TP-Link WA850RE v2.0 Bricked

I have the same device, bricked it for almost the same reason, the section where you should use a .bin image from OEM based on whether it has 'boot' or not is wrong, I didn't have the 'boot' in the image and therefore should've no problem flashing the original firmware back, I had the same problem with sysupgrade, it didn't work, so I used the mtd method, which bricked the device since it loops the same sequence with the LED's flashing, I also tried TFTP methods based on hardware similarities with older routers and failed.. I then bought a USB TTL device and used telephone wires for the connection.. a multimeter was used to check UART TX,RX,GND,VCC, and I'm not so sure it's the same as in the picture, from left to right, the first two have voltage of about 2.7 each the others don't, using a continuity test the 3rd was the only one to beep with other components in the circuit board and I deemed it to be GND, so if I checked it right the image holds up, yet after connecting GND, TX, RX and flipping both TX and RX, fired up 'screen /dev/ttyUSB0 and started to wait for something to show up (shorting the wires intentionally proved the TTY was working since it printed some characters), connected the device to its power adapter and nothing... after a few tries I thought maybe its something with the ground, shifting the ground cable caused a blackout... I have NO IDEA as to why there's no response... but it's very similar to this.

a few notes about the pictures:

  • I used analog voltage, I later switched to DC and got 2.7V.
  • Telephone wires are securing the device to the USB TTL

PREP work (Multimeter etc..):

Actual connection:


So I'm stuck and I'm right there with you @tplinkuser2

I don't like that telephone wire arrangement at all you should get three actual square pins and either solder them in or push them in the holes and tilt to the side so they make contact. The other end of the pins would go in the female sockets of your jumper wires.

Have you set the baud rate? I use picocom instead of screen it lets you set the baud rate in the same command line.

I will need to acquire pins for that, might as well... I'll update if that helps.

as for the BAUD rate, I set it to 11520, 'screen' can set it as well in just one command line.

Hi all,

Just want to share that I was able to unbrick my WA850REv2 using serial flash method.

Basically I followed these tips extracted from the posts here plus this link below:

https://www.juliogonzalez.es/how-to-unbrick-a-tp-link-tlwa860re-v1-with-a-serial-cable/403

The USB to TTL Serial adapter I used: FTDI FT232RL (IMPORTANT: Set the jumper to 3,3V!!!)

Note: I confirm you must bridge two soldering points for TX and also two soldering points for RX to make things working, like images available here.

Any specific doubts, just let me know. The process is straight forward for those with a low-level experience with serial firmware uploads.

@tp-linkuser I confirm 'tpl' works as expected.

BR,
Leo.

The only issue I see is the original OpenWrt image size too big to be flashed as it is.

I had to make an image with the following command using the Image Builder: make -j4 image PROFILE=tl-wa850re-v2 PACKAGES="-luci-proto-ppp -ppp -ppp-mod-pppoe -kmod-ppp -kmod-pppoe -kmod-pppox -opkg"

And use the openwrt-18.06.5-ar71xx-tiny-tl-wa850re-v2-squashfs-sysupgrade.bin to flash as already explained. Must work.

Important: now the device will be running OpenWrt without web interface. It's impossible to add Luci and required files to run web interface considering the small memory size WA850RE has.

I have been able to restore it :smiley:, but with firmware openwrt 18.06.5 sysupgrade. I think that with stock firmware is also restorable.
NOTE: I can't save the config settings with openwrt, erase all turning off the device.

wa850reSerial.2

  1. You have to bridge 2 points (try it first with Tx and test it, after Rx).
    Note: you'll need usb to rs232 ttl converter module, pins working at 3.3V (TTL level voltage).

  2. Setting ip pc to 192.168.1.10, run tftp server (tftpd32) on ethernet interface, download lastest firmware openwrt 18.06.5 sysupgrade version, rename to firm.bin (for easy use).
    Note: data (firmware) is sent on ethernet interface, commands are sent on serial interface UART.
    Note: openwrt 18.06.5 sysupgrade
    md5: 9464728d3dbfe7a232766811e19db5d4
    sha1: 2f7732e64088de06f19ddbcfc5ac2def6d4d12c8
    sha256: 8b80f93c2c58ed01b487c55241d233ac4f57209a1996ccb67a386b2aa08d65e4

  3. Setting baud rate to 115200 (PuTTY console), no flow control.
    Note: I have stopped loop with typing tpl.
    In my case setting to 128000 can see characters but not stop loop.I have stopped loop, setting baud rate to 115200 and only connecting Rx on device (repeater). Because if connect Tx too, i can see rare characters, and cant use ctrl-v, which interfere with ctrl-v.
    Conclusion I did it without seeing. :unamused: :pensive:

  4. During "Autobooting in 1 seconds" type tpl.
    Note: open notepad, typing tpl, select it all, copy for use it into console (PuTTY) with click right or ctrl-v.

  • set where to find for file firm.bin
  • copy firm.bin from tftp to ram memory (0x80060000 address).
  • erase 0x380004 (3670020 Bytes) from flash memory (starting at 0x9f020000).
  • copy firm.bin stored in ram to flash memory (0x380004 Bytes).
  • boot from flash memory (0x9f020000 address).
setenv serverip 192.168.1.10
tftpboot 0x80060000 firm.bin
erase 0x9f020000 +0x380004
cp.b 0x80060000 0x9f020000 0x380004
bootm 0x9f020000

Note: According to printenv (TL-WA850re v2 - Too big uncompressed stream LZMA ERROR 1) or typing printenv for info.

Stock Stripped Firmware
Note: I think that with stock firmware is also restorable. :thinking:

tftpboot 0x80060000 firm.bin
erase 0x9f020000 +0x36f923
cp.b 0x80060000 0x9f020000 0x36f923
bootm 0x9f020000

Note: wa850re v2 stripped firmware stock,file size 3602723 bytes (0x36f923 in hexadecimal).
md5: dd3d2bbbc5a1706cfedb17142efd2050
sha1: 040def0d4cbb9a8522626a9db1d3a536d3d63b27

(https://openwrt.org/toh/tp-link/tl-wa850re)

2 Likes

Worked perfectly!!!
Unfortunately as you said it is not possible to save the settings

I tried to go back to the original but it didn't work
FW - https://drive.google.com/file/d/182lVNe3GPChYFoTjHx6QT2_-z8et8gaW/view

tftpboot 0x80060000 firm.bin
erase 0x9f020000 +0x36f923
cp.b 0x80060000 0x9f020000 0x36f923
bootm 0x9f020000

Result:

## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... Too big uncompressed streamLZMA ERROR 1 - must RESET board to recover

Anyway thank you very much
It was amazing to see the device back to life
If you can recover let me know
Thank you

Excellent!

Right, the OpenWrt image size being too big for the device gives you this side effect (not being able to save the settings after reboot).

That's why I built my own image with Image Builder, without LuCI. I had to config everything using terminal, but after reboot, my config was there! :muscle: :muscle: :muscle:

BR.

I did the procedure and it worked, I leave the firmware here without LuCI. So at least it is possible to save the configuration.

But there is no alternative to easy setup?
Wanted to go back to default fimware!

I made a custom build a while back that has luci and a little space avialable to save a few files for basic operation:

http://82.251.153.140/openwrt-ar71xx-tiny-tl-wa850re-v2-squashfs-sysupgrade.bin

1 Like

It Works very well
Thanks

please someone help me, i got same device, i already soldering the serial and iam using Prolific PL2303 Adapter. when iam using "putty" there no respon on putty. how to fix it?
thanks, sorry for my bad english

Either you have the same problem as me, or your TX and RX are flipped, if the problem persists, then go over these:

  • Is your USB to TTL dongle showing in 'ls /dev/ttyUSB*' and is it working properly? (connect ONLY THE DONGLE and short its GND and RX / GND and TX, it should show something in your emulator as a response)
  • Make sure your emulator is set to 115200 BAUD rate and with no flow control
  • Make doubly sure that GND, TX and RX are in the correct order
  • Don't use VCC, use OEM power source
  • If you soldered pins make sure they don't short each other by a bad connection (use a multi-meter) with its continuity test function and check the pins don't short each other via a bad solder connection
  • If you tried the above... then welcome to where I am...

Tried following @tp-linkuser's directions, I'm pretty sure mine's is fully bricked to hell.

The process:

  • Used pins to connect to GND, TX, RX, first try without soldering, no response, USB dongle disconnected sometimes from a bad connection, tried re-powering the device while connected
  • Soldered the pins, USB dongle is stable and doesn't disappear from /dev/ttyUSB0, no output, re-powering the device while connected did nothing
  • Bridged/Shorted GND+TX, GND+RX, no change, re-powering the device while connected did nothing, also experienced a few jolts trying to flip RX and TX (thought I did it wrong)
  • Tried 9600, 38400 and 115200 BAUD rates to no avail (all without flow control) using "screen -fn /dev/ttyUSB0 BAUDRATE" (-fn for NO flow control)
  • Tried to press the RESET button whilst connected, no change.

Result:
LEDs flash, 1 LED then the "circle" of LEDs, the same flashing cycle as before but no output given via serial port, device is probably completely bricked.

Possible causes:

  • A few months ago, using a telephone cable to fix the serial port to the USB dongle I had experienced a power-outage while testing (weather-related, lightning strike), this might've caused damage.
  • Soldering? (check pics, I didn't damage the board from what I can see, only the solder)

Pics (Can't do without them):




thank you for the information, but i given up, my usb ttl burning because i connect it to 3.3vcc on device to usb ttl and i dont have good tools to bridge that small point on the device.

By bridging he meant to short them if I'm not wrong, in order to change the serial mode (https://openwrt.org/docs/techref/hardware/port.serial#serial_modes), it's possible with a simple telephone wire.. you simply use it to "bridge" between two pins.. careful though... a bit unstable with your hands you will get jolted (like I did), I tried to do so with GND+TX and GND+RX.. no change... device is probably completely bricked... at least I can finally give it up.

As @freezeheat, any thin wire would do. You can also use your phone as a magnifying glass while working.
Check this for info about what to connect

And while you are at it, would you be so kind as to take a clear photo of those points as requested by @tmomas

Check the last reply in this post. It has some links to clever ideas of how to manage to get access to tiny little points. It's a different device, but can inspire you. Howto get easy safe serial access to the BT HOME HUB 5a (bthh5a)

The same thing happened to me, those who have trouble soldering the points on the board connect them directly to the point without soldering it (by hand).
As I said, I only use RX device(wa850re), and TX TTL USB adapter. :unamused: :pensive:

RX -- TX
GND -- GND

In the image I see that the points are not soldering. @freezeheat @eza1


And to verify that the ttl usb adapter works, connect RX and TX to each other, type anything and you must see it on the screen

thank you for the information and tips you given to me, here some picture what i done before
IMG20200330165538
IMG20200330165626
IMG20200330165321