I purchased a cheap TP-Link TL-841N router from Facebook Marketplace for $10 to practice hardware hacking. I opened the case and located the UART debug port, soldering a USB‑to‑UART adapter to read boot logs at 115200 baud. The flash chip, a GD25Q64CSIG, was found beneath the board.

Using UART I dumped the firmware partitions to a TFTP server on my laptop, then pulled them viaવર tftp. I also extracted the chip directly with a CH341A programmer, checking the 3.3V voltage and clipping it to the chip’s pins.

After obtaining the root filesystem I inspected for plaintext credentials that would survive a factory reset. The process demonstrated how easily debug interfaces can expose sensitive data, emphasizing the need for secure default passwords.

This walk‑through highlights the practical steps of rooting a router, extracting firmware via UART/TFTP or on‑chip flash, and the risks of hardcoded credentials.