Returning MR3040 (or other TP-Link routers) back to original factory firmware [Solved]

Update Matthias ~ 07th July 2015
Most bricks happen through this howto. If you have troubles, don't try to recovery to factory firmware- ask first.


PirateBox is great, but what if you want to return your router back to its original TP-Link configuration? I have a TL-MR3040, a Windows 8.1 laptop, and here is what I did.

You will need three free utilities (dd, Mongoose web server, and Putty) but they are all click-to-run, no installation necessary, portable apps. You will use them, then delete them (or save them for future use). No need to install or uninstall anything in Windows, no extra DLLs, no registry changes, etc.

1. Download the latest TL-MR3040 firmware from TP-Link:
[www.tp-link.com]

2. Download dd from [www.chrysocome.net] and clip the firmware .bin file, which in my case (June 2014) was called mr3040v2_en_3_17_1_up_boot(131121).bin, down to size so the flashing will work. Full instructions/explanation here: [wiki.openwrt.org]. Look for the line:
dd if=original_filename.bin of=modified_filename.bin skip=257 bs=512
To make typing easier, I renamed mr3040v2_en_3_17_1_up_boot(131121).bin as aaa.bin, and ran dd as:
dd if=aaa.bin of=bbb.bin skip=257 bs=512
...so that the modified file was called bbb.bin

3. Download and run the Mongoose web server free edition from: [cesanta.com], and configure it to point to a folder where you will move bbb.bin to.

4. Download and run Putty from: [www.chiark.greenend.org.uk], which will allow you to telnet into your router. At this point, connect the router to your computer with a network cable, and run ipconfig in a command prompt to get your local IP address.

5. Using Putty, telnet into your router (try the standard IP addresses 192.168.1.1, 192.168.0.1, etc. I don't remember which one worked for me) and login to OpenWrt as user root and whatever password you chose when you installed PirateBox.

6. Once you are logged in enter:
cd /tmp
wget [your computer's IP address] bbb.bin
The Mongoose web server should be running, and if you open a browser window in your computer and enter your local IP address you should be able to see bbb.bin

7. Once the file is done copying, flash the image by entering the following command:
mtd write bbb.bin firmware

8. After that process finishes, initiate a hard reboot:
reboot -f

9. Once the system reboots and the lights are done flashing, open a browser on your computer and go to 192.168.0.254, login with admin for both username and password.

10. Done! Your router is now back to factory spec. You can shut down the Mongoose server.

These instructions are based on:
[wiki.openwrt.org]
[forum.piratebox.cc] (See Matthias post from June 20, 2013 03:27AM)

edit: ~matthias , made sticky



Edited 3 time(s). Last edit at 07/07/2015 06:16PM by Matthias.

I tried your steps and I had issues with the web server. so I did some digging and found out how to copy it directly to the USB drive

Steps 1 and 2 are the same

3. Copy the new . bin file to the root directory of the USB drive.

4. Safely remove the USB drive

5. Re insert the USB drive into the TPlink

6. Power up the tp link like normal.

7 SSH into the router.

8 command cd /mnt/usb

9 command ls this command will show the contents of the directory. Verifiy that the bin file is in the directory.

10 Command cp ***.bin /tmp

11 command cd /tmp

12 command ls again just to make sure the file is there,

13 Goes back to Step 7 of nec240 and procede.

Sorry that I am new and I do not know how to add the fancy formatting here. I also hope this helps

Awesome, lonewolf! This makes it more elegant, since you used one less program (web server) than I did. Well done!

For those of you attempting this for the first time:

- Use lonewolf's solution instead of my Steps 3-6, and you won't have to download the Mongoose Web Server.
- You will still need Putty (or something like it) to SSH (lonewolf Step 7) and run my Steps 7 and 8.

Thanks, lonewolf.

Will this work for TL-WR703N?

Cardinal Fang Wrote:
-------------------------------------------------------
> Will this work for TL-WR703N?


I guess it will, but I can't seem to find the original firmware file on the TP-Link website anymore. The whole device has disappeared. Not that I would want to go back to the original FW, it's completely in Chinese. Maybe it's better to go back to OpenWRT?

One little heads up when using that 3rd party dd software; if you know how to fire up Linux, use Linux, because I didn't get anything out of that dd software, Linux worked like a charm.

Yeah, i think so too, the reason why i wanted original firmware is so i can flash it with openWRT.

Can someone point me to a openWRT over PirateBox flashing tutorial for this device? Googling for it only leads me to confusing results.

Thanks in advance

Can someone point me to a openWRT over PirateBox flashing tutorial for this device?

As PirateBox IS OpenWRT, you can follow each howto about reflashing.

I think, If you have a working PirateBox, the easiest way is to download the correct firmware from openwrt.org ,
bring it to the USB Stick,
power up your PirateBox,
Login to your PirateBox,
and then run

mtd write -r /mnt/usb/<filename> firmware

While <filename> is the name of the firmware file.

regards Matthias

---

This is only my signature.

thanks man, you're the king

Hey, I'm new to using dd. Having trouble clipping the manufacturer firmware file down to the right size. Help?

Aaron

what trouble do you have? ....

---

This is only my signature.

how do you change firmware filename with dd?

Linux/Ubuntu Instructions: (should work for any router)

1. Download latest firmware (seems like they changed from tp-link.com to tplink.com)
2. Ubuntu:

dd if=<downloaded filename> of=<output filename> skip=257 bs=512

3. Ubuntu:

scp <output filename> root@192.168.1.1:/mnt/usb/

(drop the "mnt/usb/" if no usb, might be too big to fit though) (requires root's password to be set)
4. Ubuntu:

mtd write <output filename> firmware

5. Ubuntu:

reboot -f

(it didn't seem to come back so I unplugged and plugged it back in after waiting a bit)

Go to your router's IP Address to see if the firmware has been changed.

I do not remember what password i set for root, what can i do to reset root password so i can go about resetting to original firmware?

use failsafe mode to recover the password...

---

This is only my signature.

That is where i am having a problem, i turn the router on holding the button for 5 to 10 seconds and then i get no wireless connection to connect to. So i have tried the same with a wired connection and i cannot connect with putty when i try ssh or telnet in, i have tried 192.168.1.1 and 192.168.0.254. (Windows shows unidentified network with no network access for the wired connection???) What am i doing wrong here?

[piratebox.cc] that did it, i was following a different guide that said to press the WPS/reset button straight away which doesn't work, you have to wait until it blinks.

I think I might've bricked it, that or my settings are so crazy that nothing wants to go well for me.
1) Running Windows 7 professional
2) My ip when I use ipconfig is said to not be a webpage when I try and put it into putty.
3) mtd isn't a command on my ubuntu i haven't gotten to the step where I need to use it in putty.
4) First day, not so good at this, please be nice

well, you have to run mtd on your piratebox

---

This is only my signature.

Hi,

May I ask a newbie question ?
Why do you need to copy fw file from USB key to /tmp before flashing ? any current flash stick should be more than quick enough to allow a nand flash to be fed...
I was not able to find a reason on OpenWRT forums...

Thx.

1. /tmp is located in the memory not in the flash disk.
2. Router-flashes are not like common nand spaces and have the tendency to be slow
3. USB is slower that writing/reading from ram

Matthias

---

This is only my signature.

Wahoo, that was quick !

Ok, so basically, you're just telling that "there may be a timing problem with USB", and no one has a certainty about it. The step "making a copy to /tmp" is just to ensure that "there will be no timing problem".

I did ask the question because I've been working with embedded ARM platforms (among others), where mass-storage where implemented with a SD card (FAT32 formatted) accessed throught SPI interface, and I did flash directly from SD. (ram was only 512 ko, flash was 4 Mo, with a 40 MHz arm7. SPI access was quick enough to flash directly. But in fact, on this platform, fw upgrade was a specific routine, and while flashing, there was no full-fledged system running).

I think I will need to go deeper into the code and the hard to know this thing (MIPS) better.

Thanks a lot !

You're welcome.

To be honest: I usually my flash my devices directly from USB storages
But like you technically described, there might be issues and for myself- I think the usb port is not that reliable.
Once- I in bad power conditions the flash from usb failed, because the device had not enough power to supply usb and the flash.

So flashing from RAM makes it a bit saver, yes.

---

This is only my signature.

Hello,

I am unable to clip the firmware because I am unable to find the correct file to download from www.chrysocome.net. If someone can post the clipped firmware it certainly will help a lot.

I just don't want to give up on my router.

Regards.

Why do you want to restore the router back to factory?
Does piratebox not work or what is the reason?

Thanks for the guide!

One small amendment - the wget command should refer to the file all as part of one URL (perhaps obvious to some but I got thrown trying to put the IP address in separately!)

For example:
wget [192.168.1.108]

Sadly despite everything going smoothly I still ended up with a bricked router - green lights on and WiFi access reset to default, but not properly allocating an IP address when I tried to connect and thus no web interface. Off to try and resolve that next!

Go to http://www.friedzombie.com/tplink-stripped-firmware/
see on your router label the hardware version V1, V2 ...
download firmware for your router
extract zip archive and copy bin file to your usb flash drive
telnet 192.168.1.1 with putty.exe

cd /mnt/usb
sysupgrade TL-MR3040-V1-FW0.0.3-stripped.bin

same procedure for other tp-link rourter

I try to restore TP-link 3020 v1 back to original fw but now LED light alway blink .
Power, internal, wifi, Lan, WPS
1, 1, 1, 1, 1
1, 0, 0, 0, 0
1, 0, 0, 0, 1
1, 0, 0, 0, 0
Loop

Someone have solution for this happening

yes, you flashed it wrong, now your system is not bootable anymore.
You need to get serial access to fix it.

Need an MR 3020 reset to factory. the OpenWrt was corrupt. Droppped out on Telnet connections. Instructions for "Upgrade" don't seem to apply to install from scratch. 3G/4G mode wouldn't change directory to mount USB.. Ended up bricking. Either need to restore, return or sledgehammer it. Was able to Pineapple x4 of these w/o a prob. Don't get it. Maybe a bad one. Any advice would be appreciated.

If you flashed a corrupt OpenWrt bin, you need to get serial access to reflash your device: see this OpenWrt wiki page for more details.