Default SSID and Key for TPLink Archer lineup

For Developers
1

Recently I was trying to incorporate default Wi-Fi, most laptops do not come with LAN ports and managing routers on OpenWrt was becoming a problem. So I set out to build custom images with default SSID and KEY. I got a script from the forum made by a member @braian87b, this worked well for my TPLINK WDR3600 and the 841N I had lying around. Though made a few small changes to the script, but overall worked well. Then I turned to Archer C60v2 which I had, on that I figured that the info partition (/dev/mtdblock1) has the KEY and the SSID can be obtained by modifying the previous script.

So, can anyone help me understand whether this works for all Archer models or just for Archer C60v2.

uci set wireless.@wifi-iface[0].ssid="TP-LINK_$(ifconfig eth0 | awk '/HWaddr/ { printf $5 }' | tr -d : | tail -c 4)"
uci set wireless.@wifi-iface[0].key="$(dd if=/dev/mtdblock1 bs=1 skip=520 count=8 2>/dev/null)"
uci set wireless.@wifi-iface[0].encryption='psk2+aes'
uci commit

Thanks

2

the ssid and encryption settings would work for all devices

for example you can test in SSH terminal for SSID generation
(encryption setting has no function so there is nothing to test)

echo "TP-LINK_$(ifconfig eth0 | awk '/HWaddr/ { printf $5 }' | tr -d : | tail -c 4)"

If I understand right, TP link devices like WDR3600 do not have a default password for wireless, so it is not stored in flash...

also, there is 2 radios, so if you want to change the SSID of the other one you probably need to do

uci set wireless.@wifi-iface[1].ssid=

3

If I was a betting man, I'd bet that it does NOT work on more Archer models than it does. Why don't you set it up with a static key in the custom image (which you can then change later)?

4

They do as per the sticker on the back.
I agree on the SSID and encryption settings, they would work for all devices. It was more to illustrate the purpose.

About the 2 radios, yes this was just a sample example code to understand the key parameter. Otherwise, I have implemented the logic to set the properties for 2 radios.

5

Yes, agreed, that is one way(static key) to go about it. But if I wanted to help somebody out with a similar build which they could flash and use the Wi-Fi out of the box without compromising on security to a large extent. One such example was a friend took a router from me while I was not in my hometown, and that hardware was running OpenWrt. Now we don't have laptops with built-in LAN ports, so with this approach he can theoretically just press the reset pin, and use the details printed on the back of the router and carry on with the setup. Or someone out in the wild might put this in a use where access via Ethernet is not an option and having a hard-coded key defeats the purpose of security.

6

I looked at the label of on of my TP Link devices and it says "PIN / Wireless Password"

so assuming that the default password is the same as the WPS pin...

the WPS pin is stored in flash in the uboot partition at the end
on my WDR3600 this is at 0x1fe00
you can see this by doing

hexdump -C /dev/mtd0

so basically you use the same line with dd program to grab that word from flash
remembering that it accepts decimal number of bytes to skip when blocksize (bs) is 1

however the WPS pin is always 8 numbers, so lets make the blocksize 8
then we skip the number of blocks which is bytes divided by blocksize

0x1fe00 ---decimal---> 130560 / 8 ---> 16320

so this will return the WPS pin on my WDR3600

dd if=/dev/mtd0 bs=8 skip=16320 count=1 2>/dev/null

so your uci command would be

uci set wireless.@wifi-iface[0].key="$(dd if=/dev/mtd0 bs=8 skip=16320 count=1 2>/dev/null)"

1 Like
7

Hey Thanks for the commands :slight_smile: I know this and it works for older TPLink Device primarily ones start with TL XXXX, I am trying to confirm for Archer Devices, I have Archer C60, wanted others to let me know if this works for Archer C6/Archer C7 and similar.

8

ok then search the flash yourself like

hexdump -C /dev/mtdX | grep 'something'

9

Hey it already works on my archer C60 with the following code
dd if=/dev/mtdblock1 bs=1 skip=520 count=8 2>/dev/null
I wanted to confirm with others who have other archer devices if this works for them too.