The easy way to de-brick / upgrade FW locked TP-Link 1043ND

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Atheros WiSOC based Hardware
Goto page 1, 2  Next
Author Message
NewFace
DD-WRT Novice


Joined: 09 Jul 2018
Posts: 23

PostPosted: Mon Jul 09, 2018 17:08    Post subject: The easy way to de-brick / upgrade FW locked TP-Link 1043ND Reply with quote
Complete title:
The easy way to de-brick / upgrade FW locked TP-Link WR1043ND V1.x without TTL cable

Hi folks, this my first post & perhaps the last too,
since English isn't my native language, so......

Part#1
The source is from OpenWRT wiki & my personal experience

First of all, prepare a PC as TFTP server (or anything that you may let your bricked 1043ND v1 communicate in TFTP),
a TFTP server software (my personal favor http://tftpd32.jounin.net/tftpd32_download.html)
the OEM TP-Link firmware for the TL-WR1043ND with the boot part removed to revert to the original OEM firmware for TL-WR1043nd v1
TL-WR1043ND-V1-stripped.zip
a RJ45 cable, and your bricked 1043ND v1.

Screwdriver & TTL cable? We won't need them all.


Last edited by NewFace on Tue Jul 10, 2018 10:25; edited 1 time in total
Sponsor
NewFace
DD-WRT Novice


Joined: 09 Jul 2018
Posts: 23

PostPosted: Mon Jul 09, 2018 17:15    Post subject: Reply with quote
Part#2

Next,
1. Remove the power cord from your bricked 1043ND v1, connect it to the PC running TFTP server with RJ45 cable in any LAN port.

2. Add both 2 sets of IPv4 address/mask to the LAN adapter connecting with 1043ND v1,
192.168.0.66 / 255.255.255.0 (for TFTP)
192.168.1.2 / 255.255.255.0 (for Web UI)

3. Extract "TL-WR1043ND-V1-FW0.0.3-stripped.bin" from TL-WR1043ND-V1-stripped.zip from OpenWRT wiki,
rename it to "wr1043nv1_tp_recovery.bin" (OpenWRT wiki missed the letter "n")

4. Execute TFTP server, point the root path to where "wr1043nv1_tp_recovery.bin" is stored.
Assign its interface to 192.168.0.66 (if necessary).

5. Now hold your bricked 1043ND v1, use a pin, a pen or something press the reset button. Make sure it's triggered firmly & hold it.
Next, connect the power cord to 1043ND v1, within 30 secs, if without any mistake, you will see the TFTP server starting its upload,
meanwhile you may release the reset button.
If it's not working, check the TFTP server log to verify any issue
(except the linking, mostly the reverting FW file name, eg. the missed letter "n", if your follow the steps on OpenWRT wiki. That's why wiki suggests to check the log).
As reference, that's how TFTPD by ph. jounin works for uploading


6. Wait about 2~3 mins, the LED of 1043ND v1 will blink normally as usual,
you may open it Web UI with web browser in the default IPv4 address 192.168.1.1 with the default ID & PW both "admin" to login the reverted factory FW.
Later you may upgrade it with factory-to-ddwrt.bin of any working DD-WRT you want.

Looks complicated? Sorry, that's all my fault.
DIY for couple times, you will find out how it's easy by yourselves.

FYI, in the past months tests, the suitable beta DD-WRT FW for WRT1043ND v1.x,
the final version which can be normally upgraded & downgraded with DD-WRT Web UI, is "09-11-2017-r33345",
since "09-19-2017-r33375" to "06-10-2018-r36104", I can only upgrade it with the TFTP trick & factory-to-ddwrt.bin FW file.
Since "06-16-2018-r36154", the only thing I have after flashing is a boot-loop WRT1043ND v1 Crying or Very sad.
NewFace
DD-WRT Novice


Joined: 09 Jul 2018
Posts: 23

PostPosted: Mon Jul 09, 2018 17:35    Post subject: Reply with quote
Sorry, another issue I forgot to mention.

According to the OpenWRT wiki, it supposes to flash FW in TFTP recovery mode, even the DD-WRT factory-to-ddwrt.bin, just rename it to the fail-safe FW name eg. wr1043nv1_tp_recovery.bin for WRT1043ND v1.x.

But in my experience, it doesn't work for both my WRT1043ND v1.1 & WRT841N v9.1.
I can only revert them back to the factory FWs then use their Web UI to flash newer DD-WRT.

I only suffered FW locked issue for once on WRT841N v9.1, when I upgraded it from 09-19-2017-r33375 to 09-27-2017-r33413.
varocketry
DD-WRT Novice


Joined: 20 Jul 2009
Posts: 3

PostPosted: Wed Jul 25, 2018 17:37    Post subject: Following - bricked my WR1043ND v.1 today Reply with quote
I finally decided to flask my TP-LINK wr1043ND v1 today as I've replaced it some time ago with a UBIQUITI router. My daughter was hoping to take it to grad school for her apartment.

After doing the 30/30/30 reset, I tried flashing the dd-wrt version recommended in the database:

tl-wr1043nd-webflash.bin

After logging into the TP-link device through the ADMIN interface, I uploaded this firmware.

Fail, code 18005

Did 30/30/30 reset again, used a different browser and tried again.

Fail, code 18005

Did 30/30/30 reset again, and then tried the alternate dd-wrt firmware:
factory-to-ddwrt.bin

This appeared to work and was accepted by the router, went through the upload countdown, 0-100%, the the installation countdown/up 0-100%, and after a little while the screen cleared and there was no connectivity to the tplink router. Error messages says media disconnected, no lights on the RJ45 port of my laptop.

The TP-link lights alternately FLASH all lights, dark, then LAN 1-4 and WAN port lights flash on. Just cycles in this state. 30/30/30 reset has no effect.

Manually set the lan adapter setting and CANNOT ping the router - 100% dropped.
IPCONFIG show nothing connected.

It appears to be bricked. SO I'm following this thread.
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 3712
Location: UK, London, just across the river..

PostPosted: Fri Jul 27, 2018 19:28    Post subject: Reply with quote
well if you have read the installation procedures, carefully you would have find that for first flash you start with
factory to ddwrt file first... also 30/30/30 is very bad
way to reset your router its applicable only for the old
linksys WRT routers for any other routers you have to use either the reset button or software reset via GUI menu
and last but very important all the new builds are here
ftp://ftp.dd-wrt.com/betas/ all the routers data base suggestions are very old so ignore them...to find
appropriate and working firmware for your router either read
all the new build threads or ask in atheros forum post a new thread...
do not forget that your router is very old and especially v1 is kind of problematic too...so read read and read...

https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=311642

_________________
Atheros
TP-Link WR740Nv1 ------DD-WRT 44085 BS AP,NAT
TP-Link WR740Nv4 ------DD-WRT 43028 BS WAP/Switch
TP-Link WR1043NDv2 ----DD-WRT 44112 BS AP,NAT,AP Isolation,Firewall,Local DNS,Forced DNS,DoT,VPN
TP-Link WR1043NDv2 ----DD-WRT 44048 BS AP,NAT,AD Block,Firewall,Local DNS,Forced DNS,DoT,VPN
TP-Link WR1043NDv2 ----Gargoyle OS 1.12.0 AP,NAT,QoS,Quotas
Qualcomm/IPQ8065
Netgear R7800 -------DD-WRT 44112 BS AP,NAT,AD-Block,AP&Net Isolation,VLAN's,Firewall,Local DNS,DoT
Broadcom
Netgear R7000 -------DD-WRT 44112 BS AP,Wi-Fi OFF,NAT,AD-Block,Firewall,Local DNS,Forced DNS,DoT,VPN
------------------------------------------------------------------------------------------------
Stubby for DNS over TLS I DNSCrypt v2 by mac913
DooMaster
DD-WRT Novice


Joined: 02 Feb 2013
Posts: 1

PostPosted: Fri Sep 14, 2018 19:43    Post subject: Reply with quote
you save me my mate, i've just brick my device, thanks you.
SirLouen
DD-WRT Novice


Joined: 04 Jan 2013
Posts: 11

PostPosted: Tue Dec 11, 2018 12:37    Post subject: Reply with quote
I have a wr1043ND v1.4 and it doesn't seem to start the TFTP server with the given information. No logs or anything, it just simply does not trigger the TFTP server

I've tried connecting the PC to another network, and uploading the given file from another computer via TFTP protocol and it works perfectly both in and out the server.

I was using previously v24 r2xxxxx ddwrt firmware, but I tried to webupdate to r36330 from
https://dd-wrt.com/support/router-database/?model=WR1043N(D)_1.x

Without the knowledge that this firmware actually bricked the device (I'm wondering who had the great idea to put it in that section...)

Now I believe that my v1.4 router is too old and doesn't have the TFTP method or something?

I post here a video of the loop assuming that this is obviously seem to be a boot loop:
https://photos.app.goo.gl/nfCV4FuSwbv4cTsK7

I'm not sure, but I think I will be required to execute the serial alternative? Crying or Very sad
NewFace
DD-WRT Novice


Joined: 09 Jul 2018
Posts: 23

PostPosted: Tue Dec 11, 2018 14:50    Post subject: Reply with quote
DooMaster wrote:

you save me my mate, i've just brick my device, thanks you.

You are welcome, bro Smile

SirLouen wrote:
Now I believe that my v1.4 router is too old and doesn't have the TFTP method or something?

I post here a video of the loop assuming that this is obviously seem to be a boot loop:
https://photos.app.goo.gl/nfCV4FuSwbv4cTsK7

I'm not sure, but I think I will be required to execute the serial alternative? Crying or Very sad

In my guess, it doesn't relate with your 1043ND version, since even my elder v1.1, the TFTP trick still works.
It's embedded rescue util for all 1043ND v1.x.

Yes, your video clearly display you having a bricked 1043ND, just like I ever had Rolling Eyes

Let's verify something.
1. Do you alter/add the IP address 192.168.0.66/255.255.255.0 to your NIC IPv4 protocol, that links to bricked 1043ND?
(If you use Jounin TFTP, better change its Server Interface to 192.168.0.66)

2. Do you set the PC firewall rule for TFTP passthrough?
(the better way, keep all devices off net & completely close firewall for mins)

3. Above steps has been all set, then press the reset button of 1043ND, don't move.
Next plug-in the power cord to 1043ND, TFTP should work (after TFTP triggered, you may release hand from reset button).

And watch out the name of factory FW to restore!
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 3712
Location: UK, London, just across the river..

PostPosted: Tue Dec 11, 2018 15:25    Post subject: Reply with quote
some routers need a simple switch in between the pc/router to trigger the TFTP try this way, if its not working than it must have a different TFTP procedures... or its that badly bricked and needs a serial or there is a hardware failure, like faulty ram or flash rom...

at the end i don't see any point to spend all day re writing a openWRT post instead just paste a link or youtube video ... but you know better.... Razz

_________________
Atheros
TP-Link WR740Nv1 ------DD-WRT 44085 BS AP,NAT
TP-Link WR740Nv4 ------DD-WRT 43028 BS WAP/Switch
TP-Link WR1043NDv2 ----DD-WRT 44112 BS AP,NAT,AP Isolation,Firewall,Local DNS,Forced DNS,DoT,VPN
TP-Link WR1043NDv2 ----DD-WRT 44048 BS AP,NAT,AD Block,Firewall,Local DNS,Forced DNS,DoT,VPN
TP-Link WR1043NDv2 ----Gargoyle OS 1.12.0 AP,NAT,QoS,Quotas
Qualcomm/IPQ8065
Netgear R7800 -------DD-WRT 44112 BS AP,NAT,AD-Block,AP&Net Isolation,VLAN's,Firewall,Local DNS,DoT
Broadcom
Netgear R7000 -------DD-WRT 44112 BS AP,Wi-Fi OFF,NAT,AD-Block,Firewall,Local DNS,Forced DNS,DoT,VPN
------------------------------------------------------------------------------------------------
Stubby for DNS over TLS I DNSCrypt v2 by mac913
SirLouen
DD-WRT Novice


Joined: 04 Jan 2013
Posts: 11

PostPosted: Wed Dec 12, 2018 11:03    Post subject: Reply with quote
NewFace wrote:

1. Do you alter/add the IP address 192.168.0.66/255.255.255.0 to your NIC IPv4 protocol, that links to bricked 1043ND?
(If you use Jounin TFTP, better change its Server Interface to 192.168.0.66)


Yes, I set it to that interface.

NewFace wrote:

2. Do you set the PC firewall rule for TFTP passthrough?
(the better way, keep all devices off net & completely close firewall for mins)


Yes, you have to remember, that I just used the TFTP as a client from a different computer, so tftp is working fine.

NewFace wrote:

3. Above steps has been all set, then press the reset button of 1043ND, don't move.
Next plug-in the power cord to 1043ND, TFTP should work (after TFTP triggered, you may release hand from reset button).


The interface activates and deactivates everytime it loops with a 169.X address (I know this because I was able to ipconfig in the exact milisecond once it was reestablished!)

The most interesting part is that the interface changes to 127.0.0.1 in jounin TFTP everytime the router loops. I put it back to 192.168.0.66 but it goes back to 127.0.0.1 again...

Reset button doesn't do anything, it just reboots always the same way with the reset button pressesed or not... today I wil be trying to solder some pins and all that Sad

NewFace wrote:

And watch out the name of factory FW to restore!


Yes, I used the wr1043nv1_tp_recovery.bin file name... there are no logs or anything trying to upload anything at all.

Test 2:

I've tested in a second computer, disabled all interfaced except for the network ethernet interface with the 192.168.0.66/255.255.255.0 assignment.

Nothing Sad

Maybe the router is full bricked... today I will be soldering.
NewFace
DD-WRT Novice


Joined: 09 Jul 2018
Posts: 23

PostPosted: Wed Dec 12, 2018 12:47    Post subject: Reply with quote
SirLouen wrote:
The interface activates and deactivates everytime it loops with a 169.X address (I know this because I was able to ipconfig in the exact milisecond once it was reestablished!)

The most interesting part is that the interface changes to 127.0.0.1 in jounin TFTP everytime the router loops. I put it back to 192.168.0.66 but it goes back to 127.0.0.1 again...

Reset button doesn't do anything, it just reboots always the same way with the reset button pressesed or not... today I wil be trying to solder some pins and all that Sad

I have never noticed those address regarding 169.x in ipconfig (maybe I just focus on pressing reset button & watching the TFTP Wink I even never run the ipconfig) --
even the TFTP address I learned it from Openwrt wiki.
I just follow the rescue steps on Openwrt wiki,
power off 1043ND
connect it to PC & set the IP address for TFTP,
make sure everything has been ready,
keep pressing the reset button then connect the power cord to 1043ND,
let it do the rest in the final.

& the TFTP interface IP has been never changed to 127.0.0.1 by itself in my case.
Do you have the last version of jounin TFTP?
http://tftpd32.jounin.net/tftpd32_download.html
or force binding it with 192.168.0.66 in setting

SirLouen wrote:

Maybe the router is full bricked... today I will be soldering.

I think this old dog is hard to be completely killed, even I ever tried to flash it in SSH but completely failed -- that's why I found out the TFTP trick, since I had a bricked 1034ND but had no any TTL cable to save it.
I am dumb but this old dog is tough, have your try, you may save it Smile
SirLouen
DD-WRT Novice


Joined: 04 Jan 2013
Posts: 11

PostPosted: Wed Dec 12, 2018 22:14    Post subject: Reply with quote
Finally I've soldered and thanks to this tutorial is back
https://www.youtube.com/watch?v=IHNrnLnLakE

I have to say that this guy also made a arduino uno tutorial, and this saved me buying the dongle (is not expensive, but the time and everything considering I already had the arduino).

Now I will be restoring everyhing... I have to double check which firmware is the most adequate ATM.

BTW I'm the worst at soldering Laughing but I managed to do this



Here we go:
https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2018/06-10-2018-r36104/tplink_tl-wr1043nd/



Very Happy
Pack
DD-WRT Novice


Joined: 17 Jan 2019
Posts: 3

PostPosted: Thu Jan 17, 2019 17:29    Post subject: Reply with quote
I have WR1043ND 1.8 and read all wiki steps.

Flashed the current factory to DD-WRT (https://dd-wrt.com/support/router-database/?model=WR1043N(D)_1.x) after doing 30/30/30 and only being connected to the router through LAN cable, firewall disabled.
Guess what? At some point the router disconnected LAN and from that on I only had the light show going on, with LAN interface on PC showing disconnected-connected loop (with "connected" just showing up less than a second).
Found this thread, having the same light show as in the video from fellow member.

So I gave TFTP a try... but failed. Nothing in the log. Assigned 192.168.0.66 to it (same as network card), nothing.

I must say I am shocked that I am not the only one who straight ran into brick even reading and double checking everything in the wiki!
NewFace
DD-WRT Novice


Joined: 09 Jul 2018
Posts: 23

PostPosted: Sat Jan 19, 2019 20:38    Post subject: Reply with quote
Pack wrote:
So I gave TFTP a try... but failed. Nothing in the log. Assigned 192.168.0.66 to it (same as network card), nothing.

I must say I am shocked that I am not the only one who straight ran into brick even reading and double checking everything in the wiki!

Hi Pack,
did you press the reset button firmly before connecting the power cord to 1043? Keeping pressing after power on, even so, nothing in log?
Pack
DD-WRT Novice


Joined: 17 Jan 2019
Posts: 3

PostPosted: Sun Jan 20, 2019 8:50    Post subject: Reply with quote
Thanks for the reply.

Yes I pressed it before powering up... did try it several times... nothing in the log Sad
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Atheros WiSOC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum