Good day,

yesterday i installed dd-wrt on my 3 week old tl-wdr4300 and everything went fine. After the Installation i had the issue that port-forwarding rules were not applied so i wanted to switch to openwrt. As the dd-wrt webinterface wouldn't accept the openwrt bin i went ahead and tried flashing it manually via ssh. I tried following the instructions from here http://wiki.openwrt.org/toh/tp-link/tl- … ng.openwrt but my flash layout was named different so i removed the 8mb partition named "fullflash" (yeah i know, bad idea...) because i thought it is the same as the "firmware" in openwrts layout. Anyway after removing the mtd write command still failed but as the webinterface was still up i tried reinstalling dd-wrt. After reboot brick...
I get nothing on the serial port and am pretty sure that i wired everything correctly. I even tried two different TTL to RS232 converters but still no luck. Is there any hope to debrick the device? Can anyone give me a hint on JTAG on AR934 devices?

Thank You

Crck

Safe option when you move from DD-WRT to others firmware is via TFTP boot.

There's still a hope to recover, as long as you got programmer tools and art.bin back up file.

i have jtag adapater and also an spi programmer but no backup of the art partition...
is this really hardware specific or could i take from another 4300 and just change the mac values?

Art.bin is specific to hardware device, it is not interchangeable or you can go to Atheros tell them to calibrate your wifi chip

DO BACKUP EVERYTHING BEFORE FLASHING YOUR ROUTER

Take off flash chip from board read it with SPI flash programmer and save it to a file , do some hex analysis with hex editor.

(Last edited by xopal on 7 Jan 2013, 12:47)

...at least the mac values and other router-specific info.
(e.g. router's serial number and the WPS pin code are found in my wndr3700's art partition).

Regarding the possible "wifi calibration" items and stuff like that, I am not sure if Openwrt utilises that info to any extent.

would you be so nice and upload or pm me your art.bin?
i'm currently dumping the flash so i can compare if it is intact.

EDIT:
so i dumped my flash and to my surprise its not empty. It starts with "....OpenWrt.................r34996" in hex:
"01 00 00 00 4F 70 65 6E 57 72 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 72 33 34 39 39 36" is this right?

EDIT2:

can someone post the offset of the art.bin in a flashdump?

(Last edited by crckmc on 7 Jan 2013, 13:19)

I don't have any TL-WDR4300 , but I do compare art.bin between two 3420v1.

If you dumped the whole flash content then go to address:

400000 - 10000 = 3F0000

This is the starting address of an art.bin , total size is 10000 [hex] go grab them and save to a file.

but my flash is 8mb so i start at 7F0000?

doesn't look good but to be honest i don't know what i'm looking for

So still not working but here is what i've tried:

I downloaded the orginal FW from tp-link and opened the bin in a hex editor. Then i merged my dump and the new bin so that the flash starts with the bin and (hopefully) has my art.bin at the end.
The router is still not booting and only the powerled is on.

What did i do wrong? Any suggestions?

(Last edited by crckmc on 7 Jan 2013, 13:47)

Upload your dumped file some where.

will do after my next try. art partition seems to be fully intact as i can find my mac adress and stuff

thanks for your help so far

It works!!!

i had to remove the header from the tp-link firmware and no it boots again.

Thank you all for your help!

(Last edited by crckmc on 7 Jan 2013, 14:20)

Dear friend, y brick my router TP-LINK WDR4320, I have chance to recover it using the Jtag?, since I saw that this is my only option.

how did you bricked it? usually a usb to ttl serial adapter is enough to unbrick...