@Marvin_S 

thanks for replay .... but

the isp only seller...they just buy these router from tp-link and buy to user becouse tp-link dont sell these pon router directly to user.

contacting with isp about software will not answered ...or they forward to here becouse firmwaring is tp-link job.

so i need the source or factory base primal fireware as router seem likly zero software as they in shape they manfacture in tp-link factor and need the first firmware

u-boot.bin

or

tclinux.bin

or

tcboot.bin

something like that

  @Marvin_S 

@MohKirkuk 

here more info and more digging it

AX1800 Dual Band Wi-Fi 6 GPON Router

XX230v

https://service-provider.tp-link.com/gpon/xx230v/

Serial Terminal Connection

--------------------

Serial Terminal Output after malfunction

Press X

CCCCCCCCCCCCCCCCCCCCCC

----------------

Serial Terminal Output before malfunction

Press X

CCCCCCCCCCCCCCCCCC

EN7523DRAMC V0.2

dram_type = 5, speed = 1866

Final Impdance Cal Result: OCDP:0x17, OCDN:0x1e, ODTP:0xa, ODTN:0xa

DDR1866 PLL setting init

[Dramc] PCDDR3 AC Timing update 

Fire MRW command...

ModeReg.2, value.0x20 done

Fire MRW command...

ModeReg.3, value.0x0 done

Fire MRW command...

ModeReg.1, value.0x6 done

Fire MRW command...

ModeReg.0, value.0x1114 done

Fire MRW command...

ModeReg.1, value.0x86 done

Fire MRW command...

ModeReg.1, value.0x6 done

Calculate size.

DRAM size=256MB

Press x to update firmware

CCCCCCCCCCCCCCCCCC

U-Boot 2014.04-rc1 (Oct 23 2023 - 06:47:22)

DRAM: 240 MiB

EN7529CT

Now running in RAM - U-Boot at: 8edff000

spi_nand_probe: mfr_id=0xc8, dev_id=0x1

Using Flash ECC.

Detected SPI NAND Flash : _SPI_NAND_DEVICE_ID_F50L1G41LB, Flash Size=0x8000000

bmt pool size: 81 

BMT & BBT Init Success 

In: serial

Out: serial

Err: serial

CPU0: found redistributor 0 region 0:8ee3d988

Net: ecnt_eth

Uip activated

.

.

.

.

ECNT>

-------------

ECNT> version

U-Boot 2014.04-rc1 (Oct 23 2023 - 06:47:22)

arm-buildroot-linux-gnueabi-gcc (Buildroot 2015.08.1-gd814875) 4.9.3

GNU ld (GNU Binutils) 2.24

----------------

ECNT> coninfo

List of available devices:

serial 80000003 SIO stdin stdout stderr 

ecnt_uart 00000003 .IO

----------------------

ECNT> bdinfo

arch_number = 0x00001D63

boot_params = 0x80000100

DRAM bank = 0x00000000

-> start = 0x80000000

-> size = 0x0F000000

eth0name = ecnt_eth

ethaddr = []

current eth = ecnt_eth

ip_addr = 192.168.1.1

baudrate = 115200 bps

TLB addr = 0x8EFF0000

relocaddr = 0x8EDFF000

reloc off = 0x0CFFF000

irq_sp = 0x8CDFAF40

sp start = 0x8CDF8F30

--------------------

ECNT> base

Base Address: 0x00000000

--------------------

ECNT> showvar

HUSH_VERSION=0.01

------------

ECNT> printenv

arch=arm

baudrate=115200

board=en7523_evb

board_name=en7523_evb

bootcmd=flash tpimg;bootm 81800200

bootdelay=1

bootfile=tclinux.bin

console=ttyS0,115200n8 earlycon

country_code=ff

cpu=armv7

dsl_gpio=0b

ethact=ecnt_eth

ethaddr=[]

ether_gpio=0c

fdt_high=0xac000000

fileaddr=81000000

filesize=1a6636a

internet_gpio=02

invaild_env=no

ipaddr=192.168.1.1

kernel_filename=tclinux.bin

loadaddr=0x81800000

multi_upgrade_gpio=0b020400000000000000000000000000

onu_type=2

password=[]

power_gpio=1515

product_name=xPON ONU

qdma_init=33

root=/dev/mtdblock8 ro

sdram_conf=0x00108893

serdes_sel=0

serverip=192.168.1.100

snmp_sysobjid=1.2.3.4.5

soc=en7523

stderr=serial

stdin=serial

stdout=serial

uboot_filename=tcboot.bin

username=telecomadmin

vendor=ecnt

vendor_name=ECONET Technologies Corp.

verify=0

Environment size: 893/16380 bytes

---------------------

ECNT> iminfo

## Checking Image at 81000000 ...

Unknown image format!

-------------------

ECNT> imginfo

mtd parts is NULL

mtd parts is NULL

get_tclinux_img_version, read trx magic(0x32524448) error.

Read first tclinux.bin from flash 0x0 error.

get_tclinux_img_version, read trx magic(0x32524448) error.

Read second tclinux.bin from flash 0x0 error.

imginfo - imginfo - Show tclinux.bin version command

---------------------------

  @MohKirkuk 

Hi same prob here,

I am investigating to try to load a valid image onto my XX230v, to unbrick the router which has firmware corruption.

I also have acces to SPI:

EN7523DRAMC V0.2
dram_type = 5, speed = 1866
Final Impdance Cal Result: OCDP:0x1b, OCDN:0x1e, ODTP:0xa, ODTN:0xa
DDR1866 PLL setting init
[Dramc] PCDDR3 AC Timing update
Fire MRW command...
ModeReg.2, value.0x20 done
Fire MRW command...
ModeReg.3, value.0x0 done
Fire MRW command...
ModeReg.1, value.0x6 done
Fire MRW command...
ModeReg.0, value.0x1114 done
Fire MRW command...
ModeReg.1, value.0x86 done
Fire MRW command...
ModeReg.1, value.0x6 done
Calculate size.
DRAM size=256MB

U-Boot 2014.04-rc1 (Apr 29 2024 - 08:18:41)

DRAM:  240 MiB
EN7529CT
Now running in RAM - U-Boot at: 8edff000
spi_nand_probe: mfr_id=0xc8, dev_id=0x1
Using Flash ECC.
Detected SPI NAND Flash :  _SPI_NAND_DEVICE_ID_F50L1G41LB, Flash Size=0x8000000
bmt pool size: 81
BMT & BBT Init Success
In:    serial
Out:   serial
Err:   serial
CPU0: found redistributor 0 region 0:8ee3d988
Net:   ecnt_eth
               Uip activated
use flash mac: 3C:64:CF:FB:3C:48
Not found TC Phy
Not found TC Phy
Not found TC Phy
Not found TC Phy
[ CPEinit ] 465:  CPE init
[ cp_initCommProto ] 277:  g_commProtoConfig.myMac: 3c:64:cf:fb:3c:48
Boot flag csum incorrect, return image0
[ os_initCPEInfo ] 297:  hw ver: XX230v v1.0 00000000
[ os_initCPEInfo ] 298:  sw ver: 0.3.0 3.0.0 v6066
[ os_initCPEInfo ] 305:  sn: 224A265001515
[ os_initCPEInfo ] 308:  pin: 15038319
[ os_initCPEInfo ] 315:  endian: 0
[ os_initCPEInfo ] 318:  acFlag: 0
[ CPEinit ] 489:  CPE is idle
Hit any key to stop autoboot:  0

ECNT> help
?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootflag- bootflag read/swap command

bootm   - boot application image from memory
chpart  - change active partition
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dcache  - enable or disable data cache
echo    - echo args to console
editenv - edit environment variable
efuse   - efuse - efuse command

env     - environment handling commands
exit    - exit script
false   - do nothing, unsuccessfully
fdt     - flattened device tree utility commands
fip_test- fip_test - test command

flash   - flash - flash command

go      - start application at address 'addr'
help    - print command description/usage
icache  - enable or disable instruction cache
imginfo - imginfo - Show tclinux.bin version command

iminfo  - print header information for application image
imxtract- extract a part of a multi-image
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loadx   - load binary file over serial line (xmodem mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mtd     - mtd - mtd  command

mtdparts- define flash/nand partitions
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
showvar - print local hushshell variables
sleep   - delay execution for some time
source  - run script from memory
sr_test - sr_test - test command

test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
true    - do nothing, successfully
version - print monitor, compiler and linker version
ECNT> version

U-Boot 2014.04-rc1 (Apr 29 2024 - 08:18:41)
arm-buildroot-linux-gnueabi-gcc (Buildroot 2015.08.1-gd814875) 4.9.3
GNU ld (GNU Binutils) 2.24

ECNT> bdinfo
arch_number = 0x00001D63
boot_params = 0x80000100
DRAM bank   = 0x00000000
-> start    = 0x80000000
-> size     = 0x0F000000
eth0name    = ecnt_eth
ethaddr     = 00:0A:EB:13:09:69
current eth = ecnt_eth
ip_addr     = 192.168.1.1
baudrate    = 115200 bps
TLB addr    = 0x8EFF0000
relocaddr   = 0x8EDFF000
reloc off   = 0x0CFFF000
irq_sp      = 0x8CDFAF40
sp start    = 0x8CDF8F30
ECNT>

From here I don't know how I could load the manufacturer's firmware. I suppose the correct tclinux.bin image is needed.

I also have a burner and tools to unsolder the flash memory. I don't know if someone could provide me with the memory image. I am going to try to recover this thing by all means. I offer any help and I can to investigate como hacerlo and I would appreciate it.

Regards,

  @QuarX 

Olá,  se for o xx230v v1 Brasil eu tenho a cópia da memória nand.

Me chame 17 98120-2713 

  @QuarX 

hi too

your Router Software is less Bricke form mine

you can acseess to  "ECNT>"

in my case i cant acsees to  "EN7523DRAMC V0.2"

and its under text

what i did .... i do by mistake upload file when its say in console window

waiting for firmware before this line ""EN7523DRAMC V0.2"

using XModem Protocol .... but its brick it more ... as you see in my first post

my problem was the router was some setting was hide like WAN MODE "PPPOE"

this very need i my case ..so try to update new firmware ... in main menu no firmware is found

-------------
 

  @Rolenbec 

Can Provide us Your :

Email or Telegram or Facebook ?

I need that File in Urgent way ...

-------------------

Pode nos fornecer seu:
 

E-mail, Telegram ou Facebook?
 

Preciso desse arquivo com urgência...

--------------

research how to recover a TP-Link GPON XX230V V1 (ES) device after a failed update and power outage, using the Serial port,focus on:

* Whether there is an official or alternative bootloader or firmware file
* Details about the "CCCCCCC" stage and the Xmodem tool used
* Are there known ways to revive the device if it stops after C only?
I will get back to you soon with results and suggested steps.

# Recover a stuck TP-Link XX230v (GPON) device after a failed software update

## Reason for stopping at the Press X screen and the appearance of the CCCCCC series

When the power is cut during a firmware upgrade, the device's bootloader is often corrupted. In the case of the XX230v, the message "Press X" followed by a series of repeated Cs appears, indicating that the initial boot part is searching for a file via the Xmodem protocol and cannot find the necessary bootloader. This behavior ( CCCC... ) means that the device is stuck in the Boot ROM and is unable to load the bootloader from the internal memory due to damage or loss. As a result, the DRAM is not initialized and the device does not complete the normal boot process. In short, the cause is a failed bootloader (or part of it) that forces the Boot ROM to wait in receive mode via the serial port, not a hardware issue with the memory itself. One forum user confirms that CCC... appears to mean that the device is waiting for a file to boot via Xmodem.

> Note: In normal operation for this device, the text "Press x to update firmware" appears briefly during boot, allowing the update file to be uploaded if necessary, and then booting continues to the U-Boot bootloader. For example, before the error occurred, the normal sequence was to initialize the DRAM and its size (256MB), then the message *Press x to update firmware* followed by a few C , and then start U-Boot. Now, none of these subsequent messages appear, confirming that execution has stalled at the first stage of boot.

## Serial port recovery methods

There is a well-known and reliable way to restore TP-Link and similar TrendChip/ECONET devices via the serial UART port, by reloading the bootloader to the device using the Xmodem protocol(.) The general steps are as follows:

1(.) Connect to the serial port: Make sure the UART interface (such as a USB-TTL FTDI converter) is connected to the device pins (RX, TX, GND) and the communication speed is set to 115200-8-N-1(.) Open a terminal session (for example, TeraTerm or PuTTY)(.)

2(.) Enter Bootloader Mode: Disconnect the device's power(.) Now press and hold the Reset button on the device and reconnect the power, monitoring the serial port while doing so(.) Once the terminal displays "Press X," press the X key on your keyboard(.) This will put the device into Xmodem download waiting mode (you will see the letter C repeating continuously in the terminal)(.) This indicates that the device is ready to receive a file via Xmodem (CRC mode) (.)

3(.) Send the Bootloader via Xmodem: You now need to send the bootloader to the device(.) The bootloader on this platform consists of two parts: a small initialization part often called bootext(.)arm (which initializes the DRAM), followed by the main bootloader file, usually tcboot(.)bin (.) If no bootloader is present in the device's memory (this is "emergency" mode), the two files must be sent sequentially via Xmodem(.) The developer documentation confirms that the "emergency upgrade" process involves first uploading bootext(.)arm via Xmodem and then tcboot(.)bin via the same session(.) After the first part is successfully transferred and run, the first part will begin preparing memory and then wait for the second part (you may notice a continuation or repeating of the C , indicating that it is ready to receive the next file)(.) Use a terminal program (such as SecureCRT or similar) to send each file via the Xmodem protocol (select Xmodem-CRC for sending)(.) It is important to wait for the bootext(.)arm transfer to complete and then immediately send tcboot((.))bin (.) If everything is done correctly, the bootloader will be stored in RAM and executed(.)

4(.) Bootloader and System Restore: After loading tcboot((.))bin and running it from RAM, the device will have restored the temporary U-Boot interface (the bootloader runs from memory)(.) At this point, the bootloader's capabilities can be used to restore the full firmware(.) The easiest way is to use a TFTP server to transfer the main system file (firmware) to the device(.) When the bootloader is running, the virtual machine's address is usually 192((.))168((.))1((.))1 and can receive a file via TFTP(.) You can connect the computer to the device via a direct Ethernet port and set an IP address on the same network (for example, 192((.))168((.))1((.))100 )(.) Then, execute the file upload command from the computer: On Windows, for example, open a command prompt and run the command:

tftp -i 192(.)168(.)1(.)1 put <path_to>/tclinux(.)bin

Where tclinux(.)bin is the full firmware file (the device's operating system)(.) According to TP-Link/TrendChip instructions, after sending the tcboot(.)bin file and rebooting the device, it must be unplugged and then rebooted to send the tclinux(.)bin file(.) Once tclinux(.)bin has been successfully transferred via TFTP to the device's memory, the bootloader will flash the internal flash memory with this file(.) After the writing is complete, you can enter the boot command (in the temporary U-Boot interface if requested) or simply reboot the device(.) The device will then run with the restored firmware(.)

5(.) Alternative: Direct Flash Programming: If the above method is not possible, another technical option is to extract the memory chip (SPI NAND) and program it externally using an EEPROM/FLASH programmer with a valid file taken from another device or from an official update file(.) This option requires equipment and expertise, so it is only recommended if serial methods are unsuccessful(.)

> Note: The scenario of recovering via serial port and updating via Xmodem is documented by the platform developers(.) A MediaTek (Airoha/TrendChip) documentation mentions an Emergency Bootloader Mode that allows you to upload the bootloader file first and then resume the update(.) In a practical example, one source demonstrated how to upload `bootext(.)arm` and `tcboot(.)bin` via Xmodem when the device crashes as the first step in the recovery, and then use the network to upload the remaining files(.) These procedures are exactly the same as our case on the XX230v(.)

## What type of file is required when “CCCCC” appears and how to obtain it

When the device prints C characters in standby mode, it needs the appropriate bootloader file (.) As mentioned, the bootloader on TrendChip/Airoha devices consists of two parts: a small boot extension for memory initialization (Boot Extension) and the main U-Boot part(.) The company often distributes a single combined bootloader file called `tcboot(.)bin` (a modified U-Boot for this device) in addition to the main system file `tclinux(.)bin` (.) The virtual environments for these devices show that the expected filenames are exactly tcboot(.)bin for the bootloader and tclinux(.)bin for the operating system(.) The SDK documentation also confirms that these files are generated separately when building the program(.)

In our case, the specific file we need is the bootloader image for the XX230v V1 (.) Unfortunately, TP-Link doesn't usually provide the bootloader file separately on its website(.) Instead, official update files typically come as a single package that includes the bootloader, default settings, and operating system(.) For example, the firmware file for the XX230v (ES version) is ~26 MB in size and is an "all-in-one" image containing the bootloader, a configuration file (ROM file), and the driver (kernel+rootfs)(.) If you have the bootloader file, you can extract it from this package using a binary editor(.) The bootloader partition is typically 128 KB or 256 KB in size (depending on the device's memory partition)(.) Some sources indicate that the bootloader size on modern GPON platforms (EN7523) may be 256KB with bootext, and some users have inferred that Xmodem transfer stops at ~126KB, which may indicate a size of about half that size(.) In any case, the best way to obtain the correct file is to do one of the following:

* From a similarly healthy device: If you have access to another working XX230v device (same V1(ES)), you can access its U-Boot interface via the serial port (by abort at boot and possibly entering debug credentials if prompted) and then use commands like save or read to copy the contents of the boot partition(.) Alternatively, you can perform a full flash dump using an external programmer and extract the bootloader section(.) The extracted file will be the required tcboot(.)bin (.) Care must be taken to ensure that the bootloader version matches your device (preferably the same version and region)(.)

 

* From the official firmware file: If no other device is available, you can use the official firmware BIN file (e(.)g(.), Build 231010 the device was running on or a newer ES version) and extract the boot part(.) The bootloader usually starts at the first offset of the BIN file(.) You can open the file with a hex editor and look for a text beginning with "U-Boot" or preview the size(.) On many TP-Link/TrendChip devices, the bootloader is a fixed length (e(.)g(.), 0x20000 bytes = 128KB or 0x40000 = 256KB)(.) You can cut the first 128KB and try using it as a tcboot(.)bin file(.) If that doesn't work, try the first 256KB(.) This should be done carefully, and it's best to ensure the cut part is correct (e(.)g(.), a string indicating the U-Boot version near the end, as shown in the previous boot log)(.) It is worth noting that some firmware versions may contain a phrase like “UP\_BOOT” in their name, which means that they include a bootloader upgrade – this confirms that the file contains a bootloader(.)

* Search technical forums: Sometimes hobbyists or techies share these files(.) You may find projects on forums like 4PDA, OpenWrt, or GitHub where owners have shared boot files for similar devices (for example, a device with the same EN7523 processor)(.) However, be careful and only use a file taken from the same device or official firmware to ensure compatibility(.)

What about “boot(.)bin” or “ramboot(.)bin”?
The name boot(.)bin is sometimes used generally to refer to a boot file, while ramboot(.)bin can refer to a method for booting a system from memory (e(.)g(.), a temporary boot image from RAM for development purposes)(.) For the XX230v, TP-Link does not provide a ramboot file for this platform(.) What you need is exactly what was mentioned above: the bootloader file (tcboot(.)bin with bootext)(.) After restoring the bootloader, you will use the tclinux(.)bin file (the main firmware) to complete the repair process(.) No additional files are required for this process(.)

In short, the file you're looking for when you see the repeated 'C' is the correct bootloader for your device (.) You can get it by either extracting it from a healthy device or unpacking the official XX230v (ES) upgrade file (.) This file (tcboot(.)bin) is what you'll send via Xmodem so the Boot ROM can load it into RAM and boot(.)

## References and sources related to the case

This issue (device crashing after a power outage during a firmware upgrade) has been encountered by others with similar ISP devices(.) TP-Link itself won't provide a direct solution for this ISP-specific device —its support states that the XX230v model is for ISP projects and regional variations, and that the ISP is responsible for the firmware (.) In other words, you won't find a ready-made recovery file on the TP-Link website, and the company will advise you to consult your ISP(.) In the case of the aforementioned user (using the ES version for Spain), TP-Link's Spanish website offers update packages (which include the bootloader and firmware) in multiple versions, but they are not publicly available without contacting technical support(.)

On the developer forums, OpenWrt environments, and community support for the EN7523 chipset : OpenWrt began adding preliminary support for Airoha (formerly Econet/TrendChip) processors such as the EN7523 around 2021, but there is no ready-made OpenWrt release for this specific model yet(.) However, the general principles of recovery are the same as in the internal documentation(.) For example, the MediaTek/TrendChip platform SDK notes mention a bootloader-mode upgrade, where the `tcboot(.)bin` file is first uploaded via a special method (Xmodem or TFTP) before entering the rest of the system bootloader mode(.) Also, a Chinese tech blog documented a step-by-step emergency recovery procedure (which we quoted above) that was identical to what we explained(.)

Given the scarcity of Arabic sources on this particular device, the following foreign contributions that address the same topic can be useful:

 

* TP-Link Forum (Provider Devices Section): The issue was raised by the same user, who described the symptoms (stuck at "Press X") and the need for the initial firmware file(.) A TP-Link moderator confirmed that there is no official solution because the device is dedicated to a service provider(.) This thread documented the serial port log before and after the crash in detail, which helped understand the normal boot sequence(.)
* Airoha EN7523 GitHub documentation and projects: There are open source repositories and software that reference tcboot(.)bin and tclinux(.)bin as parts of the operating system for these devices(.) For example, the build script demonstrated how to create a single image that includes the bootloader, settings, and firmware together, and this is exactly what we're dealing with when unpacking the update file(.)
* Other forums for similar devices: Some similar devices (such as GPON routers from other companies using the EN752x) have discussed recovery methods(.) For example, the Askey RTF8225VW from one service provider was found to also use a similar ECONET U-Boot bootloader and follow the dual image concept(.) Although the details of this device vary, it confirms the ubiquity of this architecture and that serial recovery solutions are possible via similar interfaces(.)
* hungvu(.)tech blog (Quantum Fiber W1700K): This is another example of a close-architecture ONT(.) The author shared information about the UART interface and boot environment (showing U-Boot commands and environment)(.) Although he didn't discuss the bootloader crash, the detailed information about the commands and environment is helpful in understanding how to work with the recovered U-Boot (such as printenv , flash , etc(.) commands that might be used during system recovery)(.)

In conclusion, the recommended solution is to reflash the bootloader via serial using Xmodem and then use the temporary bootloader interface to flash the full firmware to the device(.) Network technicians have successfully implemented this process on devices similar to the XX230v platform, as mentioned in the sources above(.) With proper preparation and the correct files (bootext(.)arm + tcboot(.)bin + the appropriate update to tclinux(.)bin) from a reliable source, the device can be salvaged and restored to working condition even without official vendor support(.) Always remember to take care when dealing with low-level programming and ensure that the files are compatible with your device, as flashing the wrong files can exacerbate the problem(.)

Sources: This article was based on official TP-Link forum documentation and user posts, as well as technical resources on GitHub and blogs detailing the software architecture (tcboot/tclinux) of GPON processors, as well as emergency recovery instructions from the chipset manufacturer's documentation(.) These combined resources provide a comprehensive picture of the issue and its solution(.) We hope this explanation helps you get your device back up and running successfully(.)


----