折腾古董冷门便携路由器TP-LINK TL-WR820N

zhiyiyang · 发表于 2022-11-14 00:22

本帖最后由 zhiyiyang 于 2022-11-16 10:44 编辑

TL-WR820N v1，腌王普联技术出品(这货美版和欧版可能就是那个WR810N.V1)
5年前在小黄鱼收的，拿到手后膜拜恩山各位大佬的贴子，了解到TP原厂固件家长管理权限漏洞，于是淦它

。
还真有效果，刷上了openwrt CC。但是这没有不死bootloader，用着不爽啊，搞不好就要进Failsafe模式来恢复，这也太麻烦了。于是在恢复模式用命令行更新uboot分区刷入Breed。通电开机~呃……灯常亮，两个网口也不工作，

这、这、这就砖了？！赶紧上山、上度，结果由于这个路由器比较冷门，没有找到相关的有用信息。因为在黄鱼上捡漏的，所以想着找人救个砖(原因有两个:1、那时候手上没有工具和材料，2、个人觉得这个便携路由器比较漂亮，还可以出差时拿USB口5V1.5A充手机)。在小黄鱼上找到一位改机师傅，寄过去让他帮忙修顺便换16M闪存。师傅很负责、有诚信，只怪这路由器太冷门。他发现这机子拆开上TTL，TTL没有反应，灯常亮，网口全部不工作，就和我视频，实时操作给我看(误，我的玩机水平哪看得懂啊）和我说这路由器估计是CPU烧了，修不好了。最后师傅还是给了我一套8+64，我让他机子不拼，散着给返了回来。收到就扔那了……
今年疫情，在家收拾整理，又发现了这散着的820N，刚好我还有个更老的WR834N，10年前买的(淦！怎么这么巧，怎么我买的TP的路由器都是冷门的？！当然了我也有个曾经的热门的货K2)。嘿嘿，这些都可以搞一下嘛，淘宝走起！
于是就有个这图上的改机。
改成了，上图，用的WR810的openwrt固件。
不知怎么回事，这个路由器不能刷Breed。breed-qca953x.bin、breed-qca953x-letv-lba-047-ch.bin 这两个都不能用，我用hackpascal大神教的方法，链接在此【U-Boot】U-Boot 刷机方法大全。我买了编程器的，当然也用编程器刷了Breed，最后装上去都是一样的结果TTL没有反应，灯常亮，网口全部不工作。原本想给hackpascal大神反馈一下这个问题的，但是一想还是算了，觉得现在这个小众的冷门古董路由器，不直得浪费他的时间去处理了。

用到的资源，贴上一部分,排序不分先后（

有的不记得出处了），再次感谢恩山各位大神！
   WR820N 4M编程器固件 (QCA9531)
   AR/QCA/MTK Breed，功能强大的多线程 Bootloader
   TP原厂固件家长管理权限漏洞
   【U-Boot】U-Boot 刷机方法大全
   tplink的新玩意 wr820n 拆解
   tp-link wr820n 可用的 openwrt
   找到国外牛人给出的不通过TTL刷openwrt到1.7版本的703n的方法
   TTL串口工具sscom

后面附上TP原厂固件家长管理权限漏洞“wr820的免拆机直刷openwrt包”，论坛附件大小限制，4M多RAR分成了９个包，全部下完放到一起解压。
         方法来源于网络大神，非本人原创，刷机有风险！步骤在下面：

游客，如果您要查看本帖隐藏内容请回复

刷完后可以刷个别的固件完，要什么样的可以自己去openwrt官网定制
官网定制OpenWrt 固件

正常启动时的TTL输出
[  204.124074] reboot: Restarting system

U-Boot 1.1.4 (Jun 10 2014 - 12:45:22)

AP143 (QCA953x - Honey Bee 1.1) U-Boot
DRAM:  64 MB
Flash: Winbond W25Q128 (16 MB)
Using default environment

Clocks: CPU:550MHz, DDR:400MHz, AHB:200MHz, Ref:25MHz
In: serial
Out: serial
Err: serial
Net: ath_gmac_enet_initialize...
Fetching MAC Address from 0xbf01fc00
Fetching MAC Address from 0xbf01fc00
Scorpion ----> S27 PHY*
S27 reg init
GMAC: cfg1 0x800c0000 cfg2 0x7114
eth0: 5c:63:bf:ce:12:6a
eth0 up
Honey Bee ----> MAC 1 S27 PHY*
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
GMAC: cfg1 0x800c0000 cfg2 0x7214
eth1: 5c:63:bf:ce:12:6b
eth1 up
eth0, eth1
Hit any key to stop autoboot:  1 0
## Booting image at 9f020000 ...
Image Name: Unknown board (08100001)
Created:    1970-01-01 0:00:00 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 8125952 Bytes =  7.7 MB
Load Address: 80060000
Entry Point:  80060000
Uncompressing Kernel Image ... OK

Starting kernel ...

[ 0.000000] Linux version 4.4.182 (buildbot@builds-02.infra.lede-project.org) (gcc version 5.4.0 (LEDE GCC 5.4.0 r3101-bce140e) ) #0 Tue Jun 18 18:45:43 2019
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[ 0.000000] SoC: Qualcomm Atheros QCA9533 ver 1 rev 1
[ 0.000000] Determined physical RAM map:
[ 0.000000]  memory: 04000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] No valid device tree found, continuing without
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[ 0.000000] Kernel command line:  board=TL-WR810N  console=ttyS0,115200 rootfstype=squashfs,jffs2 noinitrd
[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 60296K/65536K available (3133K kernel code, 167K rwdata, 420K rodata, 304K init, 197K bss, 5240K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:51
[ 0.000000] Clocks: CPU:550.000MHz, DDR:424.218MHz, AHB:212.109MHz, Ref:25.000MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6950037990 ns
[ 0.000011] sched_clock: 32 bits at 275MHz, resolution 3ns, wraps every 7809031678ns
[ 0.008249] Calibrating delay loop... 366.18 BogoMIPS (lpj=1830912)
[ 0.071068] pid_max: default: 32768 minimum: 301
[ 0.076100] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.083084] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.093765] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.104189] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 0.112137] NET: Registered protocol family 16
[ 0.118465] MIPS: machine is TP-LINK TL-WR810N
[ 0.576590] clocksource: Switched to clocksource MIPS
[ 0.583313] NET: Registered protocol family 2
[ 0.589096] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.596468] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.603252] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.610087] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.616266] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.623251] NET: Registered protocol family 1
[ 0.633973] Crashlog allocated RAM at address 0x3f00000
[ 0.658953] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.665111] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.678822] io scheduler noop registered
[ 0.682966] io scheduler deadline registered (default)
[ 0.688730] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.698759] console [ttyS0] disabled
[ 0.722701] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A
[ 0.731812] console [ttyS0] enabled
[ 0.731812] console [ttyS0] enabled
[ 0.739369] bootconsole [early0] disabled
[ 0.739369] bootconsole [early0] disabled
[ 0.754582] m25p80 spi0.0: found w25q128, expected m25p80
[ 0.760268] m25p80 spi0.0: w25q128 (16384 Kbytes)
[ 0.766775] 5 tp-link partitions found on MTD device spi0.0
[ 0.772542] Creating 5 MTD partitions on "spi0.0":
[ 0.777520] 0x000000000000-0x000000020000 : "u-boot"
[ 0.784491] 0x000000020000-0x000000157bc0 : "kernel"
[ 0.791807] 0x000000157bc0-0x000000ff0000 : "rootfs"
[ 0.799106] mtd: device 2 (rootfs) set to be root filesystem
[ 0.805005] 1 squashfs-split partitions found on MTD device rootfs
[ 0.811478] 0x0000005c0000-0x000000ff0000 : "rootfs_data"
[ 0.819200] 0x000000ff0000-0x000001000000 : "art"
[ 0.826200] 0x000000020000-0x000000ff0000 : "firmware"
[ 0.859475] libphy: ag71xx_mdio: probed
[ 1.449563] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd042, driver=Generic PHY]
[ 1.459880] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[ 2.049154] ag71xx-mdio.1: Found an AR934X built-in switch
[ 2.092610] eth1: Atheros AG71xx at 0xba000000, irq 5, mode:GMII
[ 2.101035] NET: Registered protocol family 10
[ 2.110415] NET: Registered protocol family 17
[ 2.115085] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[ 2.128328] 8021q: 802.1Q VLAN Support v1.8
[ 2.134599] hctosys: unable to open rtc device (rtc0)
[ 2.147356] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[ 2.157022] Freeing unused kernel memory: 304K
[ 3.330767] init: Console is alive
[ 3.334563] init: - watchdog -
[ 5.239945] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 5.328370] usbcore: registered new interface driver usbfs
[ 5.334196] usbcore: registered new interface driver hub
[ 5.339863] usbcore: registered new device driver usb
[ 5.391323] SCSI subsystem initialized
[ 5.402754] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 5.411479] ehci-platform: EHCI generic platform driver
[ 5.417093] ehci-platform ehci-platform: EHCI Host Controller
[ 5.423083] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1
[ 5.433422] ehci-platform ehci-platform: irq 3, io mem 0x1b000000
[ 5.456702] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00
[ 5.464337] hub 1-0:1.0: USB hub found
[ 5.468763] hub 1-0:1.0: 1 port detected
[ 5.476222] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[ 5.484523] ohci-platform: OHCI generic platform driver
[ 5.492898] uhci_hcd: USB Universal Host Controller Interface driver
[ 5.504511] usbcore: registered new interface driver usb-storage
[ 5.511726] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 5.521599] init: - preinit -
[ 6.124289] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[ 6.154747] random: procd: uninitialized urandom read (4 bytes read, 10 bits of entropy available)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 8.468661] mount_root: loading kmods from internal overlay
[ 8.513143] kmodloader: loading kernel modules from //etc/modules-boot.d/*
[ 8.522313] kmodloader: done loading kernel modules from //etc/modules-boot.d/*
[ 8.865599] jffs2: notice: (412) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[ 8.882219] block: attempting to load /tmp/jffs_cfg/upper/etc/config/fstab
[ 8.893105] block: extroot: not configured
[ 8.954070] jffs2: notice: (409) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[ 9.121849] block: attempting to load /tmp/jffs_cfg/upper/etc/config/fstab
[ 9.133019] block: extroot: not configured
[ 9.138456] mount_root: switching to jffs2 overlay
[ 9.152548] urandom-seed: Seeding with /etc/urandom.seed
[ 9.320852] procd: - early -
[ 9.323950] procd: - watchdog -
[ 9.685810] random: jshn: uninitialized urandom read (4 bytes read, 16 bits of entropy available)
Failed to connect to ubus
[ 9.954614] procd: - watchdog -
[ 9.958334] procd: - ubus -
[ 10.206874] random: ubusd: uninitialized urandom read (4 bytes read, 17 bits of entropy available)
[ 10.506131] random: ubusd: uninitialized urandom read (4 bytes read, 17 bits of entropy available)
[ 10.527059] random: ubusd: uninitialized urandom read (4 bytes read, 17 bits of entropy available)
[ 10.832077] random: ubusd: uninitialized urandom read (4 bytes read, 18 bits of entropy available)
[ 10.848436] random: ubusd: uninitialized urandom read (4 bytes read, 18 bits of entropy available)
[ 10.876781] random: ubusd: uninitialized urandom read (4 bytes read, 18 bits of entropy available)
[ 10.886564] random: ubusd: uninitialized urandom read (4 bytes read, 18 bits of entropy available)
[ 10.895950] random: ubusd: uninitialized urandom read (4 bytes read, 18 bits of entropy available)
[ 10.927591] procd: - init -
Please press Enter to activate this console.
[ 11.531171] kmodloader: loading kernel modules from /etc/modules.d/*
[ 11.574102] ntfs: driver 2.1.32 [Flags: R/O MODULE].
[ 11.607823] tun: Universal TUN/TAP device driver, 1.6
[ 11.613058] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[ 11.654936] ip6_tables: (C) 2000-2006 Netfilter Core Team
[ 11.688441] i2c /dev entries driver
[ 11.711933] Linux video capture interface: v2.00
[ 11.783660] u32 classifier
[ 11.786475]    input device check on
[ 11.790330]    Actions configured
[ 11.812940] Mirror/redirect action on
[ 11.837548] nf_conntrack version 0.5.0 (946 buckets, 3784 max)
[ 11.863661] usbcore: registered new interface driver cdc_acm
[ 11.869597] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
[ 11.909403] Loading modules backported from Linux version wt-2017-01-31-0-ge882dff19e7f
[ 11.917772] Backport generated by backports.git backports-20160324-13-g24da7d3c
[ 11.959062] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 12.017741] usbcore: registered new interface driver ums-alauda
[ 12.038501] usbcore: registered new interface driver ums-cypress
[ 12.058631] usbcore: registered new interface driver ums-datafab
[ 12.067550] usbcore: registered new interface driver ums-freecom
[ 12.083462] usbcore: registered new interface driver ums-isd200
[ 12.098890] usbcore: registered new interface driver ums-jumpshot
[ 12.124346] usbcore: registered new interface driver ums-karma
[ 12.149128] usbcore: registered new interface driver ums-sddr09
[ 12.159978] usbcore: registered new interface driver ums-sddr55
[ 12.175028] usbcore: registered new interface driver ums-usbat
[ 12.202271] usbcore: registered new interface driver usbserial
[ 12.208508] usbcore: registered new interface driver usbserial_generic
[ 12.215345] usbserial: USB Serial support registered for generic
[ 12.337581] xt_time: kernel timezone is -0000
[ 12.416952] usbcore: registered new interface driver ftdi_sio
[ 12.423019] usbserial: USB Serial support registered for FTDI USB Serial Device
[ 12.559112] usbcore: registered new interface driver pl2303
[ 12.564989] usbserial: USB Serial support registered for pl2303
[ 12.589806] PPP generic driver version 2.4.2
[ 12.608252] NET: Registered protocol family 24
[ 12.626679] usbcore: registered new interface driver uvcvideo
[ 12.632632] USB Video Class driver (1.1.1)
[ 12.790104] ieee80211 phy0: Atheros AR9531 Rev:1 mem=0xb8100000, irq=47
[ 12.841636] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 22.092317] device eth1 entered promiscuous mode
[ 22.120396] br-lan: port 1(eth1) entered forwarding state
[ 22.126024] br-lan: port 1(eth1) entered forwarding state
[ 22.210721] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[ 23.086791] br-lan: port 1(eth1) entered disabled state
[ 23.669166] eth1: link up (1000Mbps/Full duplex)
[ 23.674007] br-lan: port 1(eth1) entered forwarding state
[ 23.679670] br-lan: port 1(eth1) entered forwarding state
[ 25.472960] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[ 25.546568] device wlan0 entered promiscuous mode
[ 25.630648] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 25.637493] br-lan: port 2(wlan0) entered forwarding state
[ 25.643208] br-lan: port 2(wlan0) entered forwarding state
[ 25.676668] br-lan: port 1(eth1) entered forwarding state
[ 27.636683] br-lan: port 2(wlan0) entered forwarding state
[ 47.436662] random: nonblocking pool is initialized