When Modding Goes Wrong (TP-Link - WPA8631P V3.0)

This is a short description of the page

I recently was given a WPA8631P unit by a friend. This is a powerline adapter with a built in WiFi access point. Normally sold in pairs, I only received a single unit. The other unit apprently had suffered a lightining strike. Given I only had one, it made sense to just use the single unit as a WIFI access point for the network.

But like most things I decided to see if there was an third party firmware. I soon came across: Open-WRT. Open-WRT is an amazing custom firmware for several different devices. The firmware allows you to super charge your device into a secure wifi access point.

I chose Open-WRT over the default TP-Link firmware for a few reasons:

• TP-Link only allows 20 MAC address in the allow list.
• TP-Link doesn’t support some of the new WiFi encryption methods (WPA3)
• The Open-WRT firmware is really flexible and effectvily runs linux under the hood (great for tinkering).
• I feel that Open-WRT is more secure due to it being extensively battle tested.

As per the instructions before I ran the update, I made sure I updated to the latest version of the TP-Link firmware (3.0.2) (This in the end turned out to be my undoing). Once updated, I downloaded the firmware and uploaded the Open-WRT update using the TP-Link interface.

After the upload was complete, the device rebooted … and then rebooted … and then rebooted. Sadly, The device had entered into a boot loop and was effectvitly bricked. I jumped on the forum and discovered that there was someone with a similar issue and that updating to the latest version before installing Open-WRT actually broke the device. If I hadn’t updated it the update would have gone through correctly facepalm.

The result was a completely non-working unit. I tried several things such as: trying to boot the device in rescue mode from TFTP. Every possible button pressing combination. Trying to acces it from the TP utility application and starting intently at the unit. None of these worked, The last resort was to connect to the device directly. This could only be done by pulling the unit apart and soldering on a connector to be able to talk to the device via UART. The soldering was exceptionally fiddely. Thankfully the CPU of the device can be powered directly by the USB TTY device (you do not need to connect it to powerpoint directly to work on it).

The WPA8631 plugs directly into mains electricity, this is very dangerous.
Do not have the device connected to mains while you have the device case open.

I then connected to the device using a USB TTY device I purchased off Amazon. The pin layout after some trial and error was:

The connectors supplied with the USB TTY were very unreliable. I ended up switching them out for some I had from an earlier project.

Once I had the device connected, I could see what was happening during the boot of the device. I soon discovered the device simply would not boot with a network cable connected. If I started the device with the network cable connected it would get stuck at boot trying to configure the bridge network. If I tried connecting the network after the device had started the OS would throw a stackoverflow.

After many attempts at loading the Open-WRT, I gave up and discovered the Uboot system. Uboot starts before the operating system and is what allows the device to have its firmware replaced. Thankfully, I was able to connect a network cable while in Uboot without crashing. To access Uboot I had to hammer the 1 button as the device powers up (very much a case of split second timing).

To allow Uboot to pull the OS down, TFTP was started on my desktop machine (I ended up using: Tftpd64).

Using option one “1: Load system code to SDRAM via TFTP”, I was prompted for some various options to establish the connection and was able to download the firmware from the TFTP server.

For UBoot to work, I had to use rom that ends with “-initramfs-kernel.bin” as this is intended for running in memory on the device. Once booted, I was able to access the web interface and with some experimentation found that I could load and successfully run an older version of Open-WRT.

I put the device back together but hit another issue. Where I had soldered the UART pins was blocking a mental plate that is used for disapating the heat away from a few areas of the unit. The solution? HACKSAW! …

It isn’t beautiful, but it works. I then replaced all of the heatpads through out the device (the ones it came with were pretty rubbish). I reassembled the device and now enjoy WiFi from my new device…. phew…