Hello everyone
I apologize in advance for my English.

Bought c7 v1.1 from Ebay, who was with cFeon Q64-104HIP.

After desoldered of cFeon Q64-104H  - lost the chip.

Bought  Winbond W25Q64HIP.

Need help and guidance what files need to put on Winbond W25Q64FV.

Тhank you in advance

(Last edited by feti on 7 Jul 2014, 09:15)

Successfully flash custom compiled ArcherC7 v2 firmware to WDR7500 v3

5g work if you build trunk version less then 40799
later trunk has a broken ath10k
https://dev.openwrt.org/ticket/16589#no1

I've tried trunk@40698 ,everything works, include 5g wifi .

v3 has a 8MB flash,  build with archerC7 v2's  profile to 8MB
enable ath10k buildin
build and flash it from ttl

>tftpboot  0x80020000 firmware.bin
>erase 0x9f020000 +0x7c0000
>cp.b 0x80020000 0x9f020000 0x7c0000

Hi Everyone,

Last week my Archer C7 v2 failed to boot after having played a bit with the trunk build. Initially it started up fine, I was able to configure quite a lot of things on it. At some point I wanted to try out 802.11ac, during those configuration attempts the router crashed a few times (no feedback from SSH while I was connected through wired Ethernet). I decided to switch the router off completely by using the HW button at the back and now it does not boot anymore...

As I could not enter safemode, I thought I would be able to unbrick it by using serial cable but unfortunately it does not seem to reach the stage at which I could type "tpl".

Here is the only thing I see as output from the serial:

U-Boot 1.1.4 (Mar 14 2014 - 16:32:53)
 
ap135 - Scorpion 1.0DRAM:  
sri
Scorpion 1.0
ath_ddr_initial_config(178): (32bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0xaa55aa55, 0x0)
Tap values = (0x8, 0x8, 0x8, 0x8)
128 MB

Does anyone have an idea of what I can try to recover the unit?

Thanks!

(Last edited by rd87 on 28 Jun 2014, 07:52)

Hi

Could you please share your 8mb custom build? Thanks

How much free space is available for user installable software with 8MB flash?

Thanks in advance.

Hi.
I would be grateful if someone can send me  full dump file -  Tp link C7 v1.1

ffeti@abv.bg

Thank you.

Have you tried this?

Use ArcherC7v2_tp_recovery.bin instead of ArcherC7v1_tp_recovery.

Yes, in fact that is precisely the procedure I was trying to apply.

But U-Boot never gets to the point of displaying "Autobooting in 1 sec". It gets stuck after printing the amount of RAM.

just a simple patch

--- openwrt/target/linux/ar71xx/image/Makefile  2014-06-27 17:00:11.766060455 +0800
+++ trunk/target/linux/ar71xx/image/Makefile    2014-06-27 18:45:46.043719662 +0800
@@ -1133,7 +1111,8 @@
$(eval $(call SingleProfile,TPLINK,64kraw,TLWR1043V1,tl-wr1043nd-v1,TL-WR1043ND,ttyS0,115200,0x10430001,1,8M))

$(eval $(call SingleProfile,TPLINK-LZMA,64kraw,ARCHERC7V1,archer-c7-v1,ARCHER-C7,ttyS0,115200,0x75000001,1,8Mlzma))
$(eval $(call SingleProfile,TPLINK-LZMA,64kraw,ARCHERC7V2,archer-c7-v2,ARCHER-C7,ttyS0,115200,0xc7000002,1,16Mlzma))
+$(eval $(call SingleProfile,TPLINK-LZMA,64kraw,ARCHERC7V3,archer-c7-v3,ARCHER-C7,ttyS0,115200,0x75000003,1,8Mlzma))
$(eval $(call SingleProfile,TPLINK-LZMA,64kraw,TLMR10U,tl-mr10u-v1,TL-MR10U,ttyATH0,115200,0x00100101,1,4Mlzma))
$(eval $(call SingleProfile,TPLINK-LZMA,64kraw,TLMR11UV1,tl-mr11u-v1,TL-MR11U,ttyATH0,115200,0x00110101,1,4Mlzma))
$(eval $(call SingleProfile,TPLINK-LZMA,64kraw,TLMR11UV2,tl-mr11u-v2,TL-MR11U,ttyATH0,115200,0x00110102,1,4Mlzma))
@@ -1206,7 +1185,7 @@

$(eval $(call MultiProfile,AP121,AP121_2M AP121_4M))
$(eval $(call MultiProfile,AP136,AP136_010 AP136_020))
-$(eval $(call MultiProfile,ARCHERC7, ARCHERC7V1 ARCHERC7V2))
+$(eval $(call MultiProfile,ARCHERC7, ARCHERC7V1 ARCHERC7V2 ARCHERC7V3))
$(eval $(call MultiProfile,EWDORIN, EWDORINAP EWDORINRT EWDORIN16M))
$(eval $(call MultiProfile,OPENMESH,OM2P MR600))
$(eval $(call MultiProfile,TEW652BRP,TEW652BRP_FW TEW652BRP_RECOVERY))

and here is the boot log:

U-Boot 1.1.4 (Feb 10 2014 - 10:39:47)

ap135 - Scorpion 1.0DRAM: 
sri
Scorpion 1.0
ath_ddr_initial_config(178): (32bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x4, 0x1f)
Tap values = (0x11, 0x11, 0x11, 0x11)
128 MB
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

*** Warning *** : PCIe WLAN Module not found !!!
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0xe
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Scorpion  ----> S17 PHY *
athrs17_reg_init: complete
: cfg1 0x80000000 cfg2 0x7114
eth0: ba:be:fa:ce:08:41
eth0 up
athrs17_reg_init_wan done
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x800c0000 cfg2 0x7214
eth1: ba:be:fa:ce:08:41
eth1 up
eth0, eth1
Setting 0x18116290 to 0x58b1214f
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Linux version 3.10.36 (compile@tc_128_166) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r41355) ) #5 Sun Jun 29 11:35:20 CST 2014
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019750 (MIPS 74Kc)
[    0.000000] SoC: Qualcomm Atheros QCA9558 rev 0
[    0.000000] Clocks: CPU:720.000MHz, DDR:600.000MHz, AHB:200.000MHz, Ref:40.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x07ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x07ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line:  board=ARCHER-C7 console=ttyS0,115200 rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 126248k/131072k available (2217k kernel code, 4824k reserved, 592k data, 260k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048)
[    0.060000] pid_max: default: 32768 minimum: 301
[    0.060000] Mount-cache hash table entries: 512
[    0.070000] NET: Registered protocol family 16
[    0.070000] MIPS: machine is TP-LINK Archer C7
[    0.080000] ar724x-pci ar724x-pci.0: PCIe link is down
[    0.080000] registering PCI controller with io_map_base unset
[    0.090000] registering PCI controller with io_map_base unset
[    0.500000] bio: create slab <bio-0> at 0
[    0.500000] PCI host bridge to bus 0000:00
[    0.510000] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[    0.510000] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.520000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.520000] PCI host bridge to bus 0000:01
[    0.530000] pci_bus 0000:01: root bus resource [mem 0x12000000-0x13ffffff]
[    0.530000] pci_bus 0000:01: root bus resource [io  0x0001]
[    0.540000] pci_bus 0000:01: No busn resource found for root bus, will use [bus 01-ff]
[    0.540000] pci 0000:01:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    0.550000] pci 0000:01:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
[    0.550000] pci 0000:01:00.0: using irq 41 for pin 1
[    0.560000] Switching to clocksource MIPS
[    0.560000] NET: Registered protocol family 2
[    0.570000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    0.570000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.570000] TCP: Hash tables configured (established 1024 bind 1024)
[    0.580000] TCP: reno registered
[    0.580000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.590000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.600000] NET: Registered protocol family 1
[    0.610000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.620000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.630000] msgmni has been set to 246
[    0.630000] io scheduler noop registered
[    0.630000] io scheduler deadline registered (default)
[    0.640000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.670000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[    0.670000] console [ttyS0] enabled, bootconsole disabled
[    0.670000] console [ttyS0] enabled, bootconsole disabled
[    0.690000] ath79-spi ath79-spi: master is unqueued, this is deprecated
[    0.690000] m25p80 spi0.0: found s25fl064k, expected m25p80
[    0.700000] m25p80 spi0.0: s25fl064k (8192 Kbytes)
[    0.700000] 5 tp-link partitions found on MTD device spi0.0
[    0.710000] Creating 5 MTD partitions on "spi0.0":
[    0.710000] 0x000000000000-0x000000020000 : "u-boot"
[    0.720000] 0x000000020000-0x00000011c9c4 : "kernel"
[    0.730000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.740000] 0x00000011c9c4-0x0000007f0000 : "rootfs"
[    0.750000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.760000] mtd: device 2 (rootfs) set to be root filesystem
[    0.760000] 1 squashfs-split partitions found on MTD device rootfs
[    0.770000] 0x000000380000-0x0000007f0000 : "rootfs_data"
[    0.780000] 0x0000007f0000-0x000000800000 : "art"
[    0.780000] 0x000000020000-0x0000007f0000 : "firmware"
[    0.820000] switch0: Atheros AR8327 rev. 4 switch registered on ag71xx-mdio.0
[    2.070000] libphy: ag71xx_mdio: probed
[    2.620000] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.0:00 [uid=004dd034, driver=Atheros AR8216/AR8236/AR8316]
[    2.630000] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:RGMII
[    3.190000] eth1: Atheros AG71xx at 0xba000000, irq 5, mode:SGMII
[    3.200000] TCP: cubic registered
[    3.200000] NET: Registered protocol family 17
[    3.200000] 8021q: 802.1Q VLAN Support v1.8
[    3.210000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    3.220000] Freeing unused kernel memory: 260K (8031f000 - 80360000)
procd: Console is alive
procd: - watchdog -
procd: - preinit -
[    6.360000] eth1: link up (1000Mbps/Full duplex)
[    6.400000] usbcore: registered new interface driver usbfs
[    6.410000] usbcore: registered new interface driver hub
[    6.420000] usbcore: registered new device driver usb
[    6.430000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    6.430000] ehci-platform: EHCI generic platform driver
[    6.440000] ehci-platform ehci-platform.0: EHCI Host Controller
[    6.440000] ehci-platform ehci-platform.0: new USB bus registered, assigned bus number 1
[    6.450000] ehci-platform ehci-platform.0: TX-TX IDP fix enabled
[    6.460000] ehci-platform ehci-platform.0: irq 48, io mem 0x1b000000
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and[    6.500000] ehci-platform ehci-platform.0: USB 2.0 started, EHCI 1.00
hit [enter] to [    6.500000] hub 1-0:1.0: USB hub found
select the debug[    6.510000] hub 1-0:1.0: 1 port detected
level
[    6.510000] ehci-platform ehci-platform.1: EHCI Host Controller
[    6.520000] ehci-platform ehci-platform.1: new USB bus registered, assigned bus number 2
[    6.530000] ehci-platform ehci-platform.1: TX-TX IDP fix enabled
[    6.540000] ehci-platform ehci-platform.1: irq 49, io mem 0x1b400000
[    6.560000] ehci-platform ehci-platform.1: USB 2.0 started, EHCI 1.00
[    6.560000] hub 2-0:1.0: USB hub found
[    6.570000] hub 2-0:1.0: 1 port detected
jffs2 is ready
[    9.720000] jffs2: notice: (341) jffs2_build_xattr_subsystem: complete building xattr subsystem, 19 of xdatum (0 unchecked, 18 orphan) and 34 of xref (0 dead, 18 orphan) found.
switching to jffs2
[    9.750000] eth1: link down
procd: - early -
procd: - watchdog -
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
[   11.070000] NET: Registered protocol family 10
[   11.080000] nf_conntrack version 0.5.0 (1976 buckets, 7904 max)
[   11.090000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   11.110000] Loading modules backported from Linux version master-2014-03-31-1-0-g5c109d2
[   11.110000] Backport generated by backports.git backports-20140221-0-g8e94650
[   11.140000] cfg80211: Calling CRDA to update world regulatory domain
[   11.140000] cfg80211: World regulatory domain updated:
[   11.150000] cfg80211:  DFS Master region: unset
[   11.150000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   11.160000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   11.170000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   11.180000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[   11.190000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   11.190000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   11.200000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[   11.240000] ath10k_pci 0000:01:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[   11.250000] PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
[   11.560000] ath10k: pci irq legacy
[   12.470000] ath10k: qca988x hw2.0 (0x4100016c) fw 10.1.467.2-1 api 2 htt 2.1
[   13.000000] cfg80211: Calling CRDA for country: US
[   13.010000] cfg80211: Regulatory domain changed to country: US
[   13.010000] cfg80211:  DFS Master region: FCC
[   13.020000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   13.030000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 3000 mBm), (N/A)
[   13.030000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 1700 mBm), (N/A)
[   13.040000] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz), (N/A, 2300 mBm), (0 s)
[   13.050000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 3000 mBm), (N/A)
[   13.060000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 4000 mBm), (N/A)
[   13.090000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   13.150000] xt_time: kernel timezone is -0000
[   13.170000] PPP generic driver version 2.4.2
[   13.190000] NET: Registered protocol family 24
[   13.230000] ieee80211 phy1: Atheros AR9550 Rev:0 mem=0xb8100000, irq=47
procd: - init complete -
[   20.050000] eth1: link up (1000Mbps/Full duplex)
[   20.050000] device eth1 entered promiscuous mode
[   20.060000] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   20.080000] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   21.050000] br-lan: port 1(eth1) entered forwarding state
[   21.050000] br-lan: port 1(eth1) entered forwarding state
[   21.060000] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   21.930000] eth0: link up (1000Mbps/Full duplex)
[   21.940000] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   23.050000] br-lan: port 1(eth1) entered forwarding state

BusyBox v1.19.4 (2014-06-27 18:51:32 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
|       |.-----.-----.-----.|  |  |  |.----.|  |_
|   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
|_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
-----------------------------------------------------
BARRIER BREAKER (Bleeding Edge, r40698)
-----------------------------------------------------
  * 1/2 oz Galliano         Pour all ingredients into
  * 4 oz cold Coffee        an irish coffee mug filled
  * 1 1/2 oz Dark Rum       with crushed ice. Stir.
  * 2 tsp. Creme de Cacao
-----------------------------------------------------
root@OpenWrt:/#

and this is the firmware i compiled: (with luci build-in)

http://pan.baidu.com/s/1o6mH5qi

Must be flashed from  serial console using ttl
(I don't know how to bypass tp-link firmware check
simpley change firmware version to 75000003 is not enough)

try without flash using uimage

>tftpboot  0x80020000 uimage.bin
>bootm

or flash factory.bin using

>tftpboot  0x80020000 firmware.bin
>erase 0x9f020000 +0x7c0000
>cp.b 0x80020000 0x9f020000 0x7c0000

about 4.2MB left,  after flashed my build( has luci build-in)

Can someone upload full dump of original Archer C7 v2.0 firmware?
16Mb, W25Q128. Need to confirm some thoughts about ART partition.

The ART is seems to the same.
I have flash the C7V2(taiwan version) firmware without art ,and combine the ART which is from the WDR7500 V3  140210 version firmware.It work fine.

http://img.mydigit.net/Mon_1406/88_2724 … 930645.jpg

http://pan.baidu.com/s/1jG5g7ga

This is the ART and Uboot from Archer C7 v2(131217version) and WDR 7500 V3(140217version).
I have changed the three key "tpl" to  interrupt the uboot to "xxx".It is easy to interrupt the uboot.

The Firmware in the RAR,it's a OpenWrt factory image which unlock ART,Uboot,you can easyly flash your ART,Uboot in the ssh.

(mtd -r write yourart.bin art   or  mtd -r write yourubootfile.bin u-boot)

Good luck.

Thanks a lot, wuxeon.
Currently i have WDR7500 v2 flashed to C7 v1, waiting for WDR7500 v3 this week, will change it's flash to w25q128 and convert it to Archer C7 v2.
Looks like now i have all needed to make this possible.

BTW, have you checked the working 5Ghz frequencies on your WDR7500?
My WDR7500 v2 has locked 36-140 channels before i flashed one of the beta firmwares for C7 v1, don't remember the actual build number.
Once opened, I flashed the newest available at that moment firmware for C7 - 140402, and got some channels locked (router settings says channel is 48 but no wi-fi network SSID was visible at all; 5Ghz LED was light like it works).
When setting back to channels 149-165, SSID became visible normally.

After that i begin to flash earlier beta builds and one of them unlocked these frequencies somehow.
I've set channel to 48 and found 5Ghz network in 149 channel instead. That was some step forward, and i decided to flash again newest available at that moment build, 140402. Router begins to work normally, all channels 36-165 set in settings works as they should.

So there's something that older firmwares do with art partition (i guess), that newest firmwares don't and this unlocks 5GHz EU 36-140 channels. Thus interested whether such manipulations will be needed with newest TL-WDR7500 v3 or these channels are unlocked from the box.

(Last edited by docomo on 30 Jun 2014, 13:32)

Sounds enough to me. Perhaps I could wait for a web flashable image for WDR7500v3 instead of getting a C7v2.

Cheers.

you'd better read the ath10k   linux drivers  in linux wiki,then you will know   why 7500v2 and c7 v1 can't support 5G in  OpenWrt.  But the v3 can support 5G.
But the ath10k driver is  not perfect yet,not support HT80  and above. The WDS MODE   only HT40  about 300Mbps.

I know about revisions of the used qca9880 and 5G support in OpenWRT.
The post i wrote was completely about stock TP-Link firmwares, not OpenWRT.

(Last edited by docomo on 30 Jun 2014, 20:49)

Hi,

Do you know if this procedure Works with wdr7500 stock firmware?

Regards

Thanks for the tip! I will try the procedure tomorrow.

However I do not have high hopes since U-Boot itself seems to get stuck.

(Last edited by rd87 on 4 Jul 2014, 01:23)

Can someone upload full dump of original Archer C7 v1.1 firmware?
8Mb, cFeon Q64-104HIP

@phorcys02: Have you figured out how to make a web flashable OpenWrt firmware for the WDR7500 v3?

Cheers.

Using his patch should be able to generate a sysimage that will write using the factory web interface, or, frankly, a hand-edit of the c7v1 firmware (hosted on openwrt's build servers) will also do it.

Open the file in a hex editor and find the value "75 00 00 01" at address 0x40. Change to "75 00 00 03".

Note that his patch is actually quite inappropriate, since it masquerades as ArcherC7V3, which it most certainly is NOT. Where it falls in terms of Archer C7, is actually in between V1 and V2, in that it is, effectively, just the V2's wifi chip on what is otherwise a V1. At some point, there will probably be an actual ArcherC7V3, which will most definitely NOT be the same as a WDR7500V3, so having system images labeled for ArcherC7V3 will be confusing to anyone who actually buys such a device when it becomes available. In the very least, it should be labeled properly as a WDR7500v3.

There is QCA9558 uboot(suit to wdr7500,archer c7,i have tested it.) ,it's very useful,u can update uboot,art,firmware with this uboot.
http://www.right.com.cn/forum/thread-136444-1-1.html

It looks like very deep modification/fork of my project (just checked that).
And... no sources available? Shame!

Typical way of Chinese doing.It's generous for them to share a working bin already!