Reverse engineered layout of tiny TL-WR703N router

Posted on Wednesday, October 10th, 2012 in reversed, wireless by the machinegeek

Squonk informs us that he’s reverse engineered the layout of the small TP-Link TL-WR703N 802.11n WiFi router using EagleCad. He writes: “Unlike what it is marketed for, the TP-LINK TL-WR703N is not a “3G travel router”: it does not include a 3G modem at all, it simply means that the firmware support external USB 3G modems! Despite this shortcoming, at less than $23, this device is the cheapest Wi-Fi router you can get west of the Pecos River!” Inside he found an Atheros AR9331 chipset with Atheros AR7040 400 MHz MISP24kc CPU, integrated 802.11n 150 Mbps (130 Mbps real) Wi-Fi with 20 dB (100 mW) output power, 4 MB of serial (SPI) Flash memory, 32 MB of DDR SDRAM, a USB 2.0 host port and other goodies.

Details on this project and supporting links can be found on Squonk’s GitHub page along with the design files resulting from this effort.

Via the contact form.

This entry was posted on Wednesday, October 10th, 2012 at 3:00 pm and is filed under reversed, wireless. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.

26 Responses to “Reverse engineered layout of tiny TL-WR703N router”

  1. robthebrew says:

    This an amazing little board, and squonk is making it even better.

  2. dext0rb says:

    Awesome! Question: legal to make exact copy and then release work as CC?

    • Squonk says:

      This is not an exact copy: the original has internal layers, this is only double-sided and non functional, so there are significant differences with the original PCB. I assume it is similar to taking a photograph or making a drawing of the PCB and may thus be covered by a license. However, IANAL!

      However, if this infringes some copy rights, I am ready to remove the material immediately.

      The goal is not to copy the device, which is pointless due to the already low market price and because of the unavailability of the main chip for retail.

      The goal here is to be able to recreate the unavailable schematic in order to understand how the router is working for the sake of interoperability.

      • dext0rb says:

        Ahh, didn’t realize the differences in the details. Thanks for clearing that up. BTW, wasn’t implying your work is just to copy and reproduce the device! Getting the knowledge of how it operates is excellent. I was earnestly wondering about licensing.

      • Squonk says:

        Don’t worry, this is how I understood it!

        And I love this device too much to do anything wrong against it. It is really the cheapest Linux Wifi router west of the Pecos River.

        Despite its ultra-low price, I can tell you it is a very good design indeed, without any compromise on quality, and very clever work from both the chip manufacturer and the OEM integrator.

        I am almost done with reconstructing the schematic too!

    • Guan Yang says:

      There are also generous exceptions in copyright law for functional elements. This layout is necessary to understand how the WR703N works and how to modify it. On the other hand, if there had been some kind of artwork in the silkscreen, it would probably not be okay to copy that.

      There’s actually a separate kind of protection for mask work, but I believe that only applies to the design of integrated circuits, not circuit board designs.

  3. Markus says:

    I just found that this little router is quite a marvel: It is supported by dd-wrt, so you can flash a decent firmware. It also runs off USB power (max consumption 200mA during boot), so you can plug it into whatever USB power source you have.

    • They are quite handy especially for the price, I had a customer hack one with dd-wrt and use it as a USB host for one of my LeoPhi units, so now he has a wifi pH datalogger for about 60 bucks that is just crazy! I am in the middle of making one myself I will let the DP guys now when I have a write up done. Thanks to Nick for discovering this!

  4. Grapsus says:

    Great work, but sadly, I don’t think you can order those Atheros SoC unless you’re a huge corporation.

    By the way, 100 mW is 20 dBm which is -10 dB.

  5. Kris Lee says:

    I’m wondering that is there a chip level backdoor built into these devices?

  6. @Grapsus: dB are always relative to something.

    I agree that 20dBm is 100 mW because dBm express a power ratio relative to 1mW: dBm = 10 log(power/1mW)

    but -10dB what? Of course, 100mW = 0.1 watt, so it would be -10dBW, which is an unusual (but valid) unit.

    Using the dB unit without any suffix means a dimensionless ratio, such as an amplification factor. -10dB means an amplification of gain G=0.1, nothing more :)

    • Squonk says:

      My fault, the missing “m” in “dBm” is just a typo… You should read “Integrated 802.11n 150 Mbps (130 Mbps real) Wi-Fi with 20 dBm (100 mW) output power”

  7. Nice!

    Thanks to you, I just bought a TL-WR703N on ebay, that will be a lovely portable hacking platform <3

  8. Grapsus says:

    @openmakersdaily come on ! yes by the book dB is just a ratio without a unit, but when used in a specific context, there is usually an implied unit. In accoustics a dB stands for dB SPL wihch is the sound pressure over hearing threshold pressure. In RF, a dB stands for power over 1 Watt.

  9. The context I know is full of hams, and is using dBm, that’s probably what made me think about that!

  10. Frank says:

    Why don’t you reverse engineer 8devices Carambola? Looks like it is way useful than tplink router.

  11. systemstech says:

    Here is a link to the files for the Carambola’s motherboard.

  12. systemstech says:

    These guys have NO! intention of releasing the files.

  13. Eug says:

    Although I commend Kean for the daughter board they created/designed, I am not fond of the layout of it. Squonk, do you have any plans on creating any alternative expansion board designs?

  14. Squonk says:

    No, I don’t have a plan for an expansion board per se.

    However, I already discussed with Kean about a project to create an Arduino Mini board (ATMega32U4, VinciDuino-like) that would fit and replace exactly the WR703N blue lid, and possibly integrate the same GL850G USB hub chip as on his board, in order to integrate a SanDisk Cruzer Fit tiny memory stick… And of course, having the Arduino shield-compatible pinout on top!

    Unfortunately, Kean is too busy for taking yet another project :( Too bad!

  15. Win says:

    Hi Squonk,
    I am interested to discuss with you on further development with you on this.

Leave a Reply to Squonk

Click here to cancel reply.

Notify me of followup comments via e-mail. You can also subscribe without commenting.

Recent Comments

  • Joe Desbonnet: Ya, I can recommend the low melting point solder. I used brand 'ChipQuik' and it's amazingly easy to use.
  • Jerome: I need a new BusPirate for the Fablab ;) Many thanks!
  • Max: Seems like an unexpectedly violent way to remove the chip indeed. A hot air station should of course do the job just fine, but in...
  • jose: Part removal described here is pure butchery, the cheapest hot air station will do a fast and clean job removing the QFP, heat air to...
  • Cody: Yes please