in Uncategorized

TP-Link Archer C7 AC1750 V2 TFTP Recovery

archerc7

After accidentally overwriting /etc/config/network on a TP-Link Archer C7 AC1750 V2 today… I went looking for ways to recover without a JTAG header and a FDTI adapter. Playing around with the reboot/reset I finally got it into some kind of recovery mode. I saw ARP 192.168.1.66 which is followed by it asking for ArcherC7v2_tp_recovery.bin.

Since as far as I can tell this feature is totally undocumented for the Archer C7 V2 and its addresses are slightly different from previous models. I figured I’d put this out there for anybody else looking to fix one of these things without resorting to a soldering iron.

First, install some kind of TFTP server

user@computer:$ apt-get install atftpd

Download a factory image of OpenWrt. I use snapshots until chaos calmer is released since I want 802.11ac support in luci and iwinfo.

user@computer:$ wget https://downloads.openwrt.org/snapshots/trunk/ar71xx/openwrt-ar71xx-generic-archer-c7-v2-squashfs-factory.bin

Make the router think its getting a normal recovery firmware

user@computer:$ mv openwrt-ar71xx-generic-archer-c7-v2-squashfs-factory.bin /srv/tfptd/ArcherC7v2_tp_recovery.bin

Now, configure your network card for 192.168.1.66 and power on the router while holding down the reset button. The router itself will come up as 192.168.1.86 when in recovery mode. It should take a little bit to transfer and then restart. (lights will flash) After that you should be able to telnet to 192.168.1.1 and start configuring openwrt.

  • arango

    Unbelievably helpful. Totally saved me today!

  • mkhpalm

    I’m glad it helped somebody else.

  • Courtney

    How long did you hold the button to enter recovery mode, and did you have to connect to a specific port?

  • I used port 1 and basically did a 10-10-10 reset to get it into recovery. Holding the reset down the enter time, 10 seconds while on, then 10 while off, then 10 while back on. That said… It *should* work just powering it on while holding reset down during the entire boot phase.

  • Myeongjae Yu

    I was glad to find your post, because I’ve got a bricked router.
    Archer C7 v2.
    I’ve tried Tftp recovery yesterday, and seen recovery firmware uploaded automatically in recovery mode(hold reset btn over 5secs).
    Firmware name is ArcherC7v2_tp_recovery.bin. Tftp server is 192.168.1.66. And router is 192.168.1.68 as like your post.
    But, after all, nothing is changed. all LEDs blinking again and again…
    I’ve tried openwrt firmware(BB ver. And CC trunk), dd-wrt firmware..
    Is there any other way to out of this?
    Thanks in advance.

  • Unfortunately the recovery is a bit of a shot in the dark. I’m not sure what its trying to tell you if all the lights keep blinking like that. If it won’t take the recovery firmware and boot up for you to get in then you’ll probably need to solder on the JTAG header and have a look at the console. The openwrt wiki should point you in the right direction to do that for this board.

  • deepred

    It helped me too! Thank you man!

  • Eduardo

    Hi Myeongjae Yu,

    Did you find a solution ? I have the same problem: all LEDs blinking again and again …

    Best,
    Eduardo

  • Tim Carlin

    Hi, how is 5G band working for you? I tried the the latest CC build (10 MAR) but didn’t have any luck. The RX speed was fine but TX was barely a trickle. I’m back to stock which performs fine but is pretty limited. 2.4G band worked just fine.Thanks.

  • I’m running r44620 and don’t have a problem with 5G. I do have a problem with dnsmasq needing to be restarted once after boot though.

  • Meor Naim Mkz

    i am a novice and ive never understand this TFTP thing. What ever you are doing up there is like alien language to me. Can u explain it to me in the most layman manner as possible…

  • It kind of depends on what operating system you use.

    1. Find and install a TFTP server for whatever OS you use
    2. Download the openwrt factory firmware and rename it to ArcherC7v2_tp_recovery.bin
    3. Put that file at the root of your TFTP server
    4. Configure your NIC (thats plugged into the router) with 192.168.1.66/255.255.255.0
    5. Get the router into recovery boot mode and it’ll do the rest

    The router booting into its special recovery mode will automatically try to get and install ArcherC7v2_tp_recovery.bin from 192.168.1.66 over TFTP.

  • Now I’m running r44797 and don’t have an issue with TX.

  • Meor Naim Mkz

    Much to my surprise, i managed to do it! Hahaha. It is now back to normal. Although i use a TPLINK one. I downloaded the V2 of the website and rename it to the recovery name. Now it is back to Factory!

    THANKS MIKE! You are amazing. If i can give you a star, you’ll get 10 from me. Haha

  • Max

    when I install atftpd it creates a folder /srv/tftp, not /srv/tfptd like in the article. Either way my archer c7v2 connects to 192.168.1.66, blinks a little on the ethernet port but doesn’t reboot. Do I need to do this to setup atftpd? http://wiki.ubuntuusers.de/advanced_TFTP

  • Bryce “PJ”

    Has anyone had any luck with this on a C5 (v1.2)? Instead of 192.168.1.86, the router comes up on 192.168.0.86, sends an arp request for 192.168.0.66, then gets ArcherC5v1_tp_recovery.bin. After it grabs the file, it reboots, and the power, system, and 5ghz lights light up solid, there’s absolute silence on the WAN and switch ports, as far as I can see with Wireshark. I’m trying to recovery from a bad flash with mtd from openwrt and I think I’m SOL other than JTAG.

    I’ve had nothing but issues with this guy on openwrt and ddwrt both. The 5ghz radio absolutely refuses to play nice with either. The router still has the plastic on it and it’s been out of the box for all of 48 hours, so I’m rather frustrated with it.

  • I don’t have any experience with the C5 1.20 but it seems to have the same Atheros chipset I have. My 5ghz radio has been solid since chaos calmer rc2 and mostly good with trunk releases before that. I’ve bricked mine a few times and was always able to get it back using the recovery mode. Try using the image from tp-link and see if you can get it to boot back up normal. FWIW, I tend to do a packet dump with these things when I’m trying to do a tftp recovery. Thats the only way I know for sure that it took the entire image. I’ve had a couple of times where it seemed to hang up part way through recovery and I had to start over. It always eventually worked.

  • LHTC

    When I try to connect with Tftp Server I cannot fix the working path permissions and I receive the prompt “Check ownership for the current TFTP server’s working path” Any ideas?

  • shirtsofholland

    Great post. for V1 router the IP’s are in the 0.X range. IP of computer should be 192.168.0.66 (port 69) …. and a question: our boot bin only upload to 55-66% never ever more …. so the firmware is never fully uploaded …. TP LINK Archer C7 v1 … appreciate any ideas

  • Jeff Arnts

    After banging my head against the wall for a couple hours, I set the TFTP
    server to 192.168.0.66 and it found the firmware. I have an AC1750 V2,
    so it should have been 1.66. Just posting in case other people have an
    issue with it.

  • Bablat

    Thanks for the procedure, I have bricked my router by uploading the wrong (generic broadcom…) dd-wrt firmware, it got stuck in a reboot loop (all lights flashing every 2-3 seconds or so).

    I managed to use your procedure above to get the router (Archer C7 v2) to download the firmware via TFTP. I attempted multiple versions, the router downloads all of them but after the file transfer is finished it never reboots on its own.

    When I reboot it manually, it goes back to the same reboot loop. I believe that the firmware is not completely installed.

    Any idea how I could get around this? How long does it usually take for the router to reboot after it finishes TFTPing the firmware?

    Which firmware is the safest to use to get to a working router? original stripped?

    Thanks,

    -b

  • Kevin Garcia

    Mike, you are a life saver.

    After an unsuccessful install of OpenWrt on my Archer C7 AC1750 v2, I was stuck with no installed firmware to access my router. Came across your post and after reading your step by step instructions to Meor Naim Mkz (I’m a novice so these helped a lot!) was able to get my router back in working order, with firmware.

    The best part is your instructions install the OpenWrt firmware, which is what I was trying to do from the get go!

    Thank you!

    -Kevin

  • CJ-TO

    Saved my day Jeff, Mike Palmer, awesome article, but I can concur that my C7 V2 needs the IP 192.168.0.66 for the TFTP server. Please update your article!!
    Many Thanks!

  • Ariel Barreiro

    Mike,

    Do you think this would work for replacing a US firmware with a non-US one? To tftp a stock do I only need to rename the zip file into the recovery bin?

    Thanks!

  • Yes, as of this year I think that might be what you have to do now that its illegal to have direct access to your home router’s wireless radios in the United States. (draw your own conclusions there) Companies like TP-Link now need to block things like OpenWRT, DD-WRT, etc via the supported methods since they provide access to all that. But that doesn’t mean manufacturers are going to build different hardware. It just make the US images are going to get locked down so we can’t flash over them with open source software. You will need to rename whatever image you try since that is what the lftp recovery calls out for inside the router.

  • Ariel Barreiro

    Thanks, I just flashed dd-wrt on a brand new ac7 us version today, albeit not currently in the US, flashing it through the stock web UI, so apparently the lock is just some ID in the header of the firmware. dd-wrt is making US compatible firmware images, thankfully!

    If interested:

    ftp://ftp.dd-wrt.com/betas/2016/05-19-2016-r29739/tplink_archer-c7-v2/ (latest as time of writing)

  • Tim X

    For me, it was 192.168.0.66 and 192.168.0.86. Still, my computer and the router would not communicate with each other by tftp.

  • Hose A

    Mike, you have honestly saved a drowning man. I was way in over my head messing with the firmware on my Archer C7 V2. Your article and everyone’s questions helped me figure out how to un-paperweight my router.
    I wanted to add that I also had to set the TFTP server and NIC to 192.168.0.66 for it to find the firmware. Like Meor Naim Mkz, I re-installed the OEM firmware (after following the advice on OpenWrt to cut the first 0x20200 Bytes from original firmware). After the install, I accessed the router via 192.168.0.1

    Cheers to you!
    -Jose

  • vikas rao

    I flashed https://goo.gl/skRXGC with https://goo.gl/TNqN9G using the router’s OEM firmware flashing utility. And now I can’t connect to the router through the Ethernet port. It doesn’t enter recovery mode either. When I power on the machine while pressing down on the reset button, the WPS light turns on but the time the PC connects to the Ethernet (Ethernet link lighting up) the WPS light turns off and TFTP does nothing. Is there way I can unbrick it?

  • accipter

    I have a similar issue, where the router fetches the image, but fails properly boot. I have ordered as USB-to-TTL to try and debug the situation.

  • Akki Amin

    Hello tiim I too have c7 v1.1 can’t connect router to tftp please advice how u fixed it

  • Jordan Haugh

    Mike, you have saved me quite a bit of time and I cannot thank you enough.

    Like the other commenters though, I had to change my IP to 192.168.0.66, not 192.168.1.66
    After awhile of banging my head on a wall and then reading the comments and trying that, I was back up and running in under 5 minutes.

    Thanks again mate!

  • Mikko Salonen

    Thank you for the instructions. My experience was not as straightforward. Here is my routine to debrick Archer C7 v2 (EU) using ethernet dongle and Ubuntu 16.04 liveusb (some/many parts here can be superflous but it works so I really don’t care πŸ˜€ ):

    – Fireup Ubuntu
    – add universe repository from the software manager
    – install packages, setup xinetd:
    sudo apt-get install xinetd tftpd tftp
    sudo gedit /etc/xinetd.d/tftp
    – open gedit and copy the following

    service tftp
    {
    protocol = udp
    port = 69
    socket_type = dgram
    wait = yes
    user = nobody
    server = /usr/sbin/in.tftpd
    server_args = /tftpboot
    disable = no
    }
    – download Archer firmware version Archer C7_V2_150427 from http://static.tp-link.com/res/down/soft/Archer_C7_v2_150427.zip (NOTE!! The newer firmware prevents you from installing openwrt). Unzip the package
    -create /tftpboot, copy firmware with the correct name (at least for me), and change permissions. Finally restart xinetd
    sudo mkdir /tftpboot
    sudo cp /home/ubuntu/Downloads/’unzippedArcherfolder’/’ArcherFirmware’ /tftpboot/ArcherC7v2_tp_recovery.bin
    sudo chmod -R 777 /tftpboot
    sudo chown -R nobody /tftpboot
    sudo service xinetd restart
    cd /tftpboot/
    – now continue in terminal

    tftp 192.168.0.66
    binary
    rexmt 1
    timeout 60
    trace

    – now you can connect the ethernet cable to the LAN1 port and change the ethernet settings in the connection settings to (wired internet settings -> IP4v manual IP – add): IP 192.168.0.66, subnet 255.255.255.0, gateway 192.168.0.1

    – go back to the terminal (with tftp open) and copy (shift+control+c) the following command:
    put ArcherC7v2_tp_recovery.bin

    – turn the router on while holding down the wps-button, with your other hand in the terminal paste your command until it says it sent away something (e.g. “sent …”)

    – wait for a good 3 minutes, and you should be able to open 192.168.0.1 for router configuration. With this older firmware you can now simply download the factory bin-file from openwrt page (change the name to something short!). Openwrt should now install without problems.

    -in terminal open telnet connection and change root password
    telnet
    open 192.168.1.1
    passwd

    – open ssh connection and install stuff you need e.g athk10, cant remember all the commands but something like this
    ssh root@192.168.1.1
    -insert password
    opkg update
    opkg install lucie-ssl athk10 firmware

    Check the correct athk10 and firmware commands form the beginners guide on openwrt.org. Note that wireless connection is turned off by default, easy to open using your browser (192.168.1.1). Happy surfing!!

  • ejoo

    Thanks very much, it really worked! πŸ™‚ My C7 had a
    different IP (192.68.0.1 instead of 192.168.1.1)

    from the beginning, so I tried

    192.168.0.66 instead of 192.168.1.66,

    and it worked. Good luck everyone!