The TM02 has 8MB of memory, believe me Actually the original firmware is about 8MB, while the openwrt is about 4MB
You need to join mtd4+mtd5+mtd5+mtd6+mtd7+mtd8 and cat them together, or try with the file mmmdonuts shared.
I'm a bit puzzled because I would have added mtd2 too...
And yes, this won't touch your bootloader. But you may want to set your server static ip to 10.10.10.123 maybe... not sure about the serial console, I got it working with the reset at power on

(Last edited by liladude on 14 Oct 2015, 09:57)

I am one of the people who cannot thank you enough for this
Unfortunately it looks like the original developer of this firmware is no longer active in this forum, so we cannot add the ethernet flashing to the first post, nor update the firmware on git.
Also, I don't know why he decided to change the bootloader, since the factory one seem to work fine with the firmware...
Now I'm curious: on the git there is a way to make the flashable firmware from an openwrt image, but it also needs a bootloader.
Now that CC is stable, it would be easier to have the firmware ready to be flashed through ethernet for everybody... but compiling it it's a bit too much for me right now... and I still need to fix block-mount  on my router
Is there a reason why the factory.bin from openwrt cannot be used for flashing without getting it out of the one create for uploading it through the original update software?

(Last edited by liladude on 14 Oct 2015, 07:49)

I used openwrt-ramips-rt305x-ht-tm02-squashfs-factory-r44945-ws.bin for flash from original firmware, then I upgraded to final CC using official sysupgrade image.
Some packages were missed in the upgrade , so I re-installed them and everything works fine now ( I use the tm02 as a nas on my local network)

Glad to be of assistance.  I only got involved because I wanted to rescue my TM03 then thought I could share what I learned.

I don't know why the bootloader is replaced either.  It would be good if someone could take over and update the work started by wingspinner.  The factory.bin needs to be fixed to correct the backup and it could also be modified to preserve the original bootloader.  It's all in the script and pretty straight forward.  A simple change would allow people to go back and forth between factory and OpenWRT without the need for serial console or flash programmer.

I don't quite understand your last question.

So, while we are on the subject, there are 2 files in the downloads.  What is the uImage.bin file for?

[url]https://downloads.openwrt.org/chaos_calmer/15.05/ramips/rt305x/openwrt-15.05-ramips-rt305x-ht-tm02-initramfs-uImage.bin[/url]
[url]https://downloads.openwrt.org/chaos_calmer/15.05/ramips/rt305x/openwrt-15.05-ramips-rt305x-ht-tm02-squashfs-sysupgrade.bin[/url]

Not sure what your block-mount issue is, but when you install it, do you get a message about it not being supported?  I believe it is not creating the needed /etc/config/fstab file like below.

config global
    option anon_swap '0'
    option anon_mount '0'
    option auto_swap '1'
    option auto_mount '1'
    option delay_root '5'
    option check_fs '0'

config mount
    option target '/mnt/sda1'
    option uuid 'XXXX-ZZZZ'
    option enabled '1'
    option fstype 'vfat'
    option options 'rw,sync'

Thanks all. I appreciate the continued help. I forgot to mention that I had tried setting the ETH to 10.10.10.123 but got the same results.

I will try with MmmDonuts two downloads. Might just  forgo the factory and use OpenWrt as the other formerly bricked TM02 is running fine on that. But, having said that, the challenge of getting the factory back for just out of interest sake, keeps nagging at me.

My next chore is a Rowsewill RNX-N150RT that is stuck in a boot loop. I have read the page here...
http://wiki.openwrt.org/toh/rosewill/rnx-n150rt

But, that is for an older V1 and mine is V2. But that's another story for after I get the final HooToo back running. If anyone has experience with the RNX, I'd love to hear as I have been unable to Serial into it so far. I have found a youtube on un-bricking a TPLink router (RNX is a badge engineered copy I am told) but that did not allow me to serial into it -- yet.

But, back to the HooToo for today. Thanks again, I am learning heaps.

(Last edited by HooTooBeatMe on 14 Oct 2015, 17:09)

It looks like the uImage is used for booting from the network. Perhaps for debugging or testing builds and configurations.  Not sure what other uses it may have for routers.

You should have what you need to do either/both.  I haven't tried the serial console on these routers but if you can replace any portion of the flash via serial, including the bootloader, then it shouldn't be a problem going back and forth using the files I uploaded.

I have some clip test probes to try the serial pads but haven't cracked open the TM02 yet.

Well, who knew, after Pressing "1" and getting this yesterday...

Was actually a prompt to accept that as the correct input device so pressing "Enter" then showed

Input Server IP (10.10.10.3) ==:10.10.10.3

Pressing "Enter" again gets...

Input Linux Kernel filename (Kernel) ==:Kernel

Pressing "Enter" again then starts the process.

After a while it gets to
TM02 login:
From the Manual I got "admin" and blank password -- did not work
"Admin" and blank -- did not work
"admin" and 11111111 -- did not work
"Admin" and 11111111 -- did not work

So, it looks like I am close, but no idea of the correct login and password combo.

Thoughts?

Try root, no password.  This is OpenWRT, right?

Nope, it was the factory but I can try OpenWrt.

I decided to see if I could get the factory back first then use the normal LuCI method id installing OpenWrt.

Just tired using "mtd3_firmware.bin" and selecion 1 and 2 from the menu. I loaded from the TFTP then stalled at

Kernel Panic not synching: VFS: Unable to mount root fs on unknown block(0,0)
random: nonblocking pool is initiated

Wandering aimlessly around over here.

Thanks for the help, I have not given up yet.

(Last edited by HooTooBeatMe on 14 Oct 2015, 20:25)

Factory login should be root/20080826.

With either firmware if the kernel loads and you reboot the admin web console should start on the ethernet port.

(Last edited by mmmdonuts on 14 Oct 2015, 20:33)

Sorry if my questions have been already answered but I'm a bit confused about the installation process and the status of this hack. I've the HooToo HT-TM02 but I never turned it on! I don't have a lot of spare time to play with it...

1) wingspinner's firmware replace the original bootloader. However I've read in the last posts that it's not needed anymore to install CC. It's true?

2) With the original bootloader is possible to boot openwrt and original firmware?

3) I've opened the wingspinner's firmware and it's a linux script+firmware in one single file. The script is very simple and it's very well explained (thanks a lot wingspinner). I wonder why no one edited that script to do all the whished things. There are some CRC problems?
For example: to keep the original bootloader in the usb you have to replace line 141 ("rm -f $FIRMFILE") with this: "#rm -f $FIRMFILE" (Warning: if you decrease the lines of the script, you have to change also the variable "SKIP" in the script or you will probably brick)
However if there are not any CRC or MD5 checks on the firmware, I think to be able to create a script that create a back up of the original firmware with the partitions already merged.

4) I never understood the exact procedure to restore the original firmware. I saw there is a procedure involving the serial cable and tftp. I can revert to the original firmware also via ethernet without serial? If yes, there is a guide?

5) I don't know very well how the openwrt update process work, but I think that via CLI we can use the command:
"mtd -r write ORIGINAL_FIRMWARE firmware" where ORIGINAL_FIRMWARE is mtd4+mtd5, to restore original firmware. I'm wrong?

Thanks anyone would answer my questions I want to try help this project!

P.s. sorry for any error in my message, I'm not english.

(Last edited by numero53 on 14 Oct 2015, 21:10)

Well, progress has been made. Going back through Serial data stream I noticed some checksum errors when using menu-2 and the OpenWrt Firmware.bin with the TFTP transfer.

So, in defiance of Einstein's Law, I kept retrying the process and finally got a full TFTP download. Then it happily processed it.

Sadly the same cannot be said of Menu-2 and the factory.bin firmware. I could never get it to go beyond "Login" and "Password" no matter what I tried.

So, for me the process was.
Turn off the router power.
Copy "mtd3_firmware.bin" to the TFTP base Folder
Rename it "kernal.bin" the name doesn't really matter at this stage. Capital letters will later though, so remember exactly what you named it.
Hook up the serial wires and Run puTTY in Serial 57600 with No-flow and No-Parity.
Go into the Network and Sharing center and set the Local IP address to 10.10.10.3
Click in the Subnet Mask section and it should fill it in with 255.0.0.0 and leave the rest empty.
Set the TFTP server to the correct folder for the renamed "kernel.bin"
Plug in the RJ45 to the router and check that the TFTP has 10.10.10.3 showing in the second. If not -- drop down the box and select it from the list.
Click in the puTTY window and turn on the router.
You only get 4-seconds to make a selection at the menu so be ready wwith a finger over the "2" button
Tap it and get

It doesn't look like it but that last line is a question so just tap "Enter" to accept.
The next line is similar for the Server IP so tap "Enter"
Then it will show you a file name, so Backspace it out and type in whatever you renamed the file to before. Take note of capitals. C++ cares.
Now, watch it all go by.

If no checksum errors you will get to a point where it looks like it has hung with the last line being something like "Going into Port Forwarding mode" there will be three lines like that then the cursor in a blank line.
You are actually now running in OpenWrt but no telling you, so tap "Enter" and mix a drink.
You can now shut puTTY and TFTP down.
Go back to the Ntwork and sharing center and change the local IP to 192.168.1.2
Subnet mask will fill itself in.
For gateway enter 192.168.1.1
Fill in the DNS servers if you have favorites that do not log your every request.
Use your browser to access LuCI with 192.168.1.1

A big thank-you for everyone's help.

(Last edited by HooTooBeatMe on 14 Oct 2015, 23:00)

Cool.  In my experience I was never able to get factory firmware back on the TM02 after the bootloader was replaced by OpenWRT.  I was able to run OpenWRT with the factory bootloader though, go figure.  Can you update the bootloader via the serial console?  If you can then it should be no problem to get the router back to factory firmware.

If your bootloader was factory the IPs for tftp would be different.  That's as least one way to tell.

@numero53,
This is a long thread with lots of info.  Pretty much all of your questions are answered in here except maybe who and how this will be maintained going forward. 

Start with the first 2 pages and then go backwards from this last one.  Also review the hardware wiki for the TM02. 

Evidently the mtd is protected by the kernel and OpenWRT does not allow writes to all of the partitions.  That would have solved my problems right off the bat and I would have been done after three posts.

So, I have to say I am confused on what was done here.  Maybe because I am not actually trying any of this, but I think that some of the content could be more specific.

Is this what stopped you from putting back the HooToo firmware?

Not seeing he did???

I am planning to replace my HooToo and would like to go back to stock (not enough zoom).  It's why I saved the thumb drive.

@RangerZ,
Well, I said it never worked for me and he is now running OpenWRT so it didn't really work for him either. Perhaps with a serial console I might have gotten further than the blinking blue light.

Can you check with admin pass admin and psk key 12345678 ?
I got those from mmmdonuts config files

I had tried and failed with...
login: admin
pass: admin

login: admin
pass: 12345678

login: root
pass: admin

login: root
pass: root

...and a lot of other combinations.

I did not try to use wireless at that point since I couldn't get in via RJ45, I figured I would only get the same login requirements to get into factory GUI via wifi. AND - now that you mention it, I didn't even check to see if windows could see the SSID. Ooops. That would have been a good sign that the factory GUI was running. Can't recall what LEDs were on/off.

BUT, it suggests that I was running the factory GUI. Maybe at "root" and there is another password for that.

Both TM02s are running the latest OpenWrt, so am reluctant to mess with it, but will think about opening one up and trying again.

I now have the Rosewill RNX-N150RT to try and un-brick but I can't find the Tx/Rx/Gnd points on the PCB. Also been reading that the RNX will not do TFTP, so it might just be a coffee cup coaster.

I am disappointed with Rosewill, given that it is the Newegg store brand, I thought they of all companies should be a little more open since they quote it had dd-wrt.

Not qwuit true as it comes with a stock GUI and you have to download the dd-wrt from the Roeswill website. It was not from dd-wrt, but a German adaptation, so no telling what else was slipped in there. Might explain the cheap cost. :shock:

It was updating to a real dd-wrt version that it was bricked.

(Last edited by HooTooBeatMe on 15 Oct 2015, 17:26)

My main reason for going back to stock was that I could never get OpenWrt to use the USB drive as a NAS, but the stock firmware did it perfectly.

I had tried adding "mtd" things as instructed here in other threads, but could never get it to work. I have since revived an old laptop running win7 as a dedicated NAS, so the need for factory firmware on a TM02 is no longer there.

If you still want to pursue the HooToo as a NAS I can try to put some notes together. 
Be aware, the speed is slow, even with EXT4.  I get about 50Mbps.  Never got NTFS to work.  It's not a good solution.  I actually do not use it, I have a wireless device in the USB to address the radio issues.
It is a good solution if you are traveling and need some type of shared storage.

Thanks RangerZ, but the win7 laptop is doing a fine job as was the factory GUI. Speed is not an issue as we do not need to stream from it. Mostly used to synch files between PCs.

I just cracked open one of the TM02s and hooked it up again to serial.

Using the factory firmware.bin that mmmDonuts provided as Kernel.bin

UBoot
Menu option 1 installs it and gets to the TM02 login: prompt and cannot get beyond it no matter what I try. BUT - it does show the SSID "TravelMateNano-2AEE and I can connect to it with "Limited access' BUT -- Changing the IPs back to 192.168.1.2 and 192.168.1.1 I cannot access the GUI in Firefox. It times out.

Menu option 2 installs then crashes right at the end with this...

Then it reboots and drops back to the UBoot menu.

(Last edited by HooTooBeatMe on 15 Oct 2015, 19:29)

How do I attach files? I have the entire Serial-text from Menu options 1 and 2 if anyone is interested.

I see files attached to some posts, how do I do that?

@HooTooBeatMe,
Did you try using the default subnet that HooToo uses, I think the router defaults to 10.10.10.254 on factory firmware and it should be accessible from both WLAN and WAN, a "little" glitch of theirs.

Also, did you try a reset to factory (pinhole) after the kernel loaded?  Just to see if that makes a difference.

Out of the box admin doesn't have a password but root is set to 20080826.  I don't know if you tried that one.