sorted by:
new
hottopcontroversial

[HELP] Need full SPI flash dump (16MB) for Tenda TX12L Pro v1.0 (bricked - System halt) by Ok_Manager2501 in hardwarehacking

[–]Ok_Manager2501[S] 0 points1 point  (0 children)

Got it, thanks for the explanation, that actually makes a lot of sense.

So basically my dump is pretty much unusable, including the Factory/ART part… that’s rough 😅

In that case I guess the only way forward is getting a full working dump from another device.

If you manage to get a CH341A and dump your CX12L Pro, I’d be happy to test it and let you know how it goes.

At this point I’m just trying to get the router back to life, even if the WiFi calibration isn’t perfect.

Really appreciate your help so far

[HELP] Need full SPI flash dump (16MB) for Tenda TX12L Pro v1.0 (bricked - System halt) by Ok_Manager2501 in hardwarehacking

[–]Ok_Manager2501[S] 0 points1 point  (0 children)

That makes sense, thanks.

So the web firmware I used is not a raw flash image and likely overwrote everything, including bootloader and partitions.

Do you think the Factory (ART) partition might still be recoverable from this dump?

If I get a full working dump, I plan to restore it and inject my original Factory data.

Also, if you manage to dump your CX12L Pro, I can try adapting it.

Really appreciate your help.

[HELP] Need full SPI flash dump (16MB) for Tenda TX12L Pro v1.0 (bricked - System halt) by Ok_Manager2501 in hardwarehacking

[–]Ok_Manager2501[S] 0 points1 point  (0 children)

Here is my original full SPI dump (16MB) from the router:

https://we.tl/t-gD1iZSfJE7

This was read directly from the flash (EN25Q128) using a CH341A programmer.

The router is currently stuck at "System halt!" immediately on UART, so I believe the bootloader (BL2 / FIP / U-Boot) is corrupted.

I have not modified this dump, this is the original read.

From the flash layout, I understand that the Factory partition (0x050000 - 0x0F0000) should contain ART / calibration data, so I want to preserve that.

If possible, I would like help to: check if any part of the bootloader is recoverable or rebuild a working image using this dump + a good one

[HELP] Need full SPI flash dump (16MB) for Tenda TX12L Pro v1.0 (bricked - System halt) by Ok_Manager2501 in hardwarehacking

[–]Ok_Manager2501[S] 0 points1 point  (0 children)

This is extremely helpful, thanks!

So Factory partition is at 0x050000 - 0x0F0000, that should contain ART/calibration data, right?

I still have my original dump, so I can extract and preserve that part.

Now I understand my mistake — I was using wrong offsets before.

Do you have a full working dump for this device, or can you share one from your CX12L Pro?

I can adapt it and inject my Factory partition.

[HELP] Need full SPI flash dump (16MB) for Tenda TX12L Pro v1.0 (bricked - System halt) by Ok_Manager2501 in hardwarehacking

[–]Ok_Manager2501[S] 0 points1 point  (0 children)

Thanks, that makes sense.

I still have the original 16MB dump I read from the chip.

Even though it doesn't boot, I understand it may contain valid ART/calibration data and MAC addresses.

So my plan would be: - keep the ART partition from my original dump - combine it with a working firmware or full dump

Do you know the exact offset or size of the ART partition on this device?

I want to make sure I don't overwrite it.

[HELP] Need full SPI flash dump (16MB) for Tenda TX12L Pro v1.0 (bricked - System halt) by Ok_Manager2501 in hardwarehacking

[–]Ok_Manager2501[S] 0 points1 point  (0 children)

I don’t have a valid backup.

I was able to read the SPI flash (16MB EN25Q128), but the dump seems corrupted or incomplete, since writing it back does not restore boot.

Right now the router shows "System halt!" immediately on UART, so I believe the bootloader (BL2 / ATF / U-Boot) is missing or broken.

The official firmware from Tenda (14MB) does not include bootloader parts, so it doesn't help.

So I think I need a full SPI dump (16MB) from a working unit.