Hello,

just got a TP-Link C1200(EU) V1.0 that seems to be a new chimera and won't match known openwrt releases. Can you please help to identify the model, so that i can put the right openwrt onto it. Known versions for C1200 V1.2 are ignored with "unable to upgrade" from the device.

Inside i found two Wifi chips named
BCM 43217 and BCM 53125

Pictures from inside here: https://goo.gl/photos/v4LAzxyyZVG8idgRA

What build may match this machine?

TuxHHGer

If possible, you should try and see what is beneath the black heat sink shown in the pictures. Identifying the SoC that hosts the CPU will be beneficial in order to determine the suitable target, subtarget and profile.

Both the v2.0 and v3.0 of C1200 use the BCM 47189, which is a ARM Cortex A7, so while it might be a wild guess, perhaps your router has the same CPU?

Tried that out and updated the photos. On both sides another metal sheet cover it all, it's soldered 360° to the board.

Here are snippets from the tp-link firmware, viewed with GHex.
vendor_name:TP-LINK
vendor_url:www.tp-link.com
product_name:Archer C1200
device_name:Wireless Router Archer C1200
language:EU
product_ver:1.0.0
product_id:12000001
special_id:45550000
hw_id:E3266C61DFB9CD9C24684161C720D6A7
oem_id:D6D17B060D7F223BA6438E0CD8A021FC

And something very strange is this:
<OpenWrt>/luci-static/openwrt.org</OpenWrt>
<Killer>/luci-static/killersteel</Killer>
</internal>
</luci>
<minidlna>
<minidlna name="config"

Well, no help from there. It was worth a shot though

Another thing that catches my eye is that there doesn't seem to be a UART header anywhere on the PCB. This would indicate that it is not possible to get a serial access to the console and do things such as interrupt the bootloader.

I can't find the flash chip from the images either. Is it possible that it, too, is underneath the metal sheet cover? If so, it will rule out the possibility of using a JTAG or SPI interface directly to the flash chip and re-program it from there.

This leads to a situation where it may be impossible to flash OpenWRT onto the router unless you can masquerade the OpenWRT image so it looks like an OEM firmware and passes the necessary legitimacy checks.

Perhaps TP-Link is using OpenWRT as a baseline for building their own firmware? If that is the case, then you could mail their support and ask for a copy of the build environment. It is well within your rights to request it, since Linux kernel is under GPL. See instructions at https://wiki.openwrt.org/doc/devel/add.new.platform in order to verify if it is really running Linux, and find a mail template that you can send them.

TP-Link is not required to supply you with any source code for binary-only drivers, if they are used as loadable modules. This is very often the case when Broadcom chips are involved. Broadcom guys are really clandestine about their stuff

This means that while you might get the source code, you might not be able to build an executable firmware from it, at least not easily. But you can analyze the source code and that may help you in determining how an OpenWRT firmware needs to be masked in order to pass the legitimacy check of the OEM firmware. Make no mistake, though, it will be difficult. Very difficult. Even if you managed to mask your firmware and get it flashed, the bootloader on the flash memory might not be able to load it due to various reasons.