I just had to register to this forum just to say THANK YOU.... The uploaded firmware works like a charm and Im very happy because of the english menu.... Also if somebody has a problem with Tftpd32 software for upload firmware just see if you have excepted file sharing in local area network!!!

(Last edited by dbucek on 19 Oct 2013, 12:14)

I just want to thank  lofrank, I have flashed EN firmware right now, everything ok.
great job

I would also like to thank lofrank
Brilliant job. Many thanks.

I contacted TP-link yesterday and interestingly received a reply this morning from Lisa huang in tech support.
If the firmware is traditional Chinese it can be upgraded to English
They said go to:-
http://www.tplink.com/en/support/downlo … n=V1#tbl_j
And then go to the management window--go to "系統工具”--“韌體升級”---“瀏覽”---choose the extracted file---go to "升級“.

If it is simplified Chinese then It can't be upgraded and I was to make contact with a colleague.

Google translate identified my version as simplified although it wouldn't actually translate the pages. Neither would it translate if I selected traditional, so I am really none the wiser.

Anyhow. All sorted with lofranks modified firmware.
Thanks again
Excellent job

Oops
Many thanks to jvvh5897 too.
Great work. I was about to delve in to see if I could spot the header differences myself. I would never have thought about the md5 checksum.
Thanks

Would it be possible for someone to post up a blow by blow list of steps on how to complete the modification. I would really like to change over to English

Many Thanks.

Here comes, just did this today.

First of all, thanks to lofranks, jvvh5897, Ccowap etc. for great work.

1. Download the "fixed" English hardware from http://www.mediafire.com/download/za7z3 … -en-up.bin
2. Download suitable tftp server. I used the 64-bit version of tftpd from http://tftpd32.jounin.net/
3. Temporarily turn off your firewall if you are using ZoneAlarm (don't know about other firewalls). If you don't do this you will get 1800X error from the WT702n :-)
4. Turn off wireless on your computer and connect with cable to the WR702n. After a while you should be setup with IP address 192.168.1.100 and 255.255.255.0 netmask. If not you can setup these manually.
5. Start tftp server and set the base directory to be where the .bin-file downloaded in step 1 is. In tftpd you do this by clicking settings, then selecting TFTP-tab and browsing to the directory.
6. Point your web browser to 192.168.1.253, you get a login screen, type admin and hit enter
7. On the menu on the left side of the screen click on "系統工具” (System tool), then select “韌體升級” (Firmware Upgrade)
8. On the next screen you will have place for filename and tftp server address. Set filename to wr702nv1-en-up.bin (which you downloaded in step 1) and address to 192.168.1.100 (which is the IP address assigned to your computer).
9. Below these are two boxes, click the one on the left (don't have the Chinese characters as I've changed to English by now), then click OK.
10. There will be a counter as the file is loaded, you will also see progress in the tftpd main screen. If there is an error you will get a Chinese warning page with error code like 18000, 18001, 18005 etc. If you get this Google translator is your friend. On mine I got error code 18005 when trying to upgrade to incompatible English hardware and error 18000 before I stopped ZoneAlarm.
11. Wait until the device reboots, then just to be safe another few minutes. If nothing happens I would play it safe and wait at least 15 minutes before trying a manual reboot.
12. Now the 702n IP address has changed, your computer should automatically get a new address is the 192.168.0.xxx range.
13. Turn on your firewall and point your browser to 192.168.0.254, you will get login screen, both username and password are admin.

Hope this helps and I didn't forget anything important. Let me know if I did and I'll edit the post.

And if someone does this please copy the Chinese characters on the box to click on step 9 & post here on the board or message directly to me.

Edit Dec-12, 2013: items 10, 11

(Last edited by motojapi on 12 Dec 2013, 17:25)

Thank you very much motojapi, everything went just as you detailed. now on English firmware. Just one small thing I didn't see a reboot (step 11) but maybe I was slow in looking. After leaving for a while reset local area connection  and all was good.

Many thanks again to everyone.

Hi, everyone. if anyone know TP-link WR700N  how to modify firmware from chinese to english 

I need you help. thanks!

Thank you, guys! After 2 years I finally could put an English firmware in my device!
I was able to set it properly even with the Chinese interface, but it is much easier now.

I couldn't copy the Chinese characters for step 9 of motojapi post, but I took a screenshot:
https://dl.dropboxusercontent.com/u/42083808/WR702N.PNG

Thanks again!

Flavio

Registered simply to say BIG THANK YOU to lofrank, ccowap and motojapi for putting it altogether.

I bought one on Ebay but struggled with setting it up.

Translating some of the characters determined that mine was simplified Chinese, not traditional and I still was able to upgrade with the english firmware. I now set it up as a repeater to enhance the signal which allows me now to share media all around the house rather than switching SSID everytime.

Again, thanks a million !!!
Gaetan

In addition to my previous thread, I downloaded and will install the latest FW which is supposed to fix the repeater issue I have a the moment.

Hello,

I tried to upgrade a clone of the TP-LINK WR702n (a Mercury MW151RM) :
- took the patched file wr702nv1-en-up.bin and renamed it to mw151rmv1-cn-up.bin
- replaced what seems to be the model information "07 02 00 01" to "01 51 01 01" (signature found in original firmware)
- and tried to upgrade the mini-router : file is now accepted (since file rename) and progress bar goes from 0% to 100%
- but I still obtain a message "Error Code: 18005 Upload file version does not match with the models." at the end

Maybe it is a MD5 problem... What do you think of it ?
(I see that scwks succeeded in flashing with few modifications but I cannot ask him for his mods because I didn't buy it from him) : http://scwks.blogspot.fr/2013/08/tl-wr7 … grade.html

Could someone help me computing a correct MD5 and putting it somewhere in the file ?
thank you

INFO (header of the original mw151rmv1-cn-up.bin) :
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000  00 14 2F C0 2A FA DA 8F 79 46 81 A5 8A 3D 19 F0  ../À*úÚ.yF.¥Š=.ð
00000010  74 E8 2E 29 49 4D 47 30 00 17 D8 80 01 51 01 01  tè.)IMG0..Ø€.Q..
00000020  00 00 00 01 5A 04 12 66 01 00 00 00 00 00 00 00  ....Z..f........

Can someone help me computing the "famous" MD5 checksum of my newly modified wr702nv1-en-up.bin ?
To sum up, I took the file modified by lofrank (thanks to him) and only changed the model information
("07 02 00 01" to "01 51 01 01" at addresses 0000001C and 0004009C, near 'IMG0')

please help me, I have no idea how to compute a correct MD5 but I have C programming skill ;-)

Hi,
Only changing the model info (0702) and language tag (0001) is not enough.
You should know how to fix md5 sum if you have read whole topic carefully.
Just pay attention on jvvh5897's posts in this topic.

I tried to follow the instructions as described above. It was partly successful but the device wouldn't reboot. I waited a good 15-20 minutes before I pulled the power supply to the device and then re powered it, but it started asking me for a network passcode. I tried the previous one before flashing the device but unfortunately it did not work. I reset the device like 5 times now with absolutely no luck. The device is alright and the wifi signal is available and all but I need the network password to connect to it. I'd really be thankful if you could suggest me some solution to get this device working again.

I noticed that when I reset the device the led flashes 3 times and then later it glows and then it stops for a brief moment and then glows back again.

Update: I connected locally through lan and I could change the settings. The default password is '2FDFB822'. Thanks a lot for the wonderful work. Forever grateful.

(Last edited by krishntej on 25 Mar 2014, 20:11)

registered today because of this topic. i too have this tplink wr702n with chinese fw. i don't have rj45 cable as of the moment so i can't flash mine today.

anyway since the topic is about modifying firmware, may i ask something about this? here in the Philippines, Globe (a network provider here) started distributing huawei b593s-22 lte modems for their subscribers. the problem is that their modems are network-locked and are installed with globe fw. network-locked units aren't an issue because the modem is unlockable via huawei new algo unlocker. one thing that annoys us is the gui (it's globe and not the default huawei). i already found the universal fw for my modem but the problem is that it won't accept cross-flashing like the wr702n chinese fw. is it possible to modify the universal fw and faking it to be a globe fw so that i can install it on my modem? i have no knowledge in hex editing but willing to learn. please help. thanks in advance!

edit: successfully changed two wr702n fw using mojotapi's post as guide. after that, i upgraded it's fw into tp-link's official english fw. it's like i bought an english wr702n now! thanks a lot mojotapi for the procedure! and thanks to all the people involved in editing the fw to make it useable on our chinese fw wr702n.

(Last edited by paranoia_rebirth on 14 May 2014, 15:00)

Hi,
Thank you for your help.
I tried several ways to compute the MD5 but without success.
I also tried to understand the jvvh5897 post but didnt find any simple and correct solution to compute a MD5 (on what section of data ?).
I will rework on that later... or get rid of the small funny box.

Hello everyone!

I just registered to thank this person. Thank you for your wonderful and easy tutorial. I now have a 702n in English Got one in Beijing last summer, knew how to set it up but this is way better

Tnxx & bye!

(Last edited by jaaperror on 27 Apr 2014, 21:46)

Thank you for help with this!! And all the others who helped also!!

Tnx ! And, what default wifi Security key on this firmware ?

Hello,

I have the same above problem but couldn't even get to the settings page through lan, it was 192.168.1.253 but not anymore and not 192.168.0.254 either. I tried that default password '2FDFB822' mentioned above but obviously it's not the same for all devices.

Appreciate if somebody can help.

Thank you! Thank you! Thank you!  I literally had this router in the garbage many times and I pulled it out each time knowing that one day I would be able to use it fully as intended!  I'm not against Chinese, but man is it difficult to read those characters!

Thanks again!

My situation was the same as others.  I followed the guide, but the device did not reconnect as stated.  It did however have no problems connecting to the newer assigned IP address upon switching my settings back to automatically detect IP. 

THANKS!!!!!!!!!!!!

For anyone who has a FAST FW171, I've modified the TL-WR702N English firmware to work on it. I've also written a detailed article on how to load it in. The article also shows in detail how I modified the firmware, in case someone wants to know how to make it work with a different clone, or a different firmware. Thanks to jvvh5897 for the legwork!

Installing English Firmware on a FAST FWR171

I just registered to say thank you for the WR702N firmware!
I just disabled my anti-virus and even the Windows Firewall so that no problem would occur during the flashing process!
God bless you!

(Last edited by tzikas on 9 Jan 2015, 17:05)

Thaks to jvvh5897 for his research.

He inspired me create a project for the automotion translating of messages in FW.

I looked into FW and found some interesting features what contain in Chinese version. And I thought why we should changing FW if we want to change only messages in FW. One more thanks to jvvh5897 for great idea. All the more so the newer version will be released and we probably wanting to use it.

So the global idea is - Unpack files from file system - Translate their contents (using Google translator for example, probably not only on English) - Pack back to file system - Correct MD5 checksum and the translated FW is ready !!!

I started my project on Python 3, because it is my favourite language, it is crossplatforming and it is very simple to understand.
At first I wrote a class for working with Windriver MemFS file system which was used in this FW.

# version 1.1 build 19-01-2015
# IMPORTANT !!! The file_name is case sensitive !!!

import struct, lzma

class WindRiverFS ():
    def __init__(self, compressed = 1, attribute = 0):
        self.memfs_sig = b'owowowowowowowowowowowowowowowow'
        self.memfs_header_len = 0x2C
        self.memfs_directory_item_len = 0x30
        self.external_compression = False  # Choose True if you want to use external compressor LZMA.EXE
        self.memfs_compressed = compressed
        self.memfs_attribute = attribute
        self.format_fs()

    def mount_fs_from_firmware(self, firmware_image):
        self.memfs_header_ofs = firmware_image.find(self.memfs_sig)
        if self.memfs_header_ofs != -1:
            print('Wind River MemFS Header found at : 0x%08x' % self.memfs_header_ofs)
            self.temp, self.memfs_compressed, self.memfs_num_files, self.memfs_attribute = struct.unpack_from('>32sLLL', firmware_image, self.memfs_header_ofs)
            print('Compressed      :', self.memfs_compressed, '\nTotal files     :', self.memfs_num_files, '\nMemFS attribute : 0x%04x' % self.memfs_attribute)
            self.memfs_directory_ofs = self.memfs_header_ofs + self.memfs_header_len
            self.memfs_filedata_ofs = self.memfs_directory_ofs + self.memfs_num_files * self.memfs_directory_item_len

            self.format_fs()
            for i in range(self.memfs_num_files):
                self.f_name, self.f_len, self.f_ofs = struct.unpack_from('>40sLL', firmware_image, self.memfs_directory_ofs + i * self.memfs_directory_item_len)
                self.memfs_directory.append(((self.f_name[:self.f_name.find(b'\0')]).decode('utf_8'), self.f_len, firmware_image[self.memfs_header_ofs + self.f_ofs : self.memfs_header_ofs + self.f_ofs + self.f_len]))

            self.memfs_end_ofs = self.memfs_header_ofs + self.f_ofs + self.f_len
            print('Trace message: End addr : 0x%08x' % self.memfs_end_ofs)
            self.memfs_end_ofs += (-self.memfs_end_ofs % 0x04) # Word alignment
            self.memfs_body = firmware_image[self.memfs_header_ofs : self.memfs_end_ofs]
            print('Wind River MemFS total length : 0x%08x' % len(self.memfs_body))
            return True
        else:
            return False

    def put_fs_into_firmware(self, firmware_image):
        self.memfs_header_ofs = firmware_image.find(self.memfs_sig)
        if self.memfs_header_ofs != -1:
            print('Wind River MemFS Header updated at : 0x%08x' % self.memfs_header_ofs)
            self.temp_firmware = bytearray(firmware_image)
            self.rebuild_fs()
            self.temp_memfs_body = self.memfs_body + b'\0' * 4 # 4 zero bytes as mark of the end of FS
            self.temp_firmware[self.memfs_header_ofs : self.memfs_header_ofs + len(self.temp_memfs_body)] = self.temp_memfs_body
            print('Wind River MemFS total length : 0x%08x' % len(self.memfs_body))
            return self.temp_firmware
        else:
            return None

    def dir(self):
        return [x[:2] for x in self.memfs_directory]

    def read_file(self, file_name):
        self.file_body = None
        for i in self.memfs_directory:
            if i[0] == file_name:
                self.file_body = i[2]
                if self.memfs_compressed == 1:
                    if self.external_compression:
                        # External decompressor call begin
                        import os
                        self.f_name = '$tmp7546'
                        self.f_tmp = open(self.f_name + '.lz', 'wb')
                        self.f_tmp.write(self.file_body)
                        self.f_tmp.close()
                        os.system('lzma.exe d ' + self.f_name + '.lz ' + self.f_name + '.tmp')
                        self.f_tmp = open(self.f_name + '.tmp', 'rb')
                        self.file_body = self.f_tmp.read()
                        self.f_tmp.close()
                        os.remove(self.f_name + '.tmp')
                        os.remove(self.f_name + '.lz')
                        # External decompressor call end
                    else:
                        self.file_body = lzma.decompress(self.file_body)
        return self.file_body

    def delete_file(self, file_name):
        self.status = False
        for i in self.memfs_directory:
            if i[0] == file_name:
                self.memfs_directory.remove(i)
                self.status = True
        return self.status

    def append_file(self, file_name, file_body):
        self.file_body = file_body
        if self.memfs_compressed == 1:
            if self.external_compression:
                # External compressor call begin
                import os
                self.f_name = '$tmp7546'
                self.f_tmp = open(self.f_name + '.tmp', 'wb')
                self.f_tmp.write(self.file_body)
                self.f_tmp.close()
                os.system('lzma.exe e -lc0 ' + self.f_name + '.tmp ' + self.f_name + '.lz')
                self.f_tmp = open(self.f_name + '.lz', 'rb')
                self.file_body = self.f_tmp.read()
                self.f_tmp.close()
                os.remove(self.f_name + '.tmp')
                os.remove(self.f_name + '.lz')
                # External compressor call end
            else:
                my_filters = [{"id": lzma.FILTER_LZMA1, "lc": 0}]
                self.file_body = bytearray(lzma.compress(self.file_body, format=lzma.FORMAT_ALONE, filters=my_filters))
                struct.pack_into('<Q', self.file_body, 5, len(file_body))  # Insert Length of uncompressed file (bug PyLZMA)
        self.memfs_directory.append((file_name, len(self.file_body), self.file_body))

    def rebuild_fs(self):
        self.temp_memfs_header = struct.pack('>32sLLL', self.memfs_sig, self.memfs_compressed, len(self.memfs_directory), self.memfs_attribute)
        self.temp_memfs_filetable_len = len(self.memfs_directory) * self.memfs_directory_item_len
        self.temp_memfs_curent_file_ofs = self.memfs_header_len + self.temp_memfs_filetable_len
        self.temp_memfs_filetable = b''
        self.temp_memfs_filedata = b''
        for i in self.memfs_directory:
            self.temp_memfs_filetable += struct.pack('>40sLL', i[0].encode('utf_8'), i[1], self.temp_memfs_curent_file_ofs)
            self.temp_memfs_filedata += i[2] + b'\0' * (-len(i[2]) & 0x03)  # Word alignment
            self.temp_memfs_curent_file_ofs += i[1] + (-i[1] % 0x04)  # Word alignment
        self.memfs_body = self.temp_memfs_header + self.temp_memfs_filetable + self.temp_memfs_filedata

    def format_fs(self):
        self.memfs_directory = []

    def get_fs(self):
        self.rebuild_fs()
        return self.memfs_body

I found what the internal Python LZMA library has no good level of compression, so I implement alternative way in external LZMA utility. The class supports two ways of compression depends on the value of the "external_compression" variable.

And simple example to repack files. It takes a file test_fw_cn.bin as a source firmware file, extracts all MemFS files in subdir \test (must be created before start a program) and repack these files into the firmware, calculates new MD5 check sum and saves it as test_fw_update.bin at the same directory.

import memfs, hashlib

print('Running Wind River MemFS repacker v0.9 14.01.2015')
f_in = open('test_fw_cn.bin', 'rb')
input_fw = f_in.read()
input_fs = memfs.WindRiverFS()
if input_fs.mount_fs_from_firmware(input_fw):
    print('Trace message: Successfuly mount input MemFS')
    print('Trace message: Compressed : 0x%04x' % input_fs.memfs_compressed)
    print('Trace message: Attribute : 0x%04x' % input_fs.memfs_attribute)

    temp_dir = input_fs.dir()
    i = 0  # exclude CASE SENSITIVE
    for temp_file in temp_dir:
        print('Trace message: Read file ', temp_file[0])
        temp_body = input_fs.read_file(temp_file[0])
        t_file = open('test\\%03d' %i + str(temp_file[0]), 'wb')
        t_file.write(temp_body)
        t_file.close()
        i += 1

    input_fs.format_fs()
    i = 0  # exclude CASE SENSITIVE
    for temp_file in temp_dir:
        print('Trace message: Write file ', temp_file[0])
        t_file = open('test\\%03d' %i + str(temp_file[0]), 'rb')
        temp_body = t_file.read()
        input_fs.append_file(temp_file[0], temp_body)
        t_file.close()
        i += 1

    output_fw = bytearray(input_fs.put_fs_into_firmware(input_fw))
# MD5
    md5_sig = b'\xCC\x96\x28\xEE\x8D\xFB\x21\xBB\x3D\xEF\x6C\xB5\x9F\x77\x4C\x7C'
    output_fw[0x04:0x04+0x16] = md5_sig
    m = hashlib.md5()
    m.update(output_fw)
    md5_res = m.digest()
    output_fw[0x04:0x04+0x16] = md5_res
# MD5
    f_out = open('test_fw_update.bin', 'wb')
    f_out.write(output_fw)
    f_out.close()

All we should to do is translate a messages.

TO BE CONTIINUE...

(Last edited by tarask1n on 24 Jan 2015, 14:34)