Hey Bob
Tried the openwrt factory image with the same result.
I got it open with a bit of brute force, as it's toast anyway.
Sadly there isn't a nice looking header on the board, but I can see 3 TINY dots labelled as follows:
TP_GND
TP_3.3V
TP_UART_IN
Is that what I'm looking for to manually solder in a suitable USB serial cable?
@bluewww is the one who had the device open. I can only look at the bad photos TP-Link sent to the FCC and those aren't good enough to make out anything: https://fccid.io/TE7WA1201V2/Internal-Photos/18-Internal-Photos-4633115.iframe
My devices are currently in production, so even if I wanted to break them open, I can't easily replace them right now.
But he says in his very first post here that Uart/serial is exposed on three test points. I can only wonder if that means that your TP_3.3V is the UART_OUT pin. I'm just not sure about that.
Maybe post a photo with good quality so we can actually see what is printed on the board and I'll have a look.
Apart from that the serial connection of such devices usually consists of 4 pins: 3.3V, TX, RX and GND.
You definitely need GND so the device and your PC share a common ground so both ends have a reference to even know what 5V is for instance.
You definitely DON'T want to touch the 3.3V because that can lead to your PC damaging the device or vise versa. The PC has its own power supply and so does the device.
RX (your TP_UART_IN) is used to receive commands from your serial console on your PC.
TX is used to transmit whatever the device wants to print to your serial console. And without that you're flying blind.
So either the TP_3.3V pin is the TX pin or we have to find that first.
More awesome info, thanks Bob!
I am struggling a bit for pics to come out well, perhaps these help?
TBH Even if we identify the correct points I doubt my soldering skills are up to it, but perhaps this will help someone else.
Going back to the "blind" TFTP, I did have a look at the traffic with wireshark and it does seem to be transferring an image but then not "doing" anything with it. Perhaps these images need to be trimmed?
Having said that, the image is going in 2-3 seconds which seems suspiciously fast to me...?
Trying the TP-Link firmware or any of the openwrt images doesn't work.
Maybe bluewww can weigh in also?
The bootloader might load the image into RAM just fine, but you don't know what it does after that. It might be checking the image for some checksum or there might be some other problem and that will only present itself via the serial console.
If those are the only three pads you see then you could try TP_3.3V with a multimeter against TP_GND and see if the voltage fluctuates. If it does then that might be TX. But I would rather wait for bluewww to tell you what is what.
Bit out of my depth but I did connect a multimeter to TP_3.3V and TP_GND (I think that is what you meant?).
On reboot with reset pushed and TFTP set up, the power reading spikes twice from 2.9v to 3.0v. That pattern is repeated on every reboot.
Does that make it likely that these are useful spots?
Yes, that's what I meant. If TP_3.3V was the actual Vcc pin then it would read 3.3V constantly. Since you checked and it doesn't that means that it's the TX pin of the SoC and you can connect that to RX of your TTL usb dongle.
Now knowing what connector of the usb dongle needs to be connected to which pad, you can use that together with a serial monitor application (like putty if you're using Windows) and can see what the bootloader spits out.
I'm pretty sure the pads were named something like
TP_UART_IN
TP_UART_OUT
and
TP_GND
One of the UART test pins is hidden in the metal casing which you have to pry of with a screwdriver.
I can make a photo of my device's PCB if you want. It still has the serial wires soldered onto it.
AHA!
Thanks for the reply on this bluewww - a pic would be very helpful, thankyou!
Also, have you had to do a TFTP recovery for this device, and if so which image did you use?
Guess I was wrong with my assumption then. Just strange that the Vcc pin only reads 2.9V. I would have imagined that this would only happen because the multimeter doesn't display the fast change of voltages while characters are sent (if it was the TX pin).
About your bricked device:
Here is a similar bricked TP-Link device after trying to flash the stock firmware: EAP245 (US) V3 - Soft bricked
Might be the same reason your device is now soft-bricked.
But you should of course first get serial console access so you can see what the problem actually is.
About flashing the stock firmware:
I didn't know that either until now because I have no desire to go back to stock on my devices but it seems that if you want to do that then you have to compile the tplink-safeloader.c and convert the stock firmware to a sysupgrade firmware as talked about in this reply: Adding OpenWrt support for TP-Link EAP245 - #145 by svanheule
That of course only works if you have a running OpenWrt firmware on the device. So first get access to the serial console to see what error it spits out.
More great info, thanks very much indeed.
Well, I now have a soldering iron and am ready to ruin...I mean solder some wires to the board.
I took off the cover and saw the extra pin (attached).
When using the various methods to check the pins (i.e. here: https://blog.manchestergreyhats.co.uk/posts/hacking-home-routers-for-fun-and-practise/), am I right to think that the metal frame for that shield is GND?
Thanks again all, great learning experience
As a soldering beginner, you can easily (but inadvertently) combine the one with the other.
Rule #1 for beginners: Don't overheat the board by repeatedly holding the soldering iron for extended periods of time onto the board. Soldering a wire to the board should not require more than 5sec (!) of the soldering iron in contact to the board, per wire.
Fantastic, thanks all!
Out of interest, what wire did you use to make the connections?
Step 1 for me is soldering.
Step 2 will be connecting to a terminal. I may try and use the gpio header on a raspberry pi and minicom. If not a USB dingle will be the way to go.
He used coated copper wire for micro soldering. But if you're careful you might get away with jumper wires like I used on my deco m4: https://imgur.com/a/gK1CHMb
Just don't heat up anything for too long like @tmomas said.
About your step 2: Just make sure that the signaling isn't above 3.3V or else you risk permanently damaging your device. If I was in your shoes I would order a 3.3V dongle like discussed on this page: https://openwrt.org/docs/techref/hardware/port.serial.cables
Hot glue is your friend, glue the cables to empty places on the board to relieve the stress of your soldering points. Masking tape can also come in handy.
Hi all
Well - unfortunately my soldering skills have let me down, so it's the end of the road for me.
It's not really that bad as I thought the device was bricked anyway and have learnt loads during this process.
Thanks once again for the absolutely superb help and advice, I hope documenting things here might help someone else in the future.
hello all,
I managed as well to install on my new WA1201 OpenWRT ( big thanks @bluewww great work!).
The main reason for installing OpenWRT was to have the openVPN client as I need an AP that runs a VPN.
However I see that the openVPN is not available in LuCI. Adding the offical openvpn-openssl packages does not work as this is a custom build.
I tried to build it myself but being new to this stuff I could find any sources related to openVPN on the git shared.
Can anyone help or at least clarify it is possible to have it?
Thx,
Catalin
it's supported through snapshots, once/if you sysupgrade to the openwrt snapshot, you'll be able to use the openwrt package repository.
https://downloads.openwrt.org/snapshots/targets/ath79/generic/
When using snapshots, keep in mind:
I picked one of these up today and installed the latest snapshot on it. It seems to be working just fine so far.
Sorry, I built from master not 21.02.
