vitali2y/recover_totolink_a850r_thru_realtek_bootloader.md

## recover_totolink_a850r_thru_realtek_bootloader.md

      
    Raw
  

              recover_totolink_a850r_thru_realtek_bootloader.md
            
          
    Well, in hope to get more reliable and modern firmware on my Totolink A850R router from aliexpress.com I decided to upgrade it by TOTOLINK A850R-V1.0.2-20151104.zip from Totolink official site. So, I unpacked downloaded ZIP, started to upgrade the TOTOLINK-A850R-V1.0.2-B20151104.1609.web firmware from web admin panel, where the web form counted from 90 till 1 sec, after that page has been reloaded, I waited few more mins, and ... I figured out that my upgrade failed, with next "achievements":

I cannot open the web admin panel http://192.168.1.1 from web browser anymore,
both 5G and 2.4G WiFi do not work anymore, althought LAN/WAN works, i. e. my routed is not completely bricked,
with using USB-to-RS232 TTL UART PL2303HX Auto Converter adapter I can reach RealTek bootloader console.

So, I started to recover my router (everything below under Linux) in next steps:

Preliminary network activities:

vit@meadow ~/totolink $ sudo route add -host 192.168.1.6 eth0
vit@meadow ~/totolink $ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
~...~
192.168.1.6     *               255.255.255.255 UH    0      0        0 eth0
~...~
vit@meadow ~/totolink $ sudo ufw disable
Firewall stopped and disabled on system startup
vit@meadow ~/totolink $


To connect PL2303HX to A850R (from key: empty socket, white wire (RXD), green wire (TXD), black wire (GND), red wire (VCC, +5V) is not used);
To run minicom in 38400 7N1 mode:

sudo minicom


In order to get RealTek bootloader from minicom it's required to press both WPS/RST buttons before (!!!) power up the router:

Booting...

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@
@ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize
@ 0000000h 0c84016h 00000c8h 0000040h 0000016h 0000000h 0000016h 0400000h
@ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName
@ 0010000h 0000040h 0001000h 0000400h 0000100h 0000010h 000002dh GD25Q32
@ 
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 
---RealTek(RTL8196D)at 2013.12.27-12:35+0800 v1.2 [16bit](700MHz)
no sys signature at 00010000!
no sys signature at 00020000!
no sys signature at 00030000!
no sys signature at 00040000!
P0phymode=01, embedded phy

---Ethernet init Okay!
<RealTek>
Booting...

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@
@ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize
@ 0000000h 0c84016h 00000c8h 0000040h 0000016h 0000000h 0000016h 0400000h
@ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName
@ 0010000h 0000040h 0001000h 0000400h 0000100h 0000010h 000002dh GD25Q32
@ 
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 
---RealTek(RTL8196D)at 2013.12.27-12:35+0800 v1.2 [16bit](700MHz)
no sys signature at 00010000!
no sys signature at 00020000!
no sys signature at 00030000!
no sys signature at 00040000!
P0phymode=01, embedded phy

---Ethernet init Okay!
<RealTek>
<RealTek>
<RealTek>?
----------------- COMMAND MODE HELP ------------------
HELP (?)                                    : Print this help message
DB <Address> <Len>
DW <Address> <Len>
EB <Address> <Value1> <Value2>...
EW <Address> <Value1> <Value2>...
CMP: CMP <dst><src><length>
IPCONFIG:<TargetAddress>
AUTOBURN: 0/1
LOADADDR: <Load Address>
J: Jump to <TargetAddress>
FLR: FLR <dst><src><length>
FLW <dst_ROM_offset><src_RAM_addr><length_Byte> <SPI cnt#>: Write offset-data to SPI from RAM
MDIOR:  MDIOR <phyid> <reg>
MDIOW:  MDIOW <phyid> <reg> <data>
PHYR: PHYR <PHYID><reg>
PHYW: PHYW <PHYID><reg><data>
PORT1: port 1 patch for FT2
<RealTek>
<RealTek>IPCONFIG
 Target Address=192.168.1.6
<RealTek>


Firmware preparation (downloaded from ToToLink A850R Dual Band Wireless Router V5.1 Firmware Download; also, be aware that another TOTOLINK-A850R-V1.1.4-B20170526.1150.web firmware behaves weird, i. e. the same way, as initially installed TOTOLINK-A850R-V1.0.2-B20151104.1609.web firmware* from official site), and starting up tftp:

vit@meadow ~/totolink $ ls -lt
total 2420
-rw-r--r-- 1 vit vit 2475044 Sep 27  2014 TOTOLINK-A850R-IP04268-8197D-SPI-4M64M-V5.1-B20140927_1_1097_ALL.web
vit@meadow ~/totolink $ md5sum TOTOLINK-A850R-IP04268-8197D-SPI-4M64M-V5.1-B20140927_1_1097_ALL.web 
965e767daca31aa8bc7c9af64ab2def8  TOTOLINK-A850R-IP04268-8197D-SPI-4M64M-V5.1-B20140927_1_1097_ALL.web
vit@meadow ~/totolink $ tftp 192.168.1.6
tftp> binary
tftp> rexmt 1
tftp> timeout 180
tftp> trace
tftp> status
Connected to 192.168.1.6.
Mode: octet Verbose: off Tracing: on
Rexmt-interval: 1 seconds, Max-timeout: 180 seconds
tftp> put TOTOLINK-A850R-IP04268-8197D-SPI-4M64M-V5.1-B20140927_1_1097_ALL.web
~...~
sent DATA <block=4826, 512 bytes>
received ACK <block=4826>
sent DATA <block=4827, 512 bytes>
received ACK <block=4827>
sent DATA <block=4828, 512 bytes>
received ACK <block=4828>
sent DATA <block=4829, 512 bytes>
received ACK <block=4829>
sent DATA <block=4830, 512 bytes>
received ACK <block=4830>
sent DATA <block=4831, 512 bytes>
received ACK <block=4831>
sent DATA <block=4832, 512 bytes>
received ACK <block=4832>
sent DATA <block=4833, 512 bytes>
received ACK <block=4833>
sent DATA <block=4834, 512 bytes>
received ACK <block=4834>
sent DATA <block=4835, 36 bytes>
received ACK <block=4835>
Sent 2475044 bytes in 2.9 seconds
tftp>


Next under minicom terminal (be aware, router will automatically reboot and enter in non RealTek bootloader mode at the end of firmware uploading):

<RealTek>
**TFTP Client Upload, File Name: TOTOLINK-A850R-IP04268-8197D-SPI-4M64M-V5.1-B20140927_1_1097_ALL.web
~...~
**TFTP Client Upload, File Name: TOTOLINK-A850R-IP04268-8197D-SPI-4M64M-V5.1-B20140927_1_1097_ALL.web
|
**TFTP Client Upload File Size = 0025C424 Bytes at 80500000

Success!
<RealTek>
Linux kernel (root-fs) upgrade.
checksum Ok !
burn Addr =0x00010000! srcAddr=0x80500000 len =0x00101412 
.............................................................................................................................................................................................................................................
Flash Write Successed!
<RealTek>
Root filesystem upgrade.
checksum Ok !
burn Addr =0x00130000! srcAddr=0x80601422 len =0x0015b002 
.............................................................................................................................................................................................................................................
Flash Write Successed!
<RealTek>
reboot.......

Booting...

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@
@ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize
@ 0000000h 0c84016h 00000c8h 0000040h 0000016h 0000000h 0000016h 0400000h
@ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName
@ 0010000h 0000040h 0001000h 0000400h 0000100h 0000010h 000002dh GD25Q32
@ 
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Reboot Result from Watchdog Timeout!

---RealTek(RTL8196D)at 2013.12.27-12:35+0800 v1.2 [16bit](700MHz)
no rootfs signature at 000E0000!
no rootfs signature at 000F0000!
Jump to image start=0x80500000...
decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
start address: 0x80003400
Realtek WLAN driver - version 1.6 (2013-02-21)
DFS function - version 1.0.18
8812 mp chip !! 


#######################################################
SKB_BUF_SIZE=3600 MAX_SKB_NUM=768
#######################################################


#######################################################
SKB_BUF_SIZE=3600 MAX_SKB_NUM=768
#######################################################


Probing RTL8186 10/100 NIC-kenel stack size order[3]...
chip name: 8196C, chip revid: 0
NOT YET
eth0 added. vid=9 Member port 0x10...
eth1 added. vid=8 Member port 0x1...
eth2 added. vid=9 Member port 0x2...
eth3 added. vid=9 Member port 0x4...
eth4 added. vid=9 Member port 0x8...
eth5 added. vid=9 Member port 0x0...
[peth0] added, mapping to [eth1]...
Realtek FastPath:v1.03

Done! Here is a fully workable Totolink A850R router with recovered V5.1 firmware.
More info:

About RealTek bootloader,
Firmware upgrade under Winduz with using FirmwareUpgradeTool.zip (translated from Vietnamese),
TOTOLINK A850R online emulator,
More info about hardware with pics of similar TOTOLINK A780R (in Chinese),
Firmware TOTOLINK page (in Vietnamese).
No results found