TP-Link Router – Debrick (e.g. TL-WR941ND)

Your TP-Link Router is bricked. Perhaps you flashed a alternative firmware and now you aren’t able to access it anymore.

What do you need to unbrick your Router (in this example a TL-WR941ND)?

– solder and Solder Iron
– PINs (preferred) or cables to solder them to the router board (see in picture below)
– I use a USB to TTL converter (buy one at ebay or amazon)
– PuTTY to connect to the router
– a TFTP server, connected to your network, up and running (a raspberry is fine, or just google for a server, there a a few for windows)
– a valid firmware (I prefer OpenWRT) available on your TFTP server
– Ethernet-Cable to connect your router to your wired network

As you see on the photo, I soldered multiple PINs to the Router’s serial interface (got them from an old PC).
If you are unbricking a TL-WR941ND Router, you also have to short to PINs, which are marked in the picture.

And of course you have to twist the TX / RX PINs, that means the wire connected to RX on your USB to TTL converter is connected to the TX PIN on the Router and vice versa.

2014-01-24 20.41.25

If your converter is connected properly to your router, plug it in to your PC. Open up the Device Manager (press Windows-Key & Pause-Key, you’ll find it on the right side of the System-Window) and find the COM-Port from your adapter.

2014-01-24 20_29_40

Next, start PuTTY. Change the connection type to Serial, specify the Serial line (COM-Port) and enter the baud rate. (115200)

2014-01-24 20_29_27

Click ‘open’.

Plug in your router’s power adapter. You should see some output in the PuTTY window. As soon as

Autobooting in 1 seconds

is displayed, enter

Maybe you have to try it muliple times, just power-cycle your router.

If you catch the right timing, you’ll get a prompt and you are ready to unbrick.

Connect your router with the Ethernet-Cable to your network (preferably via LAN1).

Then set your server-IP (i.e. your TFTP Server) and an IP for the router (should not be used from an other device on your network).

setenv serverip

setenv ipaddr

Next, start transferring your openwrt-Image (named it openwrt.bin) from your tftp-Server:
tftp 0x80800000 openwrt.bin

Now erase the current firmware:
erase.b 0xbf020000 +0x3c0000

0xbf020000 is the from address, you get the right size by issuing the command:
printenv bootcmd

0x3c0000 is the size of the firmware, you can have an other size, after the tftp – command you get an info about the size. Use this size!

At last copy the new firmware to the right location and reset the router. Use the right adresses (you already used them, see above):

cp.b 0x80800000 0xbf020000 0x3c0000 


Your router is now unbricked.

1 Comment

  1. Marius

    Worked like a charm! Thank you!

Leave a Reply

Your email address will not be published. Required fields are marked *