Debrick TP-Link Archer C7 v5

 I had OpenWrt installed on my Archer C7 v5 for a while. I wanted to return to TP-Link firmware. I tried to get it done via installed Luci web interface (don't do this!). Router didn't recover.

After restart I had only still power LED. I found about tftp recovery mode but it didn't work for me. I connected via UART, but one line on the PCB is not connected to the PIN. I try to solder it, but my skills where to low. I found solutions as you can see on the photos below. I put a needle trough a cable and hold it to the line on PCB while turning on router in recovery mode. Than I was able to send commands to the router. 

It was some time ago, so I don't remember all the commands.


More on this topic: 

https://openwrt.org/toh/tp-link/archer-c5-c7-wdr7500#serial

https://www.reddit.com/r/openwrt/comments/en8845/archer_c7_v5_debricking/

https://forum.openwrt.org/t/archer-c7-v5-revert-to-stock-firmware/44864/6

https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=5bdd238b634a34b038fbea9046893de29a77c000

https://forum.openwrt.org/t/solved-archer-c7-ru-v5-tftp-install-does-not-works/28946








ath> tftpboot Trying eth0 dup 1 speed 1000 *** Warning: no boot file name; using '0200A8C0.img' Using eth0 device TFTP from server 192.168.0.10; our IP address is 192.168.0.2 Filename '0200A8C0.img'. Load address: 0x81000000 Loading: ################################################################# ################################################################# removed many similar lines ################################################################# ####################################### done Bytes transferred = 15504354 (ec93e2 hex) ath> erase 0x9f020000 +ec93e2 Erasing flash... First 0x2 last 0xee sector size 0x10000 238 Erased 237 sectors ath> cp.b 0x81000000 0x9f020000 0xec93e2 Copy to Flash... write addr: 9f020000 done ath> reset U-Boot 1.1.4 (Mar 8 2018 - 16:34:18) ap152 - Dragonfly 1.0 DRAM: 128 MB Top of RAM usable for U-Boot at: 88000000 Reserving 413k for U-Boot at: 87f98000 Reserving 16448k for malloc() at: 86f88000 Reserving 44 Bytes for Board Info at: 86f87fd4 Reserving 36 Bytes for Global Data at: 86f87fb0 Reserving 128k for boot params() at: 86f67fb0 Stack Pointer at: 86f67f98 Now running in RAM - U-Boot at: 87f98000 Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18 flash size 16MB, sector count = 256 Flash: 16 MB Using default environment In: serial Out: serial Err: serial Net: ath_gmac_enet_initialize... Fetching MAC Address from 0x87fbafdc ath_gmac_enet_initialize: reset mask:c02200 athr_mgmt_init ::done Dragonfly ----> S17 PHY * athrs17_reg_init: complete SGMII in forced mode athr_gmac_sgmii_setup SGMII done : cfg1 0x80000000 cfg2 0x7114 eth0: 00:00:29:ad:00:00 eth0 up eth0 Setting 0x181162c0 to 0x41822100 [NM_Error](nm_api_checkInteger) 00384: extra-para:a6 3b [NM_Error](nm_api_checkInteger) 00389: factory boot check integer flag is not 1. Hit any key to stop autoboot: 0 Trying eth0 eth0 link down FAIL Trying eth0 dup 1 speed 1000 HTTP server is starting at IP: 192.168.0.1 HTTP server is ready!

After that I browse for TP-Link stock firmware, flashed it through web interface (192.168.0.1) and it came back. Succeed!

Share: