I'm a leader not a follower!

I'm a leader not a follower!
Two Toads I rescued from the road!

Tuesday, June 28, 2011

TP-Link MR3220 Debricking

I bricked my MR3220 router with an OpenWRT firmware upload. I did manage to get it back by soldering a 4 pin header on its pcb to allow connection to its serial port. I used a Sparkfun FTDI Basic Breakout - 3.3V USB to serial port converter . I used minicom in Ubuntu 11.04 to communicate with the MR3220.
Photo showing the FTDI Basic Breakout - 3.3V USB to serial port converter.
MR3220 Debricking Procedure
Do this:
- Power off the router
- Connect the serial cable to the router and the computer
- Connect the Ethernet cable to the router and the computer
- Set the IP address of the NIC in your computer fixed at 192.168.1.27
- Start the tftpd server I used tftpgui and placed the firmware from the TP-Link website renamed to code.bin in the root directory of the tftp server as defined in its settings.
I used info obtained from OpenWRT Wiki and the procedure I used is below
- Start minicom with parameters 8 bit, no parity, one stop bit, 115200 baud, no flow control and no xon-xoff.
- Power the router on
- Boot messages will appear on the minicom terminal
- When the message "autoboot in 1 second .." appears quickly enter password tpl you will have to type quickly. This should interrupt the boot process and you should see the prompt:
ar7100>

To program the new image:
Erase the memory
ar7100> erase 0x9f020000 +0x3c0000
Load the new firmware
ar7100> tftpboot 0x81000000 code.bin
Copy memory bytes into flash memory
ar7100> cp.b 0x81000000 0x9f020000 0x3c0000
Boot kernel image from flash memory location
ar7100> bootm 0x9f020000

To transfer image via Kermit (Serial Port)
You set the router up to receive the file via Minicom using the following commands. Erase the memory
ar7100> erase 0x9f020000 +0x3c0000
Now load the binary file
loadb 0x81000000
Exit Minicom Ctrl A Z X Fire up Kermit:-
set line /dev/ttyUSB0
set speed 115200
set carrier-watch off
set handshake none
set flow-control none
robust
set file type bin
set file name lit
set rec pack 1000
set send pack 1000
set window 5
send openwrt-ar71xx-generic-tl-mr3220-v1-squashfs-factory.bin

Back to minicom:-
Copy memory bytes into flash memory
ar7100> cp.b 0x81000000 0x9f020000 0x3c0000
Boot kernel image from flash memory location
ar7100> bootm 0x9f020000
Photo of MR3220 showing the four pin header location and pin outs.

That's hopefully it and router should now work.
The router admin webpage is now on 192.168.1.254 , Note: I found that the password was still set to the password I had set when I first got the router and not the manufacturers default password as I expected with a reflash.

6 comments:

  1. bricked this too because stock firmware did not supported static routings right. Thanks for such usefull posting!!

    Does it's VC connected to 3.3v or any 5 volts?!

    ReplyDelete
  2. Please tell me what number chip DDR RAM and flash memory in your version (1.0) of the router?

    ReplyDelete
  3. I have one question: if i use one cable CA-42, where has 3 threads, and not has the thread 3.3v. What i make?

    ReplyDelete
  4. Hi, great work! do you have to short circuit any pin to get serial port working? or is it conected from factory?

    ReplyDelete
  5. Hi!

    I have a problem.

    I have erased the memory area of boot loader 0x9f000000 - 0x9f020000 !!!

    What can I do?

    How can I upload a new boot loader?

    ReplyDelete