Full Instruction: How to unbrick TP-Link TL-WA860RE v1 using serial port on Windows

TL-WA860RE v1 Repeater
after factory resetting the repeater it was not possible to enter the Tp-Link configuration site (loaded the quick setup site, but couldn't click Exit or Start because he got stuck everytime. also no ssh or telnet possible. the only sign of life i could get, was a working ping and the two green LED's for Power & Network)
so i found two half complete instructions on the web and figured the rest out by myself.

use at own risk!


  • bricked Repeater :confused:
  • Ethernet Cable
  • Arduino or USB to TTL Converter (i used an Arduino. no detail instructions for TTL Converter here)
  • soldering iron + small wires
  • time, but with this instruction you maybe can get it done in 2 to 3 hours

First part: Hardware

  1. open the case of the Repeater (Warning - High Voltage. use ducktape to isolate the ac passthrough socket)
  2. plug the repeater into a socketboard. one with a main powerswitch is nice because you can't plug it in/out without destroying the temorary soldered connections.
  3. connect the Repeater and your PC over the Ethernet Cable
  4. solder one wire to pin TP9 (RX), one to pin TP10 (TX) and one to ground (using the Antenna's shield)
    take a look at the pictures here:

and here is how this looks like:

  1. connect the other side of each of the three wires to Arduino (Rx, Tx and Gnd) or to your TTL Converter
  2. connect GND to Reset on your Arduino. this lets you directly use the Rx/Tx Pins of your Arduino with a serial monitor like PuTTY
    check if your Arduino can be used for this. i had a Mega 2560 laying around
    --> https://forum.arduino.cc/t/arduino-as-usb-ttl-converter/350458 :white_check_mark:
    --> https://create.arduino.cc/projecthub/PatelDarshil/ways-to-use-arduino-as-usb-to-ttl-converter-475533
  3. connect the Arduino/TTL Converter to your PC using a USB Cable

Second part: Software

  1. download latest original firmware
    TL-WA860RE v1 file from TP-LINK website

this file includes the bootloader as you can see in the name. we have to cut the bootloader part out of it...

  1. remove the two brackets () from the filename because the command line can't handle them.
    wa860rev1_en_3_15_8_up_boot(150820).bin --> wa860rev1_en_3_15_8_up_boot150820.bin

the command to modify this file using Ubuntu is:
dd if=<original_file> of=tplink.bin skip=257 bs=512

if you are using Windows you could search the web for "How to install Windows Subsystem for Linux (WSL) on Windows 10" to get a linux bash running on Windows. or maybe someone can upload the modified file to the openwrt page?

  1. use this adapted command:
    dd if=wa860rev1_en_3_15_8_up_boot150820.bin of=tplink.bin skip=257 bs=512

  2. configure your PC's network settings to static IPv4 = 192.168.0.X

  3. Download and install Tftpd64 on your PC

  4. copy the generated "tplink.bin" File into the Tftpd64 Folder and check if it really has 3840Kb.

  5. run Tftpd64 and configure it like:
    (except from the IP, windows gives you preconfigured 192.168.0.X from [.4])

  6. Download and install PuTTY on your PC
    [Alternative serial monitor program like screen(linux cmd) or Realterm(windows) is also possible]

  7. run PuTTY and choose serial, then enter the right COM port (look at windows Device Manager) and set Speed(Baudrate) to "115200"
    check if you can see lot of output during repower/reset

Third part: lets do it!

  1. Turn on the Powersupply/Mainswitch for the Repeater or press the reset button of the Repeater.

  2. As soon as you see "Autobooting in 1 seconds" you need to paste
    tpl into the putty command window.
    copy it to the clipboard and right-click in the right moment
    If you miss it, just repower or reset the device and try again.

You will get a prompt:
this means the boot process is stoped
This prompt will allow us to download the firmware from a remote TFTP server.

Lets look at the configuration

  1. printenv
    your can see that the default IP is set to 192.168.1.X for serverip & ipaddr
    (of course you could have set your PC's IP at [Software 4.] to 192.168.1.X instead of 192.168.0.X)

  2. change IP to --> your PC running the Tftpd64 server
    wasp> setenv serverip 192.168.0.X

  3. change IP of the Repeater (i took the default ip)
    wasp> setenv ipaddr

  4. check with printenv again if IP is set correct

  5. transfer file from tftp to ram memory
    wasp> tftpboot 0x80000000 tplink.bin

and you will get the output:
Bytes transferred = 3932160 (3c0000 hex)

IMPORTANT: the hex value in the brackets in your PuTTY command window with a TL-WA860RE v1 must be
--> 3c0000 <--
if this is not the case, remodify the firmware file [go back to Software 3.]
if you finish and end up in a bootloop this causes most likely the problem.
i managed to escape the bootloop using tpl [go back to 2.]

  1. next erase 0x3c0000 (3670020 Bytes) from flash memory (starting at 0x9f020000).
    erase 0x9f020000 +0x3c0000

  2. copy firm.bin stored in ram to flash memory 0x3c0000 (3670020 Bytes).
    cp.b 0x80000000 0x9f020000 0x3c0000

  3. boot from flash memory (0x9f020000 address).
    bootm 0x9f020000

well done your Repeater should live again :smiley: have fun

thanks to
juliogonzalez for the how to
post in Polish for the pictures
and tp-linkuser for TP-Link WA850RE v2.0 Bricked - #37 by tp-linkuser
(linked at bedrick section -> https://openwrt.org/toh/tp-link/tl-wa850re)


maybe someone can link it to the main WA860RE v1 site :slight_smile:

is these linux code same for wr941v3?

after looking at https://openwrt.org/toh/tp-link/tl-wr941nd?s[]=wr941#flashing_via_uboot

i ASSUME that

must be changed to

wasp> tftpboot 0x80800000 tplink.bin

but if you do so you also have to change

cp.b 0x80800000 0x9f020000 0x3c0000

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.

Important Correction:
use wasp> tftpboot 0x81000000 tplink.bin
and cp.b 0x81000000 0x9f020000 0x3c0000

if you look into printenv you can see that for this device the right address is
instead of 0x80000000

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.