Posted: Mon Jul 09, 2018 17:08 Post subject: The easy way to de-brick / upgrade FW locked TP-Link 1043ND
Complete title:
The easy way to de-brick / upgrade FW locked TP-Link WR1043ND V1.x without TTL cable
Hi folks, this my first post & perhaps the last too,
since English isn't my native language, so......
Part#1
The source is from OpenWRT wiki & my personal experience
First of all, prepare a PC as TFTP server (or anything that you may let your bricked 1043ND v1 communicate in TFTP),
a TFTP server software (my personal favor http://tftpd32.jounin.net/tftpd32_download.html)
the OEM TP-Link firmware for the TL-WR1043ND with the boot part removed to revert to the original OEM firmware for TL-WR1043nd v1
TL-WR1043ND-V1-stripped.zip
a RJ45 cable, and your bricked 1043ND v1.
Screwdriver & TTL cable? We won't need them all.
Last edited by NewFace on Tue Jul 10, 2018 10:25; edited 1 time in total
Next,
1. Remove the power cord from your bricked 1043ND v1, connect it to the PC running TFTP server with RJ45 cable in any LAN port.
2. Add both 2 sets of IPv4 address/mask to the LAN adapter connecting with 1043ND v1,
192.168.0.66 / 255.255.255.0 (for TFTP)
192.168.1.2 / 255.255.255.0 (for Web UI)
3. Extract "TL-WR1043ND-V1-FW0.0.3-stripped.bin" from TL-WR1043ND-V1-stripped.zip from OpenWRT wiki,
rename it to "wr1043nv1_tp_recovery.bin" (OpenWRT wiki missed the letter "n")
4. Execute TFTP server, point the root path to where "wr1043nv1_tp_recovery.bin" is stored.
Assign its interface to 192.168.0.66 (if necessary).
5. Now hold your bricked 1043ND v1, use a pin, a pen or something press the reset button. Make sure it's triggered firmly & hold it.
Next, connect the power cord to 1043ND v1, within 30 secs, if without any mistake, you will see the TFTP server starting its upload,
meanwhile you may release the reset button.
If it's not working, check the TFTP server log to verify any issue
(except the linking, mostly the reverting FW file name, eg. the missed letter "n", if your follow the steps on OpenWRT wiki. That's why wiki suggests to check the log).
As reference, that's how TFTPD by ph. jounin works for uploading
6. Wait about 2~3 mins, the LED of 1043ND v1 will blink normally as usual,
you may open it Web UI with web browser in the default IPv4 address 192.168.1.1 with the default ID & PW both "admin" to login the reverted factory FW.
Later you may upgrade it with factory-to-ddwrt.bin of any working DD-WRT you want.
Looks complicated? Sorry, that's all my fault.
DIY for couple times, you will find out how it's easy by yourselves.
FYI, in the past months tests, the suitable beta DD-WRT FW for WRT1043ND v1.x,
the final version which can be normally upgraded & downgraded with DD-WRT Web UI, is "09-11-2017-r33345",
since "09-19-2017-r33375" to "06-10-2018-r36104", I can only upgrade it with the TFTP trick & factory-to-ddwrt.bin FW file.
Since "06-16-2018-r36154", the only thing I have after flashing is a boot-loop WRT1043ND v1 .
According to the OpenWRT wiki, it supposes to flash FW in TFTP recovery mode, even the DD-WRT factory-to-ddwrt.bin, just rename it to the fail-safe FW name eg. wr1043nv1_tp_recovery.bin for WRT1043ND v1.x.
But in my experience, it doesn't work for both my WRT1043ND v1.1 & WRT841N v9.1.
I can only revert them back to the factory FWs then use their Web UI to flash newer DD-WRT.
I only suffered FW locked issue for once on WRT841N v9.1, when I upgraded it from 09-19-2017-r33375 to 09-27-2017-r33413.
Posted: Wed Jul 25, 2018 17:37 Post subject: Following - bricked my WR1043ND v.1 today
I finally decided to flask my TP-LINK wr1043ND v1 today as I've replaced it some time ago with a UBIQUITI router. My daughter was hoping to take it to grad school for her apartment.
After doing the 30/30/30 reset, I tried flashing the dd-wrt version recommended in the database:
tl-wr1043nd-webflash.bin
After logging into the TP-link device through the ADMIN interface, I uploaded this firmware.
Fail, code 18005
Did 30/30/30 reset again, used a different browser and tried again.
Fail, code 18005
Did 30/30/30 reset again, and then tried the alternate dd-wrt firmware:
factory-to-ddwrt.bin
This appeared to work and was accepted by the router, went through the upload countdown, 0-100%, the the installation countdown/up 0-100%, and after a little while the screen cleared and there was no connectivity to the tplink router. Error messages says media disconnected, no lights on the RJ45 port of my laptop.
The TP-link lights alternately FLASH all lights, dark, then LAN 1-4 and WAN port lights flash on. Just cycles in this state. 30/30/30 reset has no effect.
Manually set the lan adapter setting and CANNOT ping the router - 100% dropped.
IPCONFIG show nothing connected.
It appears to be bricked. SO I'm following this thread.
Joined: 16 Nov 2015 Posts: 6407 Location: UK, London, just across the river..
Posted: Fri Jul 27, 2018 19:28 Post subject:
well if you have read the installation procedures, carefully you would have find that for first flash you start with
factory to ddwrt file first... also 30/30/30 is very bad
way to reset your router its applicable only for the old
linksys WRT routers for any other routers you have to use either the reset button or software reset via GUI menu
and last but very important all the new builds are here
ftp://ftp.dd-wrt.com/betas/ all the routers data base suggestions are very old so ignore them...to find
appropriate and working firmware for your router either read
all the new build threads or ask in atheros forum post a new thread...
do not forget that your router is very old and especially v1 is kind of problematic too...so read read and read...
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=311642 _________________ Atheros
TP-Link WR740Nv1 ---DD-WRT 55179 WAP
TP-Link WR1043NDv2 -DD-WRT 55303 Gateway/DoT,Forced DNS,Ad-Block,Firewall,x4VLAN,VPN
TP-Link WR1043NDv2 -Gargoyle OS 1.15.x AP,DNS,QoS,Quotas
Qualcomm-Atheros
Netgear XR500 --DD-WRT 55460 Gateway/DoH,Forced DNS,AP Isolation,4VLAN,Ad-Block,Firewall,Vanilla
Netgear R7800 --DD-WRT 55460 Gateway/DoT,AD-Block,Forced DNS,AP&Net Isolation,x3VLAN,Firewall,Vanilla
Netgear R9000 --DD-WRT 55363 Gateway/DoT,AD-Block,AP Isolation,Firewall,Forced DNS,x2VLAN,Vanilla
Broadcom
Netgear R7000 --DD-WRT 55460 Gateway/SmartDNS/DoH,AD-Block,Firewall,Forced DNS,x3VLAN,VPN
NOT USING 5Ghz ANYWHERE
------------------------------------------------------
Stubby DNS over TLS I DNSCrypt v2 by mac913
I have a wr1043ND v1.4 and it doesn't seem to start the TFTP server with the given information. No logs or anything, it just simply does not trigger the TFTP server
I've tried connecting the PC to another network, and uploading the given file from another computer via TFTP protocol and it works perfectly both in and out the server.
I'm not sure, but I think I will be required to execute the serial alternative?
In my guess, it doesn't relate with your 1043ND version, since even my elder v1.1, the TFTP trick still works.
It's embedded rescue util for all 1043ND v1.x.
Yes, your video clearly display you having a bricked 1043ND, just like I ever had
Let's verify something.
1. Do you alter/add the IP address 192.168.0.66/255.255.255.0 to your NIC IPv4 protocol, that links to bricked 1043ND?
(If you use Jounin TFTP, better change its Server Interface to 192.168.0.66)
2. Do you set the PC firewall rule for TFTP passthrough?
(the better way, keep all devices off net & completely close firewall for mins)
3. Above steps has been all set, then press the reset button of 1043ND, don't move.
Next plug-in the power cord to 1043ND, TFTP should work (after TFTP triggered, you may release hand from reset button).
Joined: 16 Nov 2015 Posts: 6407 Location: UK, London, just across the river..
Posted: Tue Dec 11, 2018 15:25 Post subject:
some routers need a simple switch in between the pc/router to trigger the TFTP try this way, if its not working than it must have a different TFTP procedures... or its that badly bricked and needs a serial or there is a hardware failure, like faulty ram or flash rom...
at the end i don't see any point to spend all day re writing a openWRT post instead just paste a link or youtube video ... but you know better.... _________________ Atheros
TP-Link WR740Nv1 ---DD-WRT 55179 WAP
TP-Link WR1043NDv2 -DD-WRT 55303 Gateway/DoT,Forced DNS,Ad-Block,Firewall,x4VLAN,VPN
TP-Link WR1043NDv2 -Gargoyle OS 1.15.x AP,DNS,QoS,Quotas
Qualcomm-Atheros
Netgear XR500 --DD-WRT 55460 Gateway/DoH,Forced DNS,AP Isolation,4VLAN,Ad-Block,Firewall,Vanilla
Netgear R7800 --DD-WRT 55460 Gateway/DoT,AD-Block,Forced DNS,AP&Net Isolation,x3VLAN,Firewall,Vanilla
Netgear R9000 --DD-WRT 55363 Gateway/DoT,AD-Block,AP Isolation,Firewall,Forced DNS,x2VLAN,Vanilla
Broadcom
Netgear R7000 --DD-WRT 55460 Gateway/SmartDNS/DoH,AD-Block,Firewall,Forced DNS,x3VLAN,VPN
NOT USING 5Ghz ANYWHERE
------------------------------------------------------
Stubby DNS over TLS I DNSCrypt v2 by mac913
1. Do you alter/add the IP address 192.168.0.66/255.255.255.0 to your NIC IPv4 protocol, that links to bricked 1043ND?
(If you use Jounin TFTP, better change its Server Interface to 192.168.0.66)
Yes, I set it to that interface.
NewFace wrote:
2. Do you set the PC firewall rule for TFTP passthrough?
(the better way, keep all devices off net & completely close firewall for mins)
Yes, you have to remember, that I just used the TFTP as a client from a different computer, so tftp is working fine.
NewFace wrote:
3. Above steps has been all set, then press the reset button of 1043ND, don't move.
Next plug-in the power cord to 1043ND, TFTP should work (after TFTP triggered, you may release hand from reset button).
The interface activates and deactivates everytime it loops with a 169.X address (I know this because I was able to ipconfig in the exact milisecond once it was reestablished!)
The most interesting part is that the interface changes to 127.0.0.1 in jounin TFTP everytime the router loops. I put it back to 192.168.0.66 but it goes back to 127.0.0.1 again...
Reset button doesn't do anything, it just reboots always the same way with the reset button pressesed or not... today I wil be trying to solder some pins and all that
NewFace wrote:
And watch out the name of factory FW to restore!
Yes, I used the wr1043nv1_tp_recovery.bin file name... there are no logs or anything trying to upload anything at all.
Test 2:
I've tested in a second computer, disabled all interfaced except for the network ethernet interface with the 192.168.0.66/255.255.255.0 assignment.
Nothing
Maybe the router is full bricked... today I will be soldering.
The interface activates and deactivates everytime it loops with a 169.X address (I know this because I was able to ipconfig in the exact milisecond once it was reestablished!)
The most interesting part is that the interface changes to 127.0.0.1 in jounin TFTP everytime the router loops. I put it back to 192.168.0.66 but it goes back to 127.0.0.1 again...
Reset button doesn't do anything, it just reboots always the same way with the reset button pressesed or not... today I wil be trying to solder some pins and all that
I have never noticed those address regarding 169.x in ipconfig (maybe I just focus on pressing reset button & watching the TFTP I even never run the ipconfig) --
even the TFTP address I learned it from Openwrt wiki.
I just follow the rescue steps on Openwrt wiki,
power off 1043ND
connect it to PC & set the IP address for TFTP,
make sure everything has been ready,
keep pressing the reset button then connect the power cord to 1043ND,
let it do the rest in the final.
& the TFTP interface IP has been never changed to 127.0.0.1 by itself in my case.
Do you have the last version of jounin TFTP?
http://tftpd32.jounin.net/tftpd32_download.html
or force binding it with 192.168.0.66 in setting
SirLouen wrote:
Maybe the router is full bricked... today I will be soldering.
I think this old dog is hard to be completely killed, even I ever tried to flash it in SSH but completely failed -- that's why I found out the TFTP trick, since I had a bricked 1034ND but had no any TTL cable to save it.
I am dumb but this old dog is tough, have your try, you may save it
I have to say that this guy also made a arduino uno tutorial, and this saved me buying the dongle (is not expensive, but the time and everything considering I already had the arduino).
Now I will be restoring everyhing... I have to double check which firmware is the most adequate ATM.
BTW I'm the worst at soldering but I managed to do this
Flashed the current factory to DD-WRT (https://dd-wrt.com/support/router-database/?model=WR1043N(D)_1.x) after doing 30/30/30 and only being connected to the router through LAN cable, firewall disabled.
Guess what? At some point the router disconnected LAN and from that on I only had the light show going on, with LAN interface on PC showing disconnected-connected loop (with "connected" just showing up less than a second).
Found this thread, having the same light show as in the video from fellow member.
So I gave TFTP a try... but failed. Nothing in the log. Assigned 192.168.0.66 to it (same as network card), nothing.
I must say I am shocked that I am not the only one who straight ran into brick even reading and double checking everything in the wiki!