Tp-link EAP225-Outdoor OpenWrt

[david]

How to install openwrt to Tp-link EAP225 V3 -Outdoor:






1. Update to official Tp-Link firmware version 5.1.6.
https://www.iot-tech.dev/ff/EAP225-Outd ... 240313.zip


2 Enable ssh from original TPlink firmware menu and ssh login to disable device firmware signature checks

Code: Select all

ssh -oPubkeyAcceptedAlgorithms=+ssh-rsa -o HostKeyAlgorithms=ssh-rsa -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@192.168.0.254

cliclientd stopcs

3. Update to this version of openwrt:
https://www.iot-tech.dev/ff/openwrt23.bin

Is good idea to backup your original router spi-flash before attempting to update it:



If someone need full spi dump of this chip find me in my telegram group i will be happy to provide it !

Join our telegram group if you wana chat or have specific questions:
https://t.me/+h2K5CX5jEZA0MWJk




I did dumped the flash chip with Pi2 you need to power on device and then run the script of your pi and try to connect clips to the spi flash chip, before doing it build and update to last version of flashrom!




Here is script that will attemt to read the flash when your hands are busy holding clips over the flash chip!

Code: Select all

#!/bin/bash

PROGRAMMER="linux_spi:dev=/dev/spidev0.0,spispeed=8000"
IMAGE="tplink_read.bin"
INTERVAL=3

echo "=== Flashrom READ retry loop started ==="
echo "Trying every ${INTERVAL}s. Press Ctrl+C to abort."

while true; do
    echo
    echo "[$(date)] Attempting read..."

    flashrom -p "$PROGRAMMER" -r "$IMAGE"
    READ_RC=$?

    if [ $READ_RC -eq 0 ]; then
        echo
        echo "✅ READ SUCCESSFUL!"
        echo "Flash dump saved as: $IMAGE"
        echo "You can remove the clip now."
        exit 0
    else
        echo "❌ Read failed. Retrying..."
    fi

    sleep "$INTERVAL"
done

Here is what you can expect after flashing:




Link to original openwrt site:
https://openwrt.org/toh/tp-link/eap225# ... ap225-wall

Note: Information there is not right about what firmware version of openwrt you need to use to update from original tplink firmware ! Use 100% tested method proved here after flashing this firmware you can update to any openwrt version !

I was able to recover my from flashdump that i did before flashing the device!

[david]

Here is how full dump of flashed openwrt looks like !

BusyBox v1.36.1 (2023-11-14 13:38:11 UTC) built-in shell (ash)

_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 23.05.2, r23630-842932a63d
-----------------------------------------------------
root@OpenWrt:~# cat /proc/mtd

dev: size erasesize name
mtd0: 00020000 00010000 "u-boot"
mtd1: 00010000 00010000 "partition-table"
mtd2: 00010000 00010000 "info"
mtd3: 00d80000 00010000 "firmware"
mtd4: 00240000 00010000 "kernel"
mtd5: 00b40000 00010000 "rootfs"
mtd6: 00730000 00010000 "rootfs_data"
mtd7: 00030000 00010000 "config"
mtd8: 000c0000 00010000 "log"
mtd9: 00010000 00010000 "art"


Let dump the flash:

Code: Select all

for i in 0 1 2 3 7 8 9; do
    echo "Dumping mtd$i"
    ssh root@192.168.1.1 "dd if=/dev/mtd${i}ro" > mtd${i}.bin
done

Check the dumps after this:

Code: Select all

ls -lh mtd*.bin

-rw-r--r-- 1 void void 128K Jan 1 11:29 mtd0.bin
-rw-r--r-- 1 void void 64K Jan 1 11:29 mtd1.bin
-rw-r--r-- 1 void void 64K Jan 1 11:29 mtd2.bin
-rw-r--r-- 1 void void 14M Jan 1 11:29 mtd3.bin
-rw-r--r-- 1 void void 192K Jan 1 11:29 mtd7.bin
-rw-r--r-- 1 void void 768K Jan 1 11:29 mtd8.bin
-rw-r--r-- 1 void void 64K Jan 1 11:29 mtd9.bin

Join our telegram group if you wana chat or have specific questions:
https://t.me/+h2K5CX5jEZA0MWJk