Flashing TP-Link TL-WR703N v1.7 to OpenWrt

The TP-Link TL-WR703N is an affordable 3G-capable travel router that is able to provide wireless access for your devices while you are in hotel (with wired LAN) or on the move (using a supported USB 3G dongle). I got a couple of these for less than US$17 each. This little gem supports 3rd party firmwares like OpenWrt and dd-wrt.

Flashing the TL-WR703N to OpenWrt is easy for the version 1.6 hardware as you can simply perform a firmware upgrade (to OpenWrt) through the TP-Link’s Web administration page.

However, it is no longer possible with the TL-WR703N with version 1.7 hardware on firmware 3.17.1 Build 140120 Rel.56593n. Firstly, the U-Boot was changed for TL-WR703N v1.7. Secondly, the official firmware no longer allows firmware firmware to OpenWrt via the TP-Link’s Web administration page. Attempts to do usually result in bricking the TL-WR703N and the only way to recover is to re-flash it via its serial interface.

The proper way to flash the TL-WR703N v1.7 is to leverage an exploit on the parental controls page (credits to BUGBLUE). It would allow you to run privileged commands on the TL-WR703N v1.7 to:

  1. Transfer both the kernel and rootfs image of OpenWrt firmware
  2. Flash the kernel partition
  3. Flash the rootfs partition

The instructions were a little unclear so I am documenting it down for (my) future reference.

 

Getting the Required Stuffs

To flash the TL-WR703N v1.7 to OpenWrt, you will need the following:

  1. TL-WR703N v1.7 on firmware 3.17.1 Build 140120 Rel.56593n
  2. OpenWrt firmware for TL-WR703N [download]
  3. cURL to send crafted http queries [download]
  4. dd to split the OpenWrt into kernel and rootfs image [download]
  5. TFTP server [download]
  6. A shell script to instruct the router to perform the flashing. You will need a editor (e.g. Notepad++) to create the shell script with Unix style for End of Line
  7. busybox 1.16.1 for mips [download]

 

Preparing the Stuffs to exploit the TL-WR703N

Splitting the OpenWrt firmware into kernel and rootfs

 

Creating the shell script “aa”

Create a file named “aa” (without the quotes and extension) with the following contents. Alternatively, you can download the aa file (remember to unzip it).

 

Renaming the busybox-mips

Rename the “busybox-mips” you have downloaded earlier to “busybox”

 

Setting your LAN address on your computer

The exploit command and shell script (aa) communicates to the address 192.168.1.9. You can either set this static IP on your computer or modify the address in the exploit command and shell script. Your choice!

 

Setting up the TFTP server with the required files

By now, you would have the following 4 files:

  1. aa
  2. i1
  3. i2
  4. busybox

Extract and execute the TFTP server and point the document root to the folder containing the above 4 files.

 

Pulling the exploit and upgrading TL-WR703N to OpenWrt

Connecting up the equipment and factory resetting the router

  1. Connect the LAN cable to both your computer and the TL-WR703N.
  2. Power on the TL-WR703N.
  3. Through the TP-Link Web administration page, perform a factory reset for TL-WR703N.

Performing the exploit and upgrade

Ensure that your computer is set to static address 192.168.1.9.

  1. On your command prompt, navigate to the directory containing cURL.
  2. Execute the following commands (those lines starting with # are comments which need not be executed).
  3. Once the power LED stops blinking, access the OpenWrt Web administration at http://192.168.1.1.
  4. Enjoy your TL-WR703N v1.7 on OpenWrt.

 

Upgrading OpenWrt in the Future

Do take caution when upgrading firmware in the future as the u-boot has not been replaced. You should not reset settings or reset to factory default in any situation.

 

Treat shadowandy!

If these step-by-step guides have been very helpful to you and saved you a lot of time, please consider treating shadowandy to a cup of Starbucks.  

51 thoughts on “Flashing TP-Link TL-WR703N v1.7 to OpenWrt

  • March 15, 2015 at 2:07 am
    Permalink

    Thank you for this great tutorial, you put an end to months of me sucking at soldering.
    You, sir, deserve your coffee! /donated

  • March 17, 2015 at 7:23 pm
    Permalink

    Mike,

    Thanks for the coffee! And glad that the guide helped you with your TL-WR703N v1.7.

  • March 21, 2015 at 1:26 am
    Permalink

    Any success with flashing DD-WRT this way?

  • March 23, 2015 at 11:17 am
    Permalink

    LuoCheng,

    It should work as the firmware would need to conform to the flash layout of the TL-WR703N.

    dev: size erasesize name
    mtd0: 00020000 00010000 “u-boot”
    mtd1: 000d9fa8 00010000 “kernel”
    mtd2: 002f6058 00010000 “rootfs”
    mtd3: 000f0000 00010000 “rootfs_data”
    mtd4: 00010000 00010000 “art”
    mtd5: 003d0000 00010000 “firmware”

    Anyway I did a little test with my TL-WR703N v1.7 on OpenWrt. I changed the firmware to dd-wrt by doing the following.

    1. cd /tmp
    2. wget <address to TL-WR703N dd-wrt webflash factory firmware>
    3. mtd -r write <dd-wrt firmware> firmware
    4. It should unlock the firmware partition for writing and reboot into dd-wrt when done

  • March 25, 2015 at 8:51 am
    Permalink

    Thanks.
    But I am hung up on the last command. It will download the aa file from TFTP (I see it in the logs), but nothing seems to happen after that.
    It does not appear that the aa file is being executed, as the other files never get downloaded. Am I missing something?
    3.17.1 Build 140120 Rel.56593n

  • March 25, 2015 at 9:13 am
    Permalink

    Sam,

    As mentioned in the guide, make sure your aa file is created with Unix type of End of Line instead of Windows type.

    Windows uses carriage return and line feed (“\r\n”) as a line ending, which Unix uses just line feed (“\n”).

    The wrong type of End of Line will cause the aa script not to execute.

    You can use this (http://dos2unix.sourceforge.net/) to convert your aa file.

    Alternatively, you can download the aa file (remember to unzip it).

  • March 26, 2015 at 10:28 pm
    Permalink

    Herman Eggink,

    OpenWrt do not allow writing to the U-Boot or mtd0. I am writing a guide to flash to dd-wrt, update U-Boot with pepper’s version and making using of pepe2k U-Boot Web access to flash in OpenWrt again.

  • March 29, 2015 at 9:12 pm
    Permalink

    Hi Shadowandy,
    Sounds like quite an undertaking but worth it :-). I hope to receive mine in about 2 weeks from china. It’s probably flashed with the chinese firmware (rather that dd-wrt as advertised) so your guide would be great.
    Thx!
    Herman

  • April 9, 2015 at 12:37 am
    Permalink

    Hi Andy,
    Quick question: I understand upgrading/resetting is out of the question. How about restoring a backup? I have 2 boxes of which one has a working config that I’d like to restore…
    Thanks,
    H

  • April 13, 2015 at 4:49 pm
    Permalink

    btw, resetting works for me remarkably. Both failsafe and settings reset. Tried to go back to the chinese FW as openwrt doe snot allow mtd update for pepe2k’s uboot but ended up with a clean openwrt…

  • April 18, 2015 at 6:56 am
    Permalink

    Hi shadowandy i m from morocco i need video tutorial please Help me guys !!
    I bought tl wr703n this month and I board tomb version is v1.7 firmware 3.17.1 Build 140120 Rel.56593n and I besion flashing a openwrt please help me guys !!
    this step in windows or linux !!

  • April 20, 2015 at 10:44 pm
    Permalink

    Hi Hamid,
    The process worked exactly as indicated BUT it worked on windows ONLY as linux behaves in a different way. Just follow the steps 1 by 1 and it will work. If you are having issues, post them on the openwrt forum (search for bigblue and you find the entry).
    H

  • April 20, 2015 at 10:50 pm
    Permalink

    Herman Eggink,

    For Linux, you will need to set up a tftp server. Other than that, the commands are the same.

    As for the pepe2k’s u-boot, just need to mtd write the dd-wrt firmware. Once you are on dd-wrt, do the mtd write for u-boot. After that make use of the pepe2k’s u-boot webflash to flash in OpenWrt.

  • April 21, 2015 at 12:16 am
    Permalink

    Hi Shadowandy,

    tftp works slightly differently than the windows tftp server in that you need to find a way around tfpt asking for a password. Th ewindows version doesn’t do that as standard.

    On pepe2k’s u-boot, since I can reset and restore, I don’t need this for now but thanks! I would assume that I can just write dd-wrt to the linux partition, right? If the reset works, I am wondering if the firmware update works (ie just flash it from the luci interface).

    H

  • April 21, 2015 at 6:00 am
    Permalink

    thx guys Herman Eggink , shadowandy
    but sorry I have difficulty to understand all the steps I need video tutorial
    please help me

  • April 29, 2015 at 9:09 am
    Permalink

    thnx guys i m updating my Tp link thx very much
    i need to connect my alfa wifi a mon router how ?!

  • May 11, 2015 at 9:02 pm
    Permalink

    Can I downloads yours files i1 i2, I dont know dd

  • May 16, 2015 at 3:37 am
    Permalink

    Didn’t work for me, on 3.17.1 build 140120 Rel.56593n. It gets as far as downloading ‘aa’, but apparently doesn’t execute it as it doesn’t download the other files.

  • May 16, 2015 at 5:33 pm
    Permalink

    Hello Andy,

    Have you tested to flash to dd-wrt directly from stock build 140120 via bugblue’s method? If so, could you also write a guide for it? Thx!

  • May 16, 2015 at 9:01 pm
    Permalink

    Tom,

    Did you manually created the aa file or you used the one I created? The aa file has to conform to Linux style of End of Line. Otherwise it won’t execute.

  • May 17, 2015 at 10:48 am
    Permalink

    Hello Andy,
    Another question is, under the op, is that possible to flash back to previous stock fw or stock mr3020 fw (before 140120)? Thanks!

  • May 17, 2015 at 11:00 am
    Permalink

    Peter,

    I didn’t do this though. But I did try to flash from OpenWrt to dd-wrt successfully.

  • May 17, 2015 at 11:18 am
    Permalink

    Hello Andy, thanks for your quick response! I assume it should be able to be flashed mr3020 stock fw. If so, the others will be eaey. Unfortunately I have no 703n w/ 140120 to test it, that’s why I am asking. Enjoy your weekend.

  • May 19, 2015 at 4:10 am
    Permalink

    Hi Andy, I left a couple comments before, so I’m not sure why they are not coming through?

    My question was around the fact that while the first curl command works fine (I think, no HTML is returned), the second and third both return a bunch of HTML/CSS – so therefore I was wondering:

    a) You mention we should reset the router, what’s the method you use to do this (I used the web interface, translating of course)
    2) If the second didn’t run successfully, I presume the 3rd won’t either as we haven’t correctly enabled parental mode – so is there a way we can achieve the same thing via the web interface?

    Thanks
    James

  • May 23, 2015 at 2:48 am
    Permalink

    Hi Andy, I get the same result as James. Really need your help to find the solution to flash this version of WR703n. Thanks

  • May 23, 2015 at 8:52 am
    Permalink

    James,

    The Akismet spam engine might have blocked your earlier comments.

    Before starting with the curl commands, the WR703N should be in new factory state. That is, it should be prompting you to set password. Because the commands are trying to make use of the password as “admin42” (without the quotes). After the first command, the web interface password should be changed to “admin42”.

    I use the web interface to perform the factory reset too.

    Do try it again and let me know.

  • May 23, 2015 at 8:54 am
    Permalink

    Man,

    Try what I had suggested to James.

  • May 24, 2015 at 12:06 am
    Permalink

    Thank you thank you Andy – this was the trick! I didn’t realise that I had to have a “clean” router, previously I had logged in to check a couple things – for those struggling, leave it alone, reset and run the commands. Also, temporarily disable Windows Firewall too, that was the last piece of the puzzle.

  • May 24, 2015 at 12:12 am
    Permalink

    James,

    Glad that you managed to flash your TL-WR703N to OpenWrt. Have fun with it. 🙂

  • May 25, 2015 at 1:27 pm
    Permalink

    Hi Andy and James,

    1) After factory reset the router through web interface, should i put the password first? (admin42) ?

    2) What happen or appear on cmd when i enter the first Curl command? and second and third?

    I still found nothing happen. I have disable my antivirus and Windows Firewall too.

    Thanks,
    Man

  • May 25, 2015 at 7:41 pm
    Permalink

    Man,

    As what I have mentioned in the guide, you should factory reset the TL-WR703N and start with the commands.

    If the first command is successful, the login password would have changed to admin42.

    If second command is successful, a new parental control item would be added.

    If the third command is successful, you should see your the TL-WR703N pulling files off your TFTP server in the TFTP server logs.

  • May 26, 2015 at 7:28 pm
    Permalink

    Hi Andy, thanks for the reply.

    1) I have done factory reset. Then I straight putting the curl commands.

    2) First command is successful, the login password have changed to admin42.

    3) Second also successful, i can see the new parental item is added and enabled.

    4) But after the third command is executed, it seem nothing happened. The 703N router not doing anything, not pulling the file from TFT server from my Windows 7 laptop. I suspect the TFTP port server at client end is not opened (port 69). Or I miss something else?

    Thanks Andy,
    Man

  • May 26, 2015 at 7:41 pm
    Permalink

    Man,

    If it is not even pulling the aa file from the TFTP server, ensure you have set your TFTP server’s IP to be 192.168.1.9 as per the guide. Also make sure your TFTP server can ping the TL-WR703N at 192.168.1.1.

  • June 3, 2015 at 7:59 pm
    Permalink

    Hi Andy,

    I have set all parameter as shown by you. My laptop (tftp server) still does not pushing aa file to the TL-WR703N. As a result I cannot flash the router to openwrt.

    I use cmd to ping TL-WR703N at 192.168.1.1 and it is alive.

    Is there any other way to ping TL-WR703N from tftp server? Please help.

    Thanks,
    Man

  • June 3, 2015 at 8:35 pm
    Permalink

    Man,

    Did you disable your Windows Firewall? I am pretty sure if the first and second command goes through. The third command of pulling aa file will not be an issue too.

    If you still cannot get it to work, you might need to remain on the original TL-WR703N firmware.

  • June 23, 2015 at 8:41 pm
    Permalink

    Man, check in the tftp programming that you are bound to the correct interface, not localhost

  • July 22, 2015 at 7:24 am
    Permalink

    Gianmichele,

    Thanks! Glad that the guide helped you.

  • August 2, 2015 at 5:57 am
    Permalink

    Man,

    Keep 4 files on c:\ and all files from curl download at same place c:\.
    Setup severs root folder to c:\. in cmd console type cd \ output
    will look c:\> then type curl commands.
    Hope it helps. 🙂

  • August 4, 2015 at 5:30 pm
    Permalink

    peponi,

    Thanks for the help. Man contacted me on my email sometime back and we managed to solve it. It was more of a settings issue like what you have pointed out.

  • September 14, 2015 at 12:27 am
    Permalink

    Shadowandy,
    Thanks so much for the guide. You saved me a lot of trouble. Now that I have openwrt flashed is there an easy way to flash dd-wrt or would i have to do this process all over again with different perameters?

  • September 16, 2015 at 8:27 am
    Permalink

    Thanks for the responses. I finally found a forum about switching from openwrt to dd-wrt on the 703n. They followed the instructions on the website that you provided Andy. Unfortunately it seems that only some people had luck with it and the rest bricked their routers. I may give u-boot a try. Thanks.

  • September 16, 2015 at 8:30 am
    Permalink

    Billy,

    For the U-Boot replacement, get pepe2k’s openwrt firmware (with writable U-Boot partition and U-Boot image). It is much simpler.

  • April 2, 2016 at 6:30 am
    Permalink

    shadowandy,

    Will this overwrite the u-boot or does the dd-wrt firmware include u-boot? It seems that we should be concerned of u-boot every time we upgrade.

  • April 2, 2016 at 6:31 am
    Permalink

    BTW, thanks for writing this great tutorial.

  • April 2, 2016 at 8:59 am
    Permalink

    cross731,

    The command only replaces the firmware part.

    Yes, we should be careful about replacing u-boot as the 1.7 u-boot is not exactly third party firmware friendly.

  • October 19, 2016 at 5:16 am
    Permalink

    Received the tp-wr703n V1.7 but could not get it to work with below guide.
    when i run the first script it is not giving me an output. With the second and third i output but it only takes 2 seconds before script is done. Last line is
    ” ”

    any ideas?

Comments are closed.