GUIDE. TP-Link TL-WDR4900 (ver1.3) unbrick

Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Index -> Atheros WiSOC based Hardware
Author Message
MariusK
DD-WRT Novice


Joined: 26 Jun 2013
Posts: 13

PostPosted: Sun Jun 30, 2013 16:13    Post subject: GUIDE. TP-Link TL-WDR4900 (ver1.3) unbrick Reply with quote
TP-Link TL-WDR4900 (ver1.3) unbrick after failled DD-WRT flash.

Preparation or "What i need?":
1. RS232 to USB adapter (cable). Some people using Nokia CA-42 cable. I use Nokia DKU-50 cable.
Nokia Data Cable DKU-5 Driver 1.24
So I found Nokia pop-port pinouts. Link: http://pinouts.ru/CellularPhones-Nokia/nokia_pop_pinout.shtml
NOTE (3/13/2021): As a more current alternative, use an FT232RL or CP2102 USB-UART-TTL adapter:
- DTECH FTDI 3 pin
- adafruit 954
- DSD TECH SH-U09C
2. TP-Link TL-WDR4900 PCB photo. Link: http://wiki.openwrt.org/_media/media/tplinkwdr4900v1serial.jpg?w=2000
3. Termite (RS232 terminal). Link: http://www.compuphase.com/software_termite.htm
NOTE (3/13/2021): As a more current alternative, use:
PuTTY ,KiTTY. or minicom
4. TFTP program. I use TFTPD32 (TFTPD64). Link: http://tftpd32.jounin.net/
5. TP-Link recovery firmware. Links:
ftp://everbest.ftpserver.biz/Share/TP-Link/TL-WDR4900%20Firmware/
https://www.tp-link.com/us/support/download/tl-wdr4900/#Firmware

Prepare router.
1. Unscrew 4 screws on bottom of the router.
2. Use knife or similar tool to remove upper cover.
3. Find Serial port on routers PCB (use PCB photo).
4. Connect your RS232 to USB / USB-UART-TTL adapter.
5. Connect UTP cable to your computers LAN card and to router one of LAN ports.

Prepare computer.
1. Run Termite / PuTTY / KiTTY / minicom.
2. Configure Termite / PuTTY / KiTTY / minicom:
Port - select your adapter port (COM1 or another)
Baud rate - 115200,
Data bits - 8,
Stop bits - 1,
Parity - none,
Flow control - none.
3. Run TFTPD32 (TFTPD64).

Recovery procedure...
1. Turn on router by pressing POWER button on the router.
2. Keep eye on Termite window and wait for this line of text:
eTSEC1
3. When you see this text immediatelly press and hold for couple seconds RESET/WPS button on the router. You should see these lines of text:
auto update firmware: is_auto_upload_firmware = 1!
SF: Detected S25FL128S_64K with page size 256, total 16 MiB
16384 KiB S25FL128S_64K at 0:0 is now current device
SPI flash read successful
Check for phy link status
Speed: 1000, full duplex
Using eTSEC1 device
TFTP from server 192.168.0.66; our IP address is 192.168.0.86
Filename 'wdr4900v1_tp_recovery.bin'.
Load address: 0x1000000
Loading: *[08]T
4. Now you can see TFTP server address (192.168.0.66) and router IP address (192.168.0.86). Also you see what file router needs to do recovery.
5. Assign static IP to your computer. Set TFTP server address: 192.168.0.66. In my case...
6. Rename downloaded TP-Link recovery firmware file to wdr4900v1_tp_recovery.bin. Router waiting for this file.
7. On TFTPD32 (TFTPD64) go to Tftp Client tab. Set Host to 192.168.0.86 (router IP address). Port leave blank. Set (browse) Local File to renamed TP-Link recovery firmware file.
8. If you "play" too long you will see this line of text:
Retry count exceeded; starting again
Don't panic and wait for another line of text:
Loading: *[08]T
9. On TFTPD32 (TFTPD64) press PUT button and BOOM! Recovery firmware is transfering to router.
10. Wait and wait again. You must see these lines of text:
Bytes transferred = 16252928 (f80000 hex)
auto update firmware: product id verify sucess!
SPI flash erase successful
SPI flash write successful
Autobo˙
11. Now router reboots itself. Do not press any buttons. Wait until you'll see blinking SYS LED on the router.
12. Remove your computer static IP address and wait for IP address from router DHCP server.
13. Open your favorite web browser and try to connect to 192.168.0.1
Login: admin
Pass: admin
14. Now you should see white/green TP-Link webui window.

Good luck.

Thanks to DD-WRT, Open-WRT, Google...
Sponsor
nebbia88
DD-WRT User


Joined: 08 Mar 2010
Posts: 174

PostPosted: Sun Jun 30, 2013 17:13    Post subject: Reply with quote
so you don't need to open the router and attach a serial adapter at all?

i cannot see any point that involves sending commands to the router via serial...
MariusK
DD-WRT Novice


Joined: 26 Jun 2013
Posts: 13

PostPosted: Sun Jun 30, 2013 18:49    Post subject: Reply with quote
Without serial you don't know what IP address have router, what IP address he is looking and what name of recovery file has to be. Of course you can try to guess IP addresses and file name (or use my). But with serial you exactly know what to provide to router.
nebbia88
DD-WRT User


Joined: 08 Mar 2010
Posts: 174

PostPosted: Sun Jun 30, 2013 20:26    Post subject: Reply with quote
well seems reasonable to me that the same model/version has the same ip and look for the same filename...
sancho2412
DD-WRT Novice


Joined: 20 Oct 2013
Posts: 3

PostPosted: Thu Nov 14, 2013 19:14    Post subject: Reply with quote
Hi,
I've got the same problem! But how have you connected the serial port to the router? Have you soldered it? I tried it with 192.168.0.66 as my local ip and tried to tftp to 192.168.0.66 but with no success. Please need some help
sancho2412
DD-WRT Novice


Joined: 20 Oct 2013
Posts: 3

PostPosted: Sat Nov 16, 2013 16:05    Post subject: Reply with quote
Hi I've tried ther serial connection but I only get some not readable output in the Termite window... what could be the problem?
kar200
DD-WRT Novice


Joined: 05 Jul 2010
Posts: 7

PostPosted: Sun Dec 01, 2013 18:10    Post subject: Reply with quote
Hi guys,

Thanks for the help here. Although not the same router but similar issue I had.

I bricked my wr740n v4.27 and couldn't log back in. All the lights would stay off when I switch it on.

What I did was to power on the unit while hold the reset button in. The padlock light would come up but nothing from the router.

I then used wireshark and sniffed the packet. It actually helped me to see that the router was looking for a 192.168.0.66 server(from 192.168.0.86) and asking to download a file called wr740v4_tp_recovery.bin.

I then installed a tftp server and renamed the image to the same filename the router was looking for. The automatic upload worked the router came back to life.

This is just to share my experience for people who are as hopeless as I am with soldering and stuff.

IT took me a while to realise that Windows 8 firewall was blocking the tftp server from uploading. Also the router will have to download the file and you cannot push it through the tftp client.

Good luck.

K.
leos79
DD-WRT Novice


Joined: 13 May 2013
Posts: 7

PostPosted: Tue Apr 29, 2014 7:50    Post subject: Reply with quote
kar200 wrote:
Hi guys,

Thanks for the help here. Although not the same router but similar issue I had.

I bricked my wr740n v4.27 and couldn't log back in. All the lights would stay off when I switch it on.

What I did was to power on the unit while hold the reset button in. The padlock light would come up but nothing from the router.

I then used wireshark and sniffed the packet. It actually helped me to see that the router was looking for a 192.168.0.66 server(from 192.168.0.86) and asking to download a file called wr740v4_tp_recovery.bin.

I then installed a tftp server and renamed the image to the same filename the router was looking for. The automatic upload worked the router came back to life.

This is just to share my experience for people who are as hopeless as I am with soldering and stuff.

IT took me a while to realise that Windows 8 firewall was blocking the tftp server from uploading. Also the router will have to download the file and you cannot push it through the tftp client.

Good luck.

K.


Hi, Kar!

Thank you for posting your method; thaks to you contribution I was able to continue the debrick process without the rs232 cable.

However I'm stuck after the upload of the file. I mean; I see the bar fillig, the wiresark shows blocks being delivered... but when it finish (after a few seconds) nothing happen... should I turn off the router? Reset it? simply wait for... what amount of time? maybe my bin is broken... what bin did you use?

Thank you very much!
leos79
DD-WRT Novice


Joined: 13 May 2013
Posts: 7

PostPosted: Tue Apr 29, 2014 8:06    Post subject: Reply with quote
add in case it is relevant...

- trying to revert to stock, i've uploaded the wdr4300 bin instead the 4900 one.

- i have 2 lights: the power led, solid and, if I have the rj45 connector plugged, the corresponding lan light blinking weird... fast a few times but dalaying a bit more sometimes... slow a fewer times... solid a second or a little more sometimes...
gtdaniel
DD-WRT Novice


Joined: 04 Sep 2011
Posts: 1

PostPosted: Thu May 01, 2014 19:34    Post subject: Reply with quote
If the upload of firmware is ok, router reboot itself and come back to life...
Probably the upload is not complete ok... Maybe the IP-s used is wrong or filename of bin is wrong...
Maybe firewall or antivirus block transfer...
Display posts from previous:    Page 1 of 1
Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Index -> Atheros WiSOC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum