[Miuw]

[ian5142]

It will most likely flash fine via TFTP. I based it on the wikidevi specifications here: https://wikidevi.com/wiki/TP-LINK_TL-WR802N_v1.0

I then searched for a router that is already supported with the same SoC, the 841N v9, 10, and 11 all fit the bill. I based my file on the 841N v9, only modifying the header at the start of the file.

TFTP server will flash something. The router has a TFTP client looking for a specific filename served by a TFTP server on 192.168.0.66. Host a TFTP server, using TFTP32/TFTP64 on 192.168.0.66 (set your computer's ip to this manually). Power up the router while holding the Reset button in for at least 10-20 seconds.
Then check the TFTP32/TFTP64 log and it should show that the router was looking for a specific filename.
Rename the file I created to that name exactly. Try powering up the router with the reset button pushed in again. It should grab the file (window pops up on TFTP32/TFTP63 screen). Then wait at least 5 min before touching the router again. It may require a manual reboot, after the 5 minutes. Did I mention wait FIVE WHOLE MINUTES.

[Miuw]

ok thank you for the link.
I checked with wireshark, the router doesn't seem to send ARP requests for 192.168.0.66 or anything else.
(Which is bit weird, since a lot of routers of tp link have this feature)
I will quadruple check tomorrow.

I used tftpgui on linux.
What are you using yourself as tftp server ?
(I have also tested something on windows, but i'm not sure of the settings (like how to start the server) )

edit:

is this good enough ?
http://www.tricksguide.com/how-to-setup-a-tftp-server-tftpd32-windows.html

[ian5142]

I told you I use TFTP32/TFTP64 on Windows. I am 99% sure the feature is there. As for that page, most of the settings are not required.

Just install a TFTP Server and set it up to look at a simple directory (ex: C:/tftp in Windows). I then set the ethernet card to 192.168.0.66, subnet mask 255.255.255.0. In TFTP32/TFTP64, then select the approriate interface from the dropdown box. Then deal with the router stuff I mentioned above:

[Miuw]

The tftp thing didn't work.
But i'm not 100% sure that i did it correctly, because i tested on a TPlink wr720N (on openwrt) and it also didn't work.

[ian5142]

It is already listed on wikidevi: https://wikidevi.com/wiki/TP-LINK_TL-WR802N_v1.0

[Miuw]

Not with these exact parameters.
But i guess you mean that it doesnt change anything.

Do you know any good tutorial on how to upload the firmware with the serial port ?

[ian5142]

I would suggest reading all of this page: https://openwrt.org/toh/tp-link/tl-wr841nd

https://www.dd-wrt.com/wiki/index.php/Serial_Recovery

You can tell me it does not have TFTP recovery, I know it does, you just have to interrupt the boot process correctly.

[Miuw]

ok thank you.
For tftp, i don't understand what i can do wrong.

- My router is plugged on my ethernet port, no tension.
- In the adaptator properties of ethernet i set 192.168.0.66 and subnet mask 255.255.255.0.
(Not that i am not on a lan otherwise)
- I switch on tftpd64 and i select 192.168.0.66 in the drop down box.
If i do "netstat -a" in a cmd, "shell" i see:
UDP 0.0.0.0:69 *:*

- Then i take a toothpick, i cut the tip, use this to press on the reset button.
- While i continue to press with the toothpick, i plug the modem and a wire in an USB socket.
- I continue to press with the the toothpick may be 30 sec, until the modem has a steady light.
- But... Nothing.
(Yeah, my ip on the lan is 192.168.0.66)
I may do something wrong, but i have no idea of what it could be...

edit: i made a mistake with the firewall, that should be disabled (on windows) or authorized, but it didn't fix the thing. No arp request for 192.168.0.66 (unless i set this address as my ip in the lan) is no arp request...

[Miuw]

Ok, so i've just realized that the device (chinese version 1.1) has actually this kind of RSA check:
https://github.com/xdarklight/mktplinkfw3/blob/master/README.md

(However the md5 checksum uses the format #1)

There are 4 publickeyblobs in the file /usr/bin/httpd.
I was able to decypher the string that is in my firmware file header, thanks to this public key (with one).

Note that my own HEX string is at the offset 0xa0 and not at the offset 0xD0 in the firmware.
Obviously to patch successfully this file, someone would need the private key blob.
Cracking rsa 1024 bits is a bit above my skills (even though, i read that it is possible to crack RSA under the right circumstances.)

This httpd file (by it's name) seems to control only what happens on the http server.

Conclusion 1: it seems useless to patch this chinese 1.1 version through the http server. (you will get error 18005 if md5 is wrong, or error 18008 if rsa is wrong)

- On this tftp technique.
So i was able to get the Rx on a serial console.
When you keep pressing on reset, the device boots... as usual...
When you release your finger, it's reset the device and it reboots... That's all.
In the filesystem, i wasn't able to find anything about this ip 192.168.0.66 (very limited result on the query 192.168.* but all make sense).
This is corroborated to the fact that wireshark is unable to detect any ARP request.

Conclusion 2: this device (chinese 1.1 version) has no tftp server that starts at the startup.

It looks like someone wanted to prevent people to flash this device...

So what about the serial console ?
Well, i was able to get the Rx, but not the Tx, but my skills in soldering are .. bad. Just not good enough for that and i was a bit too violent, and there will be no Tx anymore, because it is likely that i broke the copper layer of this Tx contactor.
Also i lack of experience with serial console and the USB device.

Final conclusion:

So, if you want to flash this chinese version:
- or you find a security weakness in the httpd file (one that a team of professional was unable to find)
- or you can try with the serial port yourself (even if it's possible good luck)...
Or you could buy something else... but it's too bad because i really like this little modem. (Or buy the non chinese version)
May be i'll see if i can write directly to the memory using the connector of the chip, but that's just for the challenge.

I hope, i saved your time.

[ian5142]

You never mentioned it was a Chinese version. Most TP-Links that are sold in China have limited flash and RAM and therefore are not able to run DD-WRT.

International, US, and Taiwan versions can though. See this list for other models, ex 841ND, 741ND, etc: https://www.dd-wrt.com/wiki/index.php/Known_incompatible_devices

[Miuw]

Thanks for the list.
However if a brand provides a firmware with a kernel and a rootfs that make a total of more than 3.9mo, it is probably a device with 4mo of memory.
See my teardown above, that seems to confirm it.
Anyway i found some tutorial that explain how to change the memory chips.
But i ll probably try to flash directly the memory... if i figure out how to do...

[azriville]

[Miuw]

Ok good to know.
You just forget to write the version of your modem.

Are you in china ?

[348heo]

I can confirm the difficulties in flashing either DD-WRT or OpenWRT on Tp-link TL-WR802N v1 China version.

As reported by @Miuw , TFTP doesn't seem to work on these devices. The web interface also prevents upgrading due to key hash mismatch as already reported.

I have tried multiple times flashing through TFTP, using both atftpd and TFTP32 set to 192.168.0.66, but to no avail: the device doesn't seem to interact with the tftp server.

I've also sniffed packets on the ethernet interface with wireshark, and as reported by @Miuw there are no ARP packets originating from the device after a reset and power on.

Given the value of this device I'm not trying further. For anybody needing a portable router, my recommendation is to go with GL.iNet devices, which natively support (and actually run) OpenWRT. TP-LINK devices seem defective by design.