Tplink archer c20 v4 bricked

[kcubeterm]

By mistake, my brother flashed openwrt image from stock ui and now router has stuck into boot cycle.
I connected the serial console and i am keep getting following ouput.

13:36:34.614 -> 
13:36:34.614 -> 
U-Boot 1.1.3 (Nov 30 2016 - 18:53:03)
13:36:34.614 -> 
13:36:34.614 -> 
Board: Ralink APSoC DRAM:  64 MB
13:36:34.614 -> 
relocate_code Pointer at: 83fb8000
13:36:34.614 -> 
******************************
13:36:35.066 -> 
Software System Reset Occurred
13:36:35.066 -> 
******************************
13:36:35.066 -> 
gpiomode1 55054404.
13:36:35.066 -> 
gpiomode2 05540554.
13:36:35.066 -> 
gpiomode2 05550555.
13:36:35.066 -> 
flash manufacture id: c8, device id 40 17
13:36:36.092 -> 
find flash: GD25Q64B
13:36:36.092 -> 
============================================ 
13:36:36.092 -> 
Ralink UBoot Version: 4.3.0.0
13:36:36.092 -> 
-------------------------------------------- 
13:36:36.092 -> 
ASIC 7628_MP (Port5<->None)
13:36:36.092 -> 
DRAM component: 512 Mbits DDR, width 16
13:36:36.092 -> 
DRAM bus: 16 bit
13:36:36.092 -> 
Total memory: 64 MBytes
13:36:36.092 -> 
Flash component: SPI Flash
13:36:36.092 -> 
Date:Nov 30 2016  Time:18:53:03
13:36:36.092 -> 
============================================ 
13:36:36.092 -> 
icache: sets:512, ways:4, linesz:32 ,total:65536
13:36:36.092 -> 
dcache: sets:256, ways:4, linesz:32 ,total:32768 
13:36:36.092 -> 
13:36:36.092 -> 
 ##### The CPU freq = 575 MHZ #### 
13:36:36.092 -> 
 estimate memory size =64 Mbytes
13:36:36.092 -> 
RESET MT7628 PHY!!!!!!
13:36:36.157 -> 
continue to starting system.
13:36:36.157 -> 
    0 
13:36:36.157 -> 
disable switch phyport...
13:36:36.157 -> 
   
13:36:36.157 -> 
3: System Boot system code via Flash.(0xbc020000)
13:36:36.157 -> 
do_bootm:argc=2, addr=0xbc020000
13:36:36.157 -> 
## Booting image at bc020000 ...
13:36:36.157 -> 
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover
13:36:36.349 -> 
[04010D08][04010C0D]
13:36:36.832 -> 
DDR Calibration DQS reg = 00008788
13:36:36.832 -> 
13:36:36.832 -> 
13:36:36.832 -> 
U-Boot 1.1.3 (Nov 30 2016 - 18:53:03)
13:36:36.832 ->

I tried to press, 1 or 7 or 4
nothing worked to switch into command mode.
what should i do to get inside command mode. once i get inside command mode, it can be unbrick

[pwned]

I have no clue about this device. So do not expect much further assistance.

Did you try the Linux method described in the wiki?
Another option for windows: https://www.tp-link.com/de/support/faq/1482/

[kcubeterm]

fixed!

i just saw, my router is trying to fetch firmware on tftp protocol, when i boot the router in recovery mode( turn of router, keep the reset button pressed, now press the power button, after 5-10 second, leave the reset button. )

so, i just setup tftp server with static ip. put firmware on tftp, booted router in recovery mode. it just flashed the openwrt successfully.

logs while booting in recovery mode.

U-Boot 1.1.3 (Nov 30 2016 - 18:53:03)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
gpiomode1 55054404.
gpiomode2 05540554.
gpiomode2 05550555.
flash manufacture id: c8, device id 40 17
find flash: GD25Q64B
============================================ 
Ralink UBoot Version: 4.3.0.0
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Nov 30 2016  Time:18:53:03
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 575 MHZ #### 
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!..................................................
starting recovery...
TODO, Read MAC Address from Flash


 netboot_common, argc= 3 

 NetTxPacket = 0x83FE6F00 

 KSEG1ADDR(NetTxPacket) = 0xA3FE6F00 

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!! 
TFTP from server 192.168.0.66; our IP address is 192.168.0.2
Filename 'tp_recovery.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80060000
Loading: T T T T T T T T T T