Utterly stuck trying to reflash stock firmware on TP-Link WDR3600

Installing and Using OpenWrt
1

Hi all,
Prepping a WDR3600 for use, I wanted to flash the stock firmware to the device.

As the WDR3600's I have all run a custom firmware (they were destined for some kind of specific project), my process is flashing OpenWRT + u-boot_mod first, THEN putting stock firmware on it, to ensure I have a reliable recovery method.

Well, I've tried just about every suggestion on the wiki page for this device, to no avail. I am utterly unable to get stock firmware running on this device, and I'm stumped at this point.

What I've tried:

  • Flashing stock firmware 150518 using TFTP recovery method, with the device unmodified from the previous custom firmware; bootloops
  • Flashing trimmed stock firmware 150518 per wiki, skip=257 bs=512 , results in a file that is UNDER 8,126,464 bytes... no activity whatsoever after flashing is complete
  • Flashing trimmed stock firmware to match 8,126,464 bytes exactly, skip=129 bs=512; no activity after flashing completes. I assume this is because this is not the proper way to do it.
  • Flashing OpenWRT (works fine), then flashing stock untrimmed 150518 firmware from within OpenWRT; no activity after flashing completes, AND OpenWRT warns the untrimmed firmware is larger than available flash memory space...
  • Flashing stock 150518 from u-boot_mod recovery space; untrimmed and trimmed, no difference, same as above.

Extremely confused on why none of this works, but to me it feels there is something missing documentation wise from the wiki entry for this device... I am now stumped as to how to get this back to stock.

I've also tried accessing u-boot console by network connection, but unfortunately the u-boot_mod documentation on this does not seem to work to allow this; waiting 7-8 seconds holding RESET and netcat still can't connect after...

My only other thought is to use the u-boot recovery method, but if using a stripped firmware through traditional flash methods doesn't do anything, why would this work?

Device info

TP-Link WDR3600, revision v1.5
Canada

BusyBox v1.36.1 (2024-09-23 12:34:46 UTC) built-in shell (ash)
OpenWrt 23.05.5, r24106-10cc5fcd00


# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00010000 "u-boot"
mtd1: 007d0000 00010000 "firmware"
mtd2: 0023af86 00010000 "kernel"
mtd3: 00595078 00010000 "rootfs"
mtd4: 00200000 00010000 "rootfs_data"
mtd5: 00010000 00010000 "art"

# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 3.8M      3.8M         0 100% /rom
tmpfs                    59.6M     68.0K     59.5M   0% /tmp
tmpfs                    59.6M     60.0K     59.5M   0% /tmp/root
tmpfs                   512.0K         0    512.0K   0% /dev
/dev/mtdblock4            2.0M    232.0K      1.8M  11% /overlay
overlayfs:/overlay        2.0M    232.0K      1.8M  11% /

# free
              total        used        free      shared  buff/cache   available
Mem:         122028       17640       88292         128       16096       71700
Swap:             0           0           0

# cat /proc/cpuinfo 
system type		: Atheros AR9344 rev 2
machine			: TP-Link TL-WDR3600 v1
processor		: 0
cpu model		: MIPS 74Kc V4.12
BogoMIPS		: 278.93
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 32
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa			: mips1 mips2 mips32r1 mips32r2
ASEs implemented	: mips16 dsp dsp2
Options implemented	: tlb 4kex 4k_cache prefetch mcheck ejtag llsc dc_aliases perf_cntr_intr_bit perf mm_full
shadow register sets	: 1
kscratch registers	: 0
package			: 0
core			: 0
VCED exceptions		: not available
VCEI exceptions		: not available

# cat /proc/meminfo 
MemTotal:         122028 kB
MemFree:           88264 kB
MemAvailable:      71676 kB
Buffers:               0 kB
Cached:            14240 kB
SwapCached:            0 kB
Active:             7248 kB
Inactive:          10152 kB
Active(anon):       3084 kB
Inactive(anon):      204 kB
Active(file):       4164 kB
Inactive(file):     9948 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          3176 kB
Mapped:             4824 kB
Shmem:               128 kB
KReclaimable:       1860 kB
Slab:               9900 kB
SReclaimable:       1860 kB
SUnreclaim:         8040 kB
KernelStack:         456 kB
PageTables:          448 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       61012 kB
Committed_AS:      11152 kB
VmallocTotal:    1048372 kB
VmallocUsed:        1264 kB
VmallocChunk:          0 kB
Percpu:               64 kB

# cat /proc/version 
Linux version 5.15.167 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r24106-10cc5fcd00) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Mon Sep 23 12:34:46 2024

# cat /proc/diskstats 
  31       0 mtdblock0 2 0 16 35 0 0 0 0 0 0 35 0 0 0 0 0 0
  31       1 mtdblock1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
  31       2 mtdblock2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
  31       3 mtdblock3 504 0 16822 6721 0 0 0 0 0 0 6721 0 0 0 0 0 0
  31       4 mtdblock4 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
  31       5 mtdblock5 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

Thank you very much!

2

doesn't seem to match https://openwrt.org/toh/tp-link/tl-wdr3600_v1#flash_layout.

does this "custom project" have anything to do with OpenWRT ?

1 Like
3

does this "custom project" have anything to do with OpenWRT ?

Technically yes, as I did see bits of OpenWRT within the accessible parts of the unit; I haven't dumped the image fully yet to explore, but my understanding is the units were to be used for a "Free Wi-Fi by showing ads to clients" sort of thing, managed/deployed by All Unite. I have no interest in using their firmware as it seems the routers would get/send to a master unit.

It seems then the flash layout is different from the retail WDR-3600s, though it's odd that OpenWRT works fine with these units, and that stock wouldn't... apologies for not noticing the flash layout differences.

I'll dump the custom All Unite firmware and post it here (frankly I believe All Unite is in violation of OpenWRT licensing), perhaps that would garner some further insight into proper flashing of stock.

4

I would drop trying stock firmware 150518.

firmwares TP-Link : wdr3600v1_en_3_13_23_up(120820), wdr3600v1_en_3_13_26_up(130129) and wdr3600v1_en_3_13_31_up(130320) come without U-Boot

The wiki states the above three firmwares work, please try these first.

1 Like
5

It is not necessary to replace the bootloader in order to run regular OpenWrt on these.

I think they have a conventional TP-Link flash layout where the first 129 kB is bootloader, the last 64 kB is ART, and the rest in between will be kernel/rootfs/jffs. The sysupgrade firmware is a concat of kernel+rootfs and then the partitions are found dynamically at runtime.

Probably hooking up serial will be the only way to find out what is going on. I like to use serial to boot the initramfs OpenWrt then install the sysupgrade (or if you want to return to stock, force flash a trimmed stock file). It's a reliable way to debrick which is also unlikely to damage the bootloader or ART.

6

Oh yes I agree fully, I simply apply the u-boot_mod as an added bonus; faster boots, extra recovery options, etc.

Indeed I'll have to find my old serial-to-usb adapter, and baring that I'll get one hopefully from someone local...