BSidesRI video: modding the TP-Link WR703N router


At the recent BSidesRI conference in Rhode Island, USA, James Edge presented an overview of the TP-Link WR703N wireless router, and how it is modifiable akin to the WRT54G. (The manufacturer’s website does not contain documentation for the 703N. The linked doc is for the 702N, which has many of the same features and functions as the 703N. However, as corrected in the comments, note that the WR702N is not the same as the 703N, in that it has less Flash and thus cannot run the same hacked firmware.)

The WR703N is a compact economy device which includes the Atheros AR9331, a 400 MHz ARM processor and 4 GB Flash. Out of the box it supports AP Mode, Router Mode, Client Mode, Repeater Mode and Bridge Mode. James discusses expandability, including doubling memory and Flash, and adding interfaces for a Teensy, serial and GPIO connections. The modded firmware he used was from the OpenWRT group.

The talk seems long on the hardware end (some of which is of the “here’s the memory mod I paid someone to do” variety) with too few details on firmware hacks and exploits. It does, however, introduce us to a new and economical WiFi hacking platform, inspiring further research.

(Note: the talk’s substance begins at 5:30.)

This entry was posted in hacks, talks, wireless and tagged , , , .

Comments

  1. Tiersten says:

    The 702N isn’t functionally the same as the 703N. It only comes with 2MB of flash onboard which is insufficient for OpenWRT and it actually runs VxWorks normally. The 703N has 4MB (not 4GB) which is enough to work out of the box with OpenWRT. If you’re upgrading the flash then a 702N is probably fine but I expect the majority of people not to be doing that.

    The closest equivalent to the 703N is the MR3020 which has the same hardware specs but a different board layout.

  2. jpm says:

    4 GB flash, are you sure ?
    My WR703N has only 4MB flash, I bought the wrong one :)

  3. Alan Hightower says:

    It is only 4MB. It’s a MIPS R24Kc, not ARM. And I’m not sure why someone would hack-up a 703N that much when the Carambola has been around for a few years. Same SoC but way more expandable and hack’able.

  4. William says:

    Not really sure what value he’s added here – there’s nothing that wasn’t discussed on the OpenWRT forums a year and more ago…

    As mentioned to Matseng some time back – if anyone decides to do the same sort of thing, be wary of the USB hubs pictured – the first one I got had an internal oscillator rather than a crystal. So after a few hours of use, the USB dropped. Not ideal when your root drive is a USB device…

    The second one I got did have a crystal, and seems to work fine.

  5. voodooman says:

    think my comment got blocked. made a cool robot with wr703n with some of these mods.
    http://voodoomanmiracle.com/wp/?p=80

  6. rasz says:

    I wish someone would miraculously get proper datasheet for Atheros AR9331 so its possible to write SPDIF/I2S driver (available pdf has some registers to initialize pins, but nothing about DMA or buffers).

  7. A. Dunkel says:

    This is nice but there’s more out there than the WR703N. Why not start development on the MR-3020 and MR-3040 platforms instead? Both can be readily sourced and have some extra hardware perks; e.g. the MR-3040 has an integrated LiPo battery.

    An Arduino, ATMega/ATTiny, PIC, or more competent dev. platform is only a USB or I2C away whichever platform you go with. OpenWRT compilation is as easy as downloading the source, typing make, make menuconfig, selecting your packages, then dropping the compiled image in via the web interface if you have Ubuntu or Debian box/VM. Make sure to add in the proper kernel mods for your serial converters when choosing your options. Will need FTDI and ACM support.

    I like the idea of that Carambola though… Especially the new one from 8Devices.

    Couple of sources to point people in the right direction:

    http://www.open-drone.org/openwrt
    http://store.jpgottech.com/support/tp-link-mr3020-openwrt-flashing-guide/

    Remember that it is easier to format EXT4 on a Linux box than having to use the command line on board your freshly flashed router.By doing this we also save some space on the image.

    Run these commands to do pivot root on a freshly formatted EXT4 USB stick. Sub these for the corresponding section on the TekShop site:

    root@OpenWrt:~# mkdir -p /mnt/usb
    root@OpenWrt:~# mount -t EXT4 /dev/sda1 /mnt/usb
    root@OpenWrt:~# tar -C /overlay -cvf – . | tar -C /mnt/usb -xvf –
    root@OpenWrt:~# vi /etc/config/fstab

Leave a Comment

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Notify me of followup comments via e-mail. You can also subscribe without commenting.