Reply
Emerging Member
Posts: 55
Registered: ‎03-09-2014
Kudos: 16

Re: HOWTO: Unbrick your UniFi AP

Dont put it in the trash.. Sent it to me for my grave yard development :-)

Have you tried the tftp method to restore the partitions ?
New Member
Posts: 19
Registered: ‎08-27-2013

Re: HOWTO: Unbrick your UniFi AP

When you try command PRINTENV is there SERVERIP value ?

New Member
Posts: 2
Registered: ‎12-28-2014

Re: HOWTO: Unbrick your UniFi AP

Hoping someone can help me revive an old UAP-LR.  It is not responsive to ping/ssh on 192.168.1.20.  I was able to get it to accept a new firmware over tftp once, but no change in behavior.

 

When I boot the unit I get the following terminal output, it never moves past "Booting...":

U-Boot unifi-v1.5.2.206-g44e4c8bc (Aug 29 2014 - 18:01:57)

DRAM:  64 MB
Flash:  8 MB
PCIe WLAN Module found (tries: 1).
Net:   eth0, eth1
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot:  0
Board: Ubiquiti Networks AR7241 board (e512-20.0101.002e)
UBNT application initialized
## Booting image at 9f050000 ...
   Image Name:   MIPS Ubiquiti Linux-2.6.32.33
   Created:      2017-09-16   5:35:32 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    921589 Bytes = 900 kB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum at 0x9f050040 ...OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

Booting...

And this is the output I get when I boot the unit into tftp mode by holding down the reset button:

U-Boot unifi-v1.5.2.206-g44e4c8bc (Aug 29 2014 - 18:01:57)

DRAM:  64 MB
Flash:  8 MB
PCIe WLAN Module found (tries: 1).
Net:   eth0, eth1
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot:  0
Board: Ubiquiti Networks AR7241 board (e512-20.0101.002e)
UBNT application initialized
reset button pressed: clearing cfg partition!

First 0x7b last 0x7e sector size 0x10000
.... done
reset button pressed: clearing u-boot-env partition!

First 0x4 last 0x4 sector size 0x10000
. done
u-boot-env is invalid, overiding with default.

First 0x4 last 0x4 sector size 0x10000
. done
write addr: 9f040000
Setting default IP 192.168.1.20
Starting TFTP server...
Using eth0 (192.168.1.20), address: 0x81000000
Waiting for connection: |

Any insight is appreciated.

New Member
Posts: 2
Registered: ‎01-19-2014

Re: HOWTO: Unbrick your UniFi AP

I have the same problem as a few people in this thread - via the TTL connection there doesn't appear to be anything corrupted, but the AP is not reachable via the ethernet interface.

 

The Unifi Discovery tool does show the AP (UAP-LR) with the default IP of 192.168.1.20, however there is no way to reach it (never responds to ping), even in TFTP recovery mode.

 

I tried to figure out what is happening. I ran a packet capture and it looks like the device is transmitting data (it transmits both the discovery broadcasts and DHCP requests): 

 

dhcp, warning       default offering lease 10.1.17.105 for 44:D9:E7:2E:7D:AC without success

But it doesn't receive anything at all.

 

So (as mentioned previously) it does indeed appear that the Ethernet port is damaged, even though the PHY does not report any errors when booting. 

 

If anyone managed to pinpoint the problem exactly I would appreciate it, however as it is a hardware problem, I don't think it's worth pursuing it much further.

New Member
Posts: 2
Registered: ‎12-28-2014

Re: HOWTO: Unbrick your UniFi AP

I ended up coming to a similar conclusion.  The only thing that still bothers me is that I was able to sucessfully tftp the firmware to the unit several times so on some level connectivity was still possible.

Emerging Member
Posts: 55
Registered: ‎03-09-2014
Kudos: 16

Re: HOWTO: Unbrick your UniFi AP


mezz64 wrote:

I ended up coming to a similar conclusion.  The only thing that still bothers me is that I was able to sucessfully tftp the firmware to the unit several times so on some level connectivity was still possible.


I would agree that you have connectivity, if you can tftp the firmware in then the ethernet hardware must be working.

 

Have you tried actually doing a full factory reset ?, you may just have a corrupted config which when the device is in recovery mode is not active as the recovery process is.

 

When the device boots it will load your config and at that point it might the problem presents its self.

New Member
Posts: 6
Registered: ‎06-12-2018

Re: HOWTO: Unbrick your UniFi AP

Hi,

 

I know this is kind an old thread but I happen to have a bricked unifi-ap-lr-v2 that I am trying to revive but unfortunately have no success.

 

I was upgrading the unit when a power failure occurred. It was a unifi-lr-v2. Without thinking i downloaded firmware from the unifi server and tftp the said firmware with success. After rebooting it was stucked on an amber light. I later found out that the firmware i flashed was from the unifi-ap-lr and not the v2 one. After realizing I had flashed the wrong firmware, I immediately flashed the correct one with success, but still stucked on the amber light. I bought a ttl cable to see what was happening under the hood and found out that it has a bad data crc. I found the thread from @stevebird but unfortunately cannot follow through as I am new to this whole ttl thing. I made a backup of a working unifi-lr-v2 partitions using ssh method used by stevebird but havent had the success of reviving it as I think the addresses are different and couldnt figure out which correct ones to use.

 

I am attaching the booting of the bricked unifi and hope that somebody especially @stevebird could shed a light on me on how to revive this thing.

 

Thank you in advance to everyone who could share any information on this matter.

 

 

Allan

 

 

uap-lr-v2.PNG

New Member
Posts: 17
Registered: ‎03-28-2017
Kudos: 1

Re: HOWTO: Unbrick your UniFi AP

IMO

1. try tftp to restore firmware, or install ddwrt/openwrt than revert back to unifi firmare (using urescue or long press button) --if it doesnt work and still display bad crc

2. issued "mtdparts default" and tftp again-- if it sill doesnt work and still display bad crc

3. copy or clone similar device partition and content, you can ask other member to dump their image ( i dont have lrv2, i dont even know there is ulr v2 before you mentione it..Smiley Very Happy) -- if it sill doesnt work and still displaybadcrc

4. most likely hardware issue -- send it for repair (here in Indonesia we have those hobyst/technician, they provide such service )

It might not worth it in other country but here we are doing it.

New Member
Posts: 6
Registered: ‎06-12-2018

Re: HOWTO: Unbrick your UniFi AP

Hi All,

I tried using the copied partitions from my working unifi-ap-lr-v2 and here is the log

U-Boot unifi-v1.6.15.278-g4ebbbcff (Mar 5 2018 - 23:41:01)

DRAM: 64 MB
Base:0x80000000, Top:0x84000000, Res logbuf:0xa3ffb000, log_magic:0x5b5a585a kseg: 0xa0000000
Flash: 8 MB
Net: athr8032_phy_probe: unit=0, AR8032 Detected
eth0: 78:8a:20:66:5b:87
athr8032_phy_probe: unit=0, AR8032 Detected
eth0
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot: 0
Board: Ubiquiti Networks AR9342 board (e582-31.1122.0030)
0. Name = u-boot, offset = 0, start_addr=9f000000, size=393216,start_sector=0, end_sector=5
1. Name = u-boot-env, offset = 60000, start_addr=9f060000, size=65536,start_sector=6, end_sector=6
2. Name = kernel, offset = 70000, start_addr=9f070000, size=7602176,start_sector=7, end_sector=122
3. Name = cfg, offset = 7b0000, start_addr=9f7b0000, size=262144,start_sector=123, end_sector=126
4. Name = EEPROM, offset = 7f0000, start_addr=9f7f0000, size=65536,start_sector=127, end_sector=127
UBNT application initialized
## Booting image at 9f070000 ...
Image Name: MIPS Ubiquiti Linux-2.6.32.33
Created: 2018-03-17 18:32:47 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 6578708 Bytes = 6.3 MB
Load Address: 80002000
Entry Point: 80002000
Verifying Checksum at 0x9f070040 ...Bad Data CRC
ar7240> tftp 83000000 ubnt/mtdblock2
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.20
Filename 'ubnt/mtdblock2'.
Load address: 0x83000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#######################################################
done
Bytes transferred = 7602176 (740000 hex)
ar7240> protect off all
Un-Protect Flash Bank # 1
ar7240> erase 0x9f070000 +0x740000
.................................................................................................................... done
Erased 116 sectors
ar7240> cp.b 0x83000000 0x9f070000 0x740000
Copy to Flash... write addr: 9f070000
done
ar7240> cmp.b 0x83000000 0x9f070000 0x740000
byte at 0x831d0000 (0x8b) != byte at 0x9f240000 (0xff)
Total of 1900544 bytes were the same
ar7240> tftp 83000000 ubnt/mtdblock3
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.20
Filename 'ubnt/mtdblock3'.
Load address: 0x83000000
Loading: ####################################################
done
Bytes transferred = 262144 (40000 hex)
ar7240> erase 0x9f170000 +0x40000
.... done
Erased 4 sectors
ar7240> cp.b 0x83000000 0x9f170000 0x40000
Copy to Flash... write addr: 9f170000
done
ar7240> cmp.b 0x83000000 0x9f170000 0x40000
byte at 0x83000000 (0x12) != byte at 0x9f170000 (0x7b)
Total of 0 bytes were the same

The compare failed on both mtdblock2 and mtdblock3. Man Sad
Emerging Member
Posts: 55
Registered: ‎03-09-2014
Kudos: 16

Re: HOWTO: Unbrick your UniFi AP

[ Edited ]

@allanguintu wrote:
Hi All,

I tried using the copied partitions from my working unifi-ap-lr-v2 and here is the log


ar7240> cp.b 0x83000000 0x9f070000 0x740000
Copy to Flash... write addr: 9f070000
done
ar7240> cmp.b 0x83000000 0x9f070000 0x740000
byte at 0x831d0000 (0x8b) != byte at 0x9f240000 (0xff)
Total of 1900544 bytes were the same
ar7240> tftp 83000000 ubnt/mtdblock3
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.20
Filename 'ubnt/mtdblock3'.
Load address: 0x83000000
Loading: ####################################################
done
Bytes transferred = 262144 (40000 hex)
ar7240> erase 0x9f170000 +0x40000
.... done
Erased 4 sectors
ar7240> cp.b 0x83000000 0x9f170000 0x40000
Copy to Flash... write addr: 9f170000
done
ar7240> cmp.b 0x83000000 0x9f170000 0x40000
byte at 0x83000000 (0x12) != byte at 0x9f170000 (0x7b)
Total of 0 bytes were the same

The compare failed on both mtdblock2 and mtdblock3. Man Sad

 

 


What you can do is try several writes before a compare. Sometimes this can work.

 

so do the erase part once, then the copy part then a compare, then a copy then a compare etc,

 

Theres little point in progressing to writing the next part if the last part hasnt been sucessful.

 

If not sadly the flash chip will require replacement which in its self isnt too hard with good soldering skills, but the problem is being able to JTAG the Uboot to it so you can then install the rest of the partitions.

New Member
Posts: 4
Registered: ‎07-12-2017
Kudos: 2

Re: HOWTO: Unbrick your UniFi AP

bricked (power cut during flash!) UAP-AC-M (Pico)

Got ttl access - here is the boot

U-Boot unifi-v1.6.7.249-gb74e0282 (Apr 25 2017 - 09:18:46)

DRAM:
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0x8, 0x8, 0x8, 0x8)
 4 MB
Base:0x80000000, Top:0x80400000, Res logbuf:0xa03fb000, log_magic:0xa7ffbfff kseg: 0xa0000000
Top of RAM usable for U-Boot at: 803fb000
Reserving 247k for U-Boot at: 803bc000
Reserving 192k for malloc() at: 8038c000
Reserving 44 Bytes for Board Info at: 8038bfd4
Reserving 36 Bytes for Global Data at: 8038bfb0
Reserving 128k for boot params() at: 8036bfb0
Stack Pointer at: 8036bf98

never goes any further, can't interrupt with ctrl-c or esc

?bin fodder??

Emerging Member
Posts: 55
Registered: ‎03-09-2014
Kudos: 16

Re: HOWTO: Unbrick your UniFi AP

 


never goes any further, can't interrupt with ctrl-c or esc

?bin fodder??


Definitly not, Send it to me if its going in the bin. I'm still trying to reverse engineer the initial UBOOT installation method and having dead units to work on is a bonus.

 

However that said, Try the regular recovery method described using urescue and failing that try this : Unbrick

 

If you need a pointer, drop me a message, happy to help.

 

New Member
Posts: 4
Registered: ‎07-12-2017
Kudos: 2

Re: HOWTO: Unbrick your UniFi AP

of course, tried all those suggestions first before asking.
Boot process takes about a milli-second, get a very brief flash of the led when power applied.

That is all! Dead!

keyboard interrupt - no

reset switch - no

Emerging Member
Posts: 55
Registered: ‎03-09-2014
Kudos: 16

Re: HOWTO: Unbrick your UniFi AP

[ Edited ]

Does the CPU LED still flash or does that stop too.

There is another remote access method that can take a bit to time out before it continues.

how long have you left it to see if any further output comes up?

Unless the UBoot is damaged in some way I've not known one that couldn’t be interrupted during the uboot part of the start-up.

 

 

New Member
Posts: 4
Registered: ‎07-12-2017
Kudos: 2

Re: HOWTO: Unbrick your UniFi AP

the LED on the side of the AP flashes once - nothing else.

Left the boot process 5 mins

as described above - too quick to interrupt.

 

what is the 'other' method of remote access??

New Member
Posts: 5
Registered: ‎02-10-2018

Re: HOWTO: Unbrick your UniFi AP

I recently upgraded my UAP-PRO firmware and after the intilial reboot it never came back up. I tried the soft TFTP method in the past but this time it just will not go into TFTP recovery. I purchased usb-ttl cable, tried every possible combination of wires GND-TX-RX to the four pins on the AP but no luck, I get nothing in the teminal. All i ever get is the green light on the side of the AP.

 

Anyone have any ideas please do share.

 

Thank you.

IMG_20180807_223817.jpg

New Member
Posts: 5
Registered: ‎02-10-2018

Re: HOWTO: Unbrick your UniFi AP

If anyone has any information on my post please do share. Thank you 

Reply