TP-LINK WR740n bricked

After I attempted to flash the router with open-wrt I managed to brick the device after trying to copy the image it said not enough memory.

When it’s bricked all it does is flash all the lights.

If you connect to the serial interface that it spits out is this :

AP121 (ar9330) U-boot

DRAM:  32 MB
led turning on for 1s…
id read 0x100000ff
flash size 4194304, sector count = 64
Flash:  4 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize…
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
auto update firmware: is_auto_upload_firmware = 0!
Autobooting in 1 seconds
## Booting image at 9f020000 …
   Uncompressing Kernel Image … Too big uncompressed streamLZMA ERROR 1 – must RESET

This is the official open-wrt page on the  TP-LINK WR740n :

You have to solder a 3 pin connector (rx, tx, gnd) and then use a usb-serial convertor to gain access directly to the processor.

Download putty, select serial select com port set Baudrate to : 115200 – and you should see something similar to the above code.

Type “tpl” in U-Boot to get a shell!

We need to set router and server IP addresses :

setenv ipaddr ROUTER_IP (eg. 192.1681.1)
setenv ipaddr
setenv serverip YOUR_PC_IP (eg.
setenv serverip
printenv (to check the settings)
tftpboot 0x81000000 openwrt-ar71xx-generic-tl-wr740n-v4-squashfs-factory.bin
erase 0x9f020000 +0x3c0000
cp.b 0x81000000 0x9f020000 0x3c0000
bootm 9f020000

Additional info :

3932160 bytes openwrt-ar71xx-generic-tl-wr740n-v4-squashfs-factory.bin
3932160 bytes = 3.75MB = 3c0000(hex) bytes

Additional resources :

To restore to original firmware :
 Download WinScp

Transfer image to /tmp using the WinScp

Connect with  putty on ip adress via ssh and type :

cd /tmp
mv wr741nv1_en_3_11_1_up(100312).bin orig.bin
dd if=orig.bin of=tplink.bin skip=257 bs=512
mtd -r write /tmp/tplink.bin firmware 

1 thought on “TP-LINK WR740n bricked”

  1. i didn’t see were to soldering the wire , thank you for sharing to us but your video is usless if don’t show where to solder the wire.


Leave a Reply to alex Cancel reply