1) This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation.
This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See
OpenWrt on 4/32 devices
what you can do now.
2) OpenWrt support for this device has ended in 2022.
19.07.10
was the last official build for 4/32 devices.
same form factor as the
TL-WR702N
. TP-Link no longer list the “TL-WR70
3
N” on their website, only the “TL-WR70
2
N”, which has no USB connector and 2
MB
flash only, so it can't run OpenWrt. Alternatives are the
TL-WR710N
or
GL-AR150
.
marketed as a
“3G travel router”
but non version actually includes a 3G/4G... modem. The marketing term rather means that the OEM firmware supports USB 3G modems because it contains drivers for USB modems! Ignore that, because with OpenWrt ANY router with USB supports 3G hardware...
Features:
802.11 b/g/n 150Mbps (130Mbps real)
wireless power output 20dBm - 100mW
4
MB
flash memory (can be modified for 16MB)
32
MB
RAM (can be modified for 64MB)
USB 2.0 port (High-Speed only, use an external High-Speed hub for Full/Low-Speed devices)
Powered via micro-USB socket
Tiny form factor: 5.7cm x 5.7cm x 1.8cm
v1.6(?) March 2013 (FW build 130321, original FW rel. 37153n) Trunk(r41336) AA confirmed working, BB too
v1.6(?) June 2013 (FW build 130625) AA(12.09) AA confirmed working
v1.7 Dec. 2012 (FW build 121204) AA(12.09) AA confirmed working, trunk (r36641) broken
v1.7 April 2014 (3.17.1 Build 140120 Rel.56593n) Unsupported trunk(r40351) not work
v1.7 April 2014 (3.17.1 Build 140120 Rel.56593n) Trunk (r45157)
confirmed working
, Chaos Calmer, trunk (r45157)
v1.7 April 2014 (3.17.1 Build 140120 Rel.56593n) barrier_braker 14.07
working image
, image includes preinstalled LuCI. I had problems with installing LuCI using trunk image
If you've got a modified version of this hardware which has 16MB of flash, then you will not be able to
build
images larger than 4MB, even though the bootloader will allow you to subsequently utilize all 16MB of flash (i.e. by adding packages after firstboot). See
mb_flash_mod
for how to solve this problem.
in the Chinese webadmin interface: “Build 120925” correspond to a v1.7 firmware
on the internal sticker located on the Ethernet jack (may have 12B042)
DO NOT RELY ON THE VERSION GIVEN BY THE EXTERNAL STICKER ON CASE BOTTOM
: it may report falsely “1.6”, even if the firmware is actually a V1.7
Below is the version of the new bootloader (which disables the
LAN
port) of a version 1.7 hardware model (bought in December 2012).
For more info visit this forum topic:
https://forum.openwrt.org/viewtopic.php?id=40986
Firmware rev.140120 has admin1/admin1 set for web login/password
This router is standardly powered via USB at 5V. The voltage regulator inside is unknown, but its input voltage should be at least between 3.7V - 5.5V, but not over 5.5V. The device will get damaged at too high voltages*. Maximum current draw at 5V is 185mA (OpenWrt boot), average current draw with WiFi at 18dBm is 100mA, without WiFi 80mA. Hence the average router power consumption is 0.5W, which is incredibly low.
Power consumption will be higher if a USB device is attached to its USB port!
*Hint: If the router seems to be damaged because of a too high voltage, connect 3.3V _after_ the voltage regulator. This replaces the function of the damaged regulator, and the router works again.
Be sure to power 5 volts into the micro-usb port at the same time if you want to have the usb port on the device work.
More information and a rough diagram here
http://img513.imageshack.us/img513/4295/saai.jpg
The serial console connector does not utilise the regular TP-Link pinouts. Two pads labelled TP_OUT and TP_IN are the TX and RX signals. 115200 8n1. You have to connect your RS232-USB apdater also to the 5V pin on the board.
Note that the pads can very easily be lifted. There is slightly more mechanical strength if you can solder to the surface-mount components to which the pads are connected--but this also takes care--your device could easily be destroyed. Make sure that your connection is secured so that tension cannot be applied to the solder points when you connect to an external device.
TL-MR703n login: root
password: 5up
Flashing
v1.6 and older: upload the latest stable version via the web interface (default: 192.168.1.1 / admin / admin).
Note:
that the factory default web interface won't accept a file with a long name. Rename it to openwrt.bin and you won't get a “23002 Error”.
v1.7 hardware running 3.17.1 Build 140120 Rel.56593n will reject OpenWrt installation via the web interface, install via
tftp instead
.
Download latest
squashfs-factory.bin
for the initial flash. Use a “sysupgrade” file for any future updates if already on openwrt.
To flash from the Chinese web interface, at the present time you would select the last menu item on the left, and then the third submenu item. This initiates a popup with two buttons--the upper right one allows you to browse to find the file you want to flash on your PC, the lower left one initiates the flash.
When you roll over an item on the Chinese web interface, the rollover text will indicate which item you are selecting.
When the configuration no longer allows you to log in via any network connection (e.g. lost password), the OpenWrt failsafe mode can be entered via the single “Reset” button on the device. However, in contrast to the
generic failsafe instructions
, for the TL-WR703N you have to wait for ca. 10 (10-12) seconds before pushing the “Reset” button after powering on the device. If the button is pushed immediately after powering on, the single blue LED will start blinking, supposedly indicating some failsafe firmware recovery mody of the embedded bootloader (not yet discovered how to use it). In this mode, the OpenWrt failsafe is not being started. Instead, wait for slightly longer than 10 seconds and - as soon as the LED starts blinking for the first time after powering on the device, push the “Reset” button for ca. 1-2 seconds. Immediately afterwards, the LED will blink rapidly (multiple Hz) and OpenWrt will be in
failsafe mode
.
- The above didn't work on a Ver 1.6 box running OpenWrt r33312. To get into failsafe mode, power up the device and wait until the LED starts flashing (about 2Hz). Once it starts flashing (within about 4 seconds) then quickly press the button. The LED will then flash much faster and the device will be in failsafe mode.
Setup serial console 115200 8n1
Enter “tpl” as soon as U-Boot announces “Autobooting in 1 seconds”
I've setup over 15 of the v1.7 hardware nodes with Chaos Calmer trunk r45157, with some nodes running non-stop for weeks without issue. WiFi, USB and ethernet works great; mostly using the WR703n's to support
VirtualHere
USB-over-
IP
services. While this works great for me, this could brick your device:
proceed at your own risk
.
Huge thanks to Interdev for the
original sketch
. Below are the specific steps that works beautifully for me.
Obtain a static BusyBox binary:
Now, exploit a vulnerability in the stock/factory httpd
The following exploit will run these commands on your WR703N:
cd /tmp ; tftp -gl aa 192.168.0.9; sh aa
DO NOT POWER OFF EQUIPMENT! INTERRUPTING THIS WILL BRICK THE WR703N!
USB port and monitoring Serial Console via USB-Serial
The USB port on the WR703n is not compatible with USB1 devices (aka full speed) and only works properly with USB2 (aka high speed) devices. You can however plug a USB-Serial adapter as long as you plug that through a <$10 USB2. While you're at it, use another USB port to plug in a USB key and write data there (like serial console logs) so as not to wear out the built in flash.
See this page for more tips and how to create a serial console server out of your WR703n:
http://marc.merlins.org/perso/linux/post_2012-12-05_Serial-Console-With-WR703N.html
The Device uses a DDR1 16Mbit x 16bit (16Mibit*16=256 mebibit. 256 mebibit/8=32MiByte) 400MHz chip Zentel A3S56D40FTP. Replace it with any 32Mbit x 16bit chip. 333MHz instead of 400MHz also works fine. It's quite hard to find these chips. One of the ways to get them is to have a look at DDR SO-DIMM (because SO-DIMM modules are shipped with x16 chips). Since there are no 64Mbit x 16bit DDR1 Chips available → no 128
MB
mod!
The most easy approach is to seek for a 4-chip DDR 256
MB
module. These all have x16 chips too. Chips only on one side (not to be confused with double-sided 256
MB
modules with 4 chips on each side) and only 4 of them - that's the best chance to get some. They represent a small percent among usual 8-chip modules but this is equalized with the amount and “cheap as dirt” price of such DDR 256
MB
modules.
Chip can also be salvaged from dead HDD with 64Mb cache, for example 2Tb Western Digital WD2002FYPS
Working chips:
Consider simply buying a
GL.iNet 6416
. Seriously, this is likely the device you actually want. And it's so cheap that it beats the time, trouble and money spend on modding - unless you do this modding for fun or educational purposes...
16MB flash chips are
most likely not supported by the boot loader which resides on your old chip
, therefore you cannot simply burn the 4
MB
chip content on the new 16
MB
chip and everything will be working. If you try this the LED will glow purple-ish. You will have to replace U-Boot with
a special version based on 1.1.4
, supported chips are:
If you've made (or bought) a device with 16MB of flash, you will still have difficulty
building
images larger than 4MB, even though you can use all 16MB once you've flashed an image (functionality provided by an appropriate bootloader, such as pepe2k u-boot mod). The reason is because the WR703N profile has a limit of 4MB, which is enforced by the
mktplinkfw
(make TP-Link Firmware) tool when the image is created. To enlarge this limit to 16MB, you can try the following (worked for me on 14.07/BB, b41353):
In order to replace the 4mb flash chip with a 16mb one you may at first dump two important partitions:
64k u-boot + 64k data section: at the beginning of the chip. The data section is important as it contains MAC (at 0x1FC00) and PIN (at 0x1FE00) as well as Model information.
64k ART partition: which contains wireless voodoo configuration. Without it your wifi won't come up.
ls -l flash_dump
# -rw-rw-r-- 1 makefu makefu 4194304 Mar 21 10:28 flash_dump
flash_size=$(ls -l flash_dump | cut -d\ -f 5)
# 4194304 / 65536
num_blocks=$(($flash_size/$bs))
# 64 blocks, 64kilobyte each
dd if=flash_dump of=data.bin bs=$bs count=1 skip=1
dd if=flash_dump of=art.bin bs=$bs count=1 skip=$(($num_blocks-1))
After that you can
cat
together your new image:
Flash this image with your SPI-programmer on your new chip and solder it in. You can now hold the button for 3 seconds (will blink each second) and release to make the bootloader start a httpd at
192.168.1.1
.
There are many other creative ways to use the MiniPwner. Here is a list of some of the software that comes installed:
Nmap network scanner
Tcpdump sniffer
Netcat Hacker’s swiss army knife
aircrack Wireless network analysis
kismet Wireless network analysis
perl Perl Scripting Language
openvpn
VPN
Client and Server
dsniff suite of sniffing and spoofing tools, including arpspoof
nbtscan NetBIOS Network Scanner
snort Sniffer, Packet Logger, Intrusion Detection System
karma Wireless Sniffing Tool - not working yet....
samba2-client Windows File Sharing Client
elinks Text Based Web Browser
yafc
FTP
Client
openssh-sftp-client Secure File Transfer Client
The upstream USB connection is intended to come via a 4 pin header plugged into the WR703N PCB below (existing USB connector removed).
You can also populate a mini-B connector for connection to any upstream USB host via a
You can populate up to 3 USB A female connectors, or use 0.1“ headers/connectors to mount USB connectors
USB1 and USB2 are intended to be standard right angle connectors, but will also take vertical style.
USB2 is recessed - partly to make the PCB able to be mounted very low on top of the WR703N PCB, but it also makes it suitable for very small USB drives (Sandisk Cruzer Fit).
USB3 can be a right angle or more usually a vertical connector. Or left off completely.
If a right angle connector is used for USB3, you can't easily use PORTB (and you should probably put some insulating tape over the PORTB pads).
The PORTA and PORTB headers are similar to the common SparkFun FTDI connector, although they include RTS instead of DTR.
The GPIO connector is intended to be a standard 2×5 box header.
See the schematic for pin outs of the GPIO and serial ports. Due to space restrictions, the extra 8 GPIO's from PORTB are not routed out.
5V and 3.3V - can mix 5V
and
3.3V
Robust, high current pins with true cmos output protection
Ascii commands and data - easy to control from shell scripts, no special binaries needed
able to switch the router power off for intermittant/low power (eg solar powered) operation.
8 i/o pins can be controlled directly
Can act as a watchdog the router where reliabilty is important.
Firmware supports autonomous data collection to the internal webserver, serial-over-network control, remote-over-internet access, webcam snapshots from internet.
Webpage allows editing of the I2C commands, logging shell scripts, javascript display functions etc.
The webpage lets you convert the I2C raw data, to readable values with some simple javascript.
Why would you do I2C this way, instead of a software bit bash the i/o pins?
Timing is predictable. Software solutions lead to intermittant smbus timeouts, and subtle problems
Robust, protected pins - SOC pins are very weak
ascii commands are truly cross platform - this solution works the same on PC's, Bluetooth, Fibre, USB etc.
Multiple buses, 5V operation.
CMOS thresholds - noise immunity.
Reliable and mature BL233 controller is over a decade old and does not have “undocumented features”
This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.
More information about cookies
If you've got a modified version of this hardware which has 16MB of flash, then you will not be able to
build
images larger than 4MB, even though the bootloader will allow you to subsequently utilize all 16MB of flash (i.e. by adding packages after firstboot). See
