hi all,
i followed the debricking procedure and i see the following msg on serial port
�

U-Boot 1.1.4 (Jun 18 2013 - 15:51:52)

ap135 - Scorpion 1.0DRAM: 
sri
Scorpion 1.0
ath_ddr_initial_config(211): (16bit) ddr1 init
tap = 0x00000002
Tap (low, high) = (0xaa55aa55, 0x0)
Tap values = (0x8, 0x8, 0x8, 0x8)
4 MB

and it gets struck at this point

Dear all, anyone know how to unbrick using Mac OS?

Know someone the resistance value 362 and 363;;; please

phukit and Qopzeep, thanks so much for your help, following your instructions, and applying a bit of common sense I was able to unbrick my WR1043ND v1.8
Thanks!!!

I used a Arduino to communicate with my board, here are my notes (future readers, use in conjunction with OP instructions)

Use Arduino Mega 2560

Pins on WR1043ND v1.8, from P1 (only P1 is labeled, the other pins are next in the row)

P1 (3v)  -> NC (no connection)
P2 (GND) -> Mega GND
P3 (RX)  -> Mega TX1
P4 (TX)  -> Mega RX1

Arduino script (upload before wiring serial port):
---------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- ----------
// Created by xera (networking at xera.co.za)
// Created on: 2014/01/21

void setup()
{
   Serial.begin(115200);
   Serial1.begin(115200);
}

void loop()
{
   if (Serial.available() > 0)
   {
      int rx = Serial.read();
      Serial1.write(rx);
   }
   if (Serial1.available() > 0)
   {
      int rx = Serial1.read();
      Serial.write(rx);
   }
}
---------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- ----------

- Plug in the Arduino to the computer, and run putty, set baud to 115200, and open serial port
- Apply power to the router
- The following show in terminal, in a loop:

---------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- ----------

U-Boot 1.1.4 (Mar 25 2013 - 09:31:55)

AP83 (ar9100) U-boot 0.0.11
DRAM:
sri
32 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7100_enet_initialize...
No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Autobooting in 1 seconds## Booting image at bf020000 ...
   Uncompressing Kernel Image ... Error: Bad gzipped data
GUNZIP ERROR - must RESET board to recover

Resetting...

---------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- ----------

- Type "tpl" fast, and  you go into console mode
- Download TFTP from tftpd32.jounin.net
- Use other instructions by phukit at beginning of thread.

Hope this helps someone!

My version is TP-Link TL-WR1043ND 1.11

I wrote this one for arduino uno:

void setup()  
{
  // Open serial communications and wait for port to open:
  Serial.begin(115200);
  while (!Serial) {
    ; // wait for serial port to connect. Needed for Leonardo only
  }
}

void loop() // run over and over
{
  if (Serial.available()>0)
  {
    int rx = Serial.read();
    Serial.write(rx);
  }
}

The loop is ok.

I use Termite but does not accept "tpl".

As in this guide
TP-Link TL-WR1043ND - Receive (RX) Disabled
I put the jumper.

HEELLP !!!

i have the same problem.
How can I fix it ?
Please help me, thanks so much.

(Last edited by duyanh100910 on 30 Dec 2014, 16:22)

what adapter are you using? can you post pictures? do not connect the VCC pin...

I'm use usb uart cp2102 to ttl, and i'm not connected VCC (connect GND->GND router, RX->TX router and TX->RX router)

Hi all. 
I have followed the suggestions by phukit and Qopzeep.
But, my TP-LINK TL-WR1043ND still flashing the LED's.
So, the Autobooting doesn't stop.
I used putty (http://www.chiark.greenend.org.uk/~sgta … nload.html) as suggested. It doesn't work well, because all the time appears only symbols at the screen.
Then, i change to Termite (http://www.compuphase.com/software_termite.htm) as suggested too. Now, i can see the information at the screen.
But, the Autobooting doesn't stop.
It says: "When the message appears as bellow
Autobooting in 1 seconds## Booting image bf0200000...

Then type following fast:  'tpl'
Now you will get into the command prompt and you're able to execute commands."
In my case, the command prompt doesn't appear. The Autobooting doesn't stop, it continuous indefinitely.
I have tried to type "tpl" so many times, all the time (as suggested by nebbia88). The prompt doesn't appear.
Now, i would like to know if someone passed for these problems and could help me.
Thank's.
Best regards.

Hope this helps...

Note: make sure to also read and refer to the original guide!

Requirements

• TP-Link TL-WR1043ND modem router

• USB to TTL cable (try eBay)

• Mac OS X (I used 10.10 Yosemite)

• TftpServer: http://ww2.unime.it/flr/tftpserver/

Steps
0. Install  Mac OS X drivers for your USB to UART cable, for my SiLabs CP2012 cable they were easily found with a quick web search

1. Download your choice of firmware (see OP, but I used official firmware to get me back to a stable place)

2. Open the case of your TL-WR1043ND
Use USB to UART cable to connect router Serial (on circuit board) port to Mac
Check: System Information.app > USB > "USB to UART" (or similar) is listed

3. Open Terminal.app and use the following with command:

screen /dev/tty.SLAB_USBtoUART 115200 8N1

4. Use Ethernet cable to connect router LAN (yellow) port to Mac
Open System Preferences > Network > Ethernet

Configure IPv4: Manually
IP Address: 192.168.0.5
Subnet Mask: 255.255.255.0

5. Open TftpServer.app

6. Make sure the "Current Directory" in TftpServer is set to folder with modified original firmware renamed to "code.bin"
If not change the directory to the one where the file is located
Click "Start Server"

7. Open Terminal.app and paste the following with command:

screen /dev/tty.SLAB_USBtoUART 115200 8N1

plug in Power cord to router... you should see bootloader coming up now...

8. You will see something like this:
No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7114
eth0 up
eth0
Autobooting in 1 seconds## Booting image bf0200000...
Then type following fast: tpl
Now you will get into the command prompt and you're able to execute commands.
If you are too slow, power cycle router off/on and try again.

9. Erase the firmware before writing it again using following command:

erase 0xbf020000 +7c0000

10. Download new modified original firmware from computer tftp directory to the router:

tftpboot 0x81000000 code.bin

11. Write the downloaded firmware to flash using:

cp.b 0x81000000 0xbf020000 0x7c0000

12. Boot the original firmware again:

bootm 0xbf020000

13. Let the router finish booting up and wait for everything to stop loading, a minute or two

14. Press Ctrl + C than hit Enter and now you should be able to the router login screen at the default web address for the firmware you chose
e.g. http://192.168.1.1

Done!

Your router should be unbricked again!

I just unblocked my router using this procedure.

Good luck!

(Last edited by gingerbeardman on 21 Jun 2015, 02:44)

So I can either use the TP-Link original firmware, but with the boot part removed, from here (TL-WR1043ND-V1-stripped.zip), or use the latest openwrt sysupgrade firmware from here? They both work? (my router's hardware version is 1.85)

I have a problem. The router doesn't get anything from tftp server after step 10, it just waits. The printenv command shows me that the router's IP is 192.168.0.3 but it doesn't even answer to ping. Where is my mistake?

Thanks

(Last edited by onlyra on 4 Jul 2015, 08:40)

Your firmware file is renamed code.bin right?

I used an unmodified original TP-Link firmware.

(Last edited by gingerbeardman on 4 Jul 2015, 12:55)

Hi,
this is very usefull. But I have another issue. My output goes like this:

Y1▒y▒▒D   y=f3▒ay=K▒▒5=7▒▒▒▒▒▒▒▒33▒▒3'=/▒-
                                                        5▒▒e{▒▒59!9!#▒▒▒▒▒▒▒▒s'=/▒▒▒▒▒e{▒▒UFK▒▒▒'▒5#-#▒▒▒▒[▒▒▒▒▒▒5'▒▒a▒▒▒▒5'▒▒u▒▒▒5'▒▒▒▒▒▒▒▒늊▒▒▒A5#5A-#--='-
                                                                             5▒▒▒▒▒▒▒='-7▒=77▒-#▒s'=/▒▒U-#1▒3-57▒=77▒▒▒˚▒꿟3▒931▒▒▒▒▒▒▒▒▒

Any ideas???

Your cable connection is not ideal, adjust the connector

(Last edited by gingerbeardman on 14 Sep 2015, 13:13)

I have, and I've tried with 2 adapters and the output is the same.

.... I need serious help!

(Last edited by arnaldoeperezb on 16 Sep 2015, 23:52)

@arnaldoeperezb

it might help if you test other speeds
also if you broke the bootloader it might dump garbage on screen
take care of that mid antenna..its really close of switch pins

Thanks, I've tried other speeds and is the same thing. What would happend if that bootloader gets broke?? Why would that happend?? and What could I do if it's actually broke?

donow what happens if it gets broke. probably garbage on screen.. probably nothing.. basically it wont boot
it gets broke from a previous bad flashing
you could build a spi flashing interface.. and hard reflash yourself or go to a GSM repair shop to reflash the chip

seems you can use jtag to rw fw..

(Last edited by makarel on 17 Sep 2015, 14:02)

I have a big problem with the 1043nd that it is impossible to flash it just throws this please for help!

U-Boot 1.1.4 (Mar 19 2014 - 11:06:29)

AP83 (ar9100) U-boot 0.0.11
DRAM:
sri
32 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7100_enet_initialize...
No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
is_auto_upload_firmware=0
Autobooting in 1 seconds## Booting image at bf020000 ...
   Uncompressing Kernel Image ... OK

Starting kernel ...

OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel...
done!
Starting kernel...

[    0.000000] Linux version 3.10.90 (root@nmndev) (gcc version 5.2.0 (OpenWrt GCC 5.2.0 r46799) ) #9817 Fri Oct 9 02:19:34 CEST 2015
[    0.000000] flash_size passed from bootloader = 8
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[    0.000000] booting platform Atheros AR9132 rev 2 (0xb9)
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x01ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x01ffffff]
[    0.000000] Primary instruction cache 64kB, 4-way, VIPT, I-cache aliases, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line: console=ttyS0,115200 root=1f02 rootfstype=squashfs noinitrd init=/sbin/init
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 29128k/32768k available (2136k kernel code, 3640k reserved, 371k data, 180k init, 0k highmem)
[    0.000000] NR_IRQS:83
[    0.000000] irq init done
[    0.000000] plat_time_init: plat time init done
[    0.000000] Calibrating delay loop... 265.42 BogoMIPS (lpj=1327104)
[    0.080000] pid_max: default: 32768 minimum: 301
[    0.080000] Mount-cache hash table entries: 512
[    0.090000] NET: Registered protocol family 16
[    0.110000] bio: create slab <bio-0> at 0
[    0.120000] Switching to clocksource MIPS
[    0.130000] NET: Registered protocol family 2
[    0.130000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.130000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    0.140000] TCP: Hash tables configured (established 512 bind 512)
[    0.140000] TCP: reno registered
[    0.150000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.150000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.160000] NET: Registered protocol family 1
[    0.160000] gpio_proc: module loaded and /proc/gpio/ created
[    0.170000] Register LED Device
[    0.170000] wl0gpio_proc: module loaded and /proc/wl0gpio/ created
[    0.180000] AR7100 GPIOC major 0
[    0.180000] squashfs: version 3.0 (2006/03/15) Phillip Lougher
[    0.190000] msgmni has been set to 56
[    0.200000] io scheduler noop registered
[    0.200000] io scheduler deadline registered (default)
[    0.200000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.230000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 19) is a 16550A
[    0.240000] console [ttyS0] enabled, bootconsole disabled
[    0.240000] console [ttyS0] enabled, bootconsole disabled
[    0.250000] guessed flashsize = 8M
[    0.260000] scanning for root partition
[    0.260000] tplink uboot detected
[    0.260000] bootloader size = 20000
[    0.270000]
[    0.270000] found squashfs at 110000
[    0.270000] Creating 8 MTD partitions on "ar7100-nor0":
[    0.280000] 0x000000000000-0x000000020000 : "RedBoot"
[    0.290000] 0x000000020000-0x0000007e0000 : "linux"
[    0.290000] 0x000000110000-0x000000770000 : "rootfs"
[    0.300000] mtd: partition "rootfs" set to be root filesystem
[    0.310000] 0x000000770000-0x0000007e0000 : "ddwrt"
[    0.310000] 0x0000007e0000-0x0000007f0000 : "nvram"
[    0.320000] 0x0000007f0000-0x000000800000 : "FIS directory"
[    0.330000] 0x0000007f0000-0x000000800000 : "board_config"
[    0.330000] 0x000000000000-0x000000800000 : "fullflash"
[    0.340000] ->Oops: flash id 0x1c3017 .
[    0.340000] tun: Universal TUN/TAP device driver, 1.6
[    0.350000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    0.360000] Found an RTL8366RB switch
[    0.360000] Realtek RTL8366RB ethernet switch driver version 0.2.4
[    0.480000] rtl8366rb rtl8366rb: using GPIO pins 18 (SDA) and 19 (SCK)
[    0.480000] rtl8366rb rtl8366rb: RTL5937 ver. 3 chip found
[    0.690000] libphy: rtl8366rb: probed
[    0.890000] PPP generic driver version 2.4.2
[    0.900000] PPP BSD Compression module registered
[    0.900000] PPP Deflate Compression module registered
[    0.910000] PPP MPPE Compression module registered
[    0.910000] NET: Registered protocol family 24
[    0.920000] u32 classifier
[    0.930000]     Performance counters on
[    0.930000]     input device check on
[    0.930000]     Actions configured
[    0.940000] Netfilter messages via NETLINK v0.30.
[    0.940000] nf_conntrack version 0.5.0 (455 buckets, 1820 max)
[    0.950000] nf_conntrack_rtsp v0.6.21 loading
[    0.950000] nf_nat_rtsp v0.6.21 loading
[    0.960000] ip_tables: (C) 2000-2006 Netfilter Core Team
[    0.960000] TCP: westwood registered
[    0.970000] TCP: hybla registered
[    0.970000] TCP: vegas registered
[    0.970000] NET: Registered protocol family 17
[    0.980000] Bridge firewalling registered
[    0.980000] 8021q: 802.1Q VLAN Support v1.8
[    0.990000] searching for nvram
[    0.990000] nvram size = 0
[    1.040000] Atheros AR71xx hardware watchdog driver version 0.1.0
[    1.050000] ar71xx-wdt: timeout=15 secs (max=21) ref freq=200000000
[    1.060000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    1.070000] Freeing unused kernel memory: 180K (802d3000 - 80300000)
start service
starting Architecture code for ap83
udevtrigger[222]: parse_config_file: can't open '/etc/udev/udev.conf' as config file: No such file or directory
sh: can't create /sys/class/net/lo/queues/rx-0/rps_cpus: nonexistent directory
sh: can't create /sys/class/net/lo/queues/tx-0/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/lo/queues/tx-1/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/lo/queues/tx-2/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/lo/queues/tx-3/xps_cpus: nonexistent directory
load RTL Switch Driver
sh: can't create /sys/class/net/lo/queues/tx-4/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/lo/queues/tx-5/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/lo/queues/tx-6/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/lo/queues/tx-7/xps_cpus: nonexistent directory
load ag71xx or ag7100_mod Ethernet Driver
[    4.030000] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:RGMII
sh: can't create /sys/class/net/eth0/queues/rx-0/rps_cpus: nonexistent directory
sh: can't create /sys/class/net/eth0/queues/tx-0/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/eth0/queues/tx-1/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/eth0/queues/tx-2/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/eth0/queues/tx-3/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/eth0/queues/tx-4/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/eth0/queues/tx-5/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/eth0/queues/tx-6/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/eth0/queues/tx-7/xps_cpus: nonexistent directory
configure eth0 to a0:f3:c1:5b:b5:aa
[    4.340000] eth0: link up (1000Mbps/Full duplex)
configure vlan1 to a0:f3:c1:5b:b5:aa
configure vlan2 to A0:F3:C1:5B:B5:AB
sh: can't create /sys/class/net/vlan1/queues/rx-0/rps_cpus: nonexistent directory
sh: can't create /sys/class/net/vlan1/queues/tx-0/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/vlan1/queues/tx-1/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/vlan2/queues/rx-0/rps_cpus: nonexistent directory
sh: can't create /sys/class/net/vlan1/queues/tx-2/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/vlan2/queues/tx-0/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/vlan2/queues/tx-1/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/vlan2/queues/tx-2/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/vlan2/queues/tx-3/xps_cpus: nonexistent directory
load ATH 802.11 a/b/g Driver
sh: can't create /sys/class/net/vlan1/queues/tx-3/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/vlan1/queues/tx-4/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/vlan1/queues/tx-5/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/vlan2/queues/tx-4/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/vlan1/queues/tx-6/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/vlan1/queues/tx-7/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/vlan2/queues/tx-5/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/vlan2/queues/tx-6/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/vlan2/queues/tx-7/xps_cpus: nonexistent directory
load ATH9K 802.11n Driver
[    4.630000] Loading modules backported from Linux version master-2015-07-21-0-g47cd203
[    4.640000] Backport generated by backports.git backports-20150626-0-gc1a4168
[    4.800000] cfg80211: World regulatory domain updated:
[    4.810000] cfg80211:  DFS Master region: unset
[    4.810000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[    4.820000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[    4.830000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[    4.840000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[    4.850000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[    4.860000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[    4.860000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[    5.540000] ieee80211 phy0: Atheros AR9100 MAC/BB Rev:7 AR2133 RF Rev:a2 mem=0xb80c0000, irq=2
[    5.550000] cfg80211: Regulatory domain changed to country: US
[    5.560000] cfg80211:  DFS Master region: FCC
[    5.560000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[    5.570000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 3000 mBm), (N/A)
[    5.580000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 1700 mBm), (N/A)
[    5.590000] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz), (N/A, 2300 mBm), (N/A)
[    5.600000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 3000 mBm), (N/A)
[    5.610000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 4000 mBm), (N/A)
configure wifi0 to A0:F3:C1:5B:B5:AA
sh: can't create /sys/class/net/wlan0/queues/rx-0/rps_cpus: nonexistent directory
sh: can't create /sys/class/net/wlan0/queues/tx-0/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/wlan0/queues/tx-1/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/wlan0/queues/tx-2/xps_cpus: nonexistent directory
[USB] checking...
sh: can't create /sys/class/net/wlan0/queues/tx-3/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/wlan0/queues/tx-4/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/wlan0/queues/tx-5/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/wlan0/queues/tx-6/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/wlan0/queues/tx-7/xps_cpus: nonexistent directory
ath9k deconfigure_single: phy0 ath0
sh: can't create /sys/class/net/br0/queues/rx-0/rps_cpus: nonexistent directory
[    8.100000] device br0 entered promiscuous mode
sh: can't create /sys/class/net/br0/queues/tx-0/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/br0/queues/tx-1/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/br0/queues/tx-2/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/br0/queues/tx-3/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/br0/queues/tx-4/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/br0/queues/tx-5/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/br0/queues/tx-6/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/br0/queues/tx-7/xps_cpus: nonexistent directory
[    8.200000] device vlan1 entered promiscuous mode
[    8.200000] device eth0 entered promiscuous mode
[    8.210000] br0: port 1(vlan1) entered forwarding state
[    8.220000] br0: port 1(vlan1) entered forwarding state
[    8.220000] device br0 left promiscuous mode
[    8.230000] device br0 entered promiscuous mode
ath9k deconfigure_single: phy0 ath0
[    8.280000] cfg80211: Invalid regulatory domain detected:
[    8.290000] cfg80211: Regulatory domain: 00
[    8.290000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[    8.300000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[    8.310000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[    8.320000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[    8.320000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[    8.330000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[    8.340000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[    8.400000] cfg80211: World regulatory domain updated:
[    8.410000] cfg80211:  DFS Master region: unset
[    8.410000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[    8.420000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[    8.430000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[    8.440000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[    8.450000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[    8.460000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[    8.460000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[    8.480000] cfg80211: Regulatory domain changed to country: DE
[    8.480000] cfg80211:  DFS Master region: ETSI
[    8.490000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[    8.500000] cfg80211:   (2400000 KHz - 2483000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[    8.510000] cfg80211:   (5150000 KHz - 5350000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[    8.520000] cfg80211:   (5470000 KHz - 5725000 KHz @ 80000 KHz), (N/A, 3000 mBm), (N/A)
[    8.520000] cfg80211:   (57240000 KHz - 65880000 KHz @ 2160000 KHz), (N/A, 4000 mBm), (N/A)
ath9k configure_single: phy0 ath0
call mac80211autochannel for interface: ath0
sh: can't create /sys/class/net/ath0/queues/rx-0/rps_cpus: nonexistent directory
sh: can't create /sys/class/net/ath0/queues/tx-0/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/ath0/queues/tx-1/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/ath0/queues/tx-2/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/ath0/queues/tx-3/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/ath0/queues/tx-4/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/ath0/queues/tx-5/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/ath0/queues/tx-6/xps_cpus: nonexistent directory
sh: can't create /sys/class/net/ath0/queues/tx-7/xps_cpus: nonexistent directory
[   10.220000] br0: port 1(vlan1) entered forwarding state
freq:2412 qual:98 noise:-95
freq:2417 qual:47 noise:-95
freq:2422 qual:72 noise:-95
freq:2427 qual:74 noise:-95
freq:2432 qual:50 noise:-95
freq:2437 qual:92 noise:-95
freq:2442 qual:46 noise:-95
freq:2447 qual:69 noise:-95
freq:2452 qual:71 noise:-95
freq:2457 qual:45 noise:-95
freq:2462 qual:89 noise:-95
freq:2467 qual:43 noise:-95
freq:2472 qual:68 noise:-95
mac80211autochannel interface: ath0 frequency: 2412
setup ath0 A0:F3:C1:5B:B5:AA
[   12.240000] device ath0 entered promiscuous mode
[   12.250000] br0: port 2(ath0) entered forwarding state
[   12.250000] br0: port 2(ath0) entered forwarding state
[   12.310000] device br0 left promiscuous mode
[   12.940000] device vlan2 entered promiscuous mode
sh: can't create /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeouts: nonexistent directory
[   13.870000] device vlan2 left promiscuous mode
ath9k radio 0: phy0 ath0
sh: can't create /proc/sys/dev/wifi0/silent: nonexistent directory
sh: can't create /proc/sys/dev/wifi0/ledon: nonexistent directory
ath9k radio 1: phy0 ath0
sh: can't create /proc/sys/dev/wifi0/silent: nonexistent directory
/opt/etc/init.d/rcS: No such file or directory
/jffs/etc/init.d/rcS: No such file or directory
/mmc/etc/init.d/rcS: No such file or directory
[   14.250000] br0: port 2(ath0) entered forwarding state
bind: Address in use
/mnt/smbshare
The Milkfish Router Services
ERROR: Necessary service setting not found: milkfish_username - aborting.
[   15.210000] nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead.
The Milkfish Router Services
Restoring SIP ddsubscriber database from NVRAM...
Empty.
The Milkfish Router Services
Restoring SIP ddaliases database from NVRAM...
Empty.

I also deleted ( ERASE ALL ) stupido i .when connect with putty nothing happend. Blank sreen.
How we can re- upload boot ?
Now router work like switch...
Thanks....

Please explain me how reflash bootloader to TP LINK 1043ND v2.1 with SPI programmer.
Where can i find corect file ?

Thanks...

Can anyone help please ?

Thankyou...

Thanks for posting this guide - it worked a treat and rescued what I thought was a dead router!

In case it helps someone else, it took me some time and some careful reading of step 2 to figure out how to get to the command prompt.   (Probably because I read what I was expecting to see...) I thought that it would automatically connect to the tftp server.  I didn't realize that I had to just blindly type "tpl" to get to the prompt.  At that point you can start entering the rest of the commands.

Hi there,
If I use another firmware (e.g. chaos calmer) in the unbrick process, will the count "0x7c0000" change? How do I figure out the new count?
Thanks.

After some research...

openwrt-15.05-ar71xx-generic-tl-wr1043nd-v1-squashfs-sysupgrade.bin firmware has 3.407.876 bytes, so the new count is  0x340004.

So, if I use:

[...]
9. Erase the firmware before writing it again using following command: erase 0xbf020000 +7c0000
10. Download new modified original firmware from computer to the router: tftpboot 0x81000000 code.bin
11. Write the downloaded firmware to flash using: cp.b 0x81000000 0xbf020000 0x7c0000
12. Boot the original firmware again: bootm 0xbf020000
[...]

It won't brick my router cause it erases more sectors than it needs and it will write far more than the firmware size, always respecting the firmware dedicated room.

Am I correct? What kind of data is written to flash at the range 0x340005 and 0x7c0000?

Thanks again.