TP Link WDR3600 recovery without serial

For those of you that don't feel confident enough to solder a serial header or need to recover a router quickly without having to buy any extras i've found a quick and easy way to do so.

I found holding the reset button in and powering on the router attempts to download a recovery firmware from a tftp server, i've written some simple steps to allow this. 
1, Change your PC/Laptop ip address to 192.168.0.66
2, Connect you computer to one of the LAN ports on the router (WAN port won't work for this)
2, Setup a tftp server on your machine (I use solarwinds tftp server)
3, Put the desired firmware in your tftp folder and rename it to wdr3600v1_tp_recovery.bin
4, Start the tftp server
5, Hold down the WPS/Reset button on the router
6, Power on the router
7, After approximately 7 seconds release the reset button
8, The router will now download the firmware from your server and upgrade
Sit back and marvel at it's simplicity.
Here is the output seen via serial during this operation….
U-Boot 1.1.4 (Sep  9 2013 - 14:28:41)</div>
<div><br></div><div>U-boot DB120</div><div><br></div><div><br></div><div>DRAM:  128 MB</div><div>id read 0x100000ff</div><div>flash size 8MB, sector count = 128</div><div>Flash:  8 MB</div><div>Using default environment</div>
<div><br></div><div>PCIe Reset OK!!!!!!</div><div>In:    serial</div><div>Out:   serial</div><div>Err:   serial</div><div>Net:   ag934x_enet_initialize...</div><div>No valid address in Flash. Using fixed address</div><div>
 wasp  reset mask:c03300</div><div>WASP  ----&gt; S17 PHY *</div><div>: cfg1 0x7 cfg2 0x7114</div><div>eth0: ba:be:fa:ce:08:41</div><div>athrs17_reg_init: complete</div><div>eth0 up</div><div>eth0</div><div>dup 1 speed 1000</div>
<div>Using eth0 device</div><div>TFTP from server 192.168.0.66; our IP address is 192.168.0.86</div><div>Filename &#39;wdr3600v1_tp_recovery.bin&#39;.</div><div>Load address: 0x80060000</div><div>Loading: T T T T T #################################################################</div>
<div>         #################################################################</div><div>         #################################################################</div><div>         #################################################################</div>
<div>         #################################################################</div><div>         #################################################################</div><div>         #################################################################</div>
<div>         #################################################################</div><div>         #################################################################</div><div>         #################################################################</div>
<div>         #################################################################</div><div>         #################################################################</div><div>         #################################################################</div>
<div>         #################################################################</div><div>         #################################################################</div><div>         #################################################################</div>
<div>         #################################################################</div><div>         #################################################################</div><div>         #################################################################</div>
<div>         #################################################################</div><div>         #################################################################</div><div>         #################################################################</div>
<div>         #################################################################</div><div>         #################################################################</div><div>         ############################</div><div>
done</div><div>Bytes transferred = 8126464 (7c0000 hex)</div><div>original_product_id = 36000001</div><div> original_product_ver = 01</div><div> recovery_product_id = 36000001</div><div> recovery_product_ver = 01</div><div>
 auto update firmware: product id verify sucess!</div><div><br></div><div>First 0x2 last 0x7d sector size 0x10000</div><div> 125</div><div>Erased 124 sectors</div><div>Copy to Flash... write addr: 9f020000</div><div>done</div>
<div><br></div><div>U-Boot 1.1.4 (Sep  9 2013 - 14:28:41)</div><div><br></div><div>U-boot DB120</div><div><br></div><div><br></div><div>DRAM:  128 MB</div><div>id read 0x100000ff</div><div>flash size 8MB, sector count = 128</div>
<div>Flash:  8 MB</div><div>Using default environment</div><div><br></div><div>PCIe Reset OK!!!!!!</div><div>In:    serial</div><div>Out:   serial</div><div>Err:   serial</div><div>Net:   ag934x_enet_initialize...</div><div>
No valid address in Flash. Using fixed address</div><div> wasp  reset mask:c03300</div><div>WASP  ----&gt; S17 PHY *</div><div>: cfg1 0x7 cfg2 0x7114</div><div>eth0: ba:be:fa:ce:08:41</div><div>athrs17_reg_init: complete</div>
<div>eth0 up</div><div>eth0</div><div>Autobooting in 1 seconds</div><div>## Booting image at 9f020000 ...</div><div>   Uncompressing Kernel Image ... OK</div><div><br></div><div>Starting kernel ...</div><div><br></div><div>
Booting Atheros AR934x</div><div>Linux version 2.6.31--LSDK-9.2.0_U6.616 (root@localhost.localdomain) (gcc version 4.3.3 (GCC) ) #1 Wed Mar 20 15:14:56 CST 2013</div><div>Ram size passed from bootloader =128M</div><div>flash_size passed from bootloader = 8</div>
<div>CPU revision is: 0001974c (MIPS 74Kc)</div><div>ath_sys_frequency: cpu srif ddr srif cpu 560 ddr 450 ahb 225</div><div>Determined physical RAM map:</div><div> memory: 08000000 @ 00000000 (usable)</div><div>Zone PFN ranges:</div>
<div>  Normal   0x00000000 -&gt; 0x00008000</div><div>Movable zone start PFN for each node</div><div>early_node_map[1] active PFN ranges</div><div>    0: 0x00000000 -&gt; 0x00008000</div><div>Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512</div>
<div>Kernel command line: console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:128k(u-boot),1024k(kernel),6912k(rootfs),64k(config),64k(ART) mem=128M</div><div>PID hash table entries: 512 (order: 9, 2048 bytes)</div>
<div>Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)</div><div>Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)</div><div>Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.</div><div>
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes</div><div>Writing ErrCtl register=00000000</div><div>Readback ErrCtl register=00000000</div><div>Memory: 112924k/131072k available (1852k kernel code, 17984k reserved, 428k data, 120k init, 0k highmem)</div>
<div>NR_IRQS:128</div><div>plat_time_init: plat time init done</div><div>Calibrating delay loop... 279.55 BogoMIPS (lpj=559104)</div><div>Mount-cache hash table entries: 512</div><div><br></div><div>****************ALLOC***********************</div>
<div> Packet mem: 8026c4c0 (0xe00000 bytes)</div><div>********************************************</div><div><br></div><div>NET: Registered protocol family 16</div><div>PCI init:ath_pcibios_init</div><div>ath_pcibios_init(294): PCI CMD write: 0x356</div>
<div>registering PCI controller with io_map_base unset</div><div>bio: create slab &lt;bio-0&gt; at 0</div><div>pci 0000:00:00.0: PME# supported from D0 D1 D3hot</div><div>pci 0000:00:00.0: PME# disabled</div><div>Returning IRQ 64</div>
<div>NET: Registered protocol family 2</div><div>IP route cache hash table entries: 1024 (order: 0, 4096 bytes)</div><div>TCP established hash table entries: 4096 (order: 3, 32768 bytes)</div><div>TCP bind hash table entries: 4096 (order: 2, 16384 bytes)</div>
<div>TCP: Hash tables configured (established 4096 bind 4096)</div><div>TCP reno registered</div><div>NET: Registered protocol family 1</div><div>ATH GPIOC major 0</div><div>squashfs: version 4.0 (2009/01/31) Phillip Lougher</div>
<div>msgmni has been set to 220</div><div>Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)</div><div>io scheduler noop registered</div><div>io scheduler deadline registered (default)</div><div>Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled</div>
<div>serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A</div><div>console [ttyS0] enabled</div><div>PPP generic driver version 2.4.2</div><div>NET: Registered protocol family 24</div><div>5 cmdlinepart partitions found on MTD device ath-nor0</div>
<div>Creating 5 MTD partitions on &quot;ath-nor0&quot;:</div><div>0x000000000000-0x000000020000 : &quot;u-boot&quot;</div><div>0x000000020000-0x000000120000 : &quot;kernel&quot;</div><div>0x000000120000-0x0000007e0000 : &quot;rootfs&quot;</div>
<div>0x0000007e0000-0x0000007f0000 : &quot;config&quot;</div><div>0x0000007f0000-0x000000800000 : &quot;ART&quot;</div><div>-&gt;Oops: flash id 0xef4017 .</div><div>----TP IGMP has been init------</div><div>TCP cubic registered</div>
<div>NET: Registered protocol family 10</div><div>NET: Registered protocol family 17</div><div>802.1Q VLAN Support v1.8 Ben Greear &lt;<a href="mailto:greearb@candelatech.com">greearb@candelatech.com</a>&gt;</div><div>All bugs added by David S. Miller &lt;<a href="mailto:davem@redhat.com">davem@redhat.com</a>&gt;</div>
<div>athwdt_init: Registering WDT success</div><div>ath_otp_init: Registering OTP success</div><div>ath_clksw_init: Registering Clock Switch Interface success</div><div>VFS: Mounted root (squashfs filesystem) readonly on device 31:2.</div>
<div>Freeing unused kernel memory: 120k freed</div><div>init started:  BusyBox v1.01 (2013.02.27-07:39+0000) multi-call binary</div><div>This Board use 2.6.31</div><div>insmod: cannot open module `/lib/modules/2.6.31/kernel/x_tables.ko&#39;: No such file or directory</div>
<div>insmod: cannot open module `/lib/modules/2.6.31/kernel/xt_tcpudp.ko&#39;: No such file or directory</div><div>xt_time: kernel timezone is -0000</div><div>nf_conntrack version 0.5.0 (2048 buckets, 8192 max)</div><div>
CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use</div><div>nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or</div><div>sysctl net.netfilter.nf_conntrack_acct=1 to enable it.</div>
<div>ip_tables: (C) 2000-2006 Netfilter Core Team</div><div>insmod: cannot open module `/lib/modules/2.6.31/kernel/iptable_raw.ko&#39;: No such file or directory</div><div>insmod: cannot open module `/lib/modules/2.6.31/kernel/flashid.ko&#39;: No such file or directory</div>
<div>PPPoL2TP kernel driver, V1.0</div><div>PPTP driver version 0.8.3</div><div>insmod: cannot open module `/lib/modules/2.6.31/kernel/harmony.ko&#39;: No such file or directory</div><div><br></div><div> (none) mips #1 Wed Mar 20 15:14:56 CST 2013 (none)</div>
<div>(none) login: Now flash open!</div><div>Now flash open!</div><div>Now flash open!</div><div>Now flash open!</div><div>Now flash open!</div><div>Erase from 0X7E0000 to 0X7EFC80:.</div><div>Program from 0X7E0000 to 0X7EFC80:</div>
<div>write successfully</div><div>Now flash open!</div><div>Now flash open!</div><div>Erase from 0X7E0000 to 0X7EFC80:.</div><div>Program from 0X7E0000 to 0X7EFC80:</div><div>write successfully</div><div>Now flash open!</div>
<div>Erase from 0X7E0000 to 0X7EFC80:.</div><div>Program from 0X7E0000 to 0X7EFC80:</div><div>write successfully</div><div>ATHR_GMAC: Length per segment 1536</div><div>ATHR_GMAC: fifo cfg 3 01f00140</div><div>ATHR_GMAC: RX TASKLET - Pkts per Intr:100</div>
<div>ATHR_GMAC: Mac address for unit 0:bfff0000</div><div>ATHR_GMAC: ff:ff:ff:ff:ff:ff</div><div>ATHR_GMAC: Max segments per packet :   1</div><div>ATHR_GMAC: Max tx descriptor count :   128</div><div>ATHR_GMAC: Max rx descriptor count :   128</div>
<div>ATHR_GMAC: Mac capability flags    :   2381</div><div>athr_gmac_ring_alloc Allocated 2048 at 0x87af3000</div><div>athr_gmac_ring_alloc Allocated 2048 at 0x87a6f800</div><div>WASP  ----&gt; S17 PHY *</div><div>Setting Drop CRC Errors, Pause Frames and Length Error frames</div>
<div>Hello, nat module!</div><div>thread: napt_ct_scan create success pid:108</div><div>netlink_kernel_create succeeded at tp_rule_nl_prot: [29]</div><div>isis_ip_intf_entry_add id[0] for vid[1]</div><div>isis_ip_intf_entry_add id[1] for vid[2]</div>
<div>ACL(Index 0) For packet From Wan Port and TTL is zero</div><div>ACL is not yet enabled. Enabling...</div><div>ACL Rule(Index 2) For UDP with Zero Checksum</div><div><br></div><div>######## S17 SSDK init succeeded! ########</div>
<div>++++ athrs17_igmp_setup once</div><div>athrs17_reg_init:done</div><div>Setting PHY...</div><div>napt_ct_scan_thread: time: 4</div><div>ADDRCONF(NETDEV_UP): eth0: link is not ready</div><div>device eth0.1 entered promiscuous mode</div>
<div>device eth0 entered promiscuous mode</div><div>Now flash open!</div><div>Receive unknown msgType:10 at isis_nat_helper.2631.c:2930/tp_rule_netlink()!</div><div>isis_ip_intf_entry_add id[1] for vid[2]</div><div>br0: port 1(eth0.1) entering forwarding state</div>
<div>ACL Rule(Index 1) For Packet From WAN to LAN Port And DIP is in lan net</div><div>nf_conntrack_rtsp v0.6.21 loading</div><div>nf_nat_rtsp v0.6.21 loading</div><div><br></div><div>Enet:0 port4 up</div><div>ATH_MAC_TIMER: enet unit:0 is up...</div>
<div>RGMii 1000Mbps full duplex</div><div>ATH_MAC_TIMER: done cfg2 0x7215 ifctl 0x0 miictrl</div><div>ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready</div><div>asf: module license &#39;Proprietary&#39; taints kernel.</div>
<div>Disabling lock debugging due to kernel taint</div><div>ath_hal: 0.9.17..1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, 11D)</div><div>ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved</div>
<div>ath_dfs: Version 2.0.0</div><div>Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved</div><div>ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved</div><div>ath_ahb: 9.2..0_U10.1020 (Atheros/multi-bss)</div>
<div>__ath_attach: Set global_scn[0]</div><div>ACBKMinfree = 48</div><div>ACBEMinfree = 32</div><div>ACVIMinfree = 16</div><div>ACVOMinfree = 0</div><div>CABMinfree = 48</div><div>UAPSDMinfree = 0</div><div>Restoring Cal data from Flash</div>
<div>dfs_attach: use DFS enhancements</div><div>DFS min filter rssiThresh = 18</div><div>DFS max pulse dur = 151 ticks</div><div>ath_get_caps[5108] rx chainmask mismatch actual 3 sc_chainmak 0</div><div>ath_get_caps[5083] tx chainmask mismatch actual 3 sc_chainmak 0</div>
<div>SC Callback Registration for wifi0</div><div>wifi0: Atheros 9340: mem=0xb8100000, irq=2</div><div>ath_pci: 9.2.0_U10.1020 (Atheros/multi-bss)</div><div>__ath_attach: Set global_scn[1]</div><div>ACBKMinfree = 48</div>
<div>ACBEMinfree = 32</div><div>ACVIMinfree = 16</div><div>ACVOMinfree = 0</div><div>CABMinfree = 48</div><div>UAPSDMinfree = 0</div><div>Restoring Cal data from Flash</div><div>dfs_attach: use DFS enhancements</div><div>
DFS min filter rssiThresh = 18</div><div>DFS max pulse dur = 151 ticks</div><div>ath_get_caps[5108] rx chainmask mismatch actual 3 sc_chainmak 0</div><div>ath_get_caps[5083] tx chainmask mismatch actual 3 sc_chainmak 0</div>
<div>SC Callback Registration for wifi1</div><div>wifi1: Atheros 9580: mem=0x10000000, irq=64 hw_base=0xb0000000</div><div>wlan_vap_create : enter. devhandle=0x87bd82c0, opmode=IEEE80211_M_HOSTAP, flags=0x1</div><div>wlan_vap_create : exit. devhandle=0x87bd82c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.</div>
<div>VAP device ath0 created</div><div><br></div><div> DES SSID SET=TP-LINK_2.4GHz_B69685</div><div> ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1</div><div>device ath0 entered promiscuous mode</div>
<div>br0: port 2(ath0) entering forwarding state</div><div> ieee80211_ioctl_siwmode: imr.ifm_active=1442432, new mode=3, valid=1</div><div>br0: port 2(ath0) entering disabled state</div><div><br></div><div> DES SSID SET=TP-LINK_2.4GHz_B69685</div>
<div>br0: port 2(ath0) entering forwarding state</div><div>br0: port 2(ath0) entering disabled state</div><div>br0: starting userspace STP failed, starting kernel STP</div><div>br0: topology change detected, propagating</div>
<div>br0: port 2(ath0) entering forwarding state</div><div>wlan_vap_create : enter. devhandle=0x86c802c0, opmode=IEEE80211_M_HOSTAP, flags=0x1</div><div>wlan_vap_create : exit. devhandle=0x86c802c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.</div>
<div>VAP device ath1 created</div><div><br></div><div> DES SSID SET=TP-LINK_5GHz_B69686</div><div> ieee80211_ioctl_siwmode: imr.ifm_active=66176, new mode=3, valid=1</div><div>Found best 11na chan: 44</div><div>br0: port 1(eth0.1) entering disabled state</div>
<div>br0: topology change detected, propagating</div><div>br0: port 1(eth0.1) entering forwarding state</div><div>device ath1 entered promiscuous mode</div><div>br0: topology change detected, propagating</div><div>br0: port 3(ath1) entering forwarding state</div>
<div> ieee80211_ioctl_siwmode: imr.ifm_active=852608, new mode=3, valid=1</div><div>br0: port 3(ath1) entering disabled state</div><div><br></div><div> DES SSID SET=TP-LINK_5GHz_B69686</div><div>br0: topology change detected, propagating</div>
<div>br0: port 3(ath1) entering forwarding state</div><div>br0: port 3(ath1) entering disabled state</div><div>br0: topology change detected, propagating</div><div>br0: port 3(ath1) entering forwarding state</div><div>fuse init (API version 7.12)</div>
<div>usbcore: registered new interface driver usbfs</div><div>usbcore: registered new interface driver hub</div><div>usbcore: registered new device driver usb</div><div>ehci_hcd: USB 2.0 &#39;Enhanced&#39; Host Controller (EHCI) Driver</div>
<div>Port Status 1c000004</div><div>ath-ehci ath-ehci.0: ATH EHCI</div><div>ath-ehci ath-ehci.0: new USB bus registered, assigned bus number 1</div><div>ehci_reset Intialize USB CONTROLLER in host mode: 13</div><div>ehci_reset Port Status 1c000000</div>
<div>ath-ehci ath-ehci.0: irq 3, io mem 0x1b000000</div><div>ehci_reset Intialize USB CONTROLLER in host mode: 13</div><div>ehci_reset Port Status 1c000000</div><div>ath-ehci ath-ehci.0: USB 2.0 started, EHCI 1.00</div><div>
usb usb1: configuration #1 chosen from 1 choice</div><div>hub 1-0:1.0: USB hub found</div><div>hub 1-0:1.0: 1 port detected</div><div>SCSI subsystem initialized</div><div>usb 1-1: new high speed USB device using ath-ehci and address 2</div>
<div>usb 1-1: configuration #1 chosen from 1 choice</div><div>hub 1-1:1.0: USB hub found</div><div>hub 1-1:1.0: 4 ports detected</div><div>Initializing USB Mass Storage driver...</div><div>usbcore: registered new interface driver usb-storage</div>
<div>USB Mass Storage support registered.</div><div> GPL NetUSB up!</div><div>kc   86 : run_telnetDBGDServer start</div><div>kc  223 : init_DebugD end</div><div>INFO1758: NetUSB 1.184, 0002061F : May  7 2012 10:36:59</div>
<div>INFO175A:  AUTH ISOC</div><div>INFO175B:</div><div>usbcore: registered new interface driver KC NetUSB General Driver</div><div>INFO0076:  init proc : PAGE_SIZE 4096</div><div>INFO17B4: Check mac address</div><div>INFO162C:  infomap 8654c220</div>
<div>INFO162F:  sleep to wait br0 to wake up</div><div>INFO02D0:  use dev Name br0</div><div>INFO1638:  sleep to wait br0 end.</div><div>INFO1651:  UDP_BROAD 7437 tcpPort:625868800</div><div>INFO02D0:  use dev Name br0</div>
<div>INFO1538: tcpConnector() started...</div><div>TP_RULE_NAT:enable hardware nat</div><div>IPv6 over IPv4 tunneling driver</div><div>(tp_mroute_enable_write)140, tp_mroute_enable = 1</div><div>INFO1415: Bind to br0

You may also like

52 Comments

  1. Unfortunately, on my 3600 the above method does not work, so I guess I’ll have to do via serial (for the moment I am ordering this here: “PL2303HX – Modular converter cable, USB to TTL to UART, RS232 COM”).

  2. Hi Mike, are you using solarwinds tftp server? does it show anything in the log? have you set your pc to the correct static ip and using a lan port on the router?

    1. Hello Brian, as tftp server I used “Tftpd64”, since I had already installed a long time; regarding IP and the rest I did as the guide, but in the server log tftp nothing appears (I have obviously set is the right folder where I put the firmware is set to the LAN where to listen). maybe now I try to do it with the TFTP server specified in the guide.

    1. here is what appears on wireshark

      [URL=http://s1340.photobucket.com/user/tgaserver/media/3600/wireshark_zpsbddafbee.png.html][IMG]http://i1340.photobucket.com/albums/o728/tgaserver/3600/th_wireshark_zpsbddafbee.png[/IMG][/URL]

  3. link doesn’t work ‘Sorry, the requested page does not exist.
    Please check the URL for correct spelling and capitalization.’

  4. Where mine says who has 192.168.0.66? (laptop) tell 192.168.0.86 (router) where yours says tell 0.0.0.0 . Also your router doesn’t appear to be in recovery mode? Try starting wireshark then hold down the wps/reset button on the router and power on, you should see the file request.

  5. Ahh my recovery was from a router running stock firmware. I will have a look at the log. Did it brick during the initial flash from stock to ddwrt? Do you have a link to the image you used?

    1. no days ago I successfully upgraded from stock firmware to DD-WRT v24 PreSP2 [Beta] Build 21061, but having some trouble every now and then with wifi (sometimes no longer appeared 2 networks wifi router) and having read around the forum that was resolved with r24461 I tried to do the upgrade via the web interface of DD-WRT, but something must have gone wrong because the restart I found myself with a bricked router; then the router can not be reached, much less respond to the ping, and so on.

      both firmware I had taken from the official website of DD-WRT, the first time I used what is called: factory-to-ddwrt.bin

  6. I’ve flashed from stock to DD-WRT v24-sp2 (03/25/13) std – build 21061 (factory-to-ddwrt.bin), when pressing the reset button on power on I was able to use the recovery method to go back to stock. I then reupgraded to 21061 then upgraded via the gui to DD-WRT v24-sp2 (06/23/14) std – build 24461 then went back to stock using my revoery method. Do you have any firewalls running? if so disable them as they may be blocking tftp.

      1. Yes try serial but seems strange that the recovery method is not working for you, have you tried it with firewall disabled?

    1. ok, the cable arrived yesterday, now I have to find the 3 pin connector and finally get some free time to put them to settle and do the rest.

        1. hello sorry for the delay in the response but after they got the pin to be welded, as they are not very handy with the soldering, I had to spend it all to a friend who gets along much better than me :), (by the way I it has also started a second router, tP-link WR1043ND v1.2 always with dd-wrt even there, however also in latter ‘I did do its welding pin). because I plan to never to the dd-wrt, but I would put on both routers “openwrt”, advise me to put before the original firmware of the tp-link router for 2 or I can already put us directly via the serial ‘openwrt ?.
          Another question, since I have two USB keys that do not use (1 2GB and 4GB one, it would put on WDR3600, while the 2GB on WR1043ND v.1.2) and I read through them that you can bypass the problem of memory limits of these routers, always using OpenWRT; if you can you tell me the steps to do?

          thanks and sorry for the length of the response.

        2. in the meantime, I have resurrected both 2 router via serial and put on both the “version” of openwrt you that I indicated yesterday, also I have already connected the two keys that I said, (I have done nothing for the moment)

          1. Hi Mike, how have things been going on the openwrt front? I haven’t done the usb flash memory thing, have you got any further with it or do you want me to have a go at it?

  7. Hi,
    I followed the instructions, uploaded the latest firware by TFTP but then I am stuck in a boot loop.
    Somehow , from what I can see, it is stuck in recovery mode even though I rebooted etc …,
    any idea?

    1. Hi Gerry did you give enought time for the upgrade to complete before you rebooted it? have you tried doing the upgrade again? Make sure you are using the correct device/hardware version firmware.

  8. 2 + Years later, I’m having this same issue. I’ve tried everything above, except getting serial cable. I ordered one and have Saturday delivery coming (today is Thursday), anyhow, Anyone have any other new recommendations before the cord and header pins come Saturday, that I can try? I have a small handful of these routeres, all not working. The person I got them from, put 3rd party software on them, that is no longer active, so when you plug internet in to it, then it tries to allow you to access the internet through the 3rd party software, but the campaign he was using is shut down now, so it goes to a page not found… so it is not working.

    The guy said these instructions should work, because the 3rd party software does not disable the ability to reset them with these methods.

    But I have been 100% unsuccessful. The TFTP Server never loads anything, nothing executes, it just sits there, even if I hold down the reset and start by plugging in the device then powering it on, nothing. I’ve tried every combination.
    I did rename the bin to the recovery bin name that it showed above.

    1. Hi Richard, generally third party software doesn’t rewrite the boot loader so the method should still work. Re tftp even if the filename is wrong you should still see the request for file x on the tftp server.

      What tftp server are you using? If running on a Windows machine have you tried disabling windows firewall? Have you set the static ip?

      As you have serial kit on the way I would put it on one of them and see what it’s up to.

  9. Hi,

    I tried the method, and initially, everything seems to be working, the image gets transferred to the router but then the router goes back into a boot loop.

    The transfer log (for tftpd) is given below.

    Connection received from 192.168.0.86 on port 1581 [19/03 10:16:19.549]
    Read request for file . Mode octet [19/03 10:16:19.550]
    OACK: [19/03 10:16:19.550]
    Using local port 49217 [19/03 10:16:19.550]
    : sent 16002 blks, 8192512 bytes in 6 s. 0 blk resent [19/03 10:16:25.340]

    I don’t have the serial cable so can’t show the boot log yet.

        1. What is the reason for the reflash? Was it running stock FW before? Are you naming the file wdr3600v1_tp_recovery.bin

          1. Yes, I renamed the firmware files. The correct file was being transferred too.

            I got this from someone and when I started it, it already was doing a boot loop. So, I am not aware of the previous firmware, whether it was stock or other.

          1. Your going have to give me something to go on, not working means nothing. Is the device bricked? Does it respond to ping? What lights are on? Have you installed openwrt on it? What tftp server are you using? Windows or Linux?

  10. If TFTP method doesn’t work. Try to place a network Hub or Switch between the router and the computer. Because the router is turning on and off its network connection and sometimes with some PC network cards or windows, the time that the router put its network up is not enough for the windows to put its network connection up. Putting a switch or hub between both of them. The windows connection will be always up, and the it will be ready to serve by TFTP when the router ask for only e few seconds.

  11. Thanks for providing such helpful info, and for continuing as the years go by!

    I have a TP-Link wdr3500-v1.3 (the interesting combination of features incl low power usage and removable antennas suits me) and am trying to recover from a bad flash.

    Its current state is that when power is applied, power LED comes on steady, and after ~4s all the others flash once every 3.5s.

    Tftp recovery appears to fetch the file correctly but promptly returns to the state described above.

    I have tried several different bin files (including tp-link, dd-wrt, and openwrt) and nothing gets the router out of this state.

    Can you educate us a bit by telling what top_wdr3600v1.bin that you provided did for the 3600, and might you have one that would help my 3500?

    Thank You.

    1. Hi Tim, thank you for your kind words it’s great to know that people are still finding my guides useful.

      Firstly has device ever worked? If so what firmware was it running i.e stock tp-link, openwrt etc? What caused the device to brick? Bad flash, bad firmware? Etc.

      I don’t have a version for the wdr3500 but I could probably knock one up of it’s something you’d like to try?

  12. It ran well using
    TP-link Firmware Version: 3.13.34 Build 130909 Rel.46031n

    Then it ran ok using
    DD-WRT v3.0-r44715
    except 5GHz was completely non-functional.

    As I recall, the current problem occurred when I was trying various versions of DD-WRT trying to get 5GHz working; I suspect I tried fw for the wrong hw.

    What I bought it for was to learn OpenWrt, but whenever I tried to install it,
    the procedure seemed ok, but when I rebooted, it was running the previous fw. I did google around looking for special instructions to get from DD to Open but didn’t see any. While looking around your site, I see your remark that “it’s a bad idea to go from one non stock f/w to another” but that was after the trouble: mainly I saw warnings that recent fw from the manufacturers will lock out non-stock upgrades for regulatory reasons.

    I would definitely be grateful if you provide a fix, and also suggest how to get from here to OpenWrt-21.

    Thanks again.

  13. Well dang, I REALLY wanted that to work, but I’m getting the same result as with all the other tftp recovery attempts. I tried it with other tftp servers, did 30-30-30, left it overnight, no joy. Grateful for your help nonetheless.

    1. Hi Tim, well that’s a shame the only other option is to connect a serial header to it, Does the tftp server show it getting the correct file and downloading it?

  14. It looks like the file is being found and sent, but then what?

    user@debian: cp outpost/top_wdr3500v1.bin /ftp/wdr3500v1_tp_recovery.bin
    Aug 31 17:25:19 localhost dnsmasq-tftp[50812]: sent /ftp/wdr3500v1_tp_recovery.bin to 192.168.0.86

    Aug 31 17:50:52 mx1 atftpd[31972]: Advanced Trivial FTP server started (0.7)
    Aug 31 17:50:57 mx1 atftpd[31972]: Serving wdr3500v1_tp_recovery.bin to 192.168.0.86:2987

    What would happen next if your file worked as hoped?

    I guess the 3.5s LED blink is just a bootloop, right?

    Again, thanks for your generous help.

      1. same as usual…

        2021-09-05T21:05:54.560066-04:00 d31 in.tftpd[17492]: connect from 192.168.0.86 (192.168.0.86)
        2021-09-05T21:05:54.562788-04:00 d31 tftpd[17493]: tftpd: trying to get file: wdr3500v1_tp_recovery.bin
        2021-09-05T21:05:54.563652-04:00 d31 tftpd[17493]: tftpd: serving file from /srv/tftp
        2021-09-05T21:06:00.151926-04:00 d31 kernel: [214926.500419] e1000e: eth0 NIC Link is Down

        … except one time (of several tries) i got a ?recovery loop instead of the usual, and the file was requested/served 6 times at 5s interval before router rebooted.

        How long do you expect a successful flash to take on the 3500?

        Thanks again.

  15. Oh that’s a shame, after it’s downloaded the file it flashes it then reboots should be done in under 5 mins.

    Does the tftp server say the file was transferred successfully?

    1. I don’t see any error messages from the server; don’t know how robust the protocol is. I guess I ought to set this aside until I can set up a serial connection. Thanks.

Leave a Reply

Your email address will not be published. Required fields are marked *