Hello great community thanks for that great website wiki and happy new year for all!

That is happened to my router:

https://forum.openwrt.org/viewtopic.php?id=33681

today i going to share my own experience how i unbricked TP-Link WR841ND v7.2 router

Tools need it:

- Serial TTL cable. I bought Nokia DKU-5 Cable

you can find it cheap in ebay:

http://www.ebay.com/sch/i.html?_nkw=dku … 86.c0.m301

I saw for 4.60$ with FREE SHIPPING

- Nokia DKU-5 Driver for windows vista, windows 7 (32 & 64 bits)
I uploaded for all you, i got couple of hours trying to find it.. i registered to another site to get the installer.

http://adf.ly/1269652/mediafire (UPDATED LINK) 2012/08/16

- Putty to get serial connection

http://www.chiark.greenend.org.uk/~sgta … nload.html

- TP-Link WR841ND v7 Openwrt Trunk Image

http://downloads.openwrt.org/snapshots/ … actory.bin

- TFTP server:

http://tftpd32.jounin.net/tftpd32_download.html

they have 32 & 64 bits program ( I used 64 bits because I have windows 7 64 bits)

OK we are ready to start to unbrick our router:

1. Get your serial ttl cable, example: Nokia DKU-5, install driver in your computer and cut your cable and splitt all wires.

check image:

GND = White
TX = BLUE
RX = RED

VCC is ignored

all other wires is NOT NEED IT

Sold or get all wire colors have contact with the holes. (I'm a bad solder, so i get my girlfriend help me to make wires contact with the holes lol!! )

Power on the router and open putty.

Serial connection is 115200 8N1 into serial connection you get something like this:

AP93 (ar7240) U-boot
DRAM:  
sri
#### TAP VALUE 1 = 9, 2 = 9
32 MB
id read 0x100000ff
flash size 4194304, sector count = 64
Flash:  4 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7014
eth0: 00:03:7f:09:0b:ad
eth0 up
No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
Autobooting in 1 seconds

now Type "tpl" (without the quotes) to get to the Uboot console prompt.

2. Open your TFTP server and put "openwrt-ar71xx-generic-tl-wr841nd-v7-squashfs-factory.bin" image into your server current directory and rename it if you want: I renamed to openwrt.bin.

Hook your computer into the switch port and configure the IP for example: 192.168.1.2

Now we need to set router and server IP addresses (here named ROUTERIP and SERVERIP, substitute these with the real IP addresses).

Type in the console:

setenv ipaddr ROUTERIP
setenv serverip SERVERIP
printenv

example:

setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.2
printenv

3. Double check that the output of printenv lists the IP addresses you just set. Now we can load the firmware over TFTP with "tftpboot 0x80000000 openwrt.bin":

ar7240> tftpboot 0x80000000 openwrt.bin
Using eth0 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'openwrt.bin'.
Load address: 0x80000000
Loading: checksum bad
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ######################################################
done
Bytes transferred = 3932160 (3c0000 hex)

- Note the "3c0000" in the last line (your number may differ). Now execute the following commands, if necessary replacing 3c0000 with the number you got from tftpboot:

4. Type this commands (you are almost done):

ar7240> erase 0x9f020000 +0x3c0000
...
ar7240> cp.b 0x80000000 0x9f020000 0x3c0000
ar7240> bootm 0x9f020000

5. Walaaaa! your router is alive again and have openwrt!!

Optional steps:

I want your router have original factory firmware again. is easy!

6. Enter into telnet, change router password.

7. Download TP-LINK WR841ND V7.2 LAST FIRMWARE:

http://www.tp-link.com/en/support/downl … version=V7

8. Upload your image with WinSCP into the router folder /tmp/
rename to tplink.bin

9. Open PuTTY as SSH to 192.168.1.1 and perform the following commands after logging in:

mtd -r write /tmp/tplink.bin firmware

10. DONE, you must wait 1-2 min the router reboot and you will see TP-Link GUI again!

Thanks for this great firmware is very stable.

Regards,

Freddy Arenas

(Last edited by freddyarenas on 16 Aug 2012, 18:53)

Hello freddyarenas,

unfortunatly I bricked my WR841ND too - I installed the wrong version of DD-WRT.
After trying hard to recover, I decided to"mtd erase linux" - now I can't reach the router any more.

My problem in particular is that I soldered a serial cable as described. But it is a serial cable, not a nokia dku 5. Now I get characters in putty that I can't read, it's all junk. I have checked everything - baud rate, 8N1 everything seems fine. I have tried on Windows XP and Windows 7, no difference. Also I have checked the pins for GRD, DX and RX, all seems fine.

>>> I think I know the reason: I need a TTL cable, not RS232. I just ordered one in Hongkong, for 2,30€ !

(Last edited by gspatzenegger on 19 Feb 2012, 21:17)

Hello, did you unbricked your router? i used a nokia dku-5.

I bought a USB 2.0 to UART TTL 6PIN Module Serial Converter CP2102 - it works, I can read the messages from the router but the router is constantly rebooting, not waiting for input from the console. So I decided to buy a new tp-link wr740n which is now working perfect with DD-WRT without any issues.

Maybe the connection via RS232 caused damage because of the higher voltage.
Many thanks for your perfect documentation!!

You welcome! i sent you a PM

Is this possible with another usb cable? I readed that the output on dk 5 is 3.3v and i wonder what other cables can achive that, in order to avoid frying my PCB

That's what a called a great documentation, Freddyarenas. Thanks for sharing it, everything is there. Unfortunatly my router is a TP-Link WR-941ND V3. But anyway, that's a true good documentation you made. Thanks a lot !

you need a serial ttl calbe with 3.3v only and will not fry your router.

You welcome

Hello

Unfortunately my router is booting again and again. There was an electrical drop during flash operation. I was trying to install dd-wrt firmware.

I found your guide but I don't know which firmware I must flash. The link to the firmware in this guide does not work but anyway I was flashing dd-wrt and not open-wrt.

Can anybody please tell me which firmware I can flash via serial?

I ordered a Nokia ca-42 cable. I think it is ok for this job.

EDIT:
Problem solved with CA-42 cable.

I want to install OPEN-WRT now on my TL-WR841ND V7.2 can anyone tell me if this router is supported cause i can´t find firmware for v7.2 ?

(Last edited by omiez on 19 Oct 2012, 03:24)

@Omiez:
Did you manage to install Openwrt on your TL-WR841ND V7.2 ? I managed on mine and I did not need to even open it ? Let me know if you succeeded, since I have noticed your post is slightly dated

(Last edited by wclemo on 28 Oct 2012, 13:02)

Hello Wclemo

Yes I managed first to unbrick with Ca-42 cable and later to flash dd-wrt using web flash image from Attitude directory. Now running 12.09 beta and seems to work without problems.

Thank you very much for your answer.

Stay tuned so if we have problems we can help us out.

Thank you very much Freddy.

Your guide worked like a charm! It was a little odd for me because when i typed in putty console i got numbers and symbols!
So i just had to make sure i was typing the correct letters/numbers because they were correct, just not shown properly.

Other than that it worked and i thank you for it.

Cheers

Hi guys, i have the same problem with jlout. is there anyone that is kind enough to help me unbrick the thing? I can consider to send it to you. I'm from Malaysia btw.

Hello friends

I have taken this from the wiki.
http://wiki.openwrt.org/toh/tp-link/tl-wr841nd

So you can look there too.
If you have strange output from serial consolle you need to use a resistor like described here:

For TP-LINK WR841ND V7.2 power conector (+5V) is ignored, just connect RX - TX - GND and router power cord, work fine…

Another user notes: My TP-LINK WR841ND V7.2 has a VCC of +3.3V and like the TL-MR3420 http://wiki.openwrt.org/toh/tp-link/tl-mr3420#serial needed to connect a 10k pullup resistor between the TX and the 3.3V pin to get reliable serial.

Yet another user notes: My TP-Link WR841ND V7.1 also requires the 10k pullup resistor between TX and the 3.3V pin. Without the resistor I just get garbage when I type, but can see some console output.

You wellcome guys, if you do not see what you type, please be carefull typing that will fix you problems

Guys, I managed to load putty, but it came out with some weird stuffs as below and just hang after that. I could not do anything. Anyone could care to share some lights?

AP93 (ar7240) U-boot
DRAM:
sri
¤¤¤$¢AVALUE 1 = 7, 2 = 8
32 MB
Z
0x100000ff
flash size 4194304, sector count = 64
Flash:  4 MB
U®Ëëdefault environment

RKÉ¥
±5
  Out:   serial
Err:   serial
ªÑé   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
'
Y
  ÒÒÒº2é09:0b:ad
Y
ªÁ5
    No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7214
Y+ÒÒÒº2é09:0b:ad
ATHRS26: resetting s26
PJ5%²ÒÉ6 reset done
Y+ªÁ5
     eth0, eth1
Autobooting in 1 seconds
¤$½½Ñ¥¹image at 9f020000 ...
   Uncompressing Kernel Image ... jªH¨HhE
ÉÑ¥¹kernel ...

Booting AR7240(Python)...
flash_size passed from bootloader = 4¦6¦F6&¦
CPU revision is: 00019374
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Built 1 zonelists
Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/sbin/init mtdparts=ar7100-nor0:128k(u-boot),1024k(kernel),2816k(rootfs),64k(config),64k(art) mem=32M
Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
PID hash table entries: 256 (order: 8, 4096 bytes)
Using 200.000 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 30540k/32768k available (1373k kernel code, 2212k reserved, 294k data, 128k init, 0k highmem)
Mount-cache hash table entries: 512
Checking for 'wait' instruction...  available.
NET: Registered protocol family 16
Returning IRQ 48
AR7240 GPIOC major 0
squashfs: version 3.3 (2007/10/31) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
Initializing Cryptographic API
io scheduler noop registered
io scheduler deadline registered
Serial: 8250/16550 driver $Revision: #1 $ 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A
RAMDISK driver initialized: 1 RAM disks of 8192K size 1024 blocksize
PPP generic driver version 2.4.2
PPPoX init, max protocols:3
NET: Registered protocol family 24
pppox protocol 0 register. max:3
cmdlinepart partition parsing not available
Searching for RedBoot partition table
5 RedBoot partitions found on MTD device ar7240-nor0
Creating 5 MTD partitions on "ar7240-nor0":
0x00000000-0x00020000 : "boot"
0x00020000-0x00120000 : "kernel"
0x00120000-0x003e0000 : "rootfs"
0x003e0000-0x003f0000 : "config"
0x003f0000-0x00400000 : "art"
->Oops: flash id 0xef3016 .
NET: Registered protocol family 2
&{«£+6
      +
        F
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
jÔÕÐj´jV{Ó6û+
             #f
               Kc+#&+
                     #Ks;&c{»F
SQUASHFS error: Unable to read cache block [1f6be4:140a]
SQUASHFS error: Unable to read inode [1f6be4:140a]
VFS: Cannot open root device "mtdblock2" or unknown-block(31,2)
Please append a correct "root=" boot option
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)

V5 or V7????

Solved it!

The key is TIMING. The moment the router says "Autobooting in 1 seconds", you must immediately type 'tpl'. (See below) Otherwise you will get all the rubbish as i posted earlier. Mine is V5 btw. Thanks all for the contributions. Without this forum, I would have thrown my router in the rubbish bin.

AP93 (ar7240) U-boot
DRAM:
sri
¤¤¤$¢AVALUE 1 = 7, 2 = 8
32 MB
Z
0x100000ff
flash size 4194304, sector count = 64
Flash:  4 MB
U®Ëëdefault environment

RKÉ¥
±5
  Out:   serial
Err:   serial
ªÑé   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
'
Y
  ÒÒÒº2é09:0b:ad
Y
ªÁ5
    No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7214
Y+ÒÒÒº2é09:0b:ad
ATHRS26: resetting s26
PJ5%²ÒÉ6 reset done
Y+ªÁ5
     eth0, eth1
Autobooting in 1 seconds

hello!
can anyone help me to unbrick my router?
i was trying to install openwrt and then i cannot access web interface! i was trying to install with putty original firmware(in wan port) and an error appear.
now my router is lighting power led and the other leds are flashing together forever!
i get this with serial connection:

gKrtGO"GEd~ĺV˙óó        +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw      é÷ý¨/Á¨wâłóčT;Ńóó       >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó   +óIăc+jßdb"*EgDăc+jßdb"*EgD§KşĆUEłć$˙ěó!ýw  é÷ý¨/Á¨wâłóčT;Ńóó   >{ă1Bd"ţĺV˙óó

what should i do?
thank you!
please excuse my bad english!

i've made it! just set speed to 115200bps and set flow control to none! it's ok now!

Having bricked my router after following an erroneous tip to remove the line: option ifname 'eth1'
I set up access using a CAT serial cable.

I was getting garbage from the serial link so tried a 10K pull up resister on the TX leg. This showed data but I was still having access issues. I added a 10K to the RX leg and all came right.

I added the 'option ifname' back in to the netconfig and I am back on line:))

Unbricking works also with WR841N V8.2.  Great. :-) Use the following settings:

- set hardware flow control to none (minicom works well, no charset problem)
- for the TFTP (ethernet) connection use the first LAN port of the router

Hi!

I have a CA-42 (compatible) and Windows 8 (64b). When I plug the USB only Windows automagically  installs a "Prolific USB-to-Serial Comm Port", but it has a yellow exclamation. Double clicking in the device I get an error code 10.
If I try to use Putty with this COM I get a "Unable to open serial port"...

I've tried installing the driver that freddyarenas gave us but Windows refuses to change the Prolific one... Should I force it? In that case, I have several TI drivers... "TUSB3410 Device", "TUSB3410 UART EVM" or should I choose another one?

EDIT: Thanks to nebbia88 we pinpointed the problem to be... Windows 8. Same hardware on a Win7 works like a charm!

(Last edited by djago on 22 Jul 2013, 23:44)

Well after about a month I finally debricked mine too.I'm in Iran and as I bought a DKU-5 cable I noticed that it has different feature than the original DKU-5 cable that described here and in other websites.The biggest differences was :1- it had 14 pins in the mobile side 2-As I installed its driver ,it was shown as "Usb to serial " device in device manager not the "DKU-5" .3-the 5 wire voltages were completely different from the value mentioned in the websites.I break the usb side cover and I figured out that the chip inside it was different from MAX232.I had tested the cable with a mobile phone and it was worked well but I don't know how Chinese made that possible.:)
I go to MAX232 Chip.And I bought a MAX323N  in about 8000 Rial which is about 0.25 US dollar (How a cheep chip and money unit )
The chip converts ttl to serial and I used the circuit shown in bellow image and implement it on a breadboard:

The Tx and Rx should connect to the Tx and Rx of router which is showed on top of the page by dear freddyarenas.
But I was getting garbage characters.I used a 270 ohm (if i'm not wrong it was red-purple-brown on ) resister between router Tx and circuit Tx.It gets better but still show some garbage characters.

(Last edited by harsini on 6 Oct 2015, 12:34)