TPLink Archer AXE5400(JP v1) chipset

For Developers
1

After examining the firmware released by tplink, we found that the processors are IPQ5018
and QCN9000 and QCN6122.

It also listed mp03.3-c2.

(This research is based on the JP version, so it may vary by country.)

2

Do you have serial console connected to get boot log of oem firmware,
If it accepts input - "printenv" and"help" from uboit, and if tou can access shell in their fw.

Please post the link to local site with fw upgrade versions. Besides binwalk-ing towards oem dts you can find "supportlist" with other devices served by same upgrades.

3

Since I did not disassemble the router, I was unable to obtain console logs.
I have not yet found a support list.
The firmware distribution link is here:

4

Does not get very far

SupportList:
{product_name:Archer AXE5400,product_ver:1.0.0,special_id:4A500000}
{product_name:Archer AXE5400V,product_ver:1.0.0,special_id:4A500000}
5

Now that I've created a DTS file, I'll explain how to do it.

  1. Extract the .bin file with
 ubireader_extract_files axe5400_jp-up-ver1-1-0-P1[20250613-rel49242]_sign_2025-06-13_14.16.53.bin.

Navigate to the newly created folder, where you'll find a file with the .ubifs extension.
4. Convert the .ubifs file with "kernel" in the filename to a DTS file with

dtc -I dtb -O dts [full path of the .ubifs file with "kernel"].

grep -n "fdt@mp03.3-c2" axe5400_composition.dts

This will search for the line containing fdt@mp03.3-c2.
Select the part that says data=[hexadecimal number here],
and paste it into the file you created as hex.txt.
Remove data=[], from the file and leave only the hexadecimal number.

#Clean spaces and newlines to create the real binary data (blob.dtb).
tr -d ' \n\t' < hex.txt | xxd -r -p > blob.dtb

Convert it to a DTS file so it can be read.

dtc -I dtb -O dts blob.dtb -o ARCHER_REAL_MAP.dts

Now, you should be able to see the structure by viewing the .dts file in a text editor.