Why connect VTref? Does the buspirate use it?
I'm not quite sure, but IIRC my WDR3600 did not have any voltage present on that pin. I did not need to connect it. What router model?
I never used the buspirate, only Rpi1/3. Maybe someone else here knows more?

What exactly did you do with your router? It might be necessary to pull the CS- or one of the Data-Pins of the Flash to ground while powering up the router and executing the initialization commands in OpenOCD. Depending on the flash-content it might prevent the CPU to halt otherwise.
There's some risk to damage the router though. Did not happen with mine, but I just want to point it out.

(Last edited by freezer2k on 9 Jun 2016, 21:22)

I have the same router and situation (messed up uboot) as you. I sorted out the JTAG problems: indeed VTref seems not connected. So I canged the buspirate config (buspirate_mode normal, buspirate_pullup 0) and now I can talk to the hardware. First thing I would like to do is to get back the stock uboot. So I took the uboot image from https://github.com/pepe2k/u-boot_mod/tr … oot_images and wrote it to the flash (flash write_image unlock tp-link_wdr3600_v1_130909.bin 0xbf000000). But nothing on serial console. Only a brief flash of all LED's and then Power stays on permanently. Do I need to strip off something of that file? Where can I find a stock uboot i can wrtie to flash via JTAG?

Update: Now I treid to flash a different image but flash auto probe fails now Not possible to access the flash anymore.

(Last edited by sebr on 11 Jun 2016, 23:41)

Did you erase the flash before writing?

Did you read back the flash after writing and compare md5sums?

Don't think you need to strip anything, seems to be an even 64kb in size. I only flashed my 128kb mtd0 backup or the binary from pepe2k's compile output, which was close to 128kb, so I filled it up with zeros.

I had issues with not erasing the flash before, resulting in garbage that creates issues with CPU halt/flash access. In this case try what I wrote in my previous post:

> It might be necessary to pull the CS- or one of the Data-Pins of the Flash to ground while powering up the router and executing the initialization commands in OpenOCD. Depending on the flash-content it might prevent the CPU to halt otherwise.
There's some risk to damage the router though. Did not happen with mine, but I just want to point it out.

(Last edited by freezer2k on 13 Jun 2016, 12:22)

Hello,
I have interest in pepe2k uboot mod for that reason too, I have achieved this but it only work  740 V4/5
You can download it here:
http://urlstat.eu/uboot740v4_5.bin
it can be flashed thru openwrt if you have u-boot partition unlocked,
keep in mind that this is my compilation of pepe2k mod and most of it features did not work. It just boots the routers, and do not blink the leds. Also flashing it will change router mac address.

Thanks so much!

what's the changes you have made it??
are you tried modifying ap121.h file?

lâu quá ko liên lạc, bữa nay bạn làm gì rồi?

(Last edited by phantnang on 14 Jun 2016, 10:02)

No I not erased before. Simply flashed the uboot image using JTAG. That caused the router to still not boot and now the flash could not be probed anymore. Pulling the data or CS pin low not worked it out.
So I ended up desoldering the flash (no problem thanks to hotair station) and soldering it on a SO-DIP adapter and connect to it with buspirate in SPI mode. Then dumped the flash with flashrom and there was garbage where uboot supposed to be. The following was rather simple: took the lastest stock firmware and cut off the header with a hex editor. The flash layout in the wiki helps you to locate the things inside the bin file and how much to cut off. Then I simply copy the whole content of this file and paste it into the dumped file to overwrite the garbage but keep the ART. After soldering it back the router booted up fine with latest stock firmware and fully functional!
I really think JTAG is the one to blame here as for some reason it not works reliable like yu also experienced.

(Last edited by sebr on 14 Jun 2016, 23:12)

Vẫn thường bạn. Dạo này có mod gì ko?

I do it long time ago and do not remember what exactly was it, but as long as I remember I comment ALL_LEDS_ON function but got no idea inside which file was it

It's here: https://github.com/pepe2k/u-boot_mod/bl … ard.c#L415

thank so much
i've rebuid your mod, it work well with full function u-boot and not blinking the led

đang làm cái bộ điều khiển trung tâm kết hợp camera, báo động và điều khiển thiết bị...Đang kiếm con router mạnh tí như Bufallo AG300H mà trên BMT mình ko có? bạn mua giúp mình được ko?

Come on Pepe
tell me what should I try to make it work on that hardware, I'm ready to brick another router

compile uboot như thế nào bạn. mình làm mà báo lỗi.

dinhchuc@K52Jr:~/u-boot_mod-master$ make tplink_wr740n_v4
fatal: Not a git repository (or any of the parent directories): .git
bash: mips-openwrt-linux-uclibc-gcc: command not found
Makefile:155: warning: overriding recipe for target '.PHONY'
Makefile:153: warning: ignoring old recipe for target '.PHONY'
Makefile:241: warning: overriding recipe for target 'board/ar7240/ap121/libap121.a'
Makefile:209: warning: ignoring old recipe for target 'board/ar7240/ap121/libap121.a'
Makefile:241: warning: overriding recipe for target 'cpu/mips/libmips.a'
Makefile:209: warning: ignoring old recipe for target 'cpu/mips/libmips.a'
Makefile:241: warning: overriding recipe for target 'cpu/mips/ar7240/libar7240.a'
Makefile:209: warning: ignoring old recipe for target 'cpu/mips/ar7240/libar7240.a'
> Configuring for TP-Link TL-WR740N v4 at: Thứ năm, 16 Tháng sáu năm 2016 13:49:37 ICT 
fatal: Not a git repository (or any of the parent directories): .git
bash: mips-openwrt-linux-uclibc-gcc: command not found
Makefile:155: warning: overriding recipe for target '.PHONY'
Makefile:153: warning: ignoring old recipe for target '.PHONY'
Makefile:241: warning: overriding recipe for target 'board/ar7240/ap121/libap121.a'
Makefile:209: warning: ignoring old recipe for target 'board/ar7240/ap121/libap121.a'
Makefile:241: warning: overriding recipe for target 'cpu/mips/libmips.a'
Makefile:209: warning: ignoring old recipe for target 'cpu/mips/libmips.a'
Makefile:241: warning: overriding recipe for target 'cpu/mips/ar7240/libar7240.a'
Makefile:209: warning: ignoring old recipe for target 'cpu/mips/ar7240/libar7240.a'
make[2]: mips-openwrt-linux-uclibc-gcc: Command not found
fatal: Not a git repository (or any of the parent directories): .git
make[2]: mips-openwrt-linux-uclibc-gcc: Command not found
bash: mips-openwrt-linux-uclibc-gcc: command not found
/home/dinhchuc/u-boot_mod-master/u-boot/config.mk:242: recipe for target 'cpu/mips/start.o' failed
make[1]: *** [cpu/mips/start.o] Error 127
Makefile:108: recipe for target 'tplink_wr740n_v4' failed
make: *** [tplink_wr740n_v4] Error 2

Bạn mua online họ bán mà. Mình cũng đang dùng con ag300h đây.

Just try image for WR841Nv9.

Tried it on WR841NV10 and bricked it. (I do that few monts ago) I can try it on 740Nv6 but suspect result will be the same.

(Last edited by nedoskiv on 16 Jun 2016, 10:07)

pepe2K:

Is there any way of extracting factory firmware image by replacing the bootloader with your version? Can the httpd serve regions to memory?

The ISP custom order TP-Link 841n with 8mb flash has a Winbond W25Q64 instead of a 4mb flash chip, so it should be supported by your bootloader. More info here including bootlogs

https://forum.openwrt.org/viewtopic.php?id=65786

The root password is different to other TP-LINK OEM Firmwares. Root/5up doesn't work as with the newer tp-link models.
https://wiki.openwrt.org/toh/tp-link/tl-wdr4300
https://wiki.openwrt.org/toh/tp-link/tl-mr3020 <- as it did on the old

This is an alternative way of extracting the ROM from the OEM u-boot. Worked on the kindle
http://igorsk.blogspot.be/2007/12/hacki … r-and.html

(Last edited by hojuruku on 22 Jun 2016, 13:51)

any one help me, please??
i have replaced flash ic on my router with backup, restore ART & Uboot. My problem is WIFI not work but it work well on stock firmware!

Great you are in Vietnam too. I may need some hardware mod help from time to time, and I'll help you with the software, compiling, debugging wifi. In Hanoi I experimented doing a wifi-mesh a while back.

Can you tell vozforums (I can't make an account) about this for me.
https://vozforums.com/showthread.php?t= … amp;page=1
vs
https://forum.openwrt.org/viewtopic.php?id=65786

Find hojuruku on #openwrt on Freenode IRC.

you replace with uboot you compile?

The location of the art image needed by the wireless driver has some interplay with u-boot I think.

Look at all the other threads with upgrading the flash size. i may run into the same trouble soon. You are glad you backed up the art mtd partition, if not you'd have a router with no usable wifi.

You are looking in the right place. Try and read the forums for information on doing a flash rom size upgrade, and the changes they need to do in software after.
Thank you for telling vozforums about my work on the 941nd v9.2 vn 8mb flash version.

The other crazy idea is to just put the kernel bloated up with everything you need (no modules at all monolithic kernel) , and use the old u-boot - change the uboot-env to set the rootfs mtd partition AFTER the art starting at 4MB in the flash.

Or boot squashfs + kernel in the first 4mb, and tweak openwrt to put jffs2 AFTER the 4MB mark. That's just my 2 cents and it's wrong. The best thing to do is to make your bootloader or wifi-driver load art from the END of your flash.

Luke

(Last edited by hojuruku on 29 Jun 2016, 12:27)

Usually the ART has to be in the last 64k i.e size of rom minus 64k so my 8mb rom is 0x800000 - 0x10000 art partition start. This could vary in theory. The definitive answer is from the datasheet for the exact wifi chip you have in your router. Most ar71xx are as I described.

https://forum.openwrt.org/viewtopic.php?id=41449

(Last edited by hojuruku on 30 Jun 2016, 04:48)

yes, it's still this bugs in my complie

Your uboot = 128kb will delete ogrinal MAC adress

chỉ 123KB thôi!
mình xem trong u-boot đó vẫn còn mac bạn ơi, với u-boot đó + stock firmware vẫn chạy wifi mà!

(Last edited by phantnang on 9 Jul 2016, 09:13)