See 'WikiDevi' @ the Internet Archive (MW XML, Files, Images)
upgraded MW to 1.30 - maybe things are slightly less broken
TP-LINK TL-WR720N v2
150Mbps Wireless N Router
"2050500519", "CA-F120" and "164602002" (11/2016)
- is silkscreened on the board.
V2 has external fixed antenna (internal Inverted-F in V1).
- (completely different devices under the very same name,
- see TP-LINK_TL-WR720N v1 page for more info)
wr720nv2-ru-up.bin bootloader at 0x68d4, kernel at 0x40114
- (LZMA 6E 00 00 80 00).
FS signature 4x owowowow, BE32 = 1?, BE32 file count, BE32?,
- 40 char name, BE32 len and ofs (LZMA 5A 00 00 80 00).
[ TX ] ( RX ) ( GND ) ( 3.3V )
You need to solder a jumper wire between TP18 and TP28 on the back
- of the PCB for TX to work.
TX are logs from router to PC (-> RX on PC side), RX commands back
- (3.3V to 2.5V resistor divider nearby <- TX).
V1 repair features PCB photos, boot log and unsuccessful flash chip /
Bootloader confusingly indicates only 8 MiB of RAM (pDmaBuf=0x80637910, buffend = 80782514),
- while VxWorks kernel later allocates full 16 MiB (pDmaBuf=0x80e1c560, buffend = 80f67164).
Tap Enter after the boot log to access VxWorks console. help or ? prints commands available.
- Not very useful since almost everything is hardwired, but provides some insight into inner workings.
Full flash backup
Set up PC for fixed IP 192.168.1.100 with TFTP server, wired connection to LAN port is required.
- Start terminal at 115200 baud, issue Ctrl+C to stop auto-boot after ~1 s, then
flash read 0 80100000 200000 tftp 192.168.1.100 put full.bin 80100000 200000
- bootloader and kernel identical to wr720nv2-ru-up.bin without 0x94 bytes header
- 0x1c0000 - settings (backed up as encrypted config.bin)
- 0x1e0000 - LAN/Wireless MAC address (6 bytes), 0x1e0010 - WPS PIN (ASCII)
- 0x1f1000 - calibration area (0x440 bytes), most important part to back up!