Wr940n v5 (ES) bricked. Trying Serial TTL and TFTP

Hi all ! I own a WR940 V5 (ES) which after successfully installing openwrt for v4 (I guess both hardware revisions are similar), I decided to rollback to the stock version. Unfortunately, I confussed about the available FW versions in TPlink web page and I flashed an incorrect region firmware. As a result, I bricked the router.
I started soldering the serial port interface as detailed in the wiki, resulting in pure garbage at the serial port terminal. I used a USB-TTL 3.3V serial adapter. I also tried with pull-up / down resistors of 12 - 33k ohms without success. This is my first concern, could be a simptom of completely bricked device?

After a couple hours of googling, I tried the TFTP method of transferring a binary image. The bricked router sucessfully downloaded images from my computer, but without success in de-bricking the device. I am sure that the router can pull several images, by analyzing the TFTP logs and tcpdump outputs, but after that I am completely blind since I have not serial port. I only know that the router resets to the bricked state. Any idea to have another clue since here?

TP link support page doesn't have a proper stock firmware for the v5 (ES) model. I tried all other available images without success. The fact that puzzles me more is that I uploaded the original openwrt v4 version that worked the first time, and it does not work anymore. Any ideas for the resucitation of my device?

Thanks in advance for any help or comment.

p/s: I have pictures, logs, etc if you need so.

u have to cut the tp-link header (1KB) from firmware before flashing it via tftp.

dd if="wr940nv5_eu_3_18_1_up_boot(180514).bin" bs=512 skip=1 > tp_recovery.bin

Here is a ready made image for u, https://file.io/hLsGVPn7RA8E

Just tftp this specific tp_recovery.bin and then update with the latest firmware by webui from here. @marianux

Thanks! let me try ...

this link didn't worked for me:


, I guess that this is the result of this

I will tell you soon, thanks a lot!

Sorry, here is the new link https://mega.nz/folder/LNl3TbYS#ddMX1a3p8dfDO_NoCw1G_w @marianux

Thanks, I am trying with all of the firmwares available. We are skiping the header (512 bytes), right? I will tell you if I succeed. Thanks!

yes, exactly...almost all tp-link recovery is done by this, if the vanilla firmware from tp-link site don't work then u have to skip 512 bytes header from start

Thanks again @bakemono but didn't work for the three firmwares online and the one that you uploaded. Could be a problem in the transmission, since it is UDP? could be a checksum or hash check in the router? Do you have some documentation about the tp link format of the header? Maybe other thing to check? As I told in the first post, the thing about garbage in the serial port puzzles me ... maybe it would be easier if I could fix the serial link to the router ... any idea?

if u tftp the openwrt image now, openwrt works right ? I need to know this

No, it doesnt, I cant go back to Openwrt either. This is also strange ...

I am looking that the filesizes of the cropped versions differ. This could be a problem if a plain dump is made to a flash memory, or it does not bother? I mean, maybe it would be better to skip the header and replace with zeros, what do you think?

No, the bootloader size is 128KB (0x20000), so the firmware must be start at 0x20000..before we cut the header, the firmware starts at 0x20200...that's why we cut that extra 0x00200 (1KB)...if the tftp download still works that means bootloader is fine and there is hope..we probably don't know what portion of the firmware needs to be cut before 0x20000

u have to take some risk now bcoz u don't know what portion of the header or how much needs to cut. u can try with cutting the entire first 128KB/129KB (to skip the bootloader completely) then try those images

dd if="wr940nv5_eu_3_18_1_up_boot(180514).bin" bs=131072 skip=1 > tp_recovery.bin


dd if="wr940nv5_eu_3_18_1_up_boot(180514).bin" bs=131584 skip=1 > tp_recovery.bin

Yeah! that what I thought. I know that people of TPlink is creating the V5 (ES) version of the online firmwares. I guess that this versions should work without cropping. If that does not work, I will discard the router ....

You mean half kilobyte? 512 bytes?

oh, yes..sorry

Did not work ....

Ok, how about this-

dd if="wr940nv5_eu_3_18_1_up_boot(180514).bin" bs=131584 skip=1 > tp_recovery.new
dd if=/dev/zero of=pad128k.bin bs=512 count=256
cat pad128k.bin tp_recovery.new > tp_recovery.bin

This was my concern before, different filesizes. I am going to try this approach for every test that you suggested ... thanks!

Do you have any documentation or wiki explaining the memory maps or flash procedures of TP link routers?