A couple of weeks ago I had the chance to mess around with a TP-Link WR340g V4.
This particular unit had a faulty reset button and could no longer be reset to factory defaults and we didn’t know the admin password anymore…
So began the quest to unlock the serial console on this device.
First bit info I found was on the openwrt forums:
The board does indeed look like in the picture on the forum:
The highlighted portion is indeed where the serial header is. The layout is the following:
- Pin in a white box, where the label J1 is: RX
- Next to it: TX
- Vcc (not needed because the board is powered separately)
Note about Vcc: supposedly you could powered the board from your 5V USB via the serial cable if you were to connect the Vcc wire. I find that unsafe and most people don’t do it, especially since you have a better quality power source integrated.
OK, I had that figured out so I soldered a PIN header to the board and tried connecting it to my PC using the Adafruit USB to serial TTL cable. Very cool debug cable, btw.
However, I was getting zilch data on the serial console…
My googling led me to a russian forum discussing how to flash via serial OpenWRT to wr340g(officially unsupported):
There, the guys correctly point out that in order to “gain the console” you need to solder a wire on the back of the board from the TX pin to the actual UART TX pin of the Atheros chip which is exposed on the back:
There are some labels there that can probably guide you where to solder. I used the littlest dot on the board as seen in the pic above and I had a very hard time making it stick.
The forum post provides a more valuable info! That the wr-340g v4 board is in fact almost identical in layout to the WR741ND v4 board which is fully documented on the OpenWRT wiki including how to access the serial console(the picture is actually from the OpenWRT wiki).
In any case, after soldering that wire to the TX pin I had a glorious serial console!
A few things I realized can be done from the console:
- While booting pressing Ctrl-C tells the bootloader to stop and wait for a new firmware via tftp. Useful for debricking – flashing a new firmware. Be warned, this little guy only has 2MB of flash.
- Once the OS is booted you have a limited number of commands which can be seen by running “help”. I used:
- dumpnvram to see all values stored in NVRAM
- factory – resets to factory defaults. yes!
- reboot – well…
Thankfully, neither the booloader nor the serial console have any passwords. Access is direct and free as it should be for debugging.
And that’s how I reset the silly wr-340g v4 to factory defaults 🙂