TP-Link 1043N V5 - Factory revert

Hi there. As a quick story: i did a custom firmware of a OpenWrt and flash to tp-link 1043N v5 router, then i tryed to factory revert with tftpd but no luck. It`s stuck at 90% uploading or so...

I did a reflash with tftpd with a trunk version from original OpenWrt and then same, same problem with reverting...

Has something to do a custom firmware with affecting boot partition or so? Because someone else has successfuly reflashed image: [SOLVED] TP-Link TL-WR1043N v5.0?

This is the log from a Jtag when i trying to flash with original stock fw:

U-Boot 1.1.4-g6ce9309a-dirty (Oct 26 2016 - 09:20:53)

ap152 - Dragonfly 1.0

DRAM:  64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 393k for U-Boot at: 83f9c000
Reserving 16448k for malloc() at: 82f8c000
Reserving 44 Bytes for Board Info at: 82f8bfd4
Reserving 36 Bytes for Global Data at: 82f8bfb0
Reserving 128k for boot params() at: 82f6bfb0
Stack Pointer at: 82f6bf98
Now running in RAM - U-Boot at: 83f9c000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x181162c0 to 0x20402100
factory boot check integer ok.
factory boot load fs uboot len 131072 to addr 0x80010000.
Hit any key to stop autoboot:  0
## Starting application at 0x80010000 ...


U-Boot 1.1.4-g6ce9309a-dirty (Oct 26 2016 - 09:24:21)

ap152 - Dragonfly 1.0

DRAM:  64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 122k for U-Boot at: 83fe0000
Reserving 16448k for malloc() at: 82fd0000
Reserving 44 Bytes for Board Info at: 82fcffd4
Reserving 36 Bytes for Global Data at: 82fcffb0
Reserving 128k for boot params() at: 82faffb0
Stack Pointer at: 82faff98
Now running in RAM - U-Boot at: 83fe0000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x181162c0 to 0x20402100
Hit any key to stop autoboot:  0
## Booting image at 9f040000 ...
   Image Name:   MIPS OpenWrt Linux-4.9.87
   Created:      2018-03-31   7:18:31 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1393869 Bytes =  1.3 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f040040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 67108864

Starting kernel ...

[    0.000000] Linux version 4.9.87 (lede@LEDE) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r6566-a64fae8354) ) #0 Sat Mar 31 07:18:31 2018
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  board=TL-WR1043N-v5 mtdparts=spi0.0:128k(factory-uboot)ro,128k(u-boot)ro,15104k(firmware),128k(product-info)ro,640k(config)ro,64k(partition-table)ro,128k(logs)ro,64k(art)ro console=ttyS0,115200 rootfstype=squashfs noinitrd
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 59896K/65536K available (3170K kernel code, 165K rwdata, 796K rodata, 276K init, 213K bss, 5640K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Clocks: CPU:775.000MHz, DDR:650.000MHz, AHB:258.333MHz, Ref:25.000MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000007] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[    0.008217] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.071034] pid_max: default: 32768 minimum: 301
[    0.075984] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.082957] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.092533] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.102936] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.109849] NET: Registered protocol family 16
[    0.115832] MIPS: machine is TP-LINK TL-WR1043N v5
[    0.365899] clocksource: Switched to clocksource MIPS
[    0.372117] NET: Registered protocol family 2
[    0.377447] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.384798] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.391538] TCP: Hash tables configured (established 1024 bind 1024)
[    0.398318] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.404484] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.411331] NET: Registered protocol family 1
[    0.419462] Crashlog allocated RAM at address 0x3f00000
[    0.425764] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    0.438188] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.444331] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.461807] io scheduler noop registered
[    0.465977] io scheduler deadline registered (default)
[    0.471625] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.478677] console [ttyS0] disabled
▒    0.502509] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A
[    0.511607] console [ttyS0] enabled
[    0.511607] console [ttyS0] enabled
[    0.519155] bootconsole [early0] disabled
[    0.519155] bootconsole [early0] disabled
[    0.530552] m25p80 spi0.0: found w25q128, expected m25p80
[    0.545444] m25p80 spi0.0: w25q128 (16384 Kbytes)
[    0.550368] 8 cmdlinepart partitions found on MTD device spi0.0
[    0.556492] Creating 8 MTD partitions on "spi0.0":
[    0.561447] 0x000000000000-0x000000020000 : "factory-uboot"
[    0.568450] 0x000000020000-0x000000040000 : "u-boot"
[    0.574882] 0x000000040000-0x000000f00000 : "firmware"
[    0.605738] 2 uimage-fw partitions found on MTD device firmware
[    0.611889] 0x000000040000-0x0000001c0000 : "kernel"
[    0.618117] 0x0000001c0000-0x000000f00000 : "rootfs"
[    0.624534] mtd: device 4 (rootfs) set to be root filesystem
[    0.630463] 1 squashfs-split partitions found on MTD device rootfs
[    0.636859] 0x000000660000-0x000000f00000 : "rootfs_data"
[    0.643778] 0x000000f00000-0x000000f20000 : "product-info"
[    0.650790] 0x000000f20000-0x000000fc0000 : "config"
[    0.657286] 0x000000fc0000-0x000000fd0000 : "partition-table"
[    0.664555] 0x000000fd0000-0x000000ff0000 : "logs"
[    0.670895] 0x000000ff0000-0x000001000000 : "art"
[    0.677954] libphy: Fixed MDIO Bus: probed
[    0.692415] switch0: Atheros AR8337 rev. 2 switch registered on ag71xx-mdio.0
[    1.383227] libphy: ag71xx_mdio: probed
[    2.017357] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[    2.028915] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:SGMII
[    2.037008] NET: Registered protocol family 10
[    2.044764] NET: Registered protocol family 17
[    2.049527] 8021q: 802.1Q VLAN Support v1.8
[    2.058978] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    2.067806] Freeing unused kernel memory: 276K
[    2.072390] This architecture does not have kernel memory protection.
[    2.555910] random: fast init done
[    2.779346] init: Console is alive
[    2.783035] init: - watchdog -
[    3.830807] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.033868] usbcore: registered new interface driver usbfs
[    4.039665] usbcore: registered new interface driver hub
[    4.045230] usbcore: registered new device driver usb
[    4.055182] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    4.063419] ehci-platform: EHCI generic platform driver
[    4.071242] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    4.078852] ohci-platform: OHCI generic platform driver
[    4.084917] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.102798] init: - preinit -
[    4.827683] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    5.857304] eth0: link up (1000Mbps/Full duplex)
[    5.862197] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    8.137940] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[    8.186119] urandom-seed: Seed file not found (/etc/urandom.seed)
[    8.339863] eth0: link down
[    8.352244] procd: - early -
[    8.355295] procd: - watchdog -
[    8.981124] procd: - watchdog -
[    8.984589] procd: - ubus -
[    9.074919] procd: - init -
Please press Enter to activate this console.
[    9.519347] kmodloader: loading kernel modules from /etc/modules.d/*
[    9.535690] tun: Universal TUN/TAP device driver, 1.6
[    9.540953] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    9.552947] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[    9.644115] gre: GRE over IPv4 demultiplexor driver
[    9.651130] ip_gre: GRE over IPv4 tunneling driver
[    9.662266] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    9.678878] cryptodev: driver 1.9 loaded.
[    9.698929] u32 classifier
[    9.701732]     input device check on
[    9.705511]     Actions configured
[    9.717963] Mirror/redirect action on
[    9.732648] nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
[    9.761578] Loading modules backported from Linux version wt-2017-11-01-0-gfe248fc2c180
[    9.769889] Backport generated by backports.git v4.14-rc2-1-31-g86cf0e5d
[    9.945122] ip_tables: (C) 2000-2006 Netfilter Core Team
[   10.173692] xt_time: kernel timezone is -0000
[   10.381010] PPP generic driver version 2.4.2
[   10.395178] PPP MPPE Compression module registered
[   10.406182] NET: Registered protocol family 24
[   10.417237] PPTP driver version 0.8.5
[   10.529642] ieee80211 phy0: Atheros AR9561 Rev:0 mem=0xb8100000, irq=47
[   10.575046] kmodloader: done loading kernel modules from /etc/modules.d/*


U-Boot 1.1.4-g6ce9309a-dirty (Oct 26 2016 - 09:20:53)

ap152 - Dragonfly 1.0

DRAM:  64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 393k for U-Boot at: 83f9c000
Reserving 16448k for malloc() at: 82f8c000
Reserving 44 Bytes for Board Info at: 82f8bfd4
Reserving 36 Bytes for Global Data at: 82f8bfb0
Reserving 128k for boot params() at: 82f6bfb0
Stack Pointer at: 82f6bf98
Now running in RAM - U-Boot at: 83f9c000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x181162c0 to 0x20402100
run command setenv serverip 192.168.0.66;setenv ipaddr 192.168.0.86
run command tftp 0x80060000 WR1043v5_tp_recovery.bin
Trying eth0
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.0.66; our IP address is 192.168.0.86
Filename 'WR1043v5_tp_recovery.bin'.
Load address: 0x80060000
Loading: checksum bad
checksum bad
checksum bad
#####checksum bad
############################################################
         #######################checksum bad
checksum bad
##########################################
         #######################checksum bad
##########################################
         ################################checksum bad
###checksum bad
##############################
         ######################################checksum bad
###########################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###########################Tftp server tranfer fail!
tftpboot firmware failed, now start normally.
factory boot check integer ok.
factory boot load fs uboot len 131072 to addr 0x80010000.
Hit any key to stop autoboot:  0
## Starting application at 0x80010000 ...

I’ve searched a stripped firmware on internet and friedzombie but I found nothing for this router !

Do you have a 5.0 or another number ?

Have you tried to flash the router with this one tftpd32.jounin.net ?

@skaox Sure i have 5.0 and using tftpd..
Could you upload somewhere original bin image that is workin for you, and tell me wich version of tftpd you use?
Thanks.

I used binwalk to read original image and i see boot partition on it :expressionless:


DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
8463          0x210F          LZMA compressed data, properties: 0xCF, dictionary size: 0 bytes, uncompressed size: 3439394832 bytes
8495          0x212F          LZMA compressed data, properties: 0xC7, dictionary size: 0 bytes, uncompressed size: 3305177104 bytes
8527          0x214F          LZMA compressed data, properties: 0xBF, dictionary size: 0 bytes, uncompressed size: 3170959376 bytes
8535          0x2157          LZMA compressed data, properties: 0xBD, dictionary size: 0 bytes, uncompressed size: 3137404944 bytes
8559          0x216F          LZMA compressed data, properties: 0xB7, dictionary size: 0 bytes, uncompressed size: 3036741648 bytes
8567          0x2177          LZMA compressed data, properties: 0xB5, dictionary size: 0 bytes, uncompressed size: 3003187216 bytes
8607          0x219F          LZMA compressed data, properties: 0xAB, dictionary size: 0 bytes, uncompressed size: 2835415056 bytes
8639          0x21BF          LZMA compressed data, properties: 0xA3, dictionary size: 0 bytes, uncompressed size: 2701197328 bytes
8671          0x21DF          LZMA compressed data, properties: 0x9B, dictionary size: 0 bytes, uncompressed size: 2566979600 bytes
8679          0x21E7          LZMA compressed data, properties: 0x99, dictionary size: 0 bytes, uncompressed size: 2533425168 bytes
8703          0x21FF          LZMA compressed data, properties: 0x93, dictionary size: 0 bytes, uncompressed size: 2432761872 bytes
8711          0x2207          LZMA compressed data, properties: 0x91, dictionary size: 0 bytes, uncompressed size: 2399207440 bytes
8735          0x221F          LZMA compressed data, properties: 0x8B, dictionary size: 0 bytes, uncompressed size: 2298544144 bytes
8743          0x2227          LZMA compressed data, properties: 0x89, dictionary size: 0 bytes, uncompressed size: 2264989712 bytes
8751          0x222F          LZMA compressed data, properties: 0x87, dictionary size: 0 bytes, uncompressed size: 2231435280 bytes
8823          0x2277          LZMA compressed data, properties: 0x75, dictionary size: 0 bytes, uncompressed size: 1929445392 bytes
8887          0x22B7          LZMA compressed data, properties: 0x65, dictionary size: 0 bytes, uncompressed size: 1661009936 bytes
8895          0x22BF          LZMA compressed data, properties: 0x63, dictionary size: 0 bytes, uncompressed size: 1627455504 bytes
8919          0x22D7          LZMA compressed data, properties: 0x5D, dictionary size: 0 bytes, uncompressed size: 1526792208 bytes
8927          0x22DF          LZMA compressed data, properties: 0x5B, dictionary size: 0 bytes, uncompressed size: 1493237776 bytes
8967          0x2307          LZMA compressed data, properties: 0x51, dictionary size: 0 bytes, uncompressed size: 1325465616 bytes
21173         0x52B5          LZMA compressed data, properties: 0x88, dictionary size: 0 bytes, uncompressed size: 2495348736 bytes
21860         0x5564          U-Boot version string, "U-Boot 1.1.4-g6ce9309a-dirty (Oct 26 2016 - 09:24:25)"
21924         0x55A4          CRC32 polynomial table, big endian
23216         0x5AB0          uImage header, header size: 64 bytes, header CRC: 0xB5FF32C0, created: 2016-10-26 01:24:26, image size: 40128 bytes, Data Address: 0x80010000, Entry Point: 0x80010000, data CRC: 0xB2E6C75A, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image"
23280         0x5AF0          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 94972 bytes
63409         0xF7B1          uImage header, header size: 64 bytes, header CRC: 0x3D21EBAA, created: 2016-10-25 03:58:50, image size: 1083030 bytes, Data Address: 0x80060000, Entry Point: 0x80060000, data CRC: 0xAF98B529, OS: Linux, CPU: MIPS, image type: Multi-File Image, compression type: lzma, image name: "MIPS OpenWrt Linux-3.3.8"
63481         0xF7F9          LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 3146928 bytes
1146504       0x117E88        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 8896590 bytes, 2455 inodes, blocksize: 131072 bytes, created: 2016-11-18 09:51:21
10043353      0x993FD9        XML document, version: "1.0"
10052329      0x9962E9        gzip compressed data, from Unix, last modified: 2016-11-18 09:51:21

Original firmware :
https://www.tp-link.com/us/download/TL-WR1043N.html#Firmware (US)
https://www.tp-link.com/fr/download/TL-WR1043N.html#Firmware (EU)

tftpd64 :
http://tftpd32.jounin.net

Tried to cut firmware by myself and flash it with tftpd32(64), no error but didn’t work…

Tried another time to flash original -> wr1043nv5-up-ver1-0-3-P1[20161118-rel64282].bin
-> WR1043v5_tp_recovery.bin -> tftpd32(64) -> OK

wr1043nv5-up-ver1-0-3-P1[20161118-rel64282].bin -> in Hex Editor :

©­E¯Å^fݤ·´ôO:fw-type:Cloud
ªUL^SK¡ø÷Éß¿}¡UªªUѨÈ1Éiû¿¼ðÔ2pÇUªÔsAàé¢cx(æ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
fwup-ptn fs-uboot base 0x01000 size 0x0d79d
fwup-ptn os-image base 0x0e79d size 0x1086d7
fwup-ptn file-system base 0x116e74 size 0x87c04f
fwup-ptn soft-version base 0x992ec3 size 0x00059
fwup-ptn extra-para base 0x992f1c size 0x0000b
fwup-ptn support-list base 0x992f27 size 0x00096
fwup-ptn profile base 0x992fbd size 0x02310
fwup-ptn default-config base 0x9952cd size 0x0265b
fwup-ptn qos-db base 0x997928 size 0x32071
fwup-ptn partition-table base 0x00800 size 0x00800
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
partition factory-boot base 0x00000 size 0x20000
partition fs-uboot base 0x20000 size 0x20000
partition os-image base 0x40000 size 0x120000
partition file-system base 0x160000 size 0xda0000
partition default-mac base 0xf00000 size 0x00200
partition pin base 0xf00200 size 0x00200
partition device-id base 0xf00400 size 0x00100
partition product-info base 0xf00500 size 0x0fb00
partition soft-version base 0xf10000 size 0x01000
partition extra-para base 0xf11000 size 0x01000
partition support-list base 0xf12000 size 0x0a000
partition profile base 0xf1c000 size 0x04000
partition default-config base 0xf20000 size 0x10000
partition user-config base 0xf30000 size 0x40000
partition qos-db base 0xf70000 size 0x40000
partition certificate base 0xfb0000 size 0x10000
partition partition-table base 0xfc0000 size 0x10000
partition log base 0xfd0000 size 0x20000
partition radio base 0xff0000 size 0x10000
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ..........ÿ.......ÿ.........
… NOT POSSIBLE TO PAST THE REST HERE … GARBAGE …

Someone can explain how to cut this one ?!?

No.. G00d Luck !

1 Like

If using tftpd recovery method to flash, firmware stripping is not required.
Firmware stripping is required only when using LUCI to upgrade/revert FW.

@rakesh ok, thanks for explanation. But why it`s stuck at 80% on reverting ? :expressionless:

Could be tftp issue? I use linux and never faced this.

@rakesh Thanks for this info but do you know how to do it (stripping) for this one ?
Can you explain how you do your tftp transfer with linux ?

@oriceon Have you tried with another system, software, cable, etc...
Can you explain how you did the transfer, which system (os), software, etc.. ?
Please give more information.

Check 1043nd openwrt wiki for firmware stripping command.
https://wiki.openwrt.org/toh/tp-link/tl-wr1043nd#back_to_original_firmware
For running tftp on linux, do a google search for your linux flavor.
Remaining steps in recovery are same.

WR1043NDv4 & WR1043Nv5 firmware don’t have the same structure than v1,v2 and v3.
https://openwrt.org/toh/tp-link/tl-wr1043nd#back_to_original_firmware <=> no v4 stripped.
Tftp is a good method and How to do it on linux was not for me ;- but why not..
Thank you anyway !

forum.tp-link_How-to-recovery-the-router-when-you-bricked-it
unbrick-tp-link-wifi-router-wr841nd-with-tftp-wireshark

openwrt_generic.flashing.tftp
openwrt_troubleshooting_tftpserver

dd-wrt_tftp_flash
ubiquiti_install-and-recover-tftp

linux_tftpgui_python

@skaox Please link to openwrt.org instead of wiki.openwrt.org. The latter is only for archival purposes and won't receive any updates.

I have Windows 10 x64 (last update build) and on other PC, Windows 7 x32 has worked to recovery.
So it`s about OS, or something regarding firewall, or something about last windows 10 update....

Thanks guys for answers!

1 Like

Thank you it's noted !

Exactly ;-!
Good news & Have fun !

Someone in this forum has used binwalk tool to decode firmware structure. You can try searching it.

1 Like