See 'WikiDevi' @ the Internet Archive (MW XML, Files, Images)
upgraded MW to 1.30 - maybe things are slightly less broken

TRENDnet TEW-432BRP D2.0R / D2.1R

From WikiDevi
Jump to: navigation, search

TRENDnet TEW-432BRP D2.0R / D2.1R

Manuf/OEM/ODM Zioncom IP04135

FCC approval date: 03 January 2008
Country of manuf.: China

Type: wireless router

Industry Canada ID: 6337A-432BRP

Power: 9 VDC, 0.8 A
Connector type: barrel

CPU1: Realtek RTL8186 (180 MHz)
FLA1: 2 MiB
2,097,152 B
16,384 Kib
2,048 KiB
16 Mib
0.00195 GiB
(Macronix MX29LV160DBTI-70G)
RAM1: 16 MiB
16,777,216 B
131,072 Kib
16,384 KiB
128 Mib
0.0156 GiB
(EtronTech EM639165TS-6G)

Expansion IFs: none specified
Serial: yes, 4-pin header, populated, J1, (38400,8,N,1)

WI1 chip1: Realtek RTL8186
WI1 chip2: Realtek RTL8225
WI1 802dot11 protocols: bg
WI1 antenna connector: RP-SMA

ETH chip1: Realtek RTL8186
Switch: Realtek RTL8305SC
LAN speed: 10/100
LAN ports: 4
WAN speed: 10/100
WAN ports: 1


Stock FW OS: Linux 2.4.18 MIPS-01.00

Third party firmware supported: Wive-NG (sfstudio) • (blog)

Default SSID: TRENDnet_432
Default IP address:
the IP is used by 101 additional devices
of which 45 are TRENDnet devices
Default login user: admin
Default login password: admin
admin:admin credentials used by 1185 additional devices
of which 48 are TRENDnet devices

802dot11 OUI: 00:14:D1 (34 E, 47 W, 2008)
Ethernet OUI: 00:14:D1 (34 E, 47 W, 2008)

For a list of all currently documented Realtek chipsets with specifications, see Realtek.
Regarding third party firmware support, Realtek SoC support in OpenWrt
+ (success) RTL8196C port status. on the OpenWrt Forum
and the Realtek thread on the DD-WRT Forum may be of interest.

This revision isn't listed by TRENDnet! had some info and firmware before 2014.

"ZC-IP04135.C" is imprinted under the solder mask.

It has antenna connector on the left of Reset button, 16 MiB of RAM, but an older 8305 switch chip.

Also in white plastic for a local ISP. Mine is unfortunately standard blue, I bought it through retail.

Stock firmware[edit]


Local ISP is probably the only source of firmware left now. I've dumped V1.2.06_B100813 from the retail version of mine and compared those. There's no ISP branding whatsoever in 101101 provided, so feel free to upgrade/unbrick your device. The kernel is almost identical though, with maybe only some minor driver updates.

Realtek bootloader accepts CSYS firmware images through TFTP server on RTL8186 with 2 MiB flash chip makes Wive-NG the only 3rd party firmware supported.


[ 3.3V ] ( TX ) ( RX ) ( GND )

Pinout from the rear / LAN side (reversed), see J1 on silkscreen and square pin on the back of the PCB! TX are logs from router to PC (-> RX on PC side), RX commands back (<- TX).

Trendnet TEW-432BRP on OpenWrt wiki features D2 revision too (16 MiB RAM, same pinout). "Auto-Discovery (ver 1.01)" in the boot log is a sort of backdoor. It also phones home to on port 1981 with WAN MAC and external IP (/bin/

another boot log

root login is "password" protected (literally!).

Full flash backup[edit]

Set up PC for fixed IP, wired connection to LAN port is required. Start terminal at 38400 baud, power on with Reset button pressed until

---Escape booting by user

is displayed (~5 sec from power on), release Reset then issue

FLR 80300000 0 200000

Wait for "Flash Read Successed!", then start TFTP client "get" mode with a file name of your liking. Courtesy of Evgeny Manachkin (sfstudio)

  • starts with bootloader (gzip-packed), MAC OUI with a tail (CRC?) at 0x5FF5
  • 0x6000 - Hardware Settings, most important part to back up! Signature HS02 01 88 00 (size 0x188), then WAN MAC address (6 bytes), LAN MAC, WAN MAC again, wireless calibration?, CRC?
  • 0x8000 - Default Settings (signature DS05W)
  • 0x10000 - Current Settings, signature CS05W. These can be backed up from Web as (0xc7 - each byte ciphered) config.dat. Stock firmware operates on this through wholeflash /dev/mtd, scary stuff!
  • 0x20000 - CSYS firmware, kernel and ext2 rootfs packed together (LZMA 5D 00 00 80 00), several zeroes, CRC-16, 0xFF padding

Looks like super / super login / password pair might also work (another backdoor).


All electrolytic caps were replaced on this one since at least one 470uF failed (glowing hot). Probably due to 1000uF in wall brick not soldered in from the factory - and polarity reversed too. I've replaced it as is and blown a fine brand new Jamicon WL...