Can't upgrade Belkin RT3200 (UBI)

[tiberio87]

I have a problem, I can't update to version 24. Yesterday I had bricked the router, but with this guide I managed to get him boot into 23, I don't have valid recovery.img files so I created one by following that guide.
Now the situation is this:

EDIT
I found an old backup of mtd0 mtd1 mtd1 mtd2 mtd3 partitions that I had created before breaking it all, can they be useful to something?

MT7622> mtd list
List of MTD devices:
* spi-nand0
  - device: snand@1100d000
  - parent: root_driver
  - driver: mtk-snand
  - path: /snand@1100d000
  - type: NAND flash
  - block size: 0x20000 bytes
  - min I/O: 0x800 bytes
  - OOB size: 64 bytes
  - OOB available: 28 bytes
  - ECC strength: 4 bits
  - ECC step size: 512 bytes
  - bitflip threshold: 3 bits
  - 0x000000000000-0x000008000000 : "spi-nand0"
          - 0x000000000000-0x000000080000 : "bl2"
          - 0x000000080000-0x0000001c0000 : "fip"
          - 0x0000001c0000-0x0000002c0000 : "factory"
          - 0x0000002c0000-0x000000300000 : "reserved"
          - 0x000000300000-0x000008000000 : "ubi"

MT7622> ubi info layout
Volume information dump:
        vol_id          0
        reserved_pebs   9
        alignment       1
        data_pad        0
        vol_type        3
        name_len        8
        usable_leb_size 126976
        used_ebs        9
        used_bytes      1142784
        last_eb_bytes   126976
        corrupted       0
        upd_marker      0
        skip_check      0
        name            ubootenv
Volume information dump:
        vol_id          1
        reserved_pebs   9
        alignment       1
        data_pad        0
        vol_type        3
        name_len        9
        usable_leb_size 126976
        used_ebs        9
        used_bytes      1142784
        last_eb_bytes   126976
        corrupted       0
        upd_marker      0
        skip_check      0
        name            ubootenv2
Volume information dump:
        vol_id          2
        reserved_pebs   60
        alignment       1
        data_pad        0
        vol_type        3
        name_len        8
        usable_leb_size 126976
        used_ebs        60
        used_bytes      7618560
        last_eb_bytes   126976
        corrupted       0
        upd_marker      0
        skip_check      0
        name            recovery
Volume information dump:
        vol_id          3
        reserved_pebs   79
        alignment       1
        data_pad        0
        vol_type        3
        name_len        3
        usable_leb_size 126976
        used_ebs        79
        used_bytes      10031104
        last_eb_bytes   126976
        corrupted       0
        upd_marker      0
        skip_check      0
        name            fit
Volume information dump:
        vol_id          4
        reserved_pebs   817
        alignment       1
        data_pad        0
        vol_type        3
        name_len        11
        usable_leb_size 126976
        used_ebs        817
        used_bytes      103739392
        last_eb_bytes   126976
        corrupted       0
        upd_marker      0
        skip_check      0
        name            rootfs_data
Volume information dump:
        vol_id          2147479551
        reserved_pebs   2
        alignment       1
        data_pad        0
        vol_type        3
        name_len        13
        usable_leb_size 126976
        used_ebs        2
        used_bytes      253952
        last_eb_bytes   2
        corrupted       0
        upd_marker      0
        skip_check      0
        name            layout volume

MT7622> mtd dump factory
Reading 2048 byte(s) (1 page(s)) at offset 0x00000000

Dump 2048 data bytes from 0x00000000:
0x00000000:     22 76 02 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000010:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000020:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000030:     00 00 00 00 44 00 00 20  00 00 00 00 00 00 00 00
0x00000040:     00 00 44 00 04 00 00 00  00 00 00 00 00 00 00 00
0x00000050:     20 00 00 bb 40 b6 c3 c3  26 80 81 81 41 c4 26 c0
0x00000060:     80 80 41 c4 26 c1 c0 c0  c0 c5 26 80 00 00 00 00
0x00000070:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000080:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000090:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000000a0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000000b0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 c6 c6
0x000000c0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000000d0:     85 85 85 82 00 00 00 00  00 00 00 00 00 00 00 00
0x000000e0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000000f0:     86 00 2e 00 a2 00 85 86  88 00 00 00 00 00 00 00
0x00000100:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000110:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000120:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000130:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000140:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000150:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000160:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000170:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000180:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000190:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000001a0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000001b0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000001c0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000001d0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000001e0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000001f0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000200:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000210:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000220:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000230:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000240:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000250:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000260:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000270:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000280:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000290:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000002a0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000002b0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000002c0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000002d0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000002e0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000002f0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000300:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000310:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000320:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000330:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000340:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000350:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000360:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000370:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000380:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000390:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000003a0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000003b0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000003c0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000003d0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000003e0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x000003f0:     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x00000400:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000410:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000420:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000430:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000440:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000450:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000460:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000470:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000480:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000490:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000004a0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000004b0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000004c0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000004d0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000004e0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000004f0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000500:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000510:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000520:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000530:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000540:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000550:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000560:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000570:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000580:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000590:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000005a0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000005b0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000005c0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000005d0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000005e0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000005f0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000600:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000610:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000620:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000630:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000640:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000650:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000660:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000670:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000680:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000690:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000006a0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000006b0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000006c0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000006d0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000006e0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000006f0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000700:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000710:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000720:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000730:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000740:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000750:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000760:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000770:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000780:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x00000790:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000007a0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000007b0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000007c0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000007d0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000007e0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
0x000007f0:     ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff

MT7622> mtd list
List of MTD devices:
* spi-nand0
  - device: snand@1100d000
  - parent: root_driver
  - driver: mtk-snand
  - path: /snand@1100d000
  - type: NAND flash
  - block size: 0x20000 bytes
  - min I/O: 0x800 bytes
  - OOB size: 64 bytes
  - OOB available: 28 bytes
  - ECC strength: 4 bits
  - ECC step size: 512 bytes
  - bitflip threshold: 3 bits
  - 0x000000000000-0x000008000000 : "spi-nand0"
          - 0x000000000000-0x000000080000 : "bl2"
          - 0x000000080000-0x0000001c0000 : "fip"
          - 0x0000001c0000-0x0000002c0000 : "factory"
          - 0x0000002c0000-0x000000300000 : "reserved"
          - 0x000000300000-0x000008000000 : "ubi"

MT7622> ubi list
0: ubootenv
1: ubootenv2
2: recovery
3: fit
4: rootfs_data

root@OpenWrt:/# cat /etc/openwrt_release
DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='23.05.5'
DISTRIB_REVISION='r24106-10cc5fcd00'
DISTRIB_TARGET='mediatek/mt7622'
DISTRIB_ARCH='aarch64_cortex-a53'
DISTRIB_DESCRIPTION='OpenWrt 23.05.5 r24106-10cc5fcd00'
DISTRIB_TAINTS=''

root@OpenWrt:/# grep "(release)" /dev/mtd0ro | tail -1
v2.4(release):OpenWrt v2021-05-08-d2c75b21-3 (mt7622-snand-1ddr)

root@OpenWrt:/# fw_printenv ver
ver=U-Boot 2023.07.02-OpenWrt-r24106-10cc5fcd00 (Sep 23 2024 - 12:34:46 +0000)

root@OpenWrt:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00080000 00020000 "bl2"
mtd1: 00140000 00020000 "fip"
mtd2: 00100000 00020000 "factory"
mtd3: 07d00000 00020000 "ubi"

[tiberio87]

I managed to get the router back in stock. I used these commands:

Be prepared to open the device and wire up the serial console!

Boot into recovery mode, either by flashing openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb (note that this file doesn't have the word installer in its filename) or by holding the RESET button while connecting the device to power or by issuing echo c > /proc/sysrq-trigger while running the production firmware.

Use scp or [WinSCP](https://winscp.net/eng/downloads.php) to copy the mtdx backup files to the /tmp folder on the router, which is the **original/vendor bootchain. Also upload the [original/vendor firmware](https://github.com/dangowrt/owrt-ubi-installer?tab=readme-ov-file#downgrade-firmware).

Connect to the device via SSH and enter the following commands:
opkg update
opkg install kmod-mtd-rw
ubidetach -d 0
insmod mtd-rw i_want_a_brick=1
mtd write /tmp/mtd0 /dev/mtd0
mtd write /tmp/mtd1 /dev/mtd1
mtd write /tmp/mtd2 /dev/mtd2
mtd write /tmp/mtd3 /dev/mtd3

As the partition layout of the UBI-build also has changed, make sure to write things to the correct place in case your backup has been done at a point when the partition layout was different from what it is now.

Now write the original/vendor firmware:

# On Linksys E8450
mtd -p 0x200000 write /tmp/FW_E8450_1.0.01.101415_prod.img /dev/mtd3

# On Belkin RT3200
mtd -p 0x200000 write /tmp/FW_RT3200_1.0.01.101415_prod.img /dev/mtd3

Reboot the device and wait about a minute for it to be ready.