Unbricking Archer C6/A6 v3.x

Sorry for replying late but thanks a lot for this!

1 Like

Can you explain how you connected it without soldering?
I have this (RPi) serial adapter and also a Pine64 woodpecker serial adapter, but I assume I'd need pins (like RPi's GPIO pins) to connect them, but all I see are the holes.
I have no soldering experience, so if I can do without that, that would be great.

I used a 3 pin header (like the one below, but cut with 3 pins only). I plugged the shorter side (without soldering) to the router board, and to the other side the serial wiring.

2 Likes

Thanks!
Do you know if it's possible to attach an UART (with those pins) and then close the enclosure again?

I don't think so. The enclosure of this device is pretty tight. So unless you drill a hole for the UART wires, I do not believe it will be possible to close the case with the UART wires attached.

1 Like

Thanks for that very useful info, much appreciated :slight_smile:
The Pine64 UART adapter does have individual wires, which might fit in the existing holes, but it looks like those holes are below the board, which means the chances of success are quite low.
I thought it may be an interesting learning experience, but I'm not willing to damage things for that.
Cheers :+1:

1 Like

Turns out, it is possible :smiley:

The wires themselves probably could go through the ventilation holes, but the connectors you'd have on each end are too big for those holes ... but they do fit through the wall-mount holes!
Right now, I have a 4 pin header, unsoldered, with 3 wires attached to them (GND/TXD/RXD) and then I closed the device up again \o/
My guess is the space is tight which holds it in place. Tight, but (just?) enough.

1 Like

Looks like I cheered too soon ...

When I initially connected it, I could follow the whole boot via the serial. But I didn't manage to provide input. One should be able to do '4' or 't' to interrupt the boot process or 'x' to start the web recovery, but I wasn't able to trigger that a single time.
I have used a serial connection before and then I'd see a login prompt when the boot has finished, but I didn't see that now.

I'm still on stock firmware as I'm assuming that's needed to fill in (some of) the gaps on the device wiki page.

I opened up my router again to see whether I could improve things, but since then I either saw no boot log or only partially. Whatever I tried since, it's mostly useful. So it looks like my initial attempt really was a lucky shot.

I hope someone can tell me or give me hints what to do in order to make the serial work properly and reliably.

Check if there is a missing zero-ohm resistor in the rx path, something TP-Link loves to do in order to prevent serial console input.

2 Likes

Thanks :+1:
Tbh I don't know what the rx path is, but I'm going to a hackerspace tonight and hopefully they do.

But if you have links to learn more about 'rx path', I'd appreciate it.
I did do a search here, but I mostly saw things wrt SQM/CAKE and another one which seems relevant, but I don't understand what it says (and whether it actually is relevant in my case).

EDIT: Router bricked, then not powering up after using self-made serial cable - #8 by anon57995562 seems potentially useful; going to watch the vids.
EDIT2: Not so useful after all

The router's rx path (at least in this sense), is the physical copper trace on the PCB between its serial rx pin (the one where you plug in your usb2serial tx connector) and the SOC itself. This copper trace should be uninterrupted, but TP-Link likes to cut it (by not assembling a zero-ohm resistor), meaning for anything you enter to reach the SOC, you will have to (solder-)bridge that connection to fix the connection.

A high-res photo of your PCB around the serial connector might help to determine that.

1 Like

I don't know if this is a proper photo, but it's likely the best my phone can do:

Does this help?

(Original is 3.2 MB, no idea whether it gets modified when uploading here)

I was wrong :smiley:
I opened the case up again to take the photos and then tried the serial again with the opened case. And when I pressed the unsoldered pins into a certain angle, I could sent key presses:

U-Boot 1.1.3 (Sep 30 2021 - 10:03:31)

Board: Ralink APSoC DRAM:  128 MB
relocate_code Pointer at: 87f58000

Config XHCI 40M PLL 
flash manufacture id: ef, device id 40 18
find flash: W25Q128BV
*** Warning - bad CRC, using default environment

============================================ 
Ralink UBoot Version: 5.0.0.0
-------------------------------------------- 
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection 
DRAM_TYPE: DDR3 
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: SPI Flash
Date:Sep 30 2021  Time:10:03:31
============================================ 
THIS IS uboot
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 880 MHZ #### 
 estimate memory size =128 Mbytes

Press '4' or 't' to break the booting process

Press 'x' to enter recovery web server                                                                                                                                                         0 
#Reset_MT7530
set LAN/WAN WLLLL

   
4: System Enter Boot Command Line Interface.

U-Boot 1.1.3 (Sep 30 2021 - 10:03:31)
MT7621 # cat /proc/mtd 
Unknown command 'cat' - try 'help'
MT7621 # help
Unknown command '�LLLLLLLLLLLLH@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@�������������������������������help' - try 'help'
MT7621 # help
Unknown command '��5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�5�55?�����������������������������help' - try 'help'
MT7621 #

I don't know what I can do here, but the RX does work. Probably need to solder it to make it work reliably.

EDIT: help does work if I press the connector 'better' (and constantly).

Hello sir @dsouza thanks for providing a usefull information for the community and i need a help from you, i have archer c6 v3 router and i flash openwrt and router got bricked, reset button, ethernet dead almost nothing is work except power button

The wrong i done is after openwrt flashed ethernet is working as expected but later i flashed tp link official firmware of archer c6 via sysupgrade which at first time provide a checksum error but i forcefully flashed it and router got bricked when i click power button all lights are on

Pls let me know is it possible to fix via uart

Thanks again and hope you will help me by provide a information

See this thread for accessing the UART headers on this specific device: No output from UART headers

Try method 1 on this link.

Hi @AashishAS and @darksky thanks for the reply as i previously said my router ethernet is not working due to brick so https://www.tp-link.com/in/support/faq/1482/ method will not work in my case
Pls let me know what i will do

Thanks and hope you guys will providing me a valuable information

Then UART is the only way. @dsouza can guide you, he helped me when I encountered the same.

Edit- Unbricking Archer C6/A6 v3.x

Thanks man :heart::heart::heart:

1 Like

I bricked my router (due to my own doings) and have set up a UART-USB connection using my flipper zero, but it's just reading garbage. I set the baudrate 115200 and 8N1, but none of the bytes read are human-readable.

The power led turns on and stays on for about 10 seconds, then turns off for a second. Then all leds turn green, then one of them turns orange, and then it's back to having the single green one.