{"id":127,"date":"2015-03-24T01:42:52","date_gmt":"2015-03-24T00:42:52","guid":{"rendered":"http:\/\/hobbykeller.spdns.de\/?p=127"},"modified":"2015-08-27T16:49:43","modified_gmt":"2015-08-27T14:49:43","slug":"unbrick-tp-link-tl-wdr4900-with-broken-bootloader","status":"publish","type":"post","link":"https:\/\/hobbykeller.spdns.de\/?p=127","title":{"rendered":"Unbrick TP-Link TL-WDR4900 with broken bootloader"},"content":{"rendered":"
\"Flashcat<\/a>
Flashcat connected to chip (no external 5V connected yet)<\/figcaption><\/figure>\n

In a failed attempt to recover a bricked WDR4900 by serial, the bootloader in the flash memory was erroneously deleted or damaged. This makes things worse as without the device even booting, there is no more option to establish an emergency connection by serial cable.<\/p>\n

In this post, a procedure is demonstrated which allows to recover the router by unsoldering the router’s memory chip and flashing it with an external SPI programming device.<\/p>\n

<\/p>\n

Symptoms<\/h1>\n

When powering up the router, the LEDs on the front panel will behave as follows:<\/p>\n

[table id=3 \/]<\/p>\n

Additionally of course, the router cannot neither be contacted by telnet, nor by ssh or serial cable.<\/p>\n

Remedies<\/h1>\n

The only way to blow life back into the router is by one of those two methods.<\/p>\n

    \n
  1. by JTAG or<\/li>\n
  2. by unsoldering the flash chip and reflash it with an external device<\/li>\n<\/ol>\n

    I first tried to go for the JTAG solution as it would have spared me to desolder the chip from the router. Unfortunately, it was impossible to establish any communication between the FlashcatUSB and the JTAG interface. This might be due to the fact that the router board has a RISCWATCH\/COP layout\u00a0 which probably differs from the EJTAG standard. The following procedure therefore only refers to directly flashing the SPI chip without passing through the JTAG interface.<\/p>\n

    Examination of the router<\/h1>\n

    You can easily open the router as described in the first minutes of this video<\/a>. Remove the 3 external antennas, unscrew the 4 screws at the bottom of the case and gently prey the plastic clips open which retain the cover of the plastic case. It is not necessary or advisable to take the board out, as this would require to unsolder the wires of the internal antennas. All work can be done with the router’s PCB remaining in the bottom part of the case and just the lid being removed.<\/p>\n

    The board<\/h2>\n

    The image below shows the opened router with the flash chip. Note that the 3 DuPont cables in the photo have been added to provide an access to the serial TTL adapter without opening the case (the adapter is of no help though, as it can only be used when U-boot is working correctly).<\/p>\n

    \"TL-WDR4900<\/a>
    TL-WDR4900 board overview<\/figcaption><\/figure>\n

    Specs of the flash memory chip<\/h2>\n

    As shown in the overview picture, the memory which holds the damaged bootloader and has to be flashed resides right above the JTAG port on the router board. According to the OpenWRT documentation for the WDR4900<\/a> it is a Spansion FL128SAIF00<\/a> chip (NOR type<\/a>).<\/p>\n

    Pin-out<\/h3>\n

    For starters, a good thing to know would be the pin-out on the Spansion memory chip. I found\u00a0a Macronix document comparing the FL128S Spansion chip with the Macronix MX25L12835F chip which also shows the connection diagramm for our Spansion chip. Nothing surprising here, as the pin-outs for both the current S25FL128S and its P-series predecessor follow the standard layout for SPI chips.<\/p>\n

    \"Spansion<\/a>
    Pinout for Spansion S25FL128S (left) and its predecessor S25FL128P (right)<\/figcaption><\/figure>\n

    Flash memory layout<\/h3>\n

    Another piece of information we are going to need is the memory flash layout. Inside the u-boot environment of a working router, this can be retrieved with the help of the printenv<\/code><\/a> command.<\/p>\n

    An alternative way to get the memory mapping is to check on a running router:<\/p>\n

    root@wdr4900:~# cat \/proc\/mtd \r\ndev:    size   erasesize  name\r\nmtd0: 00050000 00010000 \"u-boot\"\r\nmtd1: 00010000 00010000 \"dtb\"\r\nmtd2: 002a0000 00010000 \"kernel\"\r\nmtd3: 00ce0000 00010000 \"rootfs\"\r\nmtd4: 002f0000 00010000 \"rootfs_data\"\r\nmtd5: 00010000 00010000 \"config\"\r\nmtd6: 00010000 00010000 \"caldata\"\r\nmtd7: 00f80000 00010000 \"firmware\"\r\nroot@wdr4900:~# dmesg | grep u-boot\r\n[    0.639973] 0x000000000000-0x000000050000 : \"u-boot\"\r\nroot@wdr4900:~# dmesg | grep dtb\r\n[    0.645617] 0x000000050000-0x000000060000 : \"dtb\"\r\nroot@wdr4900:~# dmesg | grep kernel\r\n[    0.650943] 0x000000060000-0x000000300000 : \"kernel\"\r\nroot@wdr4900:~# dmesg | grep rootfs\r\n[    0.656530] 0x000000300000-0x000000fe0000 : \"rootfs\"\r\nroot@wdr4900:~# dmesg | grep rootfs_data\r\n[    0.676082] 0x000000cf0000-0x000000fe0000 : \"rootfs_data\"\r\nroot@wdr4900:~# dmesg | grep config\r\n[    0.682077] 0x000000fe0000-0x000000ff0000 : \"config\"\r\nroot@wdr4900:~# dmesg | grep caldata\r\n[    0.687660] 0x000000ff0000-0x000001000000 : \"caldata\"\r\nroot@wdr4900:~# dmesg | grep firmware\r\n[    0.693322] 0x000000060000-0x000000fe0000 : \"firmware\"<\/pre>\n
    Summing up, we can assume that the flash memory layout is as follows:<\/p>\n
    [table id=6 \/]<\/p>\n
    Data to be flashed<\/h1>\n
    Now is a good moment to think about how to get hold of the data we want to flash. The first thing that comes to mind is to just download the original firmware from TP-Link’s home page or get hold of an OpenWRT image for that router.<\/p>\n
    Unfortunately, that won’t solve your problem because you just get mtd7<\/code> (or even less). What you need, though, is an image of the complete content of the flash memory inside the router. Sometimes, there are folks who upload these images to dev forums (e.g. there is someone who has uploaded the config partition (mtd5<\/code>) here<\/a>), so google around a bit. At this point I can only issue an urgent public service announcement<\/a> by quoting Michael Kuron’s blog:<\/p>\n
    Why do people keep on ignoring all recommendations to MAKE A BACKUP OF YOUR ART PARTITION?<\/p><\/blockquote>\n
    Dear Michael: The problem is probably not that people deliberately ignore your advice but rather that most people (myself unfortunately included) only read that advice when they have already damaged their mtd partitions. But I will do my very best to spread your recommendation.<\/p>\n
    So please – with extra sugar on top –<\/strong> if anyone reads this post before they have damaged their config and caldata partitions: Back up your mtd partitions before it’s too late! Even if you find someone who has got the exact same router model and version and who is kind enough to share his mtd partitions, there is a debate on whether the ART<\/span> calibration data is so router specific, that your WLAN functionalities will later be buggy with an mtd5 partition copied from another device.<\/p>\n
    As I had a working twin router at home, I could dump the mtd images from that device. To dump a partition, just issue the following command on a working router’s console. As always when working with the dd<\/code> command, be careful not to mix up anything – there is a reason why dd<\/code> is nicknamed “disk destroyer”…<\/p>\n
    root@wdr4900:~# dd if=\/dev\/mtd0 of=\/tmp\/dev0_uboot.bin\r\n640+0 records in\r\n640+0 records out\r\nroot@wdr4900:~#<\/pre>\n
    Proceed the same way for mtd1<\/code>, mtd5<\/code>, mtd6<\/code> and mtd7<\/code>. mtd2<\/code> to mtd4<\/code> do not have to be dumped separately, as the firmware partition mtd7<\/code> includes these 3 partitions already. Once everything is dumped, transfer these files to your computer for further editing.<\/p>\n
    Editing the data<\/h2>\n
    Before writing these dumps back into the memory chip, we should make sure that the MAC addresses coded into the dumps are in line with the MAC address printed on the bottom of our router’s case. We therefore open the mtd5 backup file with a hex editor and proceed as follows:<\/p>\n