GL-iNet AX1800 debricking by USB and TFTPD

[vernie]

You’re excited to upgrade to a custom firmware and ended up overwriting uboot with the wrong file.

Router LED no longer lighting up when power is applied. Router no longer work as expected, no network and nothing you can do. Reset and debricking procedure using uboot not applicable at this state. When people say your router is bricked, generally it means it no longer function.

The following procedure is provided by the helpful and kind GL-iNet staff (hansome).
Text instructions were in Chinese language and google translated in English with some modifications for additional details.

Modification from original given procedure is removal of the use of serial port and serial cable as they are no longer needed with the recent firmware development.

GL-iNet AX1800 debricking by USB and TFTPD

AX1800 can be booted via USB without the bootloader.

Required tools

1. QPST software
2. QUD driver
3. TFTPD server
4. Type A Male to Type A Male USB cable
5. TFTPD
6. Windows PC
   
   

Preparation

• Download and install:

QPST software

QPST Tool v2.7.496 for Windows

QUD driver

qud.win.1.1_installer_10061.1.zip | by S3V3N for OnePlus 8 Pro

TFTPD

TFTPD64 : an opensource IPv6 ready TFTP server/service for windows : TFTP...

or get it from the link below (for 32bit and 64bit Windows PC)

TFTPD.zip

• Download the recovery files ax1800-usb-recovery.zip and unzip or extract it.

Google Drive

Or get this one with the the drivers included making sure you’ll get them even when those links above go down.

AX1800.zip

• Set the Windows PC IP address to 192.168.1.2

• Prepare the TFTPD server on Windows PC.
  Copy the settings below.

• Check Bind TFTP to this address and select the IP 192.168.1.2
  
  

• Make sure the Base directory is our recovery folder where all the recovery files are.
  
  

• Set the DHCP setting.

• Press OK to save all your settings.
  
  Our TFTPD server is ready and running at this time, waiting for our AX1800 to connect to it.
  At this point, Windows Firewall will prompt to ask if you’ll allow access to TFTPD. Just allow it.
  It is best to better turn off the firewall temporarily at this time making sure no blocking can happen.

• Connect the AX1800 and the WIndows PC using the USB Type A to USB Type A cable.
  One end of the USB-TYPE A cable to the AX1800 USB port and the other end of the USB-Type A cable to the Windows PC USB port.

• Connect the Ethernet cable or network cable of your Windows PC to LAN1 port of the AX1800.

• Connect the power cable to the AX1800.
  On Windows PC Device Manager it will be recognized as QDLoader 9008 (COM4).
  (Important to note: It can be COM3 or COM5 or whatever available COM port at that time and take note of this COM port number, we will use it later.)

• Open the Command Prompt on Windows PC.
  CD or change directory to where the ax1800-usb-recovery folder is.
  
  

cd Downloads\AX1800\ax1800-usb-recovery

Check its content by typing,

dir

do as shown on the screenshot to check the commands to enter next.

• Replace the COM4 if it is not COM4 (it can be COM3 or COM5) on your Windows PC to the correct COM number as shown on the Windows Device Manager entry for QDLoader 9008

Copying files to the AX1800

• Enter the following command on the Command Prompt (copy paste if you have to with the correct COM port).
  
  

QSaharaServer.exe -p \.\COM4 -s 13:xbl.elf -v 3

At this time, it will show some output and an indication of success.

• Enter the following command
  
  

QsaharaServer.exe -p \.\COM4 -s 1:cdt-AP-CP03-C1_256M16_DDR3.bin -s 34:devcfg_noac.mbn -s 5:openwrt-ipq6018-u-boot.mbn -v 3

The AX1800 LED should light up after the above command is done with success.

It will then fetch the needed file from the TFTPD server, you will see some output on the TFTPD window.

• Wait a moment until all output is done and no more activity on the network interface.

• Close TFTPD window.

• Remove the power from your router to turn it off.

• Replace it back and your router will power up now with LED indicator showing up.

• Change back the IP address of your Windows PC to:
  
     Obtain an IP address automatically
  
  and you can now open the browser on your Windows PC to 192.168.8.1 to start setting up your router.
  
  

• Reach out to GL-iNet support about this process and inform them about your hardware mac address found at the bottom label of the AX1800 device. They will send you a follow-up checking on the device and file to write to complete the whole process.
  
  Before that happens, prepare the router to receive a file through scp.
  
  Install the openssh-sftp-server that we you can scp (ssh copy) the file they will send to correct an entry on the device.
  
  

You can install through the LuCI interface

or you can install using the GL-iNet interface

In this example the file received from GL-iNet staff was 27DF0.zip. Extract its content and use it to copy to the AX1800 with the following command on Windows PC Command Prompt

Windows Command Prompt scp

scp 27DF0.bin root@192.168.8.1:~\

• ssh to AX1800 as root

and run the following commands at the router terminal

mtd erase /dev/mtd8
mtd write 27DF0.bin /dev/mtd8

• Do a hexdump on the device to check

This is the beginning part of the hexdump

This is the end part of the hexdump

---

and your hexdump output will also look similar as shown above to confirm it was done correctly.

Your GL-iNet AX1800 at this point is already working and no longer bricked.

---

I’ve done the whole process myself with guidance from the GL-iNet staff and my AX1800 is back like new. I love this router, it is fast and can greatly improve network performance. Thank you hansome - GL-iNet Staff (on the forum) for all the hours you shared unconditionally and for the permission given to post this guide that it can be useful and help others with a similar problem.

[solidus1983]

Nice write up bud. Glad your up and running.

[bring.fringe18]

Suggestion: Get those software dependencies uploaded & into a link for publicly shared link in a cloud provider (like what you’ve done with Google Cloud). The last thing anyone would want is to find one of 'em as 404.

I’ve seen it happen far too many times in the Android custom ROM circles.

[vernie]

Thank you for the suggestion, added alternative download links above.

[bring.fringe18]

Do you mind if I toss 'ya another one? These forums support Markdown formatting. There’s proper header support to indicate different sections & sub-sections. I use the ‘</>’ button on the toolbar for codeblocks. Eg:

this is a single line command string
`this is a command string`: one ‘backtick’ @ ea. end (below escape key)

This is a whole block of code
spanning multiple lines

```
This is a whole block of code
spanning mutilple lines
```

Bullet points are simple:

• one asterisk
• second asterisk

Here’s how I formatted a recent HOW-TO:

HOW-TO: Script: List My OPKGs (to a file for backup)

Keywords: backup, opkg, plugins, list, howto, script, shell, luci, restore, ipk, tarball, conf Description List user’s (your) installed packages, writing them to a text file that can be used to reinstall the binaries of what a user manually installed. The resulting .list file will be use to opkg install to pull from the feeds. That is done with two commands in one execution. The GL GUI doesn’t feature a backup function. Creating & restoring a backup achieve (.tar.gz, aka tarball) of all your…

[vernie]

Updated with formatting. Thank you, much better to read this time.

[lgs2007m]

@vernie Nice work! I found one parameter
of the QsaharaServer was “-s <img_id:file_name>”. May I ask how to get the img_id?

[hansome]

It’s a constant value from QCA docs.

[lgs2007m]

Thanks. I found init_sahara_mapping_list in sahara_protocol.c and class ImageType in mbn_tools.py.
I kind of confuse, the xbl.elf should be a SBL file(“-s 13:xbl.elf”), but img_id=13 match the “EHOSTDL_IMG=13” in mbn_tools.py, that was a EHOSTDL_IMG.