A couple of weeks ago I had the chance to mess around with a TP-Link WR340g V4.
This particular unit had a faulty reset button and could no longer be reset to factory defaults and we didn’t know the admin password anymore…
So began the quest to unlock the serial console on this device.
First bit info I found was on the openwrt forums:
https://forum.openwrt.org/viewtopic.php?id=48979
The board does indeed look like in the picture on the forum:
The highlighted portion is indeed where the serial header is. The layout is the following:
- Pin in a white box, where the label J1 is: RX
- Next to it: TX
- GND
- Vcc (not needed because the board is powered separately)
Note about Vcc: supposedly you could powered the board from your 5V USB via the serial cable if you were to connect the Vcc wire. I find that unsafe and most people don’t do it, especially since you have a better quality power source integrated.
OK, I had that figured out so I soldered a PIN header to the board and tried connecting it to my PC using the Adafruit USB to serial TTL cable. Very cool debug cable, btw.
However, I was getting zilch data on the serial console…
My googling led me to a russian forum discussing how to flash via serial OpenWRT to wr340g(officially unsupported):
http://www.lan23.ru/forum/showthread.php?t=8630&p=99204&viewfull=1#post99204
There, the guys correctly point out that in order to “gain the console” you need to solder a wire on the back of the board from the TX pin to the actual UART TX pin of the Atheros chip which is exposed on the back:
There are some labels there that can probably guide you where to solder. I used the littlest dot on the board as seen in the pic above and I had a very hard time making it stick.
The forum post provides a more valuable info! That the wr-340g v4 board is in fact almost identical in layout to the WR741ND v4 board which is fully documented on the OpenWRT wiki including how to access the serial console(the picture is actually from the OpenWRT wiki).
See: http://wiki.openwrt.org/toh/tp-link/tl-wr741nd#serial.port.mod
In any case, after soldering that wire to the TX pin I had a glorious serial console!
A few things I realized can be done from the console:
- While booting pressing Ctrl-C tells the bootloader to stop and wait for a new firmware via tftp. Useful for debricking – flashing a new firmware. Be warned, this little guy only has 2MB of flash.
- Once the OS is booted you have a limited number of commands which can be seen by running “help”. I used:
- dumpnvram to see all values stored in NVRAM
- factory – resets to factory defaults. yes!
- reboot – well…
Thankfully, neither the booloader nor the serial console have any passwords. Access is direct and free as it should be for debugging.
And that’s how I reset the silly wr-340g v4 to factory defaults 🙂
I have the same router, but once the OS is booted i get no respond from router, command help – no reaction, reboot and factory commands – same…
How did you connect the serial cable?
And what serial cable do you use?
And what terminal program(Putty?)
I connected just like you described, i see the booting messages and if i press ctrl+c during boot router responds but there is no “factory” command. Btw the web interface not responding (connection refused).
Sounds like a bricked firmware. Have you tried pressing ctrl-c and then sending via tftp a new firmware to it? To do that you need to connect the wan port I think to your computer via an ethernet cable and manually assign your IP address in the subnet 192.168.0.0/24; the router’s IP address should be 192.168.0.1.
Or maybe your firmware is a different version. Or your hardware is a different version…
I’ll try to reinstall firmware, but not now, if something goes wrong then at least 5 users will be without internet )
I don’t found tutorial to this router how to download firmware without web interface.
I have identical router TP-Link WR340g V4
I finally made it! I just set autobooting not in 1 sec but in 10 sec and after reboot i held reset button and it worked for me.
Glad you solved it! 🙂
The router I worked on had a busted reset button so I couldn’t use it. Also, the owner had forgotten the password to the web interface as well :P. So I had to hack the hardware.
Is there an openwrt for it ?
Probably not, TL-WR340g has very little flash and RAM.
Hi!
I’m trying to do the same on a TL-WR340G v3.1, but I can’t see the UART TX pin of the Atheros chip exposed on the back (“the littlest dot on the board as seen in the pic”).
This is the back of my TL-WR340G: http://i64.tinypic.com/jt6o86.png
Could you please show where I should solder the wire? Thanks.
Hi,
I couldn’t find much about this router. Seems the OpenWRT wiki has nothing on this router.
I could only find some minimal info here:
https://wikidevi.com/wiki/TP-LINK_TL-WR340G_v3
You might also be able to dig up something on this Russian forum:
http://www.lan23.ru/forum/showthread.php?t=8630&page=5
What I would do is identify the Atheros chip, pull up the specs and see which is the TX pin and if there are any traces leading to it.
Do you know which Atheros chip should be connected to the serial port?
My TL-WR340G router has two Atheros chips:
– AR2317 (WLAN chip)
– AR8236 (Fast Ethernet switch)
Both of them have this UART TX pin…