Materials used:
- 1 bricked mr3020
- 1 ethernet cable
- 1 mini usb cable
- 1 CP2102 USB to UART breakout board - http://www.amazon.com/gp/product/B009T2ZR6W/ref=oh_aui_detailpage_o00_s00?ie=UTF8&psc=1
- 3 female to female jumper wires (mine were supplied with the CP2102)
- 1 soldering iron
- 1 header with 3 prongs or 3 sockets (male or female) - http://www.amazon.com/gp/product/B005HN237S/ref=oh_aui_search_detailpage?ie=UTF8&psc=1
- 1 OSX computer (I used 10.10 Yosemite)
- Download
- Correct openwrt mr3020 firmware
- Download and install
- CoolTerm - http://freeware.the-meiers.org
- TftpServer - http://ww2.unime.it/flr/tftpserver/
- SLAB_USBtoUART - http://www.silabs.com/products/mcu/pages/usbtouartbridgevcpdrivers.aspx
Overview and a brief rundown of what is about to take place:
At this moment the router is rebooting constantly (about once every 2 seconds) because it's trying to load an incompatible firmware and it's not smart enough to do anything else but quit and reboot. What we have to do is gain access to the routers UART pins and send instructions through it using the breakout board and a serial connection. We have to tell it to re-flash itself with a new image from a hosted TFTP server over a standard rj45 ethernet connection.
Steps:
- Open up the MR3020 by taking a really hard piece of plastic or thin screw driver and pry up the edge by the mini usb and ethernet jack. Work your way around until the whole top pops off. It's almost impossible to not nick up or break the casing while prying and bending.
- Once you managed to get the top off, gently lift the board from the edge that is on the opposite side as the ethernet jack until it comes out.
- Holding the board vertical with the ethernet jack pointed upwards, you will notice that there are 4 pins on the bottom with a very small "p1" to the right of them. The 3 rightmost pins are the ones we are going to use. From left to right they are, Ground, RX, TX.
- Solder the 3 pins from the header in those holes, the leftmost hole should be empty.
- Connect your CP2102 breakout board to these pins but you must switch the TX and the RX pins so they are complementing each other, TX should never go with TX. The ground goes with the ground.
- Connect the USB end of the CP2102 breakout board to your computer.
- On the OSX mac, download and install CoolTerm, TftpServer, and the SLAB CP2102 usb driver for the breakout board. Installation is straightforward for all programs.
- Open up CoolTerm and click options. The "Serial Port" option should be lit with a bunch of options on the right including baudrate. Set the port to SLAB_USBtoUART, baudrate to 115200, data bits 8, parity none, and stop bits 1. Then click on the "Terminal" option and select "Line Mode" for "Terminal Mode".
- Click connect. Nothing should be showing because we don't have the router powered up.
- Open up the Settings app in OSX and create an ethernet connection with a manual address of 192.168.1.100 with a subnet mask of 255.255.255.0
- Open the TftpServer and select "Reveal" at the top. An empty finder window should open up. Drag your newly downloaded openwrt firmware to the finder window. Now your Tftp server has a file to upload.
- Towards the upper right quadrant of the screen you should see a dropdown drop with at least one network interface. Make sure that the 192.168.1.100 address is selected.
- Start the Tftp Server by pressing the "Start TFTP" button at the top right hand corner of the screen.
- Connect the ethernet cable from the router to your mac
- Plug in the router and you should see output in the CoolTerm window. If you do not see any output or the "RX" virtual Green light is not blinking, then diagnose your connection. It is possible that you may have the TX and RX wires switched up.
- Once you start seeing output, you will notice that it goes down for reboot quite frequently.
- Type the letters "tpl" into the CoolTerm command line and press enter. This will cause the firmware to recognize connection and wait for further instruction. You will know when this works when it populates the word "hornet >"
- Type in the following (wait for each command to fully finish, some take longer than others):
- setenv ipaddr 192.168.1.111
- setenv serverip 192.168.1.100
- tftpboot 0x80000000 openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin
- erase 0x9f020000 +0x3c0000
- cp.b 0x80000000 0x9f020000 0x3c0000
- bootm 9f020000
- Your router is now rebooting and unbricked! yay!
I hope this helps you and if you have any questions I'll be more than happy to answer them. Happy hacking!
Props to the developers of CoolTerm and TftpServer.
Great documentation:
http://blog.waysquare.com/how-to-debrick-tl-mr3020/
Thanks this saved my TP-WA901NDv3
ReplyDelete