Tuesday, April 16, 2013

How to unbrick tp-link tl wr1043nd


Sau khi cài Gargoyle 1.5.9 , mình thấy nó ko ổn nên đã cố gắng cài lại dd-wrt nhưng không được, màn hình upgrade firmware cứ chạy (quay vòng) mãi. Sau đó mình thử flash lại stock firmware nhưng cũng không được. Cuối cùng, mình flash lại Gargoyle 1.4.7 sau khi máy tự reboot thì không vào được web admin, ko ping được router. Kiểm tra đèn led thì power led sáng, sys led tắt, các led 1,2,3,4 đều bình thường, kết luận là có khả năng bị bricked

Sau một hồi tìm kiếm cách restore lại trên mạng thì:

1/ Nếu có thể ping router 192.168.1.1, có thể telnet, nếu đang dùng openwrt thì làm theo hướng dẫn này vì nó sử dụng sysupgrade:

--------------------------------
link nguồn: http://forums.whirlpool.net.au/forum-replies.cfm?t=1583722&#r13

For the sake of completeness and other users, I've posted the procedure I used below:
1) Download and install small http server: http://home.lanck.net/mf/srv/index.htm
2) Download the sysupgrade binary at * below
3) Copy the file downloaded in 2) to the default directory created when you installed 1) above.
Set your computer with static address 192.168.1.9 and subnet mask 255.255.255.0
Unplug the wr1043nd power cable. Plug the power cable back in and repeatedly tap the QSS button on the right like crazy for about 30 seconds.
Have your computer connected to a LAN port of the wr1043nd. Then ping it with this command:
ping 192.168.1.1
If it responds, we’re good to go
Since your wr1043nd already runs Gargoyle which is Openwrt underneath, it's easier to upgrade the firmware using the openwrt command sysupgrade and the sysupgrade firmware. There's no need for command mtd.
http://downloads.openwrt.org/backfire/10.03.1-rc4/ar71xx/openwrt-ar71xx-tl-wr1043nd-v1-squashfs-sysupgrade.bin
To get this file to the router you need to telnet to the router:
telnet 192.168.1.1
then you enter
cd /tmp
To get the file into this directory enter:
wget http://192.168.1.9/openwrt-ar71xx-tl-wr1043nd-v1-squashfs-sysupgrade.bin
then, we’re ready to upgrade
#go to /tmp directory
cd /tmp
#check firmware file integrity
md5sum openwrt-ar71xx-tl-wr1043nd-v1-squashfs-sysupgrade.bin
#use sysupgrade to flash sysupgrade image. it's one line
sysupgrade -n openwrt-ar71xx-tl-wr1043nd-v1-squashfs-sysupgrade.bin
Wait a few minutes. If successful, the wr1043nd will reboot and become openwrt with default IP number 192.168.1.1.
If it doesn’t reboot, wait a few more minutes and repower the router, it should then allow access.


2/ Nếu có thể ping router 192.168.1.1, có thể telnet, thì làm theo:

--------------------------------
link nguồn: http://samiux.blogspot.com/2010/03/howto-dd-wrt-on-tp-link-tl-wr1043nd.html

chú ý: lệnh mtd có thể làm trầm trọng vấn đề hơn (có 1 thằng bị bricked khi dùng mtd ở wiki.dd-wrt, hắn viết là: mtd erase linux (This bricked my Buffalo WHR-HP-GN!  Don't do mtd erase linux!)

Flash back to factory firmware

Download the modified factory firmware at here. Extract and save it to a USB stick. Insert the USB stick to the USB port of the router.

Telnet to the router. Make sure the USB stick is connected and mounted.

mtd -e linux -r write /mnt/<firmwarefilename.bin> linux

The screen will display :

root@ router_name:/tmp# mtd -e linux -r write /mnt/0x20200.bin linux
Unlocking linux ...
Erasing linux ...
Writing from /mnt/0x20200.bin to linux ... [w], which the [w] will change between [w] and [e]

After a few minutes, the following is shown :

Connection to host lost.

After these steps, the router will be flashed back to factory firmware.

3/ Chuẩn bị mua đồ hàn xì & tháo máy ra tự sửa bằng serial cable... và đọc tài liệu ở mục cuối cùng, số 4

--------------------------------
link nguồn: https://blog.elsbrock.de/2012-01/unbricking-a-tp-link-tl-wr1043nd.html
So, here's how to unbrick the device.

Because the device was not accessible anymore, the only way to unbrick is via the serial port. In order to do that, you need to disassemble the device. This was pretty much straightforward: First, remove two screws at the bottom (under the back rubber feets). Then, unscrew the antenna connectors and push them into the housing. Afterwards, you can gently start removing the plastic parts (it may be a bit tricky). I recommend having a look at the OpenWrt article.

Once the device has been disassembled, you'll need to attach a pin header to the PCB. Have a look at this picture to see which pins are used. Before soldering, make sure you've ground your body, because the board is quite susceptible to static electricity. It may be difficult to unsolder the pin holes; using a high temperature (about 450°C) in combination with a desoldering pump should help.

Now it's time to check if you get a serial connection. Connect a serial adapter to your computer and the breakout pins and make sure you've twisted RX and TX, otherwise you'll probably get no output at all. I used screen to connect to the device. The baud rate to be used is 115200. If it works, you'll get some output on the terminal once the device has been powered up:

U-Boot 1.1.4 (Feb  1 2010 - 10:11:24)

AP83 (ar9100) U-boot 0.0.11
DRAM:
sri
32 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7100_enet_initialize...
No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Autobooting in 1 seconds
There are a few things to do now in order to flash the new image. First of all, you'll need a tftp server to transfer it to the device. I used the tftpd-hpa available in the Debian repositories. You can set it up with dpkg-reconfigure -plow tftpd-hpa. Download the stock firmware (or whichever firmware you want to flash) and put it into your tftp server root as code.bin.

Second, you'll need to connect your computer via Ethernet to one of the LAN ports of the router and set the IP of your ethernet device to 192.168.0.x (e.g. ip address add 192.168.0.5 dev eth0).

Now you need to be quick. As soon as the output shows "Autobooting in 1 seconds", type in tpl to get a prompt. Then, delete the current (broken) firmware:

ar7100> erase 0xbf020000 +7c0000
First 0x2 last 0x7d sector size 0x10000 125
Erased 124 sectors
Get the new firmware from your tftp server:

ar7100> tftpboot 0x81000000 code.bin
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.0.5; our IP address is 192.168.0.2
Filename 'code.bin'.
Load address: 0x81000000
Loading: #################################################################
         [...]
done
Bytes transferred = 8126464 (7c0000 hex)
This is looking good. Flash the received image to the flash and boot it:

ar7100> cp.b 0x81000000 0xbf020000 0x7c0000
Copy to Flash... write addr: bf020000
done
ar7100> bootm 0xbf020000
## Booting image at bf020000 ...
   Uncompressing Kernel Image ... OK

Starting kernel ...

Linux version 2.6.15--LSDK-6.1.1.40 gcc version 3.4.4 #1 Wed Feb 23 19:36:45 CST 2011
And you're done! Pretty easy, wasn't it?

4/ Đọc thêm tài liệu, 

--------------------------------
OpenWrt Debricking Guide - http://wiki.openwrt.org/doc/howto/generic.debrick
Recover From A Bad Flash - http://www.dd-wrt.com/wiki/index.php/Recover_from_a_Bad_Flash
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=68793&postdays=0&postorder=asc&start=0
http://klseet.com/index.php/tl-wr1043nd-ver18/reset-failsafe-revert-to-factory
stock firmware for wr1043nd : http://www.tp-link.com/en/support/download/?model=TL-WR1043ND&version=V1#tbl_j

No comments:

Post a Comment