TP-Link WDR5620 V4.0拆机TTL

moo***

参考：
https://www.right.com.cn/forum/thread-8263049-1-1.html

https://e3pem.github.io/2019/07/ ... %E5%9B%BA%E4%BB%B6/


https://www.acwifi.net/2268.html



芯片1：

MEDIATEK
MT7628BN
1818-AJCSL
EAP1E239
16AAXPBPL013B00


芯片2:
MEDIATEK
MT7612EN
1813-BMJL
ETPHKV65

moo***

TTL 接口，我自己加的针，，，



黄色gnd
绿色tx
蓝色rx

moo***

尝试从uart获取shell
拆开路由器看是否存在uart调试口

存在四个并排的小孔，猜测就是uart口，首先确定这四个口对应对应的是vcc/nx/rx/gnd中的哪一个。

通过通断性测试，发现从上往下数第二个口为GND口。具体怎么做的呢？（这在上一篇小米路由器从开始到放弃中也有提到过）
将黑色表笔接到IoT设备板子上的电路接口上固定不动，红色表笔依次在四个接口上进行通断测试，如果万用表有蜂鸣声，我们就可以判断此接口是GND接口。使用万用表，将黑色的线插入COM口，红色的线插入V/Ω口，调整旋钮到测量二极管通断处。接着把黑色指针放到供电口，也就是供电线与路由器相接的地方，把红色指针放到从上往下的第二个口。这时发现万用表发出了蜂鸣声，放到其他的口却没有，说明第二个口就是GND。

moo***

TP-Link WDR5620 V4.0拆机TTL 启动跑码。

。。。。。。。。。。。。。。。

[DBG] sel_fine_tmp=00000006, sel_mst_fine=00000006,fg_dly_adj=00000008
[DBG] sel_fine_tmp=00000004, sel_mst_fine=00000006,fg_dly_adj=00000006

[04020C0F][04020C0A][86880000][22234446][00222346]
DU Setting Cal Done


U-Boot 1.1.3 (Dec 25 2017 - 08:50:47)

Board: Ralink APSoC DRAM:  16 MB
relocate_code Pointer at: 80fc0000
flash manufacture id: 1c, device id 70 15
Warning: un-recognized chip ID, please update bootloader!
PA/LNA:cf,dc
*** Warning - bad CRC, using default environment

icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768
RESET MT7628 PHY!!!!!!
Please choose the operation or press ctrl + c to stop auto boot:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   9: Load Boot Loader code then write to Flash via TFTP.

You choosed 3

0
   
3: System Boot system code via Flash.
## Booting image at bc015200 ...
addr:0xbc015200
RALINK_GPIOMODE = 570504c4
RALINK_GPIOMODE = 570404c4
***** Xtal 40MHz *****
start PCIe register access
RALINK_RSTCTRL = 2400000
RALINK_CLKCFG1 = fdbfffc0

*************** MT7628 PCIe RC mode *************
PCIE0 enabled
Port 0 N_FTS = 1b105000
init_rt2880pci done
Scan busNo=0, devNo=0 funNo=0.
PCI-E setup device 0x801, 0x14C3.
PCIe DEV 0x801 VENDOR 0x14C3 isn't work properly.
PCI-E setup bridge done.
**************************************pci_scan_bridge****************************************
bridge configuration invalid ([bus 00-00]), reconfiguring
**************************************pci_scan_bridge****************************************
Scan busNo=1, devNo=0 funNo=0.
PCI-E setup device 0x7662, 0x14C3.
PCIe DEV 0x7662 VENDOR 0x14C3 isn't work properly.
PCIe DEV 0x7662 VENDOR 0x14C3 isn't work properly.
PCIe DEV 0x7662 VENDOR 0x14C3 isn't work properly.
PCIe DEV 0x7662 VENDOR 0x14C3 isn't work properly.
PCI-E setup nprmal device done.
Scan busNo=1, devNo=1 funNo=0.
Scan busNo=0, devNo=1 funNo=0.
BAR0 at slot 0 = 0
bus=0x0, slot = 0x0
res[0]->start = 0
res[0]->end = 7fffffff
res[1]->start = 0
res[1]->end = ffff
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=0x1, slot = 0x0
res[0]->start = 0
res[0]->end = fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
RALINK_REG_GPIOMODE:0X570404D4
RALINK_REG_GPIOMODE2:0X5550555
Before exit sysClkConnect!
In sysClkEnable!
Before exit sysClkEnable!
Attmacthi7ng6 i2nt8erEfanced lLo0o..a. ddo neu
nitNum=0

Waitting for RX_DMA_BUSY status Start... done

==> netpool_mangement.c
Init netpool for mtk network now
netpool_mangement.c(): malloc for clConfig[0] with size(4748832)!
pNetPool[0]=0x80e77bd0!
<== netpool_mangement.c
Count=1,netpool=80e77bd0

Tx_Ring addr: 0xa099d2e0!!!

Rx_Ring addr: 0xa099c620!!!
mt7628EndLoad unitNum=1



                                      Version2.0
                            Software Platform for PNE2.2
              Copyright(C) 2001-2011 by TP-LINK TECHNOLOGIES CO., LTD.
                      Creation date: Aug 21 2018, 18:09:04
# RALINK_REG_GPIOMODE2:0X10001
miniFs.c(2387): Install minifs driver successed.
File:/conf/cfgSyncWhiteList.xml not found.
Flash ID = 0x0.
Flash UID 0x53464450100FF109300000FF
set mii port 0 value 0x00003300
add net default: gateway 169.254.148.97
change net 169.254.148.0
change net 0.0.0.0
==> netpool_mangement.c
mtk netPool has been init before
Count=2,netpool=80e77bd0
First phase! the return iniString=rai!
The initString info:
        phyNum=0!
        devNum=0!
        infType=5!
        irqNum=25!
        devType=0!
        privSize=0!
        csrAddr=0x7fffffff!
        devName=rai!
Update memory base to 8031119c00000001 from bar: 14
Found PCI-E device(0x14c3:0x7662) 1:0.0
            Vendor Id : 0x000014C3
            Device Id : 0x00007662
            bar 0     : 0x20000004
            bar 1     : 0x00000000
            map 0     : 0xC0000000
            map 1     : 0x00000000
hal_vec = 54, base address = 20000004
pAd->ChipID=76120044
RTMPInitPCIeDevice 1
RTMPInitPCIeDevice 2
RTMPInitPCIeDevice 3
The primary RSNIE: 805c5c3d, len = 8
0x0000 : 01 00 00 0f ac 02 00 00
The primary RSNIE: 805c5c3d, len = 20
0x0000 : 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f
0x0010 : ac 02 00 00
==> netpool_mangement.c
mtk netPool has been init before
Count=3,netpool=80e77bd0
rai: at CSR addr 0x20000000
../rlt_wifi/os/vxworks/rt_vxworks.c 3241 pAd=80578030availableNum(0) devInitStr =0:5:0:1024:4:0:apclii
wlan is caled
wlan_5G is caled
<<<<<load fw image method 1
<<<<<<<<<<<<< try 1
<<<<<<<<<<<<< OS_LOAD_CODE_FROM_BIN_2G will load file: /fw/mtk/WIFI_RAM_CODE_MT7628_e2.bin
<<<<<<<<<<<<< OS_LOAD_CODE_FROM_BIN_2G load file: /fw/mtk/WIFI_RAM_CODE_MT7628_e2.bin size: 63984(0xf9f0)
FW Version:_e2_mp
FW Build Date:20160524163352
<<<<<<<<<<<<< try 1
<<<<<<<<<<<<< oooooo! will load file: /fw/mtk/mt7662_patch_e3_hdr_v0.0.2_P69.bin
<<<<<<<<<<<<< OS_LOAD_CODE_FROM_BIN load file: /fw/mtk/mt7662_patch_e3_hdr_v0.0.2_P69.bin size: 26350(0x66ee)
<<<<<load rom patch finish 0
<<<<<<<<<<<<< try 1
<<<<<<<<<<<<< oooooo! will load file: /fw/mtk/MT7662_E3_v1.9_20160711.bin
<<<<<<<<<<<<< OS_LOAD_CODE_FROM_BIN load file: /fw/mtk/MT7662_E3_v1.9_20160711.bin size: 81984(0x14040)
wlan_5G is caled
<<<<<load fw image finish 0
wlan_5G is caled
MAX_LEN_CFG =3e3640     2
        WTBL Segment 1 info:
                MemBaseAddr/FID:0x28000/0
                EntrySize/Cnt:32/128
        WTBL Segment 2 info:
                MemBaseAddr/FID:0x40000/0
                EntrySize/Cnt:64/128
        WTBL Segment 3 info:
                MemBaseAddr/FID:0x42000/64
                EntrySize/Cnt:64/128
        WTBL Segment 4 info:
                MemBaseAddr/FID:0x44000/128
                EntrySize/Cnt:32/128
----------> RE CHIP_CALIBRATION
RF0[0x024c]=0x1d1b393c
RF0[0x0250]=0x0007100d
RF0[0x0264]=0x3c888000
RF0[0x0278]=0x39101011
RF1[0x024c]=0x1e1a3a3a
RF1[0x0250]=0x00070f0f
RF1[0x0264]=0x3a888000
RF1[0x0278]=0x3a101011

===============qadInit_2G===============

moo***

产品型号：TL-WDR5620
软件版本：2.5.98

moo***

芯片1

MEDIATEK
MT7612EN
1813-BMJL
ETPHKV65


芯片2：

MEDIATEK
MT7628BN
1818-AJCSL
EAP1E239
16AAXPBPL013B00

moo***

遇到问题无法中断uboot启动，，，，，

moo***

https://www.right.com.cn/forum/thread-181679-1-1.html
据说在这一步：Autobooting in 1 seconds
按“tpl”可以中断UBOOT

moo***

经过测试波特率就是57600

moo***

没办法只有拆了芯片，（试过sop8的夹子不行）

21:15:37 检测并识别到芯片，型号：EN25QH16 容量：2MB

烧录器：
XTW-3编程器软件
http://www.yaojiedianzi.com/index.php?m=Download&a=show&id=19

备份的原厂bootloder：

我用夸克网盘分享了「TP-Link WDR5620 V4.0-BootLoader.bin」，点击链接即可保存。打开「夸克APP」，无需下载在线播放视频，畅享原画5倍速，支持电视投屏。
链接：https://pan.quark.cn/s/e24b5cf3cf9e

马***

我家有三个3.0的

moo***

写入breed  7628 不管用

moo***

https://www.tp-link.com.cn/product_977.html?t=index

moo***

moomin 发表于 2023-6-2 21:17
没办法只有拆了芯片，（试过sop8的夹子不行）

21:15:37 检测并识别到芯片，型号：EN25QH16 容量：2MB

uboot只有2M大小

dubi***

请问有没有刷好openwrt后，提取出的编程器固件，用编程器刷写到8m闪存上，比ttl的方法要方便