-How to flash firmware over BootloaderValid for TPLINK WR-703N and WR740N v4.

This is valid to flash any firmware you want, but also to recover from bad firmw
are flashing too!!
(If you didn't damage the bootloader itself, which is very strange to be flashed
with common firmwares)
Tested firmwares are 740n v4, 703n,openwrt(choose "Factory" file, not "SysUpgrad
e"!), and DD-WRT (choose "factory-to-ddwrt" , don't use webflash version).

Things you'll need:

Quote:
Terminal(putty, teraterm, hyperterminal, that's your choice)
Tftpd32: http://tftpd32.jounin.net/
firmware (in .bin format)
Ethernet cable
Solder and soldering iron
Thin cable
Serial adapter
STOCK FIRMWARE FOR 740N V4:
http://www.tp-link.es/Resources/software/TL-WR740N_V4_111130.zip
Uncompress and use the file:
wr740nv4_en_3_12_11_up(111130).bin

You have to solder a serial port like here:

**EDIT**
DO NOT DO TRY THE RESISTOR FIX!! THEY DON'T AFFECT THE RX RELIABILITY.
Also, sorry for the mistake. RX and TX are reversed!

Once you got the serial, open a terminal with this settings:
Quote:
115.200 baud
8 bit data
1 bit stop
no parity
no flow control
Don't worry about Tx and Rx pins.
Obviously router's RX goes to computer's TX, and so on. But if you get them reve
rsed you won't break anything.

If you don't see anything on console, maybe they are reversed, so try swapping t
hem.
Power on the router and you will see the console booting up.
You will see
Quote:
Autobooting in 1 seconds
That means that the bootloader waits for you 1 second before continue loading.
So you must power on and type "tpl" as soon as you see anything in the console,
to enter the command line.
Quote:
tpl
If sucess you will be in command prompt:
Quote:
hornet>
Now, connect an ethernet cable betweeen your computer and the router, any port w
ill be ok but NOT WAN port.
Configure IP address in ethernet interface of computer as:
Quote:
IP address: 192.168.1.100
Subnet mask: 255.255.255.0
gateway: blank
dns1: blank
dns2: blank
Copy "firmware_file.bin" file from into tftpd32's folder. (you can flash any com
patible firmware, but in must be in .bin format!)
Now open TFTPF32.
Now, in the bootloader shell, type this and press enter:
Quote:
hornet> tftpboot 0x81000000 firmware_file.bin
(you have to put the same name as the file you copied in TFTPD32's folder)
Then you will see it downloading the file:
Quote:
eth1 link down
dup 1 speed 100
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.111
Filename 'firmware_file.bin'.
Load address: 0x81000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################

#################################################################
#################################################################
######################################################
done
Bytes transferred = 3932160 (3c0000 hex)
It should put "3c0000 hex" at the end , check it!!
Otherwise DO NOT continue, a bigger file may overwrite your router factory calib
ration data and you won't be able to recover them.
At this point, don't worry if it was a different size, the transferred data is s
tored in RAM, so you can retry with other file, or shutdown the router.
You're still in the safe area, nothing is deleted/flashed yet!
When finished type:
Quote:
hornet> erase 0x9f020000 +0x3c0000
(check twice when typing, this is dangerous, you can brick it if wrong numbers a
re typed, and there is no JTAG!! )
Now, it should have erased 60 flash sectors as this:
Quote:
First 0x2 last 0x3d sector size 0x10000
61
Erased 60 sectors
Now the last command:
Quote:
hornet> cp.b 0x81000000 0x9f020000 0x3c0000
This will copy the image you downloaded with tftpboot and saved to the RAM into
the flash.
Again, type the correct numbers, or you will copy some ramdom data from the memo
ry into flash, thus writing incorrect data, overwriting the factory calibration
data or even corrupting the bootloader.
When finished, your router will be flashed and ready:
Quote:
Copy to Flash... write addr: 9f020000
done
Now power off the router, wait 2-3 seconds and power on again.
If you flashed the correct file you will have a working router.
Just for letting the people knowing:
I sucessfully flashed the WR703N firmware onto WR740N v4 with this method (to ma
ke it work as repeater while I was learning to setup openwrt Laughing ).
Firmware here:
Link to 703N firmware:
http://tplink.cn/downloadfilesuploadfolder/2012110162848.rar
(slow link due chinese server...but only 3.5MB, be patient)

Have fun! Twisted Evil

Last edited by dabyd64 on Mon Mar 04, 2013 8:22; edited 19 times in total