OpenWrt installation on HLK-RM04

I know, this HLK-RM04 is old and not supported since 2019.
However, it's still used a lot.
Anyway, there are tones of post on how to flash OpenWrt.
They are all very confusing some are even contradictory.
Do someone have a good simple and clear method?
Also few questions, the uboot128.img is a .img file, firmware is a .bin.
1 - How to flash a .img ?
2 - Any difference in the method to flash the ubout128.img vs the stock .img firmware?
3 - How to flash a .bin ?
4 - What's the difference between the .img and the .bin ?
5 - By flashing different firmwares .bin files using TFTP, I have different results, some work, some don't and fail with a "Bad Magic Number" message. Is someone has some explanation of it? Is there way of fixing the problem? I saw somewhere the poking of address 0x207f94 and 0x207fa4 with values containing the file size, but it doesn't seem working.

Also, what is the easiest way to rolling back to the stock firmware once OpenWrt (any version) has been flashed?

My device is not bricked, the boot loader gives me the different flashing options and some of the OpenWrt firmwares work.
But the device is limited and due to memory, configuring the device without the webUI is not something you will do easily everyday. For this reason I am planning to roll back to manufacturer firmware.

Thanks for any help.

for 1-4 see the ToH page for your device

for 5 hard to say without knowing what we are talking about... likely size or other compatibility issues...

1 Like

You can also follow the steps explained here in the link below to install uboot, openwrt, ... on your device.
DNC Labs

And about bad magic number, as I guess, your using the squashfs-factory file after compiling the Openwrt, You must use squashfs-sysupgrade instead.

Give more details if these didn't work.

1 Like

Yes this works when you start from a brand new HLK-RM04 from the manufacturer.
But if you already changed the Uboot code using for instance Uboot256.img instead of 128 and you have a 4M RAM/16M Flash model, then how do you go flash back the correct Uboot code?
Also, how to refresh the original .img firmware from OpenWrt ?


Thanks wulfy23. The ToH page is useful for flashing starting from the stock firmware.
But it doesn't answer some of the questions, like what's the difference between stock firmware .img file and the compiled OpenWrt .bin file.
Once OpenWrt is installed, how to flash a .img ? The HiLink webpage is not available anymore.

Also, I was trying to find out what model I have, 4MiB Flash + 16MiB RAM or 8/32?
I thought the easiest was to check the chip part number. So in my case - unfortunately - a 4/16MiB only, when actually I was supposed to receive a 8/32MiB. So be careful with some vendors specially on eBay.
I found out that the new 8/32MiB model reference is HLK-RM04-8 when the old 4/16MiB doesn't have the -8 at the end.

I am still looking for a way to reinstall the stock firmware.


well have to agree to disagree on that one...

speaking of questions... can you show me where it tells you to do this?

messing with hardware requires at minimum the ability to read and comprehend instructions... seeking support is secondary to that...

we've all stuffed up... not read something... skipped a step somewhere... happens all the time... (I fried an i7 nuc this week sending 12v into the pwm line) how did you go with seeking resolution with the seller if it was not as advertised?

at this point... I urge you to throw that thing in the closet... pick something easier to mess with... do it slower this time... and maybe open the closet in a year when your fundamental skills have progressed... or just throw it in the bin?

wulfy23, nobody is forcing you to answer if you don't want to or if you find the question hopeless.
Like too many people you're doing assumptions not knowing anything, criticizing or publishing mean comments, and all that is not helping.
Thanks anyway, and sorry if I bothered you.

1 Like

The bootloader file can be changed in uboot's menu.
Just like burning a new firmware, you can change bootloader too.
(keep in mind that using bootloader with larger size than your flash will break your device)

simply by pressing 9 in the menu above, uboot can be changed.

1 Like

And installing the stock firmware is almost impossible.
You must have the binary file from manufacturer, or backing up a brand new flash by unsoldering it, blah blah ... .

1 Like

Ok, Thanks mayaz, this was useful.
We have about 1000 of these devices and want to repurpose them using the original firmware.
We previously successfully installed a stripped version of OpenWrt ( rt305x-hlk-rm04-generic-sysupgrade.bin ) for the need of the application. I am not sure anybody had the idea to backup the original firmware bin code.
I'll see if I can find one still original and extract the binary data from the flash, but I think they all have been changed.

I have had an HLK-RM04 v1 (4M flash / 16M RAM) working successfully for about 6 or 7 years now. Back then I compiled a firmware based on r49395 sources. I now want to add a small new feature to busybox. That means I need to compile a new firmware.

Unfortunately I had deleted the complete openwrt folder. No problem. I clone the 19.07.2 sources and compile a new firmware, right?

A long story short. After flashing there is nothing mounted on /overlay so no space for configuration, nothing.

Anyone had the same problem? I added mem=16M to the kernel command string to avoid having to (de-)solder resistors.

Forget about using HLK-RM04 v1 (4M flash / 16M RAM) with new firmware. Compiling 18.06 sources results in out of memory after boot, with 19.07.2 sources you end up without jffs2 after boot:

jffs2 not ready yet, using temporary tmpfs overlay

And yes, this information is missing on

The only way forward is chaos calmer. You can download the sources off github and compile them with an older version of gcc, like gcc (Ubuntu 4.8.4-2ubuntu1~14.04.4) 4.8.4.

You may say that the 15.05 sources are outdated and have security flaws but that's of no concern as the HLK-RM04 is not a router product, but a low-cost embedded UART-ETH-WIFI module.

Anyway, with these 15.05 sources I created a firmware including dnsmasq, dropbear, httpd, openssh-sftp-server, rsync, wget and everything needed for wifi. If you like to know how exactly, just let me know.

This thinking is dangerous and incorrect. These days attackers try every venue available to them, often using unknowing scapegoats whose devices they already control. Every device attached to your network is securoty sensitive and needs to be patched (or replaced, where that is no longer viable). A lot of high-profile security vulnerabilities have been found and fixed since 15.05.x, quite a few affecting wireless security and other features always exposed to your network or your surrounding. The modern web might even use your browser (javascript, web assembley, …) to attack other systems within your network (yes, the browser's security context should prevent that, but regularly fails at doing so), exploiting known security issues and using those as their bridge head within your network to infect the rest.

1 Like

Unfortunately the module crashed three days after flashing a 15.05 based firmware (r48532). Therefore I returned to the firmware compiled long ago with r49395 (DESIGNATED DRIVER) sources.

Who knows where to find these sources?

Finally I built a beautiful firmware. With v17.01 sources. Yes, LEDE. Apart from dnsmasq, dropbear, httpd, openssh-sftp-server, rsync, wget and everything needed for wifi, it features shell history and zram-swap, which makes it stable as a rock. If you like to know how exactly, just let me know.