commands are sent on serial interface UART.
    Note: openwrt 18.06.5 sysupgrade
    md5: 9464728d3dbfe7a232766811e19db5d4
    sha1: 2f7732e64088de06f19ddbcfc5ac2def6d4d12c8
    sha256: 8b80f93c2c58ed01b487c55241d233ac4f57209a1996ccb67a386b2aa08d65e4

  3. Setting baud rate to 115200 (PuTTY console), no flow control.
    Note: I have stopped loop with typing tpl.
    In my case setting to 128000 can see characters but not stop loop.I have stopped loop, setting baud rate to 115200 and only connecting Rx on device (repeater). Because if connect Tx too, i can see rare characters, and cant use ctrl-v, which interfere with ctrl-v.
    Conclusion I did it without seeing. :unamused: :pensive:

  4. During "Autobooting in 1 seconds" type tpl.
    Note: open notepad, typing tpl, select it all, copy for use it into console (PuTTY) with click right or ctrl-v.

  • set where to find for file firm.bin
  • copy firm.bin from tftp to ram memory (0x80060000 address).
  • erase 0x380004 (3670020 Bytes) from flash memory (starting at 0x9f020000).
  • copy firm.bin stored in ram to flash memory (0x380004 Bytes).
  • boot from flash memory (0x9f020000 address).
setenv serverip 192.168.1.10

tftpboot 0x80060000 firm.bin
erase 0x9f020000 +0x380004
cp.b 0x80060000 0x9f020000 0x380004
bootm 0x9f020000

Note: According to printenv (TL-WA850re v2 - Too big uncompressed stream LZMA ERROR 1) or typing printenv for info.

Stock Stripped Firmware
Note: I think that with stock firmware is also restorable. :thinking:

tftpboot 0x80060000 firm.bin
erase 0x9f020000 +0x36f923
cp.b 0x80060000 0x9f020000 0x36f923
bootm 0x9f020000

Note: wa850re v2 stripped firmware stock,file size 3602723 bytes (0x36f923 in hexadecimal).
md5: dd3d2bbbc5a1706cfedb17142efd2050
sha1: 040def0d4cbb9a8522626a9db1d3a536d3d63b27

(https://openwrt.org/toh/tp-link/tl-wa850re)

3 Likes