Unbricking TP-Link TL-WR741ND V4.23

NOTE: This is my first blog EVER, i'm still working on trying to figure out formatting and things, hopefully it will get better over time.

Unbricking TL-WR741ND v4.23

TL-WR741ND

So the first thing I did when I got my router was what anyone would do……install third party firmware on it. I wanted to setup a wireless bridge and I was successful BUT it wasn't stable. Then I tried to use it as an access point, that didn't quite work either. So I thought aaaaah screw it i'll just revert back to stock firmware. I downloaded the revert to stock version of DD-WRT image and uploaded it using the web interface……… and thats where it all went to hell.

The update failed, and I don't know why I thought I should do 30/30/30 reset of the router and try again. Well…. it didn't come back. Upon rebooting, only the power LED was lit, no other signs of life.

My router is BRICKED!!!!!

Debricking

Things you need:

1. TFTP Server: tftpd32 for windows (I have not tried this on Linux but procedure should be similar)

2. Firmware (dd-wrt, openwrt or stock in .bin format)

3. Soldering Iron (and solder, and flux etc)

4. Ethernet Cable

5. Small pieces of wires

6. USB to TTL adapter (PL2303, or FTDI). If you want to DIY that, here is a schematic (full credit to picprojects.org)

SimpleRS232

7. PuTTY

Procedure:

Flip over the router, remove the two rubber pads closest to Ethernet ports and then remove the screws.

Pry open the cover.

Once open you will see this

WR741ND PCB

The serial pins are conveniently placed at the bottom right. We need to solder pins or wires so we can interface with the computer.

The first thing we need to do is to take the PCB out of the case and flip it over.

Tx Port

There we have to solder TP28 and TP18 together as TP18 is the Tx leg of CPU and TP28 is Tx leg of serial port.

TP18_TP28 Soldering

Now its time to solder the serial pins. I had some CAT5 cable laying around. I stripped both ends and solder them to the points.

20150131_215224

20150201_142100

Well this was my first time EVER soldering… and I couldn't believe it worked considering only solder that I had access to was 3 mm in diameter.

Now it is time to prepare the computer…

 

 Connecting Router to PC

Connect an ethernet cable from PC to any port except WAN port.

We can't connect the router to serial port of PC directly. We will need to use TTL adapter.

I just used the USB to TTL adapter (PL2303) which I purchased from ebay.

serial ttl-PC

Router                               USB-TTL

Tx———————————-Rx

Rx———————————-Tx

GND——————————GND

 

Now that the router is connected to the PC, launch PuTTY. Power ON the router.

Select Serial and enter the correct COM port, then enter the baud rate 115200 and click Open.

putty

The console will open and you will see something like "Autobooting in 1 second"

you have to type


tpl

and hit enter within that 1 second. Once successful, you will see something like this


hornet>

Determine the IP address that the router has and the one it is listening on.


hornet>printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtd
parts=ar7240-nor0:256k(u-boot),64k(u-boot-env),2752k(rootfs),896k(uImage),64k(NV
RAM),64k(ART)
bootcmd=bootm 0x9f020000
bootdelay=1
baudrate=115200
ethaddr=0xba:0xbe:0xfa:0xce:0x07:0x41
ipaddr=192.168.1.102
serverip=192.168.1.105
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

 

ipaddr=192.168.1.102 is the IP address that is assigned to the router.
serverip=192.168.1.105 is the IP address that it is listening for. (This is the ip address you should set your computer to)

The above information can be changed if you would like to set different IP addresses.


hornet>setenv ipaddr x.x.x.x
hornet>setenv serverip y.y.y.y

then check to see if the ip addresses have been set

hornet>printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtd
parts=ar7240-nor0:256k(u-boot),64k(u-boot-env),2752k(rootfs),896k(uImage),64k(NV
RAM),64k(ART)
bootcmd=bootm 0x9f020000
bootdelay=1
baudrate=115200
ethaddr=0xba:0xbe:0xfa:0xce:0x07:0x41
ipaddr=x.x.x.x
serverip=y.y.y.y
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

 

 Setting up TFTPD32

1. Download TFTPD

1.1 Download 32bit for 32bit OS and 64bit for 64bit OS (This part is important)

2. Install software as normal.

3. Download the firmware for router ( ie: Openwrt, dd-wrt)

4. To make life easier, rename the file from something like "openwrt-ar71xx-generic-tl-wr741nd-v4-squashfs-factory.bin" to "openwrt.bin"

5. Place the *.bin file in the tftpd install folder (ie: C:Program FilesTftpd64).

 

Loading the firmware

To transfer the file that was placed in step 5 above, type in very carefully

hornet>tftpboot 0x80000000 firmware_file.bin

The output will look something like this.

Using eth0 device
TFTP from server 192.168.2.1; our IP address is 192.168.1.1
Filename 'openwrt-ar71xx-generic-tl-wr740n-v4-squashfs-factory.bin'.
Load address: 0x80000000
Loading: checksum bad
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
######################################################
done
Bytes transferred = 3932520 (3e0000 hex)

 
Type the next line very carefully. It is very important that you write the highlighted value that appears in your console as it maybe different from case to case.


hornet>erase 0x9f020000 +0x3e0000
hornet>cp.b 0x80000000 0x9f020000 0x3e0000
hornet>bootm 0x9f020000

The router will now boot and you should be able to access it from the web browser.

 

After I verified that all was good, I put electrical tape on the tips so they would not short circuit anything once I have cloded the case.

20150201_142051

 

I hope this post has helped someone. Do let me know in the comment below.

8 Comments

Add a Comment

Your email address will not be published. Required fields are marked *