So wow you guys are great. I have been doing allot of digging. and seems like there is a embedded tftp recovery can can be used to reflash my bootloader. but you need a usb to ttl connection., does anyone have a hex to convert the flash cat to a usb to ttl. ? this would allow us to then use there built in recovery to then send over a stock bin to the tftp then recover that way. Ultimately I would like to backup the whole flash. by the way the tftp method is a little tricky but once you get the hang of it then it works. but my issue right now is I don't have a usb > ttl cable to put it into the mode to be able to flash the whole unit.
I have spent hours digging I will post what all I have found so far.
Here is some info.
To Unbrick, you'll need a 3.3v capable Serial to TTL cable. I used a USB to serial cable like this one:
Note: You CANNOT use a USB to RS-232 cable! That type is the worng polarity and it outputs high-voltage (+/- 10V) and could destroy your AP! Also: do NOT connect the power wire to anything!
This procedure should recover any AP with corrupted config or firmware. It will not fix units that have lost their bootloader somehow (rare) or if they have electrical damage (ESD/Lightning).
Connect your USB to TTL adapter to your PC, and now we'll connect the other end to the header inside. This is a 4 pin connector with bare gold pins sticking up. You only should connect 3 wires, GND, TX, and RX. (DO NOT use the Power or Vcc wire from the USB to serial adapter!)
The pinout seems to vary across models, but GND is always on one end, and it's easy to determine, as it's connected to the backplane. You can either use a meter to check continuity to the backplane (same as the silver housing on the ethernet jack), or just look at the board closely and see which end has the copper foil connected to it. (a magnifying glass makes this easy)
Once you have GND connected, fire up a terminal program. I used minicom on Ubuntu, but you can use hyperterm or teraterm (free) on windows. Be sure to set it for 115k, 8N1. (115,200 baud, 8 bit, 1 stop, No parity, and no flow control.)
You can confirm the terminal is working correctly by using a small paperclip to connect the TX and RX on your cable ends together. If you are all good to go, you should see an echo of everything you type on the screen.
Ok, now disconnect your test jumper (paperclip) and connect the RX wire to the pin adjacent to GND on the AP. Apply power to the AP, if you don't see stuff printing on the screen within a second or two, move the RX wire to the next pin on the AP, cycle power and look for the text again. If you see a bunch of garbage, it's likely the baud rate is incorrect. Try different ones until the text is readable. The UniFi Outdoor is 115,200.
Now that you've found the correct RX pin, now you've got to find the one for TX. It's always next to the RX, so at most you have 2 locations to try. Connect TX to one of these 2 pins, power-cycle the AP again and immediately begin hitting ESC rapidly over and over. If the bootup messages stop, BINGO! You're in! If not, try the other location.
Once you are in, all you have to do is type "urescue" to put the unit in TFTP accept mode. Configure a PC with the IP of 192.168.1.254 and connect it to the AP directly. (port 1 if there are 2 ports) Then TFTP the correct firmware.bin (using bin mode) to the AP at 192.168.1.20. You will see the progress on the terminal screen. Wait fully until the AP reboots before you remove power! Note that the AP doesn't respond to pings while in this mode.
Make a note of the pinout for future use to save time. (I forgot to) Post them here for each model!
I found that 2.2.5 seems to be the "safest" to revert to. Note that this WILL NOT overwrite the config, so after flashing use the reset button or login at the terminal and issue the syswrapper.sh restore-default command. After that, it's like a brand new "fresh" AP!
Enjoy!
http://bloodhound.aredn.org/products/AREDN/wiki/HowTo/Unbrick
Find the serial port and attach a rs232-tty converter ¶
- As shown on the picture, find "SIN" (Serial In) and "SOUT" (Serial Out), and "GND" (Ground) pins on the board
- Connect an RS232 serial cable between your computer and the RS232-tty converter. This is generally a cable with DB9 connectors on both ends. Male DB9 to computer and a Female DB9 to the converter.
- Connect the tty pins to the Ubiquit serial ports. The Ubiquity devices are 3v serial ports (tty voltage levels). Unless you like smoke, do NOT connect RS232 serial ports directly, which are 5v:
- TX <-> SIN
- RX <-> SOUT
- GND <-> GND
- Vcc<-> PWR (may not need this depending on your converter)
Configure your console serial terminal and gain access ¶
- Set the Terminal to 115200 8N1
- I found some issues with vt10? emulation, ANSI worked best
- Apply power to the Ubiquiti
- Look for the uboot messages and hit any key to obtain the uboot prompt before timeout:
U-Boot 1.1.4.2-s594 (Dec 5 2012 - 15:23:07)
Board: Ubiquiti Networks XM board (rev 1.0 e012)
DRAM: 32 MB
Flash: 8 MB
PCIe WLAN Module found (#1).
Net: eth0, eth1
Hit any key to stop autoboot: 0
load Ubiquiti v5.5.x firmware appropriate for your device ¶
- Follow instructions (elsewhere on AREDN site) to configure your computer for static IP address to use 'tftp' firmware load method. You computer will have a static IP address at this point.
- connect a Cat5 cable with your computer and the Ubiquiti (typical the power brick LAN port).
- on the termial console enter the command "urescue -f -e". This will put the ubiquiti in 'tftp' sever mode ready to receive the new image. The "-f" option is the critical option that will allow the uboot program to be overwritten in firmware.
- on the computer, 'tftp' the v5.5.x Ubiquiti firmware to the ubiquiti device at address 192.168.1.20.
- observe the following output on the terminal console: