Bricked D-Link DIR-1750

I have a D-Link DIR-1750 that I tried to upgrade with an official D-Link image but it bricked my router. I tried to reinstall every version of firmware offered by D-Link for this model but it always fails. I attached a USB-TTL serial device to the port inside the router and can watch how it fails, looks like it fails to decrypt the image or it does a checksum on the file and fails. I see that OpenWrt does not support this model of router unfortunately, however I was able to get one version loaded. The MediaTek MT7629 rfb AP. I noticed that the command prompt while connected showed MT729> so I tried this and it does load and run, however this firmware is not for a normal router and the UI does not come up.

My question, is there any other OpenWrt firmware for any other router based on the MediaTech 7629? I cannot seem to find anything but wanted to ask in case I missed something.

Thanks

Every device needs its very own bespoke firmware, just uploading whatever you find somewhere is a sure way to brick your device forever.

1 Like

a lot of the dlink firmware is encrypted for the web upload
but the recovery page only accepts unencrypted firmware (mt7621& ath79)
yes it makes no sense but it is what it is
I did have a quick look and the format look's different than the mt7621's
so you may have to track down who manufactures the router
the DIR-1760-1960-2660-3060 & DIR-867-878-882 where made by " Shenzhen Gongjin Electronics"

I think you best option is to try and find the GPL source code & go from there

I understand that but my first goal was to see if the my router was completely dead or not by having something run on the router again. Other MediaTech builds failed as it saw it was an invalid device and not written for the MT7629 but was happy to see something could at least run.

I will do a little more searching, thanks @Lucky1. I tried going through D-Link Support but they just gave me a link to the firmware from their website which does not work. Why have a Recovery mode that requires unencrypted firmware and never provide that firmware? That is insane to me. Maybe this works with other models but I will stay away from D-Link in the future.

well your router is not dead
how ever you have to be aware of the calibration data for the radios "ART"
this is not replicable yes you can copy from another unit but will never works as well again
unless you send it back the the manufacture & they recalibrated that unit

class this as lesions learned

find yourself another of the same model
backup it's flash & manually extract the unencrypted firmware
upload it & hope you didn't erase you calibration data

or build firmware from the gpl code
or fine the encrypt / decrypt program in it
https://dlink-gpl.s3.amazonaws.com/GPL1900178/DIR1750A1_FW100b17-FOSS.tar.gz

The problem just is, blindly force-flashing other firmwares has a high potential of overwriting non-replaceable -unique to your device- data, just like the wireless calibration data (or ART, as Lucky1 mentioned). So while your device wasn't dead before, you might have killed its ability to use the wifi this way (already) - or you might have been lucky by chance, but that's impossible to say from here for an unknown device. And chances to hard-brick the device (e.g. the bootloader) are high as well.

Thanks for all the great information. I never thought there would be something about the wifi having a software config in the firmware but it does make sense. And thanks @Lucky1 for the link, however when I finally got the build to work, the bin file created fails to boot just like the official D-Link versions. So I think this was a lesson learned and it was only $100 so not that expensive a lesson at that.

I appreciate all the help!

1 Like

@mdede439 Did you get the solution? If not let me know… I have the firmware…. You can upload it from recovery mode….

I also face the same issue but i build the firmware from GPL Code and now it’s working fine

My solution was to buy another router. If you have the BIN file I could try it as a exercise and maybe learn more.

Thanks for your response.

1 Like

Here is the link... if its work please let me know, Thanks

Just for reference, this device is very similar to DIR-1950, which is also based on MT7629 and uses the same firmware encryption format. The problem with OpenWrt was that wifi and the second CPU core are not yet supported, c.f. OpenWrt support for D-Link DIR-1950 rev. A1

The decryption keys are derived using HMAC with the model name as input and model string as key, both can be found as plaintext in the image header:

echo -n DIR-1750 | openssl dgst -sha1 -hmac MT7629B_DIR-1750-S1-1904

will result in the key 8825167f33caba4fb71519db9313d6d41003121e

To decrypt, strip the first 0x74 bytes from the header (should start with Salted__) and run

openssl aes-256-cbc -d -md md5 -in DIR-1750A1_FW111B03_noheaders.bin -out DIR-1750A1_FW111B03_decrypted.bin -k 8825167f33caba4fb71519db9313d6d41003121e

It is important to enforce -md md5 here, as this is no longer the default with current versions of OpenSSL (unlike the one present on the router).