[X]Assistant

[kestua]

Upgraded UBOOT loaders | Build OpenWrt / LEDE from source | DD-WRT FIRMWARE | Collect bin (dump) for the programmer

Upgraded UBOOT loaders for routers

Right

right

Breed

Breed

Screenshots

U-Boot_Mod

u-boot_mod
u-boot_for_tp-link_AR9331_by_pepe2k.tar.gz(355.12 KB)

AR7240 - ap91
AR7241 - ap99
AR9331 - ap121
AR9341 - ap123
AR9342 - mi124
AR9344 - db12x
QCA953x - ap143
QCA9558 - ap135 download

Screenshots

Atheros AR9331

Atheros AR9331:
u-boot-ar9331.rar(81 KB)
u-boot-ar9331-pisen.rar(81 KB)
u-boot-ar9331-wr720nv3_wr710n.rar(80.79 KB)
uboot_for_tp-link_tl-mr3020.rar(56.63 KB)

8devices Carambola 2
TP-Link TL-MR3020 v1
TP-Link TL-MR3040 v1 and v2
TP-Link TL-WR703N v1,
TP-Link TL-WR720N v3
TP-Link TL-WR710N v1
TP-Link TL-MR10U v1
TP-Link TL-MR13U v1
TP-Link TL-WR740N v4 (and similar, like TL-WR741ND v4)
TP-Link TL-MR3220 v2

Atheros AR1311

Atheros AR1311 (similar to AR9331)
D-Link DIR-505 H / W ver. A1

Atheros AR9341

Atheros AR9341:
u-boot-ar9341.rar(81.27 KB)

uboot_for_tp-link_tl-mr3420_v2.rar(55.25 KB)

TP-Link TL-MR3420 v2
TP-Link TL-WR841N / D v8
TP-Link TL-WA830RE v2
TP-Link TL-WA801ND v2

Atheros AR9344

Atheros AR9344:
u-boot-ar9344.rar(82.17 KB)
u-boot-ar9344-msa2k-3513na.rar(82.45 KB)
u-boot-ar9344-mw4530r.rar(82.23 KB)

TP-Link TL-WDR3600 v1
TP-Link TL-WDR43x0 v1
TP-Link TL-WDR3500 v1

4_BEST U-BOOT CONSOLE

wr703n-uboot-with-web-failsafe
china_uboot_ (best)

Breed

FIRMWARE FOR 16MB

FIRMWARE-16MB
If the firmware for your model is not in the list, select according to the characteristics of the device

HOW TO PUSH

U-boot bootloader.
It is always located at the beginning of the flash drive.
Under the bootloader area in the TP-LINK 3020, 3040, 3220, and 3420 routers I’ve tried for different revisions, 128kb or 0x20000 flash memory areas are allocated for the bootloader area.
For flash drives 4m, 8m, 16m, the bootloader will always be here:
0x000000000000-0x000000020000: "u-boot"
Depending on the type and revision of the router, the bootloader file itself may be less than 64kb (0x10000) or longer than 64kb. This is important to understand, because recording is possible only in a clean (wiped) area of ​​the flash drive, and the flash drive rubs sector-by-sector, and the sector length is 64 kilobytes.
bootloader (flashed via TFTP- (if alive)
If there isn’t something on the programmer
Removing backup_ open wrt:
backup u-boot: cat / dev / mtd0>/tmp/backup_u-boot.bin
write to router: mtd write /tmp/uboot.mod u-boot

BACKUP BOOT OPEN WRT:
cat / dev / mtd0>/tmp/backup_u-boot.bin

BOOT firmware:

tpl
tftpboot 0x81000000 u-boot.bin
erase 0x9f000000 + 0x20000
cp.b 0x81000000 0x9f000000 0x20000
bootm 0x9f000000

FIRMWARE firmware:

FIRMWARE firmware:
tpl
tftpboot 0x80000000 code.bin
erase 0x9f020000 + 0x3c0000
cp.b 0x80000000 0x9f020000 0x3c0000
bootm 0x9f020000

BACKUP & ART OPEN WRT Firmware:

BACKUP ART OPEN WRT
cat / dev / mtd4>/tmp/backup_art.bin
Firmware ART
tpl
For flash drives 4m:
tftpboot 0x81000000 art.bin
erase 0x9f3f0000 + 0x10000
cp.b 0x81000000 0x9f3f0000 0x10000
bootm 0x9f000000
For flash drives 8m:
tftpboot 0x81000000 art.bin
erase 0x9f7f0000 + 0x10000
cp.b 0x81000000 0x9f7f0000 0x10000
bootm 0x9f000000
For flash drives 16m:
tftpboot 0x81000000 art.bin
erase 0x9fff0000 + 0x10000
cp.b 0x81000000 0x9fff0000 0x10000
bootm 0x9f000000

backup firmware

backup firmware with your settings: cat / dev / mtd5>/tmp/backup_firmware.bin --This firmware can be flashed using the MTD method!
full backup flash:
Code:
cat / dev / mtd0>/tmp/backup_fullflash.bin
cat / dev / mtd5>>/tmp/backup_fullflash.bin
cat / dev / mtd4>>/tmp/backup_fullflash.bin
then copy the backup_fullflash.bin binary file from the / tmp directory on the router to the computer via WinSCP.

At offset 0x1FC0 is the MAC address
You can change it using any hex editor.
in the mac dump, pin: - need to be changed to your
if you edit U-boot
MAC: 0001FE00
KLASS: 0001FF00
PIN: 00020000
if you edit backup_fullflash
MAC: 0001FC00
KLASS: 0001FD00
PIN: 0001FE00
FIRWARE: 00020000

After flashing the bootloader, you must turn off the power of the router, press the buttonRESETorWPSand start the router.
The web interface is located at192.168.1.1

Add RAM up to 64mb

Compatible Chips:
Samsung - K4H511638B
Samsung - K4H511638C
Samsung - K4H511638D
Samsung - K4H511638F
Hynix - HY5DU121622CTP
Infineon - HYB25D512160CE
Micron - MT46V32M16TG
Elpida - EDD5116ADTA
Elpida - EDD5116AFTA
Nanya - NT5DS32M16BS

Chip Statistics
The list of chip series that have been tested and should fit (without suffixes) according to the Western forums for upgrading WL500P:

Samsung K4H511638D
Hynix HY5DU121622CTP
Hynix HY5DU121622CLTP
Hynix HY5DU121622DTP
Hynix HY5DU121622DLTP
Micron MT46V32M16TG
Micron MT46V32M16TGZ
Nanya NT5DS32M16BS
infineon HYB25D512160BE
Elixir N2DS51216BT-6K

List of specific chips that have been tested on the wl500g.info forum:

K4H511638D-UCCC (purchased separately (not included in the module))
Samsung K4H511638B-TCB3
Samsung K4H511638D-UCB3
Hynix HY5DU121622CTP-J
Hynix HY5DU121622CTP-D43
Hynix HY5DU121622DTP-D43
Kingston K4H511638C-UCB3
ELPIDA D5116AFTA-5B-E

The list of specific modules whose chips were tested on the wl500g.info forum:

Memory: 512Mb SO-DIMM PC2700
Module: Samsung M470L6524BT0-CB3
[Chips]: Samsung K4H511638B-TCB3

Memory: 512Mb SO-DIMM PC2700 (ROHS)
Module: Samsung M470L6524DU0-CB3
[Chips]: Samsung K4H511638D-UCB3

Memory: 256Mb DIMM
Module: Samsung M368L3324BT
[Chips]: Samsung K4H511638B-TCB3

Memory: 256Mb SO-DIMM
Module: Samsung K4H511638BT0
[Chips]: Samsung K4H511638B-TCB3

Memory: 256Mb DIMM PC2700
Module: Hynix HYMD532646CP6J-J
[Chips]: Hynix HY5DU121622CTP-J

Memory: 256Mb DIMM PC3200
Module: Hynix HYMD532646CP6J-D43
[Chips]: Hynix HY5DU121622CTP-D43

Memory: 256Mb DIMM PC3200
Module: Hynix HYMD532646CP6J-D43
[Chips]: Hynix HY5DU121622DTP-D43

Memory: 512Mb DIMM PC2700
Module: Kingston KVR333X64SC25 / 512
[Chips]: Kingston K4H511638C-UCB3

Memory: 512Mb PC2700
Module: Kingston KVR400X64SC3A / 512
[Chips]: Hynix HY5DU121622CTP-D43

Memory: 256Mb SO-DIMM PC2700 (ROHS)
Module: Transend TS32MSD64V3M
[Chips]: ELPIDA D5116AFTA-5B-E

Module: Samsung M368L3324BT without a suffix
[Chips]: Samsung K4H511638B without a suffix

Module: Samsung K4H511638B without a suffix
[Chips]: Samsung K4H511638B without a suffix

Module: Samsung M470L6524BT
[Chips]: Samsung K4H511638B without a suffix

Memory: 512Mb PC2700
Module: Kingston KVR400X64SC3A / 512
[Chips]: Nanya NT5DS32M16BS

Memory: 256Mb PC2100 # 2700 #
Module: Kingston KVR400X64SC2.5A / 256
[Chips]: infineon HYB25D512160BE

Partition Locations

FOR STABLE WIFI OPERATION -save-and fill in the native art-section (wifi calibration)

0x00000000-0x00020000: "boot"
0x00020000-0x00120000: "kernel"
0x00120000-0x003e0000: "rootfs"
0x003e0000-0x003f0000: "config"
0x003f0000-0x00400000: "art"

MAC numbers, PIN, router version.
MAC addressin almost all routers starts with the address0x1FC00. Under the MAC address is allocated, respectively, 6 bytes.
Router versionstarts with the address0x1FD00. The entry of the 3420 router of the second revision looks like this: 3420000200000001
PINstarts with the address0x1FE00. The length is 8 bytes. PIN, for example, 80751205 (the one that you see on the nameplate of the router) in the firmware file will look like 3830373531323035.
for 2m flash
MAC - at position --5FF8

Calibration table of the Wi-Fi radio module (art).
Under the area of ​​the calibration table of the Wi-Fi (art) radio module in TP-LINK routers, 64kb (0x10000) of memory in the flash drive is allocated. art is always located at the end of the flash drive.
For flash drives 4m:
0x0000003f0000-0x000000400000: "art"
For flash drives 8m:
0x0000007f0000-0x000000800000: "art"
For flash drives 16m:
0x000000ff0000-0x000001000000: "art"

Programs

Winpcap_4_1_3.exe(893.68 KB)

BreedEnter.exe(45.5 KB)
HerculesSetup.zip(567.13 KB)

hercules_3-2-8.exe(1.24 MB)

babyftp.zip(40.19 KB)

HW_VirtualSerialPort.zip(1.18 MB)

winscp573setup.rar(5.4 MB)

FULL DUMP ROUTERS

FULL DUMP

LIST of dumps

DIR-320 (A)
DWL-2100AP
ASUS RT-G32_b1_f.zip
DIR-300_b.5.dom.ru.rar
DIR-300A1FULLDUMP.rar
DIR-300B7.zip
DIR-300NRU HW B1.rar
DIR-400.rar
DIR-601vb1-dlinkfirmware.7z
DIR-615 E4 Dump Work.rar
DIR-615_AP99-AR7240-RT-091105-00.rar
DIR-615_k2_1_0_19.zip
DIR-615RevK1.rar
DIR-620_HWA1_FW1.21.rar
DIR-620D1-1.3.10full_dump.rar
DSL-2500UBRUD HW Ver. D1.rar
DSL-2540.7z 1.8
DSL-2640C2.rar 3.3
DSL-2640U_BRU_C2.7z
DSL-2650U v1.0.10_dump full.7z 6.0
DSL-2740.7z 3.7
DSL-2750U (repair flash & manual) .zip 19.3
DSL_2650NRU_v_1_0_11_17082011_fix_bad_fw_Update.zip
FAST-FW150R.rar
FAST-FW300R_20DCE6A9E4AE_98804894.7z
GETNET GR-124W.rar
MERCURY MW150Rv10.rar
MERCURY MW305R + .rar
QTECH QDSL-1040WU (analogue DSL-2750U & DSL-2650U) .7z
TD-W8951 (moded) .rar 1
TD-W8951ND_v4_QH16-104HIP_ (EN25Q16) _mac6470023ED2A9.rar
TD-W8951ND full dump_v 5.0_A0F3C1F454DA.7z
TD-W8951ND ver5.0.zip
TD-W8960N.7z 3.8
TD-W8961ND_V2_old.rar
TD-W8961ND full dump sborka v3.zip
TD-WN8901G_v3.rar
TENDA-W308R_ok.rar
TENDA-W311R_4mb_flash_ralink.rar
TENDA-W316R_original.rar
TL-MR3020.7z
TL-MR3220 v1.bin.7z
TL-MR3220 v2.0 fullflash factory.rar
TL-MR3220_v1.rar
TL-MR3220V2 Dump fullflash 3220v2.rar
TL-MR3420_v1.rar
TL-MR3420v2.zip
TL-WA500G.7z
TL-WA500G_F4-EC-38-FA-F4-87.rar
TL-WA501G.rar
TL-WA501G_00-1D-0F-D9-FE-1B.rar
TL-WA501G_00-19-E0-65-3A-B4.rar
TL-WA501G_01.rar
TL-WA601G_ver1_test2_dellconfig.zip
TL-WA701ND.7z
TL-WA701ND_74EA3AC1BF88_30718333.7z
TL-WA701ND_940C6DAC60EA_15306760.7z
TL-WA801ND_90F652642AD9_62318884.7z
TL-WA801ND_B0487ADFEF51_14264481.7z
TL-WA801ND_F4EC38B99430_22157287.7z
TL-WA801ND rabochij ver 1.2 B0-48-7A-DF-EF-51.bin.7z
TL-WA5110G_D8-5D-4C-D7-5C-A6.rar
TL-WA5110G_D8-5D-4C-D7-5C-A6.bin.7z
TL-WA5210 (new) .rar
TL-WA5210G (oreg) .rar
TL-WA7510N.bin.7z
TL-WA7510N_F8D111B165BE.7z
TL-WR340_WA500_mak D85D4CFB5112.bin.7z
TL-WR340_work_01.7z
TL-WR542.7z 1
TL-WR543_94_0C_6D_EE_12_70.7z
TL-WR702N 90-F6-52-70-6F-44.rar
TL-WR720N 64-70-02-CE-E9-34.rar
TL-WR740_hw4_2.zip
TL-WR741ND_V4.rar
TL-WR741ND_V350MHz_D85D4CD61C2C_65480403.rar
TL-WR741ND_V350MHz_orig_11605119.rar
TL-WR743v2_000000.rar
TL-WR802N.rar
TL-WR841ND_original.bin.7z
TL-WR841ND_V6_V7_54E6FCA5EEC2_35579113.rar
TL-WR841ND_V6_V7_D85D4CEDA888_99681081.rar
TL-WR841ND_V6_V7_F8D11161E6C8_15681119.rar
TL-WR841Nv9 (notest) .rar
TL-WR841Nver83.rar
TL-WR841v83.rar
TL-WR940N_1_4_fullflash.rar
TL-WR941ND_V2_00212765BE14_51967994.rar
UBNT airrouter.rar
UBNT BULLET2_00156DABE3D0.rar
UBNT BULLET2_002722166B76.rar
UBNT BULLET M2.rar
UBNT NS2_00156DAB944A_V401 (write2) .rar
UBNT NS2_00156DD2DD74.rar
UBNT NS2_Loco_00156DE4B20D.rar
UBNT NS M2.rar
UBNT NS M2 LOCO NSLm2.7z
UBNT NS M2 MX25 Nano.rar
UBNT NS M2 nanosM2.rar
UBNT NS M2 orig25x64.rar
UBNT NS M2 origin mine .rar
uboot.ar9331.7z
ZYXEL-Keenetic Lite A.1.rar
ZYXEL-KEENETIK_LITE_B_3E7C87.zip

Attached files

3420v1.backup_art.rar(521 bytes)
backup_art_3420_V.2.2.rar(461 bytes)


Post has been editedstp101 - 26.12.18, 20:43

[Simulacrum]

elecvlad_ru,
Check the MAC address. Breed overwrites. I ate when the second one also flashed and got a conflict in the grid.
But the benefit in breed can fix it all
Yes, and it’s worth clarifying the breed version, maybe you downloaded the wrong version. The link in the header should be on the Chinese forum. There are all descriptions. Chrome handles the translation, if that

P.S.
Not in the header, but here it is:
http: //www.right.com.c...thread-161906-1-1.html

breed-ar9331.bin AR9331 Universal, 115200 baud rate, the reset button GPIO # 11
breed-ar9331-mr12u.bin TP-LINK MR12U dedicated, 115200 baud rate, the reset button GPIO # 11
breed-ar9331-pisen.bin PISEN cloud routing (cloud base and easy filling WMM003N / wireless music routing WPR001N) dedicated, 115200 baud rate, the reset button GPIO # 12
breed-ar9331-wr710n.bin TP-LINK WR710N / WR720N v3 dedicated, 115200 baud rate, the reset button GPIO # 11
breed-ar9331-hiwifi-hc6361.bin Route One pole pole (HC6361) dedicated only to support TP class firmware, 115200 baud rate, the reset button GPIO # 11

(Sorry, my translation is in English. Well, you understand, if that)
It also indicates that Breed-ar9331.bin for TP-LINK TL-MR3020 v1, maybe the version is the case?

Post has been editedSimulacrum - 20.01.17, 03:01

[elecvlad_ru]

Thanks for the quick response. Exactly, because of the jammed mac, it did not start. And already it was before on other routers, but there I just assigned an arbitrary address from Lucy openwrt and everything turned on. But on openwrt-15.05.1-ar71xx-generic-tl-mr3020-v1-squashfs-sysupgrade.bin this did not work. The already corrected section of the bootloader was about to sew and here in breed I saw a page for changing the mas ... In general, everything works, thanks.
I have TP-LINK TL-MR3020 v1 so breed-ar9331.bin 2017-01-16 quite suited.
Now I'm trying to find some kind of manual by breed.
On the web there is a tab * programmer firmware * "Will it be possible to shoot and record a full flash dump using breed?
And the console is also interesting, there are functions that are not on the web.

[socop]

Comrades, please help me, noob, I have tp link mr3220 v1.2 MultiWeb_310_2015-03-14 (OpenWRT r43228) / LuCI Branch (git-14.343.56284-0fb85fb) I don’t have to catch a wifi from any device, as I understand it, I need an art partition like then register in the router however I do not know which program to download and where to start how to register the code on atheros9285? Can this be done via the web interface? really hope for your answer

[elecvlad_ru]

Where did your art go? Have you changed the memory chip on the router?
Maybe you just have wifi off? On this router there is a wifi shutdown button, and in the openwrt admin panel on the wifi tab, take a look if it is turned on.

Post has been editedelecvlad_ru - 20.01.17, 11:31

[socop]

no, the memory chip didn’t change; the modem wasn’t used for a very long time since I forgot the password and made a hard reset, and when I configure client wds it catches Wi-Fi but doesn’t give it out and the qss lamp doesn’t light at all even when turned on

[socop]

look at the picture, maybe something is wrong there

Attached images

[elecvlad_ru]

Wifi works for you. Now the router is in client mode. Do you want to take wifi internet and give it out also via wifi?
Then you need bridge modehttp: //stackoverflow.c...lient-how-to-configure

Post has been editedelecvlad_ru - 20.01.17, 12:05

[socop]

yes right, I want him to distribute wi-fi too, but doesn’t seem to have a bridge mode or is it somehow differently written in the picture? but how can I make sure that he is giving out wi-fi, I can’t see him at all no matter what settings

Attached images

[elecvlad_ru]

Yes, unfortunately there are no ready-made settings. But the link above gives an example of creating 2 wireless interfaces. One for accessing the WWAN Internet, the other for distributing to WLAN clients. Once you create a WLAN in Access Point Mode, your router will immediately be visible to other devices.

[socop]

Thank you so much the link you gave me made my life much easier. I searched so much through Google I couldn’t find it in any way)) everything works

[nokiaman1997]

Hello dear friends
there are 2 devices from Ubiquiti Networks (nanostation loco m5) (ubiquiti airrouter is not HP without an external antenna, roughly speaking)
Both devices got caught (but ping) during firmware on OpenWrt - I don’t know what I did wrong. but they cyclically went into reboot.
Re-flashing to the drain did not work - the lights blink on and off, and so on ad infinitum.
I decided to fill in DDWRT via tftp point and the router came to life and work, that is, wi fi and so on.
Only here the settings after reboot are reset, probably these are such quirks of the ddwrt trial?
Flash back on openWRT fails tftp screams Firmware check failed
But not the point, I'm new to this business, please tell me how to be in this situation?
Ordered usb uart from china. I'm waiting for that for now.
They say that you can revive the points with it.
But, what will happen if you fill full flushes via tftp without a usb uart converter?
Can airOS be returned? (airOS could not be content with openwrt as well)
And is it necessary to somehow edit the full flash before pouring?
I’m extremely glad I found such a topic, please if there is anyone who can tell you something, unsubscribe. There are a lot of such problems and solutions in net.
or write in private messages.
Thank you very much.

[inak]

nokiaman1997,
Full flash you will not fill in through tftp since This method of pouring a gavernyka protects the boot from being overwritten. The wrong data will be filled in and will not start. While waiting for the lace from China, go to the flea market and buy an old USB cable with a microcircuit.

[nokiaman1997]

inak,
Thanks for your reply.
If there is a cable date, what should I do?
As I understand it, the router and nanos should be brought into recovery mode and overwrite the boot via putty?
But in what way?
It would be interesting to read.

[inak]

nokiaman1997,
It’s unnecessary to rewrite the boot, otherwise only the programmer will save you. You need to first see what the console generally produces.

[braun90]

Well, I got to the programmer, the situation brought. Everything is not complicated, but ... without them in any way.
I even revived for a moment, saw the network and connected ... But it seemed to me not enough, and I decided to flash it again, but on a different firmware, it seems like it was reading it on the programmer, seeing, but not writing. (Error - something there with the expiration of time).
Actually a question. What are the analogues for replacing flash, specifically now stands sampion flo32pif for 4mb.
What to look at in a datasheet?

[m0l0dec]

I welcome, dear forum users. Sorry, that may be off topic, but I need FULL DUMP for tp-link tl-wa901ndver: 2.1for the programmer.
Can anyone have, please give?

Post has been editedm0l0dec - 04.04.17, 06:43

[r0ma1992]

fullwa901v2.rar(2.56 MB)


Post has been editedr0ma1992 - 04.04.17, 08:23

[m0l0dec]

R0ma1992 @ 04.04.17, 11:23

fullwa901v2.rar(2.56 MB)

thanks, of course ... but this is a file for version 2.3, for version 2.1 it does not fit.

Post has been editedm0l0dec - 04.04.17, 14:53

[r0ma1992]

ok, and how does 2.3 differ from 2.1?

[m0l0dec]

R0ma1992 @ 04.04.17, 22:03

ok, and how does 2.3 differ from 2.1?

Well, how do you think one version should differ from another? iron probably not?
The bottom line is that the point does not work after flashing this dump.