Xiaomi WR30U TTL Brick Recovery Tutorial

TTL Serial + U-Boot Command Line Recovery Guide

This guide documents the complete recovery process for Xiaomi WR30U router that had its network functionality damaged after flashing an incompatible U-Boot, using TTL serial to restore it.

Xiaomi WR30U Front

Xiaomi WR30U / Redmi CR6606 (China Unicom version) Front

Recovery Process

Follow these steps to recover your router

1

Preparation

Hardware and software checklist

Details →
2

Disassembly & TTL Connection

Open case, connect serial cable

Details →
3

Enter U-Boot

Access command line via TTL

Details →
4

Transfer U-Boot

Kermit protocol serial file transfer

Details →
5

Flash System

Web recovery or TFTP flash

Details →
6

Verify & Backup

Test boot, backup critical partitions

Details →

📋 Applicable Scenarios

  • Network fails after flashing OpenWrt U-Boot; TFTP recovery mode unavailable
  • Router shows solid orange LED, won't boot normally
  • ARP Retry timeout, can't acquire IP address
  • Requires disassembly + TTL serial for recovery

🎯 Core Strategy

Access U-Boot command line via TTL serial → Transfer hanwckf stock U-Boot via serial → Use new U-Boot's Web recovery or TFTP to flash system firmware → Recovery complete.

Step 1: Preparation

Hardware Checklist

Item Specification Purpose
USB-to-TTL Module CH340G/CP2102, 3.3V logic Connect computer to router serial port
Jumper Wires Female-to-female or male-to-female Connect to TTL pins (insert stripped wire into through-hole)
Ethernet Cable Standard cable Connect computer to router LAN port
Plastic Pry Tool Credit card or dedicated tool Open case (screwless version)

Software Checklist

💡 Tip

Only the U-Boot file is required. System firmware will be flashed later via U-Boot's Web recovery or TFTP — no need to prepare it in advance.

Step 2: Disassembly & TTL Connection

Opening the Case (Screwless Version)

Some WR30U versions have no screws on the bottom — they use pure snap-fit design. Start from the top cover:

Step Action
Inspect Check the bottom of the router — confirm no rubber feet or screw holes
Pry open top cover Insert plastic pry tool/card into the seam along the top cover edge. Slide around slowly to release each snap (listen for clicks)
Tips if tight Use a hair dryer on low heat to warm and soften the plastic edge. The network port side or vent holes side are easiest to start from
Remove cover Once all snaps are released around the perimeter, lift off the top cover to reveal the mainboard

⚠️ Caution

Don't be afraid of breaking snaps — it won't affect use. If needed, also remove the bottom cover or mainboard mounting screws.

Locating TTL Pins

WR30U mainboard has 4 through-hole pads for TTL (no vertical pins installed). They're usually near the network ports or board edge.

Pin Description
3.3V Do NOT connect
TX Connect to module RX
RX Connect to module TX
GND Must connect

🔍 Identification Method

  • Use a multimeter to measure resistance to ground — GND reads 0Ω
  • 3.3V shows voltage when powered
  • TX/RX are signal lines

Wiring

WR30U Mainboard USB-TTL Module Note
GND GND Required
TX RX Cross connection
RX TX Cross connection
3.3V Do NOT connect Prevents power conflict

Wiring method: Strip the end of a jumper wire, insert into the through-hole pad, secure with hot glue or tape.

Step 3: Access U-Boot Command Line

Connect Serial

✅ Success Indicator

MT7981> prompt or Boot Menu appears (press 0 for command line)

Step 4: Flash U-Boot

⚠️ Problem

If U-Boot network is damaged (ping fails, ARP Retry), TFTP is unavailable. Serial file transfer is needed to flash new U-Boot.

Serial U-Boot Transfer

1. Start Kermit Receiver

MT7981> loadb 0x46000000 115200 ## Ready for binary (kermit) download to 0x46000000 at 115200 bps...

2. Tera Term Send File

File → Transfer → Kermit → Send, select mt7981_wr30u-fip-fixed-parts-multi-layout.bin

3. Flash Directly (No Verification Needed)

# Erase FIP partition MT7981> nand erase 0x1c00000 0x200000 # Write new U-Boot MT7981> nand write 0x46000000 0x1c00000 0x200000 # Or use auto command MT7981> run mtd_write_fip # Reboot MT7981> reset

💡 Transfer Failure Handling

If Kermit transfer is slow or fails, try lowering baud rate to 57600, or use Ymodem protocol:

MT7981> loady 0x46000000 115200

Step 5: Flash System Firmware

After reboot, hanwckf U-Boot is active and network is restored. Flash system firmware via one of these methods:

Method 1: Web Recovery Interface (Recommended)

Step Action
Set computer IP IP: 192.168.31.254/24, Gateway: 192.168.31.1
Enter Web Recovery Press Reset to enter U-Boot, Web recovery starts automatically, open browser to http://192.168.31.1/
Select Layout Choose default or qwrt (depending on firmware type)
Upload Firmware Select OpenWrt sysupgrade firmware, wait for auto-reboot after completion
OpenWrt LuCI Admin Interface
OpenWrt LuCI Admin Interface (accessible after successful flash)

Method 2: TFTP Command Line

# Set network MT7981> setenv ipaddr 192.168.31.1 MT7981> setenv serverip 192.168.31.254 # Test connectivity MT7981> ping 192.168.31.254 # Download and flash firmware MT7981> tftpboot 0x46000000 openwrt-squashfs-sysupgrade.bin MT7981> nand erase 0x700000 0x6e00000 MT7981> nand write 0x46000000 0x700000 $filesize MT7981> reset

Step 6: Verification & Backup

Verify System Boot

After reboot:

Backup Critical Partitions (Important!)

# Backup U-Boot root@OpenWrt:~# dd if=/dev/mtd4 of=/tmp/fip-hanwckf-backup.bin # Backup SN/Mac root@OpenWrt:~# dd if=/dev/mtd2 of=/tmp/bdata-backup.bin # Backup wireless calibration root@OpenWrt:~# dd if=/dev/mtd3 of=/tmp/factory-backup.bin # Download to computer via WinSCP or scp

Test Recovery Mode

FAQ

Problem Solution
Top cover won't pry open Heat the edge with a hair dryer to soften plastic, or start from the network port side
Kermit transfer slow or failed Lower baud rate to 57600, or try Ymodem/Xmodem protocol
Web flash says "Image not supported" Try a different layout (default or qwrt)
UBI partition error Execute nand erase 0x700000 0x6e00000 in U-Boot command line
Won't boot after flashing TTL connection available — re-enter U-Boot and flash again
Network unreachable Check cable, IP settings, firewall. Confirm LAN port is used (not WAN)

🔑 Key Takeaways

  • Screwless WR30U opens from the top cover
  • Serial U-Boot transfer requires no memory verification — flash directly
  • hanwckf U-Boot network is stable; Web recovery is the simplest option
  • Keep the TTL cable — useful for future brick recovery

Reference Resources

Happy recovering! 🎉

⚠️ Technical Disclaimer

This tutorial is for learning and reference only. Flashing firmware carries risks and may cause brick or void warranty. Before proceeding:

Last updated: April 2026