Tuesday, 28 June 2011

TP-Link MR3220 Debricking

I bricked my MR3220 router with an OpenWRT firmware upload. I did manage to get it back by soldering a 4 pin header on its pcb to allow connection to its serial port. I used a Sparkfun FTDI Basic Breakout - 3.3V USB to serial port converter . I used minicom in Ubuntu 11.04 to communicate with the MR3220.
Photo showing the FTDI Basic Breakout - 3.3V USB to serial port converter.
MR3220 Debricking Procedure
Do this:
- Power off the router
- Connect the serial cable to the router and the computer
- Connect the Ethernet cable to the router and the computer
- Set the IP address of the NIC in your computer fixed at 192.168.1.27
- Start the tftpd server I used tftpgui and placed the firmware from the TP-Link website renamed to code.bin in the root directory of the tftp server as defined in its settings.
I used info obtained from OpenWRT Wiki and the procedure I used is below
- Start minicom with parameters 8 bit, no parity, one stop bit, 115200 baud, no flow control and no xon-xoff.
- Power the router on
- Boot messages will appear on the minicom terminal
- When the message "autoboot in 1 second .." appears quickly enter password tpl you will have to type quickly. This should interrupt the boot process and you should see the prompt:
ar7100>

To program the new image:
Erase the memory
ar7100> erase 0x9f020000 +0x3c0000
Load the new firmware
ar7100> tftpboot 0x81000000 code.bin
Copy memory bytes into flash memory
ar7100> cp.b 0x81000000 0x9f020000 0x3c0000
Boot kernel image from flash memory location
ar7100> bootm 0x9f020000

To transfer image via Kermit (Serial Port)
You set the router up to receive the file via Minicom using the following commands. Erase the memory
ar7100> erase 0x9f020000 +0x3c0000
Now load the binary file
loadb 0x81000000
Exit Minicom Ctrl A Z X Fire up Kermit:-
set line /dev/ttyUSB0
set speed 115200
set carrier-watch off
set handshake none
set flow-control none
robust
set file type bin
set file name lit
set rec pack 1000
set send pack 1000
set window 5
send openwrt-ar71xx-generic-tl-mr3220-v1-squashfs-factory.bin

Back to minicom:-
Copy memory bytes into flash memory
ar7100> cp.b 0x81000000 0x9f020000 0x3c0000
Boot kernel image from flash memory location
ar7100> bootm 0x9f020000
Photo of MR3220 showing the four pin header location and pin outs.

That's hopefully it and router should now work.
The router admin webpage is now on 192.168.1.254 , Note: I found that the password was still set to the password I had set when I first got the router and not the manufacturers default password as I expected with a reflash.

6 Comments:

At 11 September 2011 at 14:08 , Blogger densa said...

bricked this too because stock firmware did not supported static routings right. Thanks for such usefull posting!!

Does it's VC connected to 3.3v or any 5 volts?!

 
At 22 December 2011 at 22:00 , Blogger jimbuzz said...

VC is connected to 3.3V

 
At 29 December 2011 at 21:24 , Blogger Dmytro said...

Please tell me what number chip DDR RAM and flash memory in your version (1.0) of the router?

 
At 14 June 2012 at 04:15 , Blogger João Paulo Polles said...

I have one question: if i use one cable CA-42, where has 3 threads, and not has the thread 3.3v. What i make?

 
At 24 February 2014 at 06:08 , Blogger alfredito pot said...

Hi, great work! do you have to short circuit any pin to get serial port working? or is it conected from factory?

 
At 26 February 2014 at 12:12 , Blogger József Bencze said...

Hi!

I have a problem.

I have erased the memory area of boot loader 0x9f000000 - 0x9f020000 !!!

What can I do?

How can I upload a new boot loader?

 

Post a Comment

Subscribe to Post Comments [Atom]

<< Home