Bricked TpLink WDR4300 router advice and question

[CapLeaker]

Re: Bricked TpLink WDR4300 router advice and question

So you can't stop the auto boot with "tpl" then enter key, right when it sez auto booting? If you can't make it stop then forget about anything else on the command line. I could make mine stop, then cleared NVRAM and it rebooted with whatever it still had loaded in the recovery. I have to admit, it does take a few tries. Mine didn't do it the first 2 tries either.

[stj]

Re: Bricked TpLink WDR4300 router advice and question

LEDA is the newest custom router firmware.
https://lede-project.org/

try these:
https://downloads.lede-project.org/r...fs-factory.bin

https://downloads.lede-project.org/r...fs-factory.bin

[Dannyx]

Re: Bricked TpLink WDR4300 router advice and question

It is for us tech geeks Any sane human being would just chuck most of the stuff we're struggling with straight in the trash

[jondoe]

Re: Bricked TpLink WDR4300 router advice and question

it's about messing around and keeping myself entertained

The best reason of all!

[Dannyx]

Re: Bricked TpLink WDR4300 router advice and question

While I'm waiting for my spare SPI chips to arrive, I though I'd already remove the existing one just to see what's on it without actually altering it, so I did that with my programmer and got some random gibberish (which is what hex is actually like, so no surprises there) that didn't seem to be of any particular interest, however, upon searching for WDR4300 flash SPI, I came across this very old forum thread where a chap who seems to know a few things describes how you can modify the bin file so the router accepts it: it involves opening up it in a HEX editor and chopping out some of it, so I downloaded the oldest firmware file from TP-link and opened that up in a hex editor just to see what's SUPPOSED to happen, but couldn't quite follow what those guys talked about to the letter, because my code looked different in the end, so I tried out the NEXT oldest firmware which has the word "boot" in the filename and sure enough this time the end result looked like what it's supposed to: removing the first part of the code, DOES make it start with 10 00 00 FF, which didn't happen with the first firmware (the one without "boot" in it). The Open-WRT page STJ linked to also talks about this briefly towards the middle where it discusses reverting back to a stock firmware.

I now have two BIN files ready to try out: the unmodified firmware and the one I hacked from the second-oldest firmware with "boot" in the filename....

True, it's not about time or money at this point, it's about messing around and keeping myself entertained

[jondoe]

Re: Bricked TpLink WDR4300 router advice and question

I've had some routers that are fussy, Puttys out-of-the-box default config wouldn't work but I could read serial output, but not interact in anyway.

If memory serves me, you can send a BREAK from puttys special commands menu as well as Ctrl-C. If the keyboard version doesn't work but the special menu command does, its a sign that it might not accepting keyboard input correctly.

[Dannyx]

Re: Bricked TpLink WDR4300 router advice and question

Have you tried a differed terminal emulator? I've found that some devices don't like the default settings, or, the software I'm using to talk to them over serial.

At this point I'd be suggest to the customer they replace the router and you play with this on your own time

What else would work for this other than putty ? Windows' hyperterminal should do the job, but I don't have an XP machine readily available - I'm on win 7/10 on my machines My guess is that the serial interface is fine since it APPEARS to be working properly...others have said they just get random incoherent gibberish in their serial monitor which would indicate a connection issue, whereas mine works perfectly (again, or so it seems)...

[jondoe]

Re: Bricked TpLink WDR4300 router advice and question

That's just it: I CAN'T stop the boot process, not matter what I hit. Tutorials talk about typing TPL and spamming the heck out of it until it stops, but like I said that doesn't work. It's occasionally asking for a password but says invalid login no matter what I try. Can't enter TFPT mode either because the button doesn't seem to do anything: I'd press it then apply power while still holding it, but the serial monitor just displays the same sequence again and keeps on looping...

Have you tried a differed terminal emulator? I've found that some devices don't like the default settings, or, the software I'm using to talk to them over serial.

At this point I'd be suggest to the customer they replace the router and you play with this on your own time

[Dannyx]

Re: Bricked TpLink WDR4300 router advice and question

LEDA firmware

Small question, what IS a LEDA ?

[Dannyx]

Re: Bricked TpLink WDR4300 router advice and question

Changing the caps didn't change anything - still goes through the same sequence and ends in "restarting system". I didn't change the small one near the power switch though, because that's for the USB ports and we don't really care about that ATM...looks like I'll have to pull out that chip and write it manually. Hope this works...

[stj]

Re: Bricked TpLink WDR4300 router advice and question

not true, you can put the loader and LEDA firmware on it.

[Dannyx]

Re: Bricked TpLink WDR4300 router advice and question

Towards the bottom of that page, there IS something mentioned about doing it "the hard way" by removing the SPI chip and programming it, though from what I gather this is useless in my case because that only affects the bootloader and my bootloader is ok, so I can't put the firmware file on that chip....again, just a hunch...

[Dannyx]

Re: Bricked TpLink WDR4300 router advice and question

I noticed another thing: when it worked the first time around, a successful boot should stop at the last "check success" message in that log I posted, so it's almost up and running, but for some reason now it decides to keep on going past that, saying "Now flash open" and reading and writing for some reason...

[Dannyx]

Re: Bricked TpLink WDR4300 router advice and question

read all the way down the link i posted - there is a bit about flashing over the serial link.

I did that, but can't get to the autobooting in 1 second part (which is also where I'd have to type that TPL the guy mentions in the video)...perhaps because I need to plug in the serial connector at a certain time ? I noticed it's saying something about plugging it in BEFORE and AFTER a specific event...

[stj]

Re: Bricked TpLink WDR4300 router advice and question

read all the way down the link i posted - there is a bit about flashing over the serial link.

[Dannyx]

Re: Bricked TpLink WDR4300 router advice and question

Often the boot sequence can be escaped, that is, you can press a key/combination of keys to escape the process thus allowing you to interact with the bootloader. Or, you can invoke a TFTP boot process, making the device boot from the LAN, allowing it to load up then you can reflash it via it's web interface.

You could also put OpenWRT on it, see if it functions as expected, then re-flash it back to stock firmware. https://wiki.openwrt.org/toh/tp-link/tl-wdr4300 This page also covers TFTP loading.

That's just it: I CAN'T stop the boot process, not matter what I hit. Tutorials talk about typing TPL and spamming the heck out of it until it stops, but like I said that doesn't work. It's occasionally asking for a password but says invalid login no matter what I try. Can't enter TFPT mode either because the button doesn't seem to do anything: I'd press it then apply power while still holding it, but the serial monitor just displays the same sequence again and keeps on looping...

[Dannyx]

Re: Bricked TpLink WDR4300 router advice and question

there are only 6 caps - replace the 4 smaller ones.

https://wiki.openwrt.org/toh/tp-link/tl-wdr4300

Flashing via TFTP

Pressing the WPS/Reset button during powerup makes the bootstrap loader enter the TFTP recovery mode. The procedure can be used to transfer a firmware image:
assign 192.168.0.66 to your local network interface (the router uses 192.168.0.86)
publish a firmware image via tftp: cp openwrt-ar71xx-generic-tl-wdr4300-v1-squashfs-factory.bin /srv/tftp/wdr4300v1_tp_recovery.bin
configure your tftp server
wait for the firmware transfer (about 20s), firmware flash (about 90s) and subsequent reboot (about 30s)

I read about the reset button trick but couldn't do it: I'd hold it in, apply power but the router just goes through the sequence I posted in that word document - no difference whatsoever....either I'm doing something wrong or something else is toast. I reckon when you do the reset button thing, the serial monitor should display something like "waiting for file X.bin" (ok, maybe not like that, but the sequence should change to something indicating it's waiting for a bin file via TFPT - that's how I've seen others doing it).

[stj]

Re: Bricked TpLink WDR4300 router advice and question

there are only 6 caps - replace the 4 smaller ones.

https://wiki.openwrt.org/toh/tp-link/tl-wdr4300

Flashing via TFTP

Pressing the WPS/Reset button during powerup makes the bootstrap loader enter the TFTP recovery mode. The procedure can be used to transfer a firmware image:
assign 192.168.0.66 to your local network interface (the router uses 192.168.0.86)
publish a firmware image via tftp: cp openwrt-ar71xx-generic-tl-wdr4300-v1-squashfs-factory.bin /srv/tftp/wdr4300v1_tp_recovery.bin
configure your tftp server
wait for the firmware transfer (about 20s), firmware flash (about 90s) and subsequent reboot (about 30s)

[jondoe]

Re: Bricked TpLink WDR4300 router advice and question

Often the boot sequence can be escaped, that is, you can press a key/combination of keys to escape the process thus allowing you to interact with the bootloader. Or, you can invoke a TFTP boot process, making the device boot from the LAN, allowing it to load up then you can reflash it via it's web interface.

You could also put OpenWRT on it, see if it functions as expected, then re-flash it back to stock firmware. https://wiki.openwrt.org/toh/tp-link/tl-wdr4300 This page also covers TFTP loading.

[Dannyx]

Re: Bricked TpLink WDR4300 router advice and question

You're saying the booloader is OK because the router "boots" and does some stuff ? I'm not a master programmer so I have virtually no idea how it works, except a very basic one so this is also a good learning experience. How can I flash something if the router doesn't stop looping ? It won't accept anything I type into it, even if I spam TPL TPL TPL, it just says "password" and if I happen to type TPL at that point it says invalid login and keeps on going with its sequence - there's no stopping it. One problem I see with writing a blank SPI chip and installing it in place of the one already on the router is the MAC addresses will no longer match (at least with the very brief knowledge that I've got)...don't know if that's the case or those parameters are stored someplace else and won't be affected. Not entirely sure if it will work at all, obviously. The software I use to flash SPI chips for TVs seems to open the firmware file just fine, but whether that's actually the file that resides ON that SOIC is a whole different story, since nobody seems to have done it this way. At the end of the day, it's a 25q64 chip so my ch431 thing a ma-jig handles those.

You don't say, bad caps Well that one be one hell of a ride if all it had was a faulty cap....so as not to waste time blindly replacing all caps, are there any particular ones on there I should look out for ? There's 6 of them. I mean the router appears to work, so can a cap cause it to reboot when it reaches the same part every time ? The more you learn.......

Also ignore that jumper wire sticking out of the board - that's just a CD audio cable I hacked to connect to the serial programmer since it already had the female header at one end which matched the GND/TX/RX pins on my CH431