OpenWrt Forum Archive

Topic: TP-LINK TL-WR841nd v9 30dBm hack

The content of this topic has been archived on 22 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Yeah, I made this "hack" but 30 dBm is not actually true, this router can't do more than "true" 23 or maybe 24 dBm tx power. It is just displayed as 30 dBm, but that does not mean it's true, and this hack will not do anything about it.

(Last edited by user5077 on 11 Apr 2016, 19:13)

user5077 wrote:

Yeah, I made this "hack" but 30 dBm is not actually true, this router can't do more than "true" 23 or maybe 24 dBm tx power. It is just displayed as 30 dBm, but that does not mean it's true, and this hack will not do anything about it.

23-24 for this devices sound for me not real too smile.

pepe2k wrote:
user5077 wrote:

Yeah, I made this "hack" but 30 dBm is not actually true, this router can't do more than "true" 23 or maybe 24 dBm tx power. It is just displayed as 30 dBm, but that does not mean it's true, and this hack will not do anything about it.

23-24 for this devices sound for me not real too smile.

Thanks for answers! I understand that it is unrealistic to 30 dBm, though, it would be 22-23. I flashed u-boot, but it is impossible to go to the web interface. What need to do?

llk2014 wrote:
pepe2k wrote:
user5077 wrote:

Yeah, I made this "hack" but 30 dBm is not actually true, this router can't do more than "true" 23 or maybe 24 dBm tx power. It is just displayed as 30 dBm, but that does not mean it's true, and this hack will not do anything about it.

23-24 for this devices sound for me not real too smile.

Thanks for answers! I understand that it is unrealistic to 30 dBm, though, it would be 22-23. I flashed u-boot, but it is impossible to go to the web interface. What need to do?

Go to netconsole mode(press and hold reset for 7-8 secs about 500 ms after power on), and run httpd from console.(use netcat or similar for windows, e.g hercules setup utility, port 6666 ip 192.168.1.1) You need to set your PC's IP to 192.168.1.2. After running httpd from netconsole, open a web browser(leave your IP to 192.168.1.2 for the moment), and go to 192.168.1.1/art.html. Here upload the hacked art image, follow the instructions, the router will reboot automatically. You're done. I can confirm this works for my tl-wr841n v9.

Edit: If you mean firmware doesn't load -yes that firmware with unlocked u-boot has some problem with that u-boot for some reason. If so, just flash a precompiled image from the recovery mode - at 192.168.1.1/index.html eg CC 15.05.

(Last edited by user5077 on 12 Apr 2016, 11:45)

user5077 wrote:
llk2014 wrote:
pepe2k wrote:

23-24 for this devices sound for me not real too smile.

Thanks for answers! I understand that it is unrealistic to 30 dBm, though, it would be 22-23. I flashed u-boot, but it is impossible to go to the web interface. What need to do?

Go to netconsole mode(press and hold reset for 7-8 secs about 500 ms after power on), and run httpd from console.(use netcat or similar for windows, e.g hercules setup utility, port 6666 ip 192.168.1.1) You need to set your PC's IP to 192.168.1.2. After running httpd from netconsole, open a web browser(leave your IP to 192.168.1.2 for the moment), and go to 192.168.1.1/art.html. Here upload the hacked art image, follow the instructions, the router will reboot automatically. You're done. I can confirm this works for my tl-wr841n v9.

Edit: you mean firmware doesn't load -yes that firmware with unlocked u-boot has some problem with that u-boot for some reason. If so, just flash a precompiled image from the recovery mode - at 192.168.1.1/index.html eg CC 15.05.

All problems related with kernel hanging around "Serial: 8250/16550 driver..." should be fixed with: https://dev.openwrt.org/changeset/49156/. It seems that this bug is not fixed in official CC release/s.

pepe2k wrote:
user5077 wrote:
llk2014 wrote:

Thanks for answers! I understand that it is unrealistic to 30 dBm, though, it would be 22-23. I flashed u-boot, but it is impossible to go to the web interface. What need to do?

Go to netconsole mode(press and hold reset for 7-8 secs about 500 ms after power on), and run httpd from console.(use netcat or similar for windows, e.g hercules setup utility, port 6666 ip 192.168.1.1) You need to set your PC's IP to 192.168.1.2. After running httpd from netconsole, open a web browser(leave your IP to 192.168.1.2 for the moment), and go to 192.168.1.1/art.html. Here upload the hacked art image, follow the instructions, the router will reboot automatically. You're done. I can confirm this works for my tl-wr841n v9.

Edit: you mean firmware doesn't load -yes that firmware with unlocked u-boot has some problem with that u-boot for some reason. If so, just flash a precompiled image from the recovery mode - at 192.168.1.1/index.html eg CC 15.05.

All problems related with kernel hanging around "Serial: 8250/16550 driver..." should be fixed with: https://dev.openwrt.org/changeset/49156/. It seems that this bug is not fixed in official CC release/s.

Thanks for telling me this. I thought my build system was the issue. I currently use CC 15.05 (not 15.05.1) with your u-boot and I don't have any issue with kernel, it boots fine.

TL-WR841ND v9:

ht-20 ch1 557.19mw
ht-20 ch6 893.31mw
ht-20 ch11 540.75mw

ht-40 ch1 249.46mw
ht-40 ch4 724.44mw
ht-40 ch7 261.22mw

Direct output from fcc report
all tx power use combined antennas 1&2 (plus 3db)

So this router is capable of throw 29.5dbm app  tx power.

Really powerfull and cheap router.

I use it and I can see the difference... really powerful

841nd v7 ht-20 ch6 426.58mw

841nd v8 ht-20 ch6 332.005mw

(Last edited by Takv on 15 May 2016, 20:41)

Is this hack working for v10 as well? I'd love to squeeze a few more dBm out of this unit.

plp wrote:

Is this hack working for v10 as well?

Don't just read threads title.
Read post #4

danymarc wrote:
plp wrote:

Is this hack working for v10 as well?

Don't just read threads title.
Read post #4

Don't just read threads up to post #4.
Read post #10.

And less tongue in cheek, even if I could squeeze 2-3 more, I'd be a happy camper.
Anyone tried this on v10?

v10 is low tx power. max 20 dbm.

Also, most stable by experience is v8 in ptmp.

v9 most powerfull by my experience.

I'm a WISP in Viña del Mar, Chile, around 200+ routers deployed.

Hi !

I flash my WR841Nv9's art with hacked file ... and my router doesn't start anymore the wifi.
The wifi's led is always down and when i try to enable from Luci Gui, it's always disable ...

I try to flash with the backup but the wireless doesn't work too !! I dump the art and i check !

Can you help me please ?

Edit : I haved fixed the problem. The artHacked force the country to US. If your global country is 00 ( World ) it doesn't start the WiFi interface binding.

(Last edited by j.lefebvre59 on 30 Sep 2016, 08:29)

Takv : Can you share how you hack other version of WR841N transmit power ?

Please !

j.lefebvre59, have you experienced any perceptible change (as in actual change in signal, not in the UI) after applying the hacked art?

Also, since you're being forced to US locale, are you able to use channels 12 and 13? If not, have you applied the reghack? luci.subsignal.org/~jow/reghack/README.txt

Hi ! I use the hack art on a v8, v9 and v11.

I follow this step :
1 ) I compile openwrt from trunk with target wr841n and i modify the source to unlock the art and uboot write possibility.
2 ) I flash the routers and the art.
3 ) I apply the regs hack

After I config all router to channel 6 @ 30dbm with HT40+
The signal is strength all in my house !!!

Anybody know any config to boost WiFi speed/signal ?? (Antenna gain ???)

j.lefebvre59 wrote:

Hi ! I use the hack art on a v8, v9 and v11.

I follow this step :
1 ) I compile openwrt from trunk with target wr841n and i modify the source to unlock the art and uboot write possibility.
2 ) I flash the routers and the art.
3 ) I apply the regs hack

After I config all router to channel 6 @ 30dbm with HT40+
The signal is strength all in my house !!!

Anybody know any config to boost WiFi speed/signal ?? (Antenna gain ???)

Can you please compile openwrt for me with unlocked ART so that I can use the 30dbm hack?
I'm a previos DD-WRT user and OpenWrt seems a little strange to me.But the 30dbm trick works only on OpenWrt.
So please help.

So can no one reupload the firmware with unlocked art?

I testet it on v7 Hardware, i have build a firmware with unlocked art partition and flashed the hacked art.
unfortunately i dont know how to change the global country, or do you mean by "global country" the country setting in wireless.radio0.country='US' ?  because my wifi dont starts after flashing the hacked ART partition (j.lefebvre59).

and to Takv: do you pulled up the db on v7  with this hackedART oder with another one?


Of curse i can upload the compiled FW with unlocked ART and U-BOOT partitions for those who are not familar with builiding images (but these are only with german luci language, sorry):

edit: no links alowed here for me, send me an email if you want: chwzr@0815.su


pic the image for your hardware as usual.

kind regards

Here how to unlock 30dbm WR841N/ND V9
(The official guide ART unlocked firmware is uboot unlocked not art)


1) (Skip if you have installed open wrt already)
    -- Flash official openwrt-15.05.1-ar71xx-generic-tl-wr841n-v9-squashfs-factory.bin
    -- Flash official openwrt-15.05.1-ar71xx-generic-tl-wr841n-v9-squashfs-sysupgrade.bin

2) Having open wrt official working, flash firmware via lucy compiled by me with ART UNLOCKED
drive google com /file/d/1mMn8CMNaT6ULBCLwpoekR99ypEPUoXFU/view
and wait router reboot

NOTE: Dunno why, but lucy web interface giving connection refused via web, dont care.

3) Make SCP connection to router like this (WinSCP for windows users):
### Image: imgur com/3NZPGum
### Official artHACKED.bin image: drive google com/file/d/0B04Rm7S5I3txejBUS2tpcXNxeTQ/view

Upload artHACKED.bin downloaded from official guide to /tmp/


4) Make ssh connection (For example with Putty in windows) and run:

mtd -r write /tmp/artHACKED.bin art


### Image: imgur com/wYfHrPy
#Wait for router reboot


5) After router reboot

A) Make connection via SCP to router, upload official openwrt-15.05.1-ar71xx-generic-tl-wr841n-v9-squashfs-sysupgrade.bin firmware with name flas.bin to /tmp

B) Make ssh connection with putty and execute:

cd /tmp
sysupgrade flas.bin

### Image: imgur com/zGNzeW9


#Wait for router to flash oficial firmware and reboot
#Country US , you will have to 30dbm
Image: imgur com/mo7IxQP





###Final notes
With 30dbm i have stronger signal in my room, with 21dbm had only 5mb connection enougth for browser, now 36 mb.
In places where there was no connection, now can watch youtube videos smoothly.

Thanks to open wrt. I was in ddwrt and was for killing that router. Had to reset every some days. Now all go fine.

(Last edited by santiagopg on 20 Feb 2018, 05:48)

The discussion might have continued from here.