Hidden TFTP of TP-Link routers

I did some more investigation after the positive results with the TL-WR740Nv4 (click the link to get introduced to the way of recovery). Most users report that devices and firmware updates released after a point in time usually have this mode enabled. If a firmware update is available from the vendor for your device, it's a good idea to apply that update before installing OpenWRT or dd-wrt UNLESS you own something for which upgrading will ensure incompatible with OpenWrt, like a TL-WR730N, and possible some other models (please report). Note that some old models have newer updates in different languages, those may also be worth a try (TODO: compatibility?). Also remember that later on, tftp recovery will need a type of firmware image without a boot loader, so strip it with dd if yours has it (grep U-Boot, or check the filename).

Positive reported claims so far (personal results highlighted):
  • TL-WDR4300 router 192.168.0.86 server 192.168.0.66 query wdr4300v1_tp_recovery.bin from wdr4300v1_ru_3_13_23_up(130506).bin, TL-WDR4300_V1_130617.zip
  • TL-WDR3600 router 192.168.0.86 server 192.168.0.66 query wdr3600v1_tp_recovery.bin from TL-WDR3600_V1_130527_RU.zip
  • TL-WR841ND_V8_130620_RU.rar 192.168.0.66 query mr3420v2_tp_recovery.bin
  • TL-WR841N v8.3 (unbricked by serial) needs latest to support TFTP by reset: TL-WR841N_V8_140724.zip
  • TL-MR3020 router 192.168.0.86 server 192.168.0.66 query mr3020v1_tp_recovery.bin from TL-MR3020_V1_130507_RU, TL-MR3020_V1_140610, TL-MR3020_V1_140408
  • TL-WR740Nv4 router 192.168.0.86 server 192.168.0.66 query wr740v4_tp_recovery.bin from TL-WR740N_V4_130529.zip (wr740nv4_en_3_16_6_up_boot(130529).bin Rel.62825n) TL-WR740N_V4_140520.zip (wr740nv4_en_3_17_0_up_boot(140520).bin Rel.75075n) (confirmed by majlin), wr740nv4_en_3_17_0_up_boot(150105).bin (confirmed by Christian)
  • TL-WR741ND_V4.20_140410
  • TL-WR842ND v1.1 router 192.168.1.86 server 192.168.1.66 query wr842ndv1_tp_recovery.bin from TL-WR842ND_V1_130322.ZIP (wr842ndv1_en_3_12_25_up_boot(130322).bin) (some report versions before 2012-08-27?) note that tftp does not accept OpenWRT, only OEM firmware!
  • TL-WR1043ND v1.11 3.13.5 Build 140319 Rel41339n wr1043nv1_en_3_13_15_up_boot(140319).bin U-Boot 1.1.4 (Mar 19 2014 - 11:06:29)
  • ? TL-MR3220v2 query mr3220v2_tp_recovery.bin from TL-MR3220_V2_130607_RU.zip
  • ? TL-MR3420v2
  • TL-WR940Nv2 needs latest to support (verified on 3.16.9 Build 150311 Rel.62186n), router 192.168.0.86, server 192.168.0.66, query wr941ndv5_tp_recovery.bin
  • ? TL-WR941NDv5 - should work exactly the same as for TL-WR940Nv2 because it has the same board
  • ? TL-WR1042NDv1 router 192.168.1.86 server 192.168.1.66 query wr1042nv1_tp_recovery.bin
  • ? any TP-Link with firmware (or update) after date XXX TODO (about March of 2013)

Negative reports (personal results highlighted):
  • TL-WR740Nv4 3.12.11 Build 120320 Rel.51047n (works after update)
  • TL-WR740Nv4 3.16.5 Build 130329 Rel.62825n (confirmed by majlin, works after update))
  • TL-MR3420v1 3.11.11 Build 101104 Rel.70817n, TODO try updates
  • TL-WR940v2 3.14.5 Build 130709 Rel.36000n (works after update)
  • ? TODO: TL-MR3040
  • ? TODO: TL-WR741NDv2
  • ? TODO: TL-WR743NDv1
  • ? TODO: TL-WR841Nv5
  • ? TODO: TL-WR841Nv7
  • ? TODO: TL-WR941Nv3
  • ? TODO: TL-WR2543ND_V1_121207


Sources:
This post is work in progress and I plan to eventually migrate it to a new page on the OpenWRT wiki. Stay tuned! TODO

Comments

  1. ChristianJanuary 30, 2015 at 6:07 PM

    Hi,

    You mention that the latest (tftp enabled) firmware for the WR1043ND is incompatible with OpenWRT. Following the thread in the OpenWRT forum, I can only find references to the WR703N device not accepting non TP-LINK firmware images.

    Because I would like to harden my WR1043NDv1 with an old uboot version against bricks (I already failed hilariously on other devices :D), a tftp enabled uboot without the need for soldering would be perfect.

    Searching the OpenWRT forums, searching google and looking at your lists, I cannot find any information regarding the WR1043ND firmwares not accepting OpenWRT images.

    Did you test the WR1043ND yourself or where is this information comming from?

    Thanks
    Christian

    ReplyDelete
  2. bkilJanuary 30, 2015 at 6:35 PM

    Dear Christian,

    If the linked forum does not contain the reference, I may have assimilated the information from the OpenWRT wiki page about the device:
    http://wiki.openwrt.org/toh/tp-link/tl-wr1043nd#warningsgotchas

    Which hardware revision are you using, v1 or v2? I have no information on the validity of that claim or the exact u-boot versions causing an issue, as there aren't enough people updating the wiki, and I haven't personally ran into such a device yet. Perhaps you could do some targeted web search about experience with exact firmware revisions and build numbers. All three revisions of the currently linked OEM updates should (might) support tftp updates, but it is very easy to test them. Then just it's a matter of searching for confirmation on which one is supported by OpenWRT. If you can't find anything, you may also consider an OpenWRT side patch. Anyhow, don't take my word on it, but after updating to one that definitely supports tftp, you might just as well try to install OpenWRT yourself and see which one doesn't brick the router. The advantage of tftp recovery...

    Feel free to share your experience if you find anything. Or please tell me if there exist other models for which u-boot updates could kill OpenWRT, so we can a place a word of warning here about them too.

    I myself am in the process of gathering new devices. My fleet is already in the dozens. I already have specimens of 740, 741, 840, 841, 842, 941, 2543ND, MR3020, 3220, 3420 and perhaps some others I forgot to list. Unfortunately, I have no specimen of 1043ND yet, but I'm working on the issue. For example, the 842ND had tftp u-boot updates, however no update is available to the 2543ND. I'm considering to build its OEM firmware from scratch and patch the u-boot source myself, though I wouldn't like to start by messing up this beauty. I am also considering to risk cross-flashing some models with Chinese firmware, as those are newer in many cases. I will report back when I have results.

    Best regards,
    bkil

    ReplyDelete
  3. ChristianJanuary 31, 2015 at 11:25 AM

    Hi,

    I guess you are referring to the "WAN port disabled" bug which affected the WR1043ND v1 and seems to be fixed regarding the bug tracker. I did not encounter this bug on my v1.11 model on different uboot versions with 12.09 and 14.07. The Wiki can be confusing...

    Anyway, today I tested a WR740N v4.21 and a WR1043ND v1.11. Both had old uboot versions from 2012 without the tftp feature. At least I did not see any traffic with tcpdump.

    So I took a leap of faith and updated both devices with the latest stock firmwares and uboot:
    WR740N v4.21: wr740nv4_en_3_17_0_up_boot(150105).bin
    WR1043ND v1.11: wr1043nv1_en_3_13_15_up_boot(140319).bin

    Shown versions after the updates on the stock web interface:
    WR740N: 3.17.0 Build 150105 Rel.61576n
    WR1043ND: 3.13.5 Build 140319 Rel41339n

    uboot versions after the updates:
    WR740N: U-Boot 1.1.4 (Jan 5 2015 - 17:01:20)
    WR1043ND: U-Boot 1.1.4 (Mar 19 2014 - 11:06:29)

    I had no problems flashing stock firmwares and OpenWRT images back and forth on both devices. So the bug/feature from the WR703N firmware, which does not allow OpenWRT images being flashed over the stock web interface does not affect the WR1043ND.

    After the updates, both devices have a tftp enabled uboot now :). I have not tested tftp itself, but I assume the feature is there. I saw bootp, ARP requests and both IP addresses .66 and .86 in tcpdump.
    Interestingly bootp and ARP requests on the WR740N, but only ARP requests on the WR1043ND.

    No more soldering required, if I mess up an OpenWRT image (again) :)

    Greetings
    Christian

    ReplyDelete
    Replies
    1. bkilJanuary 31, 2015 at 4:41 PM

      Glad to hear about your success. Thank you for your data point. Happy hacking!

      By the way, it's also good that you pointed out that updated firmware is available. Although, I think I won't be reflashing the dozens of already installed devices just for this new u-boot. I'll have a look whether they have even updated that part since last May.

      Delete
  4. AnonymousAugust 26, 2015 at 8:32 PM

    TP-Link TL-WR841ND v8.2 won't work.

    ReplyDelete
    Replies
    1. bkilAugust 27, 2015 at 12:19 AM

      From the top of my head, I have specimens of TL-WR831N 2*8.2, 8.3, 2*8.4 which work flawlessly. I have installed Barrier Breaker on each one of them using reset+tftp.

      Note that on the oldest models, I had firmware from 2012 which I had upgraded to May 2013 before proceeding. If your u-boot is not recent, you will need to proceed with the next method in line: serial, JTAG or SPI soldering, whichever yields first.

      If in doubt, it would be great if you could open a thread a thttp://forum.openwrt.org in the hardware section, link your thread here and we will try to help you recover. For example, see: http://forum.openwrt.org/viewtopic.php?id=45567 "TP-Link TL-WR841N v8.4 Bricked" Describe what you have done in detail there so we can see the issue more clearly.

      Delete
    2. bkilAugust 27, 2015 at 12:22 AM

      Correction: I've consulted my notes and the first firmware which did support tftp on reset on that model may be 3.15.9 Build 140724 Rel.63227n. Or at least that's the one which I install on each new one

      Delete
    3. AnonymousAugust 27, 2015 at 1:41 PM

      I was buying today TP-Link MR3220 v2.2, and upgrade to newer official firmware. (TL-MR3220_V2_140929) , and see that 192.168.0.66 on WAN port working (in wireshark i see what want - mr3220v2_tp_recovery.bin)..... But I must upload OpenWRT... so what need I do, to keep bootloader with tftp client? For bricked WR841ND i wait USB <-> TTL...

      Delete
    4. AnonymousAugust 27, 2015 at 6:26 PM

      All is OK with OpenWRT on this router (TP-Link MR3220 v2.2) :) TFTP client in boot loader still exists :) ....

      Delete
    5. bkilAugust 29, 2015 at 2:33 PM

      I'm glad to hear that! Yes, as you have found out: an OpenWrt upgrade keeps the smart boot loader in place.

      I hope you're having fun with your new gadgets! :) You can find some cool use cases especially for USB ones.

      Over here, the MR3220 v2 and MR3420 v2 cost a lot, so I only have some of the dumb v1 ones. C'est la vie.

      Delete
    6. AnonymousSeptember 11, 2015 at 9:12 PM

      My bricked TP-Link TL-WR841ND v8.2 is again in life :D With USB <--> TTL adapter, some wires without soldering, SW - Realterm, send command to OpenWRT to remove some package :D But i upgrade now (before stripped official firmware), just in case - wr841nv8_en_3_15_9_up_boot(140724).bin, and TFTP client workin and send request on 192.168.0.66 for wr841nv8_tp_recovery.bin ..

      Delete
    7. bkilSeptember 16, 2015 at 10:28 PM

      Very good! Did you use Barrier Breaker or Chaos Calmer? I'm considering upgrading if you have good experience.

      Delete
    8. AnonymousSeptember 20, 2015 at 12:39 AM

      Barrier Breaker. Chaos Ch. haven't enought space for web admin - Luci.

      Delete
    9. bkilSeptember 20, 2015 at 12:46 AM

      What do you mean by not enough space? CC final has been released just last week. All release images should include Luci by default. The CC I had installed on a TL-WR741ND v4 definitely has one out of the box.
      https://downloads.openwrt.org/chaos_calmer/15.05/ar71xx/generic/

      Delete
    10. AnonymousSeptember 20, 2015 at 12:14 PM

      I'm not sure now.. but i tested before one month ... CC was without Luci and image was about 3.4MB .. For my testing purpose and my module in C , BB is good :)

      Delete
    11. AnonymousSeptember 20, 2015 at 12:17 PM

      I forgot tell - sysupgrade image for WR841ND v8.2, before bricking... But BB is good for my job.. for now :)

      Delete
  5. UnknownSeptember 16, 2015 at 9:06 AM

    This comment has been removed by a blog administrator.

    ReplyDelete
  6. Sophia MillerApril 29, 2021 at 2:16 PM

    Nice Blog Post thanks for sharing it.

    tp link guest wifi
    TP-Link Support Australia

    ReplyDelete
  7. OliacacMter_muApril 25, 2022 at 10:51 PM

    OliacacMter_mu Andrew Payne https://wakelet.com/wake/ISUs3_mpMxdYp3lRfm2KP
    reaurakopart

    ReplyDelete
  8. tranermons_su_1998August 26, 2022 at 11:11 PM

    aredOvenchi Mike Flynn EaseUS Data Recovery Wizard
    Internet Download Manager
    Disk Drill
    roepesigod

    ReplyDelete
  9. AnonymousAugust 23, 2023 at 9:00 PM

    In my case for TL-WR743ND v2 TFTP server (your PC) address was 192.168.1.100 instead of 192.168.1.66.

    ReplyDelete

Post a Comment

Popular posts from this blog

Tftp secret of TL-WR740N uncovered

I've found out that even this particular entry level router supports anti-bricking, so there's no need for soldering, unless of course you are modding. The method I used is the following: Set up a tftp server  on your PC and verify if it works correctly (configuration, permissions, firewalls, etc.) Rename your target firmware to wr740v4_tp_recovery.bin and copy it to your base folder (by default /tftpboot). I tested with openwrt-ar71xx-generic-tl-wr740n-v4-squashfs-factory.bin r43602. Set up the following static IP for your PC: 192.168.0.66 /255.255.255.0. If you're not sure about the firmware name on a different model, start a packet sniffer on your PC ( tcpdump -i eth0 -n -l ) and look for the name in the RRQ message. Preferably disconnect WAN from the router Connect the PC to a LAN port Power off the router Press and hold the reset button Power on the router After the leftmost (power) LED and the rightmost (padlock) LED turn on alone in a few seconds, release
Read more

When both Google *and* AppStatus is down

Here is a link where you could theoretically monitor Google outages: https://www.google.com/appsstatus#hl=en&v=status I had a problem with Google services just recently. However, as I wanted to verify whether the problem is on my side, this monitoring site was down as well. At the same time, the third party reports on alternative sites started to grow: http://outage.report/google http://downdetector.com/status/google http://aussieoutages.com/status/google This highlights why we should not put all our eggs into the same basket.
Read more