See 'WikiDevi' @ the Internet Archive (MW XML, Files, Images)
upgraded MW to 1.30 - maybe things are slightly less broken


From WikiDevi
Jump to: navigation, search

TP-LINK TL-WR720N v2.x

FCC approval date: 30 December 2015
EAN: 6935364090739 (UPC DB, On eBay)
Country of manuf.: China

Type: wireless router


Power: 5 VDC, 0.6 A
Connector type: barrel

CPU1: Atheros AR9331
FLA1: 2 MiB
2,097,152 B
16,384 Kib
2,048 KiB
16 Mib
0.00195 GiB
(GigaDevice GD25Q16CSIG)
RAM1: 16 MiB
16,777,216 B
131,072 Kib
16,384 KiB
128 Mib
0.0156 GiB
(Zentel A3S28D40JTP-50)

Expansion IFs: USB 2.0 (solder pads), GPIO
Serial: yes, 4-pin header, J1, TP18, (115200,8,N,1)

WI1 chip1: Atheros AR9331
WI1 802dot11 protocols: bgn
WI1 MIMO config: 1x1:1
WI1 antenna connector: soldered

ETH chip1: Atheros AR9331
Switch: Atheros AR9331
LAN speed: 100M
LAN ports: 2
WAN speed: 100M
WAN ports: 1


Stock FW OS: VxWorks 5.5.1

802dot11 OUI: 18:D6:C7 (3 E, 2 W, 2016)
Ethernet OUI: 18:D6:C7 (3 E, 2 W, 2016)

For a list of all currently documented Atheros chipsets with specifications, see Atheros.

150Mbps Wireless N Router

Product page  • Support page

"2050500519", "CA-F120" and "164602002" (11/2016)

is silkscreened on the board.

V2 has external fixed antenna (internal Inverted-F in V1).

See also TP-LINK TL-WR720N v3.0 (3G) and v4.0 (CN)

(completely different devices under the very same name,
see TP-LINK_TL-WR720N v1 page for more info)

Stock firmware[edit]

wr720nv2-ru-up.bin bootloader at 0x68d4, kernel at 0x40114

(LZMA 6E 00 00 80 00).

FS signature 4x owowowow, BE32 = 1?, BE32 file count, BE32?,

40 char name, BE32 len and ofs (LZMA 5A 00 00 80 00).


[ TX ] ( RX ) ( GND ) ( 3.3V )

You need to solder a jumper wire between TP18 and TP28 on the back

of the PCB for TX to work.

TX are logs from router to PC (-> RX on PC side), RX commands back

(3.3V to 2.5V resistor divider nearby <- TX).

V1 repair features PCB photos, boot log and unsuccessful flash chip /

firmware upgrade to one of MR3220. • same guy?boot log

Bootloader confusingly indicates only 8 MiB of RAM (pDmaBuf=0x80637910, buffend = 80782514),

while VxWorks kernel later allocates full 16 MiB (pDmaBuf=0x80e1c560, buffend = 80f67164).

VxWorks-based WR702N and WR710N exhibit the same bug.


Tap Enter after the boot log to access VxWorks console. help or ? prints commands available.

Not very useful since almost everything is hardwired, but provides some insight into inner workings.

Full flash backup[edit]

Set up PC for fixed IP with TFTP server, wired connection to LAN port is required.

Start terminal at 115200 baud, issue Ctrl+C to stop auto-boot after ~1 s, then
flash read 0 80100000 200000
tftp put full.bin 80100000 200000
  • bootloader and kernel identical to wr720nv2-ru-up.bin without 0x94 bytes header
  • 0x1c0000 - settings (backed up as encrypted config.bin)
  • 0x1e0000 - LAN/Wireless MAC address (6 bytes), 0x1e0010 - WPS PIN (ASCII)
  • 0x1f1000 - calibration area (0x440 bytes), most important part to back up!