This article will provide an easy DIY guide on rewriting the bootloader on many cheap eBay wireless routers sold under the names of “WAVLINK” or for those who buy wholesale quantities they’re sold by “WINSTARS”.
Any how the said devices should be running an MT7628 processor and its original firmware. As you may have already read or seen these devices run an unsecured linux firmware, some even run a tainted version of OpenWrt. For the most part these devices won’t have the necessary utilities needed to upload anything onto the firmware (lacks curl, wget, scp, etc) or if they do the current kernel prohibits anyone from writing to certain mtd partitions especially the “Bootloader” partition (usually seen on those already running OpenWrt) So for the sake of simplicity I’m assuming you have a device which is similar to this one and you can’t seem to get anything running on that device after multiple attempts of following the “TFTP” steps on this page.
What You’ll Need
- The device, I’m using a WL-WN575A3, running the original firmware that it came with
- An Ethernet cable, you could use a wireless connection
- This bootloader found here.
- PuTTY or your favorite telnet terminal
- Some familiarity with linux commands
First Step
- Get connected to the device via Ethernet or a wireless connection.
- Go to http://192.168.10.1/ and sign in with username as admin and password as admin.
Second Step
- Connect the device via telnet using 192.168.10.1 as the IP address on port 21. I’m using telnet(1) on Linux
- Upon connecting login using admin as the user and admin as the password.
Backup Your Original Bootloader
- Change your current directory to
/etc_ro/lighttpd/www
- Copy a bit-per-bit copy of your original bootloader by executing the following:
cat /dev/mtd1 > original_bootloader.bin
- Go to your browser and download the original bootloader located at http://192.168.10.1/original_bootloader.bin
Rewriting The Bootloader
- We’ll need to create a simple html upload page to upload the bootloader onto our device
vi upload.html
- Hit ‘i’ in your keyboard
- And copy everything from below into vi
<form method="post" action="cgi-bin/upload_bootloader.cgi" name="submit" enctype="multipart/form-data"> <input type="file" name="fileField"><br /><br /> <input type="submit" name="submit" value="Submit"> </form>
- Like so
- Once you’ve done that press ‘esc’ on your keyboard and hit ‘:wq’ to save and exit
- Head on over to http:/192.168.10.1/upload.html
- Select the ‘Bootloader.bin’ file that you downloaded initially & ‘Submit’
- If you are redirected to the login page then you’ve timed out like me this is why I instructed you to login at the beginning.
- Login back in and go back to http:/192.168.10.1/upload.html
- You should see something like below
- After rebooting you should be able to successfully flash any image as long as you follow the steps outlined at the bottom of this page under “TFTP”.
Flashing with OpenWrt
Once you have OpenWrt on the device you are free to flash with mtd.
Hello,
I Have a Wavlink AC1200 WL-WN529B3.
When I start the router, port 2323 keeps open for some time. When I try to telnet into it, it doesn’t accept admin/admin as username and password. The router is running a tainted version of openwrt. Since I can’t get it via telnet, I am unable to change its bootloader. Any advice you may provide may be useful`.
Hello,
i have problem, please help me!!!.I have WavLink WL-WN575A3 (EBAY).I got to the point where I should upload BOOTLOADER via WEB.I got to the step where I should upload the BOOTLOADER via WEB. When BOOTLOADER will give SUMBIT, he writes that the path does not exist (cgi-bin/upload_bootloader.cgi).PLEASE HELP ME
This only works if cgi-bin/upload_bootloader.cgi already exists on the firmware. It’s usually located in /etc_ro/lighttpd/www. You can test if it exist by “visiting” the following page: http://192.168.1.1/cgi-bin/upload_bootloader.cgi
If the response is a blank page then you should be good to go assuming your following correctly. If not then this won’t work for you and you’ll need to seek another method.
Will this also work for WL-WN530A3???? It has decent spec’d with 64mb/512mb flash/ram combo and mt7628an after I searched online the IC’s to confirm.
Sorry for the late response.
I’m afraid I can’t answer your questions regarding the WL-WN530A3 as I do not own one or have access to one.
Oh, ok thanks! So its up to me to take the risk, but since many of Wavlink’s products almost have identical spec’s, so I was hoping they should atleast have the same way of flashing custom bootloader inorder to flash OpenWrt.
It seems Wavlink no longer provides firmware updates for this(been sending emails but no reply), but ofcourse gotta have another Router as alternative before going thru the procedure just incase something goes wrong.
The router have the SoC, MT7628AN with 64/512mb ROM/RAM, MT7612EN 1200AC, 100mbps LAN, with USB Slot that sadly is useless as it cannot be used for Cloud/Network Storage and only useable via Wavlinks Smart App.
If only there’s an easy way to customize this pretty good spec’d Wavlink Device.
Is this possible for WL-WN530A3?
Hi
Hi, thank you for the tutorial. I’d like to know before flashing here, is there any extra info in the pictures needed for the process?
The pics aren’t available anymore unfortunately.
Thanks.
Hello Dosilid,
I fixed the issue, had a bit of a domain problem. The pictures are just for reference to the written steps.
Thanks for the quick repairs Connor, much appreciated. 😉
I was able to use the procedure you showed here on a Wavlink WL-WN570HA1 router but I am stuck with the bootloader.
1.- I gained CLI access and can create the upload.html file
2.- I am able to “upload” an upload_bootloader.cgi script which I found on this post https://www.zjtan.net/2021/12/flashing-of-openwrt-onto-a-wavlink-wl-wn575a3-repeater. Reason I had to do it is that there is no upload_bootloader.cgi script on any of the firmware versions I could find
3.- However, when I use the upload.html to load the unblocked bootloader I see the device reboot but cant get the TFTP step working and when I return, I see all files gone (upload.html, bootloader cgi script gone).
I gather something is going wrong with the bootloader.bin file and can only speculate either the bootloader.bin is not getting loaded due to the cgi script itself or the bootloader.bin file
I have all the access to make changes.
Any comments would be appreciated
I recently just digged out an old router/repeater, which is called “Coredy AC1200 CX-E120”.
And it works perfectly with your instructions and modified bootloader.bin, thank you very much!
Now it is running Openwrt!
BTW, how you create the modified bootloader.bin?
I have a Wavlink Ariel HD2 bought in April 2023 off ebay and yeah I works but lacking options so I wanted to drop openwrt on it. SO I tried the TFTP way and though TFTP said it uploaded openwrt successfully,. Yeah if it were only that simple right? Nothing uploaded and various telnet apps on different machines all lied to me. So I figured “Locked bootloader?” and here I am now:
Following your guide to uploading an unlocked bootloader I now am being denied a telnet connection. I can access the webUI and log in there but that is it. Any other means of connecting outside of the official webUI seems to no longer be possible On Units running the last most updated firmware – 2023615. which dropped in June 2023.
My telnet is working because I can telnet into my Ubiquiti nanobeams just fine