Author Topic: tl-sg108e v1 firmware search (Read 2502 times)

kokodin · « **on:** March 16, 2022, 06:03:07 pm »

hello , i have a sick puppy in form of 8 port gigabiy mannaged switch after firmware update failure
switch is pretty much ded without the brain , the only thing it does is power led
tplink only provides firmware patches, and probably not aplying them all in order was the problem, either way i do not have another v1 hardware switch of this type and can't pull the firmware out of it (all i have is v3, v4 , and some 5 port switches from v1 hardware but those might be different)
i pulled and saved content of the oryginal flash chip, tryed to flash it with what is on tplink site but file size is about 40% of the dumped rom
this thing is pretty old , tplink already at revision 6 with different cpu so they won't help

if anyone has working tplink tl-sg108e v1 and is willing to share the rom dump, i would be gratefull because i can't find anything by googling it

kokodin · « **Reply #1 on:** March 17, 2022, 11:32:22 pm »

i did a bit of a research with hex editor

flash rom is 1 mb big
content of the flash rom on the device contain :
some code, probably a boot loader
firmware patch that apear to be flashed corectly or at least with no errors, who know if it is in the right place or not
and on the end, after firmware patch there is a bit of empty space, probably reserved for configuration, because on the very end there is some text about default vlan number and other functions

removing the tail bits and blanking them does not seems to do anything and all firmware patches seems to be 477kb long for this hardware revision, they also apear to be similar structure inside
tl-sg105e firmware patch apear to be different thing entirely and i wouldn't be surprised if 5 port switch and 8 powr switch of the same line to use different controller chip entirely since all switches are configured by a windows aplication it might have telemetry and templates for each model separately

i don't know if flashing the entire rom would just fix the device or would it clone someone elses switch, mac address and all, but as far as i can see firmware patch was programmed during update correctly, only who knows what else was changed in the process

DavidAlfa · « **Reply #2 on:** March 19, 2022, 07:25:18 am »

Contact TP-Link, they might help you by sending the full firmware.

dc101 · « **Reply #3 on:** March 24, 2022, 01:17:10 am »

Do you know the type of flash chip is in your device? Do you have any tools to read and write to a flash chip?

dc101 · « **Reply #4 on:** March 24, 2022, 01:50:50 am »

This was the only picture I could find of the TP SG108E board. I'm guessing the SPI flash is to the upper right of the main processor, and to the left of the CE FC logo. That's the most likely the chip you will need to identify.

kokodin · « **Reply #5 on:** April 07, 2022, 05:29:36 am »

Sorry i kind of lost intrest in the tread after contact tplink comment, becides it was sitting open in my browser tab for days and for some reason those don't refresh automatically.

I know the chip, i did dumped it's content and my programer was able to auto identyfi it correctly
label on the chip is ae1511 25q80bsig e5r718

it contain some code, copy of the firmware i flashed and some blank space at the end of firmware
i am assuming if flashing the chip didn't brick the cpu by itself the boot loader or the flash section must be wrong to boot up corectly

DavidAlfa · « **Reply #6 on:** April 07, 2022, 08:23:32 am »

So you lost interest after the very valid and logical step of contacting the manufacturer for support?

kokodin · « **Reply #7 on:** April 07, 2022, 11:01:26 am »

last time i asked tplink for help they totaly ignored my question
i only got an automatic reply , it was 5 years ago though so they might have changed for better
i don't know. it kind of felt like advice that opened old wounds

PKTKS · « **Reply #8 on:** April 07, 2022, 03:06:18 pm »

Confirm the firmware compatible serial ..

I have 2 firmwares here
'TL-SG108E(UN)_V2_160526.zip'
'TL-SG108E(UN)_v2_20160108.zip'

You may have a lucky shot.

Paul

kokodin · « **Reply #9 on:** April 08, 2022, 06:36:52 am »

from what i read online v2 could be flashed with v3 firmware because they shared the same core architecture but i never seen any mentions of v1 hardware and v2 hardware. and if i remember corectly firmware v3 supported browser configuration, v1 did not
does v2 hardware/firmware combo has a browser based configuration? or like v1 can only be configured by aplication?

thanks anyway i will look into it later

as for tplink support, they did reply
"helo sir , we cannot help you, we do not have those informations you require, please check with your hardware reseler about guarantee terms policy"

PKTKS · « **Reply #10 on:** April 09, 2022, 04:00:19 pm »

have these

official releases...

Paul

kokodin · « **Reply #11 on:** April 11, 2022, 07:24:02 am »

I already had those and that is just a firmware patch, not the whole rom content. it do not contain header /bootloader section of the switch nor it has any data that is behind the patch on the flash

flash rom is 8 megabits big, this rom is only about half that space with no information at what adress on the flash it should be, or what else should or should not be on the flash.
it is intended only to be used from configuration app, when the switch is in fact running

PKTKS · « **Reply #12 on:** April 11, 2022, 07:34:51 am »

This is all we have from them

The last one seems to be a full image while the first 2 not

Paul

PKTKS · « **Reply #13 on:** April 11, 2022, 05:09:16 pm »

Quote from: kokodin on April 11, 2022, 07:24:02 am

I already had those and that is just a firmware patch, not the whole rom content. it do not contain header /bootloader section of the switch nor it has any data that is behind the patch on the flash

flash rom is 8 megabits big, this rom is only about half that space with no information at what adress on the flash it should be, or what else should or should not be on the flash.
it is intended only to be used from configuration app, when the switch is in fact running

nop.. it is not.. it has a large pdf bundle inside with another patch..

so we are hopeless unless finding someone with same hardware version...
to dump the image for help

Paul

kokodin · « **Reply #14 on:** April 12, 2022, 06:04:15 am »

Quote from: PKTKS on April 11, 2022, 05:09:16 pm

so we are hopeless unless finding someone with same hardware version...
to dump the image for help

pretty much waht i was asking all along

we are not even sure if the patch file is in fact a firmware block, or just a bunch of areas to patch in initial firmware and how it knows where to flash it, since it all happening from a windows app on your computer, that already has all the information about all the revisions of the hardware baked in. it may even flash only spaces of the firmware patch that aren't empty space, kind of masking the changes in what was already there, then not flashing all firmware patches in order from the oldest to newest would also brick it without giving any errors.

DavidAlfa · « **Reply #15 on:** April 12, 2022, 06:27:55 pm »

Upload the full flash dump, luckly the tplink packages could be the system partition, so the image could be repaired by manually patching it.
I have no idea because I didn't see the contents, but having a programmer, all you can lose is a bit of time.

Some weird Realtek stuff.
There's a flash dump for the RTL8370N, looks like a chinese firmware.
More RT8170N stuff.

It seems in some switches there's an option to activate a backup image (Search "TP-LINK BOOTUTIL").
Find the UART pins, migh be an easy fix after all. But there's no UART in the RTL8370M datasheet.

Found a TL-108E dump here, source, however is 16Mbit flash (2MB).
It seems he converted a basic unmanaged switch into the more expensive, managed model, by adding the SPI flash and setting the boot pins to SPI mode.

kokodin · « **Reply #16 on:** April 15, 2022, 04:17:31 pm »

if i remember corectly this is what i dumped out of the flash
i later tryed to compare it to what tplink provides and it is there only in the middle with some stuff at the top and after it
i tryed being silly and blanking the flash and flashing just the firmware from tplink.. no luck
i tryed to replace the firmware part with older versions and also no luck

this switch is not dumb, it is mannagable, via na app the cpu on it might be too slowe to host a web page based mannagment but it is able to be configured i don't know if the linked firmware would work with my switch because it most likely is for the newer revision but more than that i do not think i have any spi chips around that would fit 2 mb flash

romirom · « **Reply #17 on:** August 27, 2022, 12:34:15 pm »

Hi, I've had the same problem.
SG108E v1, firmware update, then bricked - only power LED lit, utility couldn't find it.
The fix was very simple (https://community.tp-link.com/en/business/forum/topic/77562) -> go to http://192.168.0.1/menu.cgi click http firmware update and upload the firmware (the switch was in "loader mode" - prepared to update firmware, but never got one)
There are also other hidden links:
http://192.168.0.1/info.cgi
http://192.168.0.1/menu.cgi
http://192.168.0.1/hidden.cgi
http://192.168.0.1/panel.cgi
If anyone is interested, I've attached two full dumps (1MiB bins) - one before update (in loader mode, when it seems dead) and second one updated and working with 1.1.2 firmware

kokodin · « **Reply #18 on:** February 05, 2023, 11:24:56 am »

yup that fixed the thing, thanks
why didn't tplink give that answer in the first place when i asked them i have no idea, maybe i am unable to google things as i often do


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: tl-sg108e v1 firmware search (Read 2502 times)

Share me