*☆｡ﾟjuni's caramel tech café･ﾟ*☆/posts/42/rooting-the-tplink-tl841n-pt1/
(˃ 𖥦 ˂) wowie ! don'tcha just miss them old school marquees? (˶˃ ᵕ ˂˶) .ᐟ.ᐟ
The rooting, firmware analysis and hardcoded, reset-persistent credentials of the TP-Link TL-841N!
2 Aug 2026
Now, let me just preface this with a disclaimer:
… and get used to this puppo, as you may see this a few more times in this post :’).
In light of continuing my bumbling foray into the hardware hacking landscape, I bought a bottom-of-the-line $10<br>TP-Link TL-841N(EU) router off a random fellow on Facebook Marketplace, in a thrilling, high-stakes deal conducted in the middle of… a nearby mall.
My intention behind such a daring exchange was to practice the end-to-end process of pulling apart an IoT device to poke at it, access debug logs , potentially get a root shell , practice various kinds of firmware extraction (via UART & via on-chip flash memory), and even have a mosey about the filesystem for some potential security vulnerabilities later down the road.
Here’s a short overview of the journey so far, documented below:
1. Cracking it open: Finding the UART & getting connected
2. Dumping the firmware (Method 1. - UART & tftp)
3. Dumping the firmware (Method 2. - on-chip flashrom chip extraction)
4. Un-squashing the root filesystem
5. Having a Look-see - Preliminary Snooping/Analysis
Hang around until the end for discovering what kinds of various plaintext, hardcoded creds from the previous owner (censored) could be found on this device … one of which would survive even a full “router reset” .
Yeah. Kinda… no bueno?
Let’s dig in.
1. Cracking it open: Finding the UART & getting connected<br>I began by searching the router model number up on the<br>FCCID to check for its datasheet, to get information on the PCB, voltage levels & the available chips on the board.
Opening it up and finding the very-well-labelled<br>UART ports for serial/debug interface access was straightforward, with one quirk being that the flash was found on the underside of my board - model number GD25Q64CSIG (<br>datasheet).
Finding the UART ports (four "traffic light" holes on right picture) on the shelled router (left)
If your device isn’t as friendly with labelling, you can also use a multimeter to probe each suspected UART port at boot time to determine which pin is which - the device’s TX pin should have a fluctuating voltage during boot (due to it transmitting various boot logs in the form of serial 1s and 0s, corresponding to fluctuations in voltage), and the GND pin should be 0V.
Probing the suspected UART pins at boot until I found one with a fluctuating voltage level (i.e. not the standard steady 3.3V or 0V for my router), indicating it's likely the `TX` port.
My trusty AliExpress<br>USB-to-UART adapter (which I checked to confirm supports both 3.3V and 5V output , so we don’t fry anything) had the following pinout/wire colouring:
# Four-color DuPont terminal wiring<br>RED: 5V<br>BLACK: GND<br>GREEN: TX<br>WHITE: RX
So, I connected the USB GND to the router’s GND port (or can just touch grounded metal on the board), USB RX to the discovered router’s TX port, and USB TX to router’s suspected RX port (which can be found by trying the remaining two pins, until you get a successful input by spamming a key on your keyboard once connected).
I soldered mine in for a better/persistent connection, & plug-&-play functionality 😜.
Soldering on the `GND`, `RX` and `TX` leads to access the debug interface hands-free!
Once I identified what /mnt/dev device my USB-to-UART device was and got connected up with picocom -b 115200 --logfile bootlog-tplink.txt /dev/tty.usbserial-1210 (using the common baud rate of 115200, which worked), we can see we’re dropped into a root shell once again! Too easy 😅.
(I also attempted to connect my phone to the generated TP-Link Wifi network, which generated the extra logs seen above)
Connecting my computer directly via one of the router’s LAN ports, we can be assigned an IP and access the admin console as expected:
Home sweet home... but how do we get in?
2. Dumping the firmware (Method #1 - UART & tftp)<br>So, now I could see & navigate the filesystem, I wanted to dump & transfer it to my local device to perform some preliminary analysis!
Listing the flash partitions at /proc/mtd, as well as a few other mount details, gives us a good point to start:
Some preliminary details about the router's configured memory partitions
Preparing our receiving TFTP server<br>So we can transfer the firmware files over, I installed & started a<br>tftp-now server with tftp-now serve on my Mac (with brew, as am on apple silicon).
NOTE: Ensure to create a folder in your home directory corresponding to where you’re transferring the file from on your router (for me, from ~/var), otherwise you’ll get a “No such file exists” error when the tftp agent attempts to put its remote file...