Cannot flash firmware using TFTP TL-WR841N

Hi everyone,

I recently flashed a bad firmware image to my router (TL-WR841N) using the mtd command from the shell.

Not the first time I flash a bad image, so I tried to go back to the previous version using tftp2. However, the image cannot be uploaded to the router. It gets stuck at about 75% - 90%. tftp2 log shows ERR message: timeout waiting for ack block

So far I have tried:

  • Using at least 3 different TFTP clients, none of them work.
  • Compiled custom firmware with size of 3.2MB, still upload gets stuck at 90%
  • I tried uploading a corrupted firmware image of size 1.9MB. This one completes upload 100%, which makes me believe that flash memory got reduced somehow.

Any suggestions how to fix the issue?

(a) Try flashing the factory image over TFTP, or
(b) Buy a router that isn't so hardware constrained

4/32 devices will shortly fall in the politely named "Difficult" category.

(a) not even the offical TP-Llink factory image fits on the router. Its very strange. It used to work perfectly fine!
(b) I am aware of its limitations, but as I mentioned it used to work perfectly fine. This issue just occurred recently.

1 Like

The big question here is what happened and what the "bad firmware" actually contained and did to your router.

Trying to flash a firmware for a different router by force (mtd) might change its bootloader - and with that its hardware ID and partition map. This would affect what is accepted by the tftp firmware recovery and how much data it will try to read from tftp during a recovery process, respectively where it tries to write it. Depending on what happened, you may be able to "fool" the tftp recovery process by faking the expected (wrong) hwid on a correct firmware image, serial console access may help you identifying what is going wrong here - and serial console access might also allow you to intercept the bootloader and invoke tftpboot manually (either with an initramfs image or flashing directly).

A few things are still possible, but most of them will at least become easier with serial console access - in the worst case you may also need an spi-nor writer to flash the spi-nor chip externally, but if ART was damaged (without you having a backup), it would be game over for the wireless cards anyways…

You really need to consider how much effort you're willing to spend, how much to invest into external hardware (usb2serial adapter, spi-nor flasher, SOIC8 clamps, …) to rescue a 4/32 device, which might not have recoverable wlan anymore.

1 Like

The "bad firmware" was a failed/corrupted OpenWrt build for my TL-WR841N.

Thanks for the detailed explanation!

I figured it may come to a serial flash... Not doing that for now.

Thanks again!!