OpenWrt Forum Archive

Topic: "Bricked" TL-WDR4900 v1.3

The content of this topic has been archived between 25 Mar 2018 and 14 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.


Today I wanted to switch from DD-WRT to OpenWRT to have more functionality. Before I was able to flash OpenWRT I noticed, that the Webinterface of DD-WRT was not reachable ( blank page ). After further investigation, a lot of the services of DD-WRT were not running anymore and almost nothing was working.

So I wanted to remove DD-WRT and replace it with OpenWRT, but I had some trouble finding a way to flash it.

I am able to ping the router, connect to ssh (although my username and password are not recognized), connect to wifi, use DHCP etc.

I tried a hard reset (30/30/30) several times but nothing happened. I also tried to set my IP to static and started a TFTP server to serve a new firmware to my router ( like described in ), but the file was never fetched. The router just instantly boots up and is in the same situation.

What can I now do to remove DD-WRT and install OpenWRT ?

Since this is not directly DD-WRT related I do hope you will be able to help me.

Best Regards


Personally I think you would be better off reverting from dd-wrt to stock firmware and then coming to OpenWRT.

The best know-how for that is surely on the dd-wrt forums/wiki/some such?

Edit 10/08/2017 - added new link, as the old was dead

I tried the recovery mode and it worked perfect.
Download and extract this file:!RkU2gZyI!FCtrgn7lXVQl … vtVRMw61Co
- Set your ip to, mask Do not set anything else.
- Connect the computer to the WDR4900's  switch,any port is ok, BUT NOT wan port!
- Open TFTPD32, leave it visible.
- Power on the router while keeping pressed the WPS/reset button, wait while keeping pressed at least 20 seconds.
- At some point, you should see that TFTPD32 starts a transfer. Just wait, the router will self reboot after 2 minutes or so.
- Done!

Also, have you tried the emergency mode? When the system led blink, quicly start pushing the reset button ,then the led should blink much faster.
Set your ip to, and telnet to 192.1681.1.
You should be on Openwrt shell, now type "mtd -r erase rootfs_data"
It will reset all the data, and restart. Then it will be a fresh Openwrt installation

(Last edited by dabyd64 on 10 Aug 2017, 23:15)

dabyd64 wrote:

Also, have you tried the emergency mode? When the system led blink, quicly start pushing the reset button ,then the led should blink much faster.
Set your ip to, and telnet to 192.1681.1.
You should be on Openwrt shell, now type "mtd -r erase rootfs_data"
It will reset all the data, and restart. Then it will be a fresh Openwrt installation

Given that he is still with dd-wrt, does this still hold?  It may default to for telnet address.

Ouch, nope ddwrt doesn't do this I think. Try the bootloader mode.

Thanks for the answers. I tried to flash the firmware again with the files dabyd64 provided, but it still seems to not be working.

The router just starts up, all leds (exept for the 2 wifi leds) are lighing up, then all leds exept for the power led turn off and the lan port 1 led starts to flash. Seconds after this, the lan led stops flashing for a few seconds. Then it starts flashing again and the wifi led turns on (I guess dd-wrt is starting at that point). (I can upload a video if you like)

The TFTP Server does not give any messeges. Here is a screenshot of my lan interface configuration :

Windows firewall is turned off btw.

Is there something I could be doing wrong ?

EDIT: When my the router is turned off tftp32.exe shows as IP-Adress. Is there a possibility that it recognizes the new IP ( too late ?

(Last edited by Steve192 on 12 Jun 2014, 18:02)

All seems OK. For me it worked, and I was using windows 8. Remember to set your ethernet as "work network", not public, maybe it blocks that connections in public mode.
Are you running TFTPD32 as admin? (Right clic->open as administrator)
I think it's some program that blocks the connection.

Yes I'm running it as admin.

The windows 8.1 network center sais "Not identified network" - "public network". Unfortunatly I cannot change the type of an unidentified network.

I will try to use ubuntu to do it and will report back.

EDIT: I also tried it with ubuntu and had no success. In the meantime I installed wireshark on both ubuntu and windows 8.1 to see if the router is searching for a tftp server, and I found nothing.

Is there anything else I could do? Why is my router not searching for a tftp server ? The bios is intact ...

(Last edited by Steve192 on 12 Jun 2014, 19:03)

try to put an ethernet switch (or another router) between 4900 and pc, so that ethernet link is always "up" and tftpd starts correctly and always see the right ip.

Strange thing. Although tftpd32 puts, this is only due the fact that the LAN interface is down, and works when you power the router.
I made a small video:

OK this is strange...

I'm doing the exact same thing and it does not connect to the tftp Server. I will upload a Video tomorrow

I also tried to add a switch between the Router and my PC and it did not work.

(Last edited by Steve192 on 12 Jun 2014, 23:09)

Maybe its something related with the version? Maybe some bootloader version disables this method

I have hardware version 1.3 what Version do you have ?

I finaly made a video of me trying to use the tftp bootloader method. I'm also showing that the Firmware partially boots up and DHCP works.

"Bricked" WDR4900:

If you have no more ideas i will try to connect to the mainboard via RS232. Is the tutorial on up to date ?

not RS232, it must be a 3.3v ttl serial adapter...

obviously you tried powering up with reset button pressed BEFORE power button, not after like it's shown in video?
try also other button (wifi toggle?) ot BOTH.

(Last edited by nebbia88 on 14 Jun 2014, 14:28)

The wifi button is just a switch. But i will try to press the button after powering up. Is there an indicator when I should press it ?

If this does not work, I have one of these laying around … 0CSB5WBP7E

Can this be used to connect to the mainboard ?

EDIT: I tried it in the exact moment as shown in the other video with no success

(Last edited by Steve192 on 14 Jun 2014, 14:42)

Yes, that adapter should work.

I have a v1.3, but mine has green LEDs, yours has blue. Not that the TFTP feature is implemented in the LEDs, but it's still a difference. Do you remember what firmware your WDR4900 shipped with, or did you update to latest stock firmware before flashing DD-WRT? The TFTP reset button method may only be implemented in the most recent firmware, I think it was first discovered last year. My WDR4900 shipped with 130424, and I've used the TFTP recovery without issue.

I don't know if the Wi-Fi toggle will do anything, but no harm trying it in both positions. The reset button should be pressed and held before you power the router on, and until the transfer is finished.

OK same version different hardware is strange. Especially if you think about the use of a hardware version.

My wdr4900 was shipped with the 130320 firmware as far as I know and I did not update it

I've checked mine, is v1.3 too.
I suggest to try with other computer

I tried it with 3 several computers and operating systems ( windows 7; windows 8.1; ubuntu 12.04) now. None worked

Then, get a serial cable and let's ser what the hell is happening there! lol

(Last edited by dabyd64 on 14 Jun 2014, 16:32)


I finally had time to use my serial cable and try to fix my router.
Sadly I had problems doing so. I was not able to access the command prompt by typing "vl" or "tpl" just after the router boots.
There was no reaction to "vl" or "tpl". There was also no change when I pressed the reset button while booting up.

Here is the log:

U-Boot 2010.12-svn18602 (Mar 20 2013 - 10:42:31)

CPU:   P1014, Version: 1.0, (0x80f10110)
Core:  E500, Version: 5.1, (0x80212151)
Clock Configuration:
       CPU0:800  MHz, 
       CCB:400  MHz,
       DDR:333.333 MHz (666.667 MT/s data rate) (Asynchronous), IFC:100  MHz
L1:    D-cache 32 kB enabled
       I-cache 32 kB enabled
Board: P1014RDB 
SPI:   ready
DRAM:  128 MiB
L2:    256 KB enabled
Using default environment

PCIe1: Root Complex of mini PCIe Slot, x1, regs @ 0xffe0a000
  01:00.0     - 168c:abcd - Network controller
PCIe1: Bus 00 - 01
PCIe2: Root Complex of PCIe Slot, x1, regs @ 0xffe09000
  03:00.0     - 168c:0033 - Network controller
PCIe2: Bus 02 - 03
In:    serial
Out:   serial
Err:   serial
Net:   initialization for Atheros AR8327/AR8328
AR8327/AR8328 v1.1 is found!
Autobooting in 1 seconds
SF: Detected S25FL128S_64K with page size 256, total 16 MiB
16384 KiB S25FL128S_64K at 0:0 is now current device
SPI flash read successful
SPI flash read successful
## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   Linux-3.10.40
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    1918109 Bytes = 1.8 MiB
   Load Address: 01000000
   Entry Point:  01000514
   Verifying Checksum ... OK
## Flattened Device Tree blob at 03000000

What am I doing wrong ?

Check flow control option smile

Very good news. Do you have any idea why tftp recovery using recovery mode won't work ?

Nope, I have no idea ...
I have a newer bootloader version ( U-Boot 2010.12-svn18602, the tutorial used U-Boot 2010.12-svn15934 ) so maybe they removed the possibility to start the tftp client by pressing the reset button. But I could not imagine why to do this.

Another possibility would be that the physical reset button is somehow damaged since there is no reaction when I pressed it, not even with dd-wrt "booted" (it should erase nvram if pressed in dd-wrt).

Anyway I now flashed the firmware with the serial cable and it worked. ( I had to turn off "append LF" to get to the command prompt and turn it back on to enter commands )

Thanks for the help everybody smile