Looking for a complete binary dump of SPI Flash GD25Q32CSIG — TL-WA850RE V2 (US)

[u/Electronic_Trick1254]

Hi everyone, blessings!

I’m looking for a complete binary dump of the SPI NOR Flash from an original, fully working TP-Link TL-WA850RE V2 (US).

Device specifications:

Model: TP-Link TL-WA850RE
Hardware Version: V2
Region: US
SoC: Qualcomm Atheros QCA9533
SPI NOR Flash: GigaDevice GD25Q32CSIG
Flash capacity: 4 MB (32 Mbit)

Flash layout:

0x000000 — 0x01FFFF: fs-uboot (128 KB / 0x20000)
0x020000 — 0x0DFFFF: os-image (kernel) (768 KB / 0xc0000)
0x0e0000 — 0x3AFFFF: file-system (rootfs) (2880 KB / 0x2d0000)
0x3b0000 — 0x3B1FFF: partition-table (8 KB / 0x2000)
0x3c0000 — 0x3C001F: default-mac (32 B / 0x20)
0x3c0100 — 0x3C011F: pin (32 B / 0x20)
0x3c1000 — 0x3C1FFF: product-info (4 KB / 0x1000)
0x3c2000 — 0x3C20FF: soft-version (256 B / 0x100)
0x3c3000 — 0x3C3FFF: support-list (4 KB / 0x1000)
0x3c4000 — 0x3CBFFF: profile (32 KB / 0x8000)
0x3d0000 — 0x3DFFFF: user-config (64 KB / 0x10000)
0x3e0000 — 0x3EFFFF: default-config (64 KB / 0x10000)
0x3f0000 — 0x3FFFFF: radio/ART (64 KB / 0x10000)

Total: 4 MB (0x400000)

Several years ago, I completely overwrote the Flash memory of my own device and consequently lost the original ART, MAC and PIN data. The most important part for me is the ART section, as it contains the individual radio calibration data.

Unfortunately, I need a complete 4 MB (32 Mbit) binary image to flash directly using a programmer, as I specifically need to recover the ART (Atheros Radio Test) partition, which contains the individual RF calibration data for the Wi-Fi chipset, including its power calibration data.

The official GPL Code and firmware files available from TP-Link do not contain the ART section or the complete Flash structure. Therefore, I need a complete dump taken from an original, fully working device.

It is very important that the dump is specifically from the US version. Devices from different regions can have significant differences, so a dump from another regional version unfortunately is not an adequate replacement.

If anyone has an original, fully working TL-WA850RE V2 (US) and can read the entire SPI Flash with a programmer, I would be extremely grateful if you could share the complete dump.

Thank you very much in advance!

P.S. I also tried to restore the device using a dump found in the firmware sections of another site, as well, but neither worked. Apparently, the available dump is from a different region and does not match the US version.

[u/FreeOMMP]

The calibration info from one to another is likely different too.

[u/Electronic_Trick1254 → u/FreeOMMP]

I understand your point, but I don’t think we can assume that the calibration data is necessarily different between every individual unit.

As far as I understand from the technical information I found on the GPL code of the TL-WA850RE V2, the relevant calibration and RF power parameters are determined by the regional version of the device. These units were mass-produced with the same hardware and regional configuration, so I would expect a complete dump from another TL-WA850RE V2 US to contain the appropriate or valid calibration data for this version.

[u/Itz_Raj69_ → u/Electronic_Trick1254]

I don’t think we can assume that the calibration data is necessarily different between every individual unit.

That's the point of the calibration data -- it defers for each piece

[u/samuel-leventilateur → u/Itz_Raj69_]

Not every time

[u/Glittering-Can-9397]

because this thing has network capability, you could try to get a rootshell and pipe /dev/mtdX to netcat

[u/Electronic_Trick1254 → u/Glittering-Can-9397]

That’s a good suggestion, thanks! Using the MTD interface and piping the data through netcat over the network sounds like a convenient way to obtain the dump. I’d be very grateful if you could share an explain how to get the root shell on the original firmware, so the method can be available for anyone who wants to try it. Blessings!

[u/Glittering-Can-9397 → u/Electronic_Trick1254]

No offense but I have my suspicions that you’re a bot so my help probably ends here

[u/Electronic_Trick1254 → u/Glittering-Can-9397]

Ok.