Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[hacktrix2006]

Is this before or after a tftp session?

Sent from my TegraNote-P1640 using Tapatalk

[mangueboy]

Is this before or after a tftp session?

Sent from my TegraNote-P1640 using Tapatalk

Before.  I have one doubt. In Zhadoon Brazilian post : http://adrenaline.uol.com.br/forum/showthread.php?t=497887&page=252&p=1070237896#post1070237896   the comand is   " tftpboot 0x80800000 tplink9980.bin" and in your video  only tftp 9980.bin.  Why?

[hacktrix2006]

Even with just tftp w9980.bin it will autoload into the 0x80800000 area that's why I didn't include the area in the command. If it's before tftp you didn't spam the key to break into uboot quickly enough I have a video online now which is linked in op.

Sent from my TegraNote-P1640 using Tapatalk

[mangueboy]

Even with just tftp w9980.bin it will autoload into the 0x80800000 area that's why I didn't include the area in the command. If it's before tftp you didn't spam the key to break into uboot quickly enough I have a video online now which is linked in op.

Sent from my TegraNote-P1640 using Tapatalk

Very thanks, guy!

[mangueboy]

Even with just tftp w9980.bin it will autoload into the 0x80800000 area that's why I didn't include the area in the command. If it's before tftp you didn't spam the key to break into uboot quickly enough I have a video online now which is linked in op.

Sent from my TegraNote-P1640 using Tapatalk

Very thanks, guy!

I would like to thank  for the help of all the guys here in the forum.  Now, I sucess crossflash and upgrade my router.

[hacktrix2006]

Congrats mangueboy on the crossflashing.

Now me personally i used a USB to serial adapter PL2303 TTL console Recovery RS232 for Raspberry Pi (red cable is 5v but not used) to flash the firmware and never had trouble.

Now looking at your image of the adaptor you used, you only used two cables and it was split on one of them to RX + GND. that might have been the issue but heck your crossed flashed now.

[mangueboy]

Congrats mangueboy on the crossflashing.

Now me personally i used a USB to serial adapter PL2303 TTL console Recovery RS232 for Raspberry Pi (red cable is 5v but not used) to flash the firmware and never had trouble.

Now looking at your image of the adaptor you used, you only used two cables and it was split on one of them to RX + GND. that might have been the issue but heck your crossed flashed now.

It´s seems that is only one splitted wire, but  Rx was solded in a orange wire, and GND in red wire. All connection was ok.  The issue is really with the device i bought.   With D-SUN model there´s no problem.   I think that there's  any incompatibility with my previous ttl adapter model, because I did a Loop test ( wire tx to rx) and what i press in keyboard was showing in Putty console. Then i´m shure there isn't any particular hardware problem with it.

[soco]

Hi everyone. I owned td w8990. If I crossflash it to 9980 I'll have troubles with something??? If he will work same but with vdsl?

[mkresin]

Dear Crossflashers,

during my effort to analyse the new RSA signed firmware, I found a way to crossflash routers which have already a RSA signed firmware installed, without opening the devices at all. Anyone who is interested in more detailed information, can get them from https://github.com/xdarklight/mktplinkfw3/blob/master/README.md.

All that has to be done, is to alter the first firmware header:

1. replace the values at the hex positions 0x34 to 0x3F of the to-be flashed firmware with the values of an stock firmware, that matches the running firmware (if the currently running firmware is a W8980 firmware use the values from a stock W8980 image, if the currently running firmware is a W8980B firmware use the values from a stock W8980B image and so on)

2. temporary replace the md5 hash at hex position 0x40 to 0x4F with 8C EF 33 5F D5 C5 CE FA AC 9C 28 DA B2 E9 0F 42

3. calculate the the md5 hash/checksum of the whole file

4. replace the temporary md5 hash at hex position 0x40 to 0x4F with the value from 3.

Now the firmware should be accepted by the the routers firmware upgrade page. Don't forget to restore the factory defaults afterwards.

I've made a video for the younger ones among us:

[youtube]https://youtu.be/noEVttStvSw[/youtube]


// Edit: temporary md5 hash was wrong

[kitoli]

thank you, it works well ! 5 minuts and i'm on W9980 last firmware

Dear Crossflashers,

during my effort to analyse the new RSA signed firmware, I found a way to crossflash routers which have already a RSA signed firmware installed, without opening the devices at all.

[Mooingall]

My device has been rock solid, very happy:
System Up Time:84 day(s) 14:34:42

Now the firmware should be accepted by the the routers firmware upgrade page. Don't forget to restore the factory defaults afterwards.

That is amazing progress, good work

That was some hefty right up, so since we can resign we can now edit rootfs? That would sure be useful.

[ejs]

I don't think it has progressed quite that far yet. Well, we can re-sign a firmware image with our own personal key, but the stock firmware won't accept that. We don't have the TP-Link private key to sign modified images with.

Changing the model numbers only works for uploading stock firmware. An alternative place to change the model numbers is the config file, that's how I flashed the 9980 firmware to my 8970v1.

[eduardoar]

Hi all,
First post, thousand reads !!!
ejs, could you please tell me how to change the config file?
I´ve checked a saved config file and it seems to be written in Chinese !
I don´t have the usb/ttl adaptor and here it´s difficult to buy it. If buying from dx or aliexpress it takes around 90 days to arrive.
Thanks for any help
Edit
Sorry, I was checking with Notepad, when I check with HxD hex editor it´s a common binary file.
But I can´t find the model inside.
Eduardo

[ejs]

The basic idea is from this thread.

I don't know if the 8980 saved config file is compressed, if it's not compressed, the StatPOSTer program can decrypt it, and then you can edit it, and add the necessary bits, then encrypt the edited file and upload that. If the saved config file is compressed, it's less easy because you have to edit a default config file obtained elsewhere, and the ones from the 9980 firmware attached to that thread might not work.

The necessary parts that I added or changed were within the <DeviceInfo> tags, near the start of the file.

Code: [Select]

<ModelName val=TD-W9980 />
<HardwareVersion val="TD-W9980 v1 00000000" />
<X_TPLINK_ProductID val=2575302657 />
<X_TPLINK_ProductVersion val=33 />

If the saved config file is compressed, it's probably easier to use the hex editing method in reply #143 above.

[eduardoar]

Dear ejs
Many thanks.
I´m now studying all that info.
Very difficult, congratulations to your knowledge!!
Eduardo