Sponsored Links

Donate via Bitcoin

Donate to Scarygliders

Hacking around the Japanese Buffalo WZR-HP-G300NH

You are currently browsing comments. If you would like to return to the full story, you can read the full entry here: “Hacking around the Japanese Buffalo WZR-HP-G300NH”.

67 comments to Hacking around the Japanese Buffalo WZR-HP-G300NH

  • yaiba

    Thanks you, it’s very helpful.
    I have a question. How do you find the Magic Number 27 05 19 56?
    All tftp firmware should begin with this?

    • admin

      I don’t know the exact meaning of your question, but I found that magic number mentioned in a dd-wrt post after a google search. Also, hex editors have a search function.

      I’m going to try and find out what that number is – my guess is it’s an ELF header, perhaps.

      Lastly, I’m pretty sure al firmware images should have this – it’s just that the Buffalo ones are encrypted.

  • Zgembo

    hello there,

    thanks for the guide on this, it may come handy… btw, have you tried changing “region=JP” parameter and checking if it would accept stock english firmware?

    Could you please post serial cable pinouts for this board?

    Regards,

    Z

  • Zgembo

    thanks for the useful information,

    i was wondering if changing region code to english would enable flashing to english stock firmware?
    btw, could you post serial pinouts for this board?

  • admin

    Zgembo :

    thanks for the useful information,

    i was wondering if changing region code to english would enable flashing to english stock firmware?
    btw, could you post serial pinouts for this board?

    Sorry for my slow replies – I’ve been incapacitated due to an abcess and have been in a huge amount of pain for the last few days – this morning’s been the first time I’ve been pain-free so I’m all :D this morning ;)

    You can change the region code. I changed it to US in order to try to convince the buffalo firmware to install the US version at one point, and yes it accepted the Bufallo US version, BUT, it semi-bricked the unit in that yes, it would boot up, but the web pages became unavailable – which is why I had to hack deeper into the router and figure out how to get dd-wrt (or even OpenWRT) working on the thing :)

    Serial port pinout:

    pin1 : VCC +3.3V
    pin2 : GND
    pin3 : TX
    pin4 : RX

    NOTE you only need to connect up GND, TX, and RX – leave the Vcc unconnected – the serial circuitry on board is already powered from the motherboard. On your terminal emulator you’ll need to set it to 115200,8,N,1 with no hardware or software flow control.

    Hope this helps.

  • yaiba

    admin :

    Zgembo :
    thanks for the useful information,
    i was wondering if changing region code to english would enable flashing to english stock firmware?
    btw, could you post serial pinouts for this board?

    Sorry for my slow replies – I’ve been incapacitated due to an abcess and have been in a huge amount of pain for the last few days – this morning’s been the first time I’ve been pain-free so I’m all this morning
    You can change the region code. I changed it to US in order to try to convince the buffalo firmware to install the US version at one point, and yes it accepted the buffallo US version, BUT, it semi-bricked the unit in that yes it would boot up but the web pages became unavailable – which is why I had to hack deeper into the router and figure out how to get dd-wrt (or even OpenWRT) working on the thing
    Serial port pinout:
    pin1 : VCC +3.3V
    pin2 : GND
    pin3 : TX
    pin4 : RX
    NOTE you only need to connect up GND, TX, and RX – leave the Vcc unconnected – the serial circuitry on board is already powered from the motherboartd. On your terminal emulator you’ll need to set it to 115200,8,N,1 with no hardware or software flow control.
    Hope this helps.

    I changed region code from JP to EU (or US) and succeed flash to english stock firmware by using the revert firmware EU from BrainSlayer (dd-wrt).
    I removed all the bytes before the Magic Number and used the psyphah’s method above.
    Now, i’m using english firmware EU 1.72. Use firmware dd-wrt, i have problem with PPPoE, i can’t access to internet.

  • Zgembo

    admin :

    Zgembo :
    thanks for the useful information,
    i was wondering if changing region code to english would enable flashing to english stock firmware?
    btw, could you post serial pinouts for this board?

    Sorry for my slow replies – I’ve been incapacitated due to an abcess and have been in a huge amount of pain for the last few days – this morning’s been the first time I’ve been pain-free so I’m all this morning
    You can change the region code. I changed it to US in order to try to convince the buffalo firmware to install the US version at one point, and yes it accepted the buffallo US version, BUT, it semi-bricked the unit in that yes it would boot up but the web pages became unavailable – which is why I had to hack deeper into the router and figure out how to get dd-wrt (or even OpenWRT) working on the thing
    Serial port pinout:
    pin1 : VCC +3.3V
    pin2 : GND
    pin3 : TX
    pin4 : RX
    NOTE you only need to connect up GND, TX, and RX – leave the Vcc unconnected – the serial circuitry on board is already powered from the motherboartd. On your terminal emulator you’ll need to set it to 115200,8,N,1 with no hardware or software flow control.
    Hope this helps.

    Thanks for the useful info again. I needed this just in case something goes wrong, but fortunately it never did. I got my WZR-HP-G300NH via rakuten, but from cheapest shop for 8.000円, and i think they were selling Taiwanese version of the router, which came preinstalled with english, and with Chinese-style power adapter, strange indeed. I flashed OpenWRT (Kamikaze r19704 built from source) immediately without even being aware of JP version problems, and it worked like charm since first day.

  • Alison

    When you were hacking around the insides of the router, did you see if the leads to the wireless antennae were on connectors or soldered to the board?

    With the stock “ear/flap” antennae on my WZR-HP-G300NH, my upstairs desktop’s wireless adapter (a D-link DWL-G120) cannot see the network, whereas it can see my old Linksys WAP54G with a $15 set of high-gain antennae attached. If the WZR-HP-G300NH’s antenna leads are on connectors rather than soldered, I was thinking I could mod RP-TNC pigtails in and attach my old antennae. But I’m not willing to void the warranty just to check.

  • admin

    Alison :

    When you were hacking around the insides of the router, did you see if the leads to the wireless antennae were on connectors or soldered to the board?

    With the stock “ear/flap” antennae on my WZR-HP-G300NH, my upstairs desktop’s wireless adapter (a D-link DWL-G120) cannot see the network, whereas it can see my old Linksys WAP54G with a $15 set of high-gain antennae attached. If the WZR-HP-G300NH’s antenna leads are on connectors rather than soldered, I was thinking I could mod RP-TNC pigtails in and attach my old antennae. But I’m not willing to void the warranty just to check.

    Hi, Yes the antennae are connected via a connector rather than soldered to the board – at least on MY unit anyway. I seem to recall there being pictures of the board some had taken I’m not at home right now but what I”ll do is take some pictures of the motherboard and either make a new post or add them to this one as an update.

    Regards.

  • John

    Hi,
    Thank you very much for your blog post about WZR-HP-G300N. I’ve read through this blog post few times. Currently, I have an Japanese version of WZR-HP-G300N, it won’t accept the stock US/EU firmware. May I ask your expertise which is the best way that I can have the EU/US stock firmware installed on it? (I really don’t want to go for DD-WRT since it doesn’t have NAS feature and I’m waiting for June 2010 release about Buffalo DD-WRT firmware).

    Looking forward to your soon replies and instructions.

    Thanks and rgds,

    (moved comment to this article from the About page)

    Reply : Hi, thanks… to be honest, I think it’s better to be patient in your case and wait for the new buffalo dd-wrt-based firmware. I tried changing the firmware from .jp to .us and got a semi-bricked WZR (which was the reason I set about hacking it in the first place ;) )

  • hakka

    pleas tell me.how to changed region code from JP to EU (or US) on U-BOOT.thanks all.

  • admin

    hakka :

    pleas tell me.how to changed region code from JP to EU (or US) on U-BOOT.thanks all.

    Hi.

    If you look at the article you’ll see the environment variable called region. In the .jp models it’s set to JP , so you would use the setenv command to change that to be US. However, do this at your own risk, and remember to save the changes otherwise after a reboot of the router you will lose them – everything you need to learn about how to do this is in the article :)

    Regards.

  • Yngwie

    Hi hakka,

    I just modified my region=AP to EU since they locked the 3G support in AP region machine. After I changed region code, 3G feature is unlocked.

    If your routor is Japanese version, you might need to flash to DDWRT first, and using the revert firmware after the region changed, since there is no multi-language support for Japan domestic version.

    The process brief as below,
    1. Connect the serial console cable between computer and routor
    2. Power on the routor
    3. Establish the serial data link using hyper terminal ( if you using windows system like me)
    4. Power off the routor then power again.
    5. Watch out the terminal window for the “tftp wait for 4 sec.” press “Ctrl-C” twice
    6. setenv region=eu
    saveenv
    Please refre to the post above for the connection cable detail, you can modified from CA-42 or purchase from RS, DigiKey whatever. If your computer is still have the serial port, you can just using 3 wire to connect GND, RX, TX to the routor.
    Hope this helps.

    Regards,
    Yngwie

    • Mike

      It seems like everything it’s OK with this region change, except the fact that it will not recognize the stock firmwares / upgrade.

      • Yngwie

        Hi Mike,
        To change the region will not affect to the firmware upgrade.
        Please console into your routor again and perform as below,

        printenv (check is there any region listed)

        If not,

        setenv EU
        saveenv

        This should setup up EU as your region in your routor.
        Thanks.

        Regards,
        Yngwie

  • Vuhothang

    Please help me!

    I/m using Com1 9pin to connect router 3 wire Rx, Tx, GND.
    In my Terminal screen only have symbol like this link picture of screen http://i22.photobucket.com/albums/b319/vuhothang/HeberTerminal.jpg
    i have press CTRL+C blind .
    Now my Router will boot only cable console connected anh PC Poweron.
    When i unplug console cable my router only Red DIAG, i can’t ping or do anything.
    when i plug console cable i will and i can use router.
    I have hard reset 30/30/30 when router can use.
    Now i not yet change region from JP to EU.
    Please help me!

    • Yngwie

      Hi Vuhothang,

      Sorry to hear that, as I review my previous post, I forget to mention about the serial to TTL circuit on the serial port connection and such carelessness mis-leaded you to take the action which damage your routor.
      Actually the logic high/low definition between serial and TTL are different, thus we need a convertor to transform in between. I am so sorry .

      Your routor looks already damaged since it only operate with your PC also power on.

      My appology to my carelessness on posted the reply.
      Regards,
      Yngwie

  • admin

    Vuhothang posted the following on April 28, 2010 at 5:04 pm. – Edit

    Please help me!

    I/m using Com1 9pin to connect router 3 wire Rx, Tx, GND.
    In my Terminal screen only have symbol like this link picture of screen http://i22.photobucket.com/albums/b319/vuhothang/HeberTerminal.jpg
    i have press CTRL+C blind .
    Now my Router will boot only cable console connected anh PC Poweron.
    When i unplug console cable my router only Red DIAG, i can’t ping or do anything.
    when i plug console cable i will and i can use router.
    I have hard reset 30/30/30 when router can use.
    Now i not yet change region from JP to EU.
    Please help me!

    Er, Vuhotang, did you just say you wired straight from your 9-pin serial interface on your PC to the WZR motherboard?

    Oh dear.

    Did you read where I mentioned you need a USB SERIAL< -->TTL Serial cable? The motherboard’s serial interface works at TTL signal levels. You’ve probably done your WZR some damage, unfortunately.

  • vuhothang

    Dear!

    Now my Router bricked, it cycle light red diag 15″ and four led (wifi, ser, router, diag) blink.

    But now i can upload firmware in unbunto via tftp tool with original fimware.

    i will buy Nokia DKU-5 to connect Rx, Tx, GND. i want read u-boot log.

    I will infor for you later.

    Thanks!

  • Vuhothang

    Dear Yngwie!

    I was buy a DKU-5 Cable, i can console into WZR. I was do step-by-step tutorials of you.

    Now my Router running normal.

    Thanks!

  • Ta Xuan Truong

    This topic very helpful for me…
    May I donate a little for you via PayPal address?

    Thank you.

  • Hi Mike,

    Sorry, correct the command as below

    setenv region EU
    saveenv

    Regards,
    Yngwie

  • nkphuongxp

    Hi everyone!
    I’m converting my Japanese WZR-HP-G300NH to EU but currently I’m having a trouble.
    This is the first time I open the router and see its motherboard. I have prepared a DKU-5 cable and known its pinouts (Tx, Rx & GND) but poor me I don’t know how to connect the cable to WZR motherboard in order to console the router. I though it would be like some other router that having some text (Rx, Tx, GND) on the board.
    Could someone show me where I could connect the cable on the WZR motherboard.
    Here are some pics of the router:

    • In your very blurry picture “wzr3.jpg”, the serial port is the one called J1 (if I remember correctly).

      I have found a clearer picture of the port, and have corrected the pin numbers in yellow…

      3.3V TTL Serial port pinout

      Pinout as follows:

      pin1 : VCC +3.3V – LEAVE UNCONNECTED.
      pin2 : GND
      pin3 : TX
      pin4 : RX

      NOTE you only need to connect up GND, TX, and RX – leave the Vcc unconnected – the serial circuitry on board is already powered from the motherboard.

      On your terminal emulator you’ll need to set it to 115200,8,N,1 with no hardware or software flow control.

      Regards,

      KC.

  • Zgembo

    an update:

    I got myself Japanese WZR-HP-G300NH, and ran into same problems. Messing a bit with the u-boot console and comparing boot variables with non-Japanese WZR-HP-G300NH, i found out an interesting setting, simply typing:


    ar7100> setenv accept_open_rt_fmt 1
    ar7100> saveenv

    Will enable flashing any compatible firmware via TFTP! Tested with OpenWRT 10.03, here are the u-boot logs BEFORE:


    tftp server(receive) go, waiting:4[sec]
    Trying eth1
    eth1 link down
    FAIL
    Trying eth0
    eth0 is duplex
    ag7100_check_link: _100BASET
    Load address: 0x81f00000
    $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    tftp server done
    Bytes transferred = 2490400 (260020 hex)
    ## Booting image at be060000 ...
    Image Name: MIPS OpenWrt Linux-2.6.32.10
    Created: 2010-04-06 13:03:43 UTC
    Image Type: MIPS Linux Kernel Image (lzma compressed)
    Data Size: 883587 Bytes = 862.9 kB
    Load Address: 80060000
    Entry Point: 80060000
    Verifying Checksum ... OK
    Uncompressing Kernel Image ... OK
    No initrd
    ## Transferring control to Linux (at address 80060000) ...
    ## Giving linux memsize in bytes, 67108864

    Starting kernel ...

    and AFTER setting accept_open_rt_fmt to 1:


    tftp server(receive) go, waiting:4[sec]
    Trying eth1
    eth1 link down
    FAIL
    Trying eth0
    eth0 is duplex
    ag7100_check_link: _100BASET
    Load address: 0x81f00000
    $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    tftp server done
    Bytes transferred = 2490400 (260020 hex)

    Airstation Public header
    Recv fw image [2490368] bytes, now writing...

    Erase Flash from 0xbe060000 to 0xbe2bffff in Bank # 1 First 0x3 last 0x15 100%
    Erased 19 sectors
    Copy to Flash...
    Copy 2490368 byte to Flash...

    • admin

      Wow haha!

      That. Is. Fantastic!

      Is it really that simple…

      Well done Zgembo. I’ll probably make a follow-up entry based on this.

      Regards,

      Kevin.

  • Hi,

    I have this router and am trying to get it working. (Well actually I ordered the N and it came as an H, I don’t know if that makes it an NH or a different animal.) You site is extremely helpful, but I can7t seem to view the comments. When I click on them at the side I get an empty page.

    Checking the DD-wrt forums all the link relating to the files have been removed, and I can’t seem to find the information/firmwares I need to get this router operational. I think the comments here would be extremely helpful. I am using firefox on an Ubuntu laptop. Anything special I need to do to see the comments?

    Cheers,

    Steve

    • admin

      Hi Steve,

      There seemed to be a problem with one of the plugins I was using. Sorry about that – and thanks for pointing it out!

      Hopefully this new comments plugin will work nicely ;)

      Regards,

      Kev.

  • Steve

    Yup! The comments are working great now.

    So, it seems I do have a different router. It is a WZR-HP-AG300H.

    I received my cable yesterday after work and was up to all hours of the night fiddling with it. The pinouts are different than what is here, but I was able to find the right combination (I’ll post it later — at work right now). A nice trick is that the ground on the board will show all other voltages as positive, so once you have the ground figured out then you have a 50/50 chance of getting the TX/RX right (I of course got it wrong…twice ;) )

    The big issue is that Uboot seems locked. I tried your procedure and have been totally unable to get the boot sequence to abort. I can TFTP a file over, but it also seems to be ignored. I have been googling like mad but can’t seem to find any information regarding this. I am getting ready to start trying voodoo and was hoping that before that someone will point out something completely obvious that solves the mystery of the locked uboot!

    Cheers,

    Steve

  • tbd

    Thanks for the great guide!
    My router is a Japanese (A0 A1) with u-boot 1.02, not the popular (A0 A3).
    The manual tftp-flash method introduced in this guide works on my router!

    However, in my test, the simple “accept_open_rt_fmt” method does not work on u-boot 1.02. I guess it should work in later u-boot (> 1.02 at least).
    And you can refer to the post in dd-wrt: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=72251

    Regards,
    Tbd

  • hoangdinh

    thank you verry much. Now i can unlock my 3G moden. change region from US to EU

  • ali

    i have DD-G300 N v2 bricked with DD-WRT V1 now i want to put original firmware i establish connection between router and PC via Serial port i can send fimware using hyper terminal kermit protocol router will receive and store in 0*80f00000 also i can copy it to flash but after booting it says EEprm error and i need to ctrl+c ant suggestion

  • Dogu

    Thanks for this great article and discussion thread. I too live in Tokyo and am trying to install English language firmware on my Buffalo WZR-HP-AG300H. Per your comment: ” I could by a conveniently available USB to TTL serial cable.”
    Where did you find this cable in Tokyo? I live in Roppongi Hills and haven’t had any luck finding a store that carries these.

  • Kevin Cave

    Dogu

    Thanks for this great article and discussion thread. I too live in Tokyo and am trying to install English language firmware on my Buffalo WZR-HP-AG300H. Per your comment: ” I could by a conveniently available USB to TTL serial cable.”
    Where did you find this cable in Tokyo? I live in Roppongi Hills and haven’t had any luck finding a store that carries these.

    Like or Dislike: Thumb up 0 Thumb down 0

    Dogu, thanks for the compliments :)

    I bought the cable from the Japanese RS Components website at : http://jp.rs-online.com/web/

    I’m at work right now so can’t be more specific at that. I’ll try to post a link to the cable as soon as I can.

  • Dogu

    Thanks for the quick reply Kevin. If you have a chance to post more details, I’d certainly be grateful.
    I browsed the RS Components online store and found that they carry several types of USB TTL serial cables, most of which are manufactured by FTDI (in the UK). Their site has a nice page outlining the types of USB TTL serial cables the produce:
    http://www.ftdichip.com/Products/Cables/USBTTLSerial.htm
    Any direction on type of cable would be appreciated.
    As I stated earlier, I’m going through the same process of hacking my Buffalo WZR-HP-AG300H so I can load the dd-wrt firmware and establish a VPN connection to my VPN provider in the US, thereby allowing all devices that connect to the router to appear as if they are coming from the US. This should let me access geo-restricted content on NetFlix, Pandora, HBO GO, Hulu+, etc.
    I’m happy to share my findings, successes, and failures along the way with anyone interested, either in this posting or another forum (any suggestions?)

    • Kevin Cave

      Heya. Yes it’s the TTL-232R-3V3-WE that I got, and it works flawlessly.

      Hope that helps!

      Rgds

      Kev.

      • Dogu

        Thanks Kevin, that’s just what I needed to know. Interesting that the RS site sells the “-WE” wire ended version of this cable for 160 yen more than the version with the 6 pin SIL connector.
        Thanks again.

  • Alem Da Lenda

    Wow!!! I have one of those japanese models. I tried to install a EN or EUR firmware and the router just refuse to update, since the firmware wasnt the same region.
    I will try this later. Just one question: My PC doesnt have a serial…so I was wondering if this adapter can be use instead: http://www.ebay.com/itm/USB-RS232-DB9-SERIAL-CABLE-ADAPTER-PDA-SATELLITE-/280746333674?pt=LH_DefaultDomain_0&hash=item415dc915ea
    Thanks

  • Kevin Cave

    Alem Da Lenda

    Wow!!! I have one of those japanese models. I tried to install a EN or EUR firmware and the router just refuse to update, since the firmware wasnt the same region.
    I will try this later. Just one question: My PC doesnt have a serial…so I was wondering if this adapter can be use instead: http://www.ebay.com/itm/USB-RS232-DB9-SERIAL-CABLE-ADAPTER-PDA-SATELLITE-/280746333674?pt=LH_DefaultDomain_0&hash=item415dc915ea
    Thanks

    Hi Alem, no, you need a USB to TTL serial adapter like the one discussed about 3 replies above yours. See http://www.ftdichip.com/Products/Cables/USBTTLSerial.htm and specifically the cable type of TTL-232R-3V3-WE.

    Regards,

    Kevin.

  • Alem Da Lenda

    Kevin Cave

    Thanks Kevin
    Out, I cant find that cable here…T_T
    I was reading dd wrt forum. Can I use this one ( http://www.ebay.com/itm/Genuine-Nokia-Connectivity-Adapter-Cable-CA-42-CD-/110706427339?pt=PDA_Accessories&hash=item19c69e05cb#ht_2994wt_922 ) intead that? Some users say that would work too…This link show the pinouts o that cable: http://pinouts.ru/CellularPhones-Nokia/nokia_pop_pinout.shtml

    Alem, hi again. I did some googling and that cable does seem to be mentioned a few times in relation to this model of router. The datasheet link you provided doesn’t say if it’s a 3.3V TTL-level cable – it’s very important you ensure that is the case, but yes that particular cable type is specifically mentioned, so I assume it would work – I’ve not used it myself though so, just be careful how you hook it up
    Is it difficult for you to buy the cable from FTDi online? They do have an online store.
    Regards
    Kevin.
    Like or Dislike: 0  0

    Hi Kevin
    I will try to find one of those two cables (the nokia cable is more easy to find and cheaper). 3.3v is really necessary? the motherboard doesnt power on itself using the ac adapter?
    Sorry to bothering you with noob questions.

  • Kevin Cave

    Hi Kevin
    I will try to find one of those two cables (the nokia cable is more easy to find and cheaper). 3.3v is really necessary? the motherboard doesnt power on itself using the ac adapter?
    Sorry to bothering you with noob questions.

    Alum,

    3.3V stands for the TTL signal level of the circuitry of the router. The router, of course, should use its AC adapter when you are communicating with it via your cable and the terminal program you are using.

    Please remember only to use the Rx, Tx, and GND of your cable. Do not connect any other wires – you could severely damage your router’s motherboard!

    If you have a techie friend who’s into electronics I suggest you ask them to connect your cable, if you’re not sure how to do this yourself. You could just be saving yourself from owning an expensive brick :)

    Regards

    Kevin.

    • Alem Da Lenda

      Well, I’ll probably have to pay someone to do this, but that was my intention since I dont have any experience in welding things. Thanks

      I’ll need to do till the step 3 right? When I use crtl+c, then I use the commands Zgembo says to let it accept any firmware?

      Do I need install a linux distro (like ubuntu) to use the console or it have any windows (yeah…I know…; ) software that I can use instead?

      Thanks again

      • Kevin Cave
        Alem Da Lenda

        Well, I’ll probably have to pay someone to do this, but that was my intention since I dont have any experience in welding things. Thanks

        I’ll need to do till the step 3 right? When I use crtl+c, then I use the commands Zgembo says to let it accept any firmware?

        Do I need install a linux distro (like ubuntu) to use the console or it have any windows (yeah…I know…; ) software that I can use instead?

        Thanks again

        Yep you need to break into the bootup sequence using ctrl-c.

        Actually you can download a Live CD version of linux which will boot straight off the CD/DVD and you can then use it as normal. Try http://www.ubuntu.com for this. There are also terminal emulators available for Windows though at time of writing I can’t remember their names so search Google for that info.

        Regards

        Kevin.

  • Garry

    Great read. How can I load a JP firmware onto a US-bought WZR-HP-G300NH ? Trying to enable ipv6 so I can watch iptv programs and still have internet here in Japan.

    Thanks

  • hakuch

    thanks for the info. question – using this method for changing country code – can i load original English language firmware to Japanese model?

    thanks

  • Bob

    You guys seem to have this unit well cracked!

    Unfortunately for me the WCN-HP-GN I purchased here in Shanghai seems to also have a restriction on firmware region. I would love to get dd-wrt on this unit so that I could load an Open VPN package. No need for me to elaborate on the importance of a VPN here.

    Thanks for all of your hard work!

  • Andrey

    Большое спасибо за статью. Очень помогла! Полностью восстановил Buffalo WZR-HP-G300NH. Уже не верил в это…

  • kiattivikrai

    Great ! this page help me unbrick my whr-hp-G300N. My router lost the ipaddr and serverip environment and fail to connect the tftp.

    Thank you

  • Leo

    I found this page and purchased a chip to enable the serial console, but it's possible to enable the telnet client on the router using a special mantenence page http://your.router.ip.address/cgi-bin/cgi?req=frm&frm=py-db/55debug.html, with special username (bufpy) and password (otdpopy+<root password if any>) 
    as described here:
    http://wiki.openwrt.org/toh/buffalo/wzr-hp-g300h#locked.u-boot.too.short.time.tftp.window
     

    • Logus

      Oh well, I was really unable to find one of those cables to do that mod…and then u came with this tip.. =D
      Can anyone give me a help here?
      I did enabled that telnet, connected to it using the windows 7 telnet client (cmd, telnet xxx.xxx.xx.x)
      I was able to connect and then I typed "ubootenv -h" and that help list pop out.
      But really don't know what to do next…I tried :
      # ubootenv setenv accept_open_rt_fmt 1 (it showed me that help list again)
      # ubootenv set accept_open_rt_fmt 1 (I THINK it worked since it didn't showed that list again, and the # came right after that)
      But after this I really don't know what to do….
      Any ideas?

      • Logus

        Well after the command  " # ubootenv set accept_open_rt_fmt 1 ", when I typed " # ubootenv list " it showed to me that the line " accept_open_rt_fmt " is set to "1".
        I tried to update the firmware using the web tool to the firmware 1.76 and ddwrt v24sp2-19484 (from buffalo official download page for this model) and both fail.
        Then I was able to transfer the file using tftp with linux liveusb (win7 didn't worked for me) but nothing happens after that. The router just boot normally…
        So am I still missing somenthing here?
        I wasn't able to do the command " saveenv " so…is that really necessary?
        When I tried to " ubootenv saveenv, ubootenv save or ubootenv sav" it didn't worked since it just showed me the help list for the command ubootenv…

  • Blukenguyen

    here my log what I need to do. I can't do Ctrl+C and it stuck there.
    BUFFALO U-BOOT Ver 1.02
    AP83–539 (ar9100) U-boot 0.0.12
    64 MB
    Memory Test (address line)
    Memory Test start(0×00000000) end(0×04000000) size(67108864)
    Data line test start:0×00000000 pattern 0×00000001 0×00000003 0×00000007 0x0000000F 0×00000005 0×00000015 0×00000055 0xAAAAAAAA
    Address line test start:0×00000000 len:0×4000000 pattern 0xAAAAAAAA 0×55555555
    Fill test patnum:5
    fill Pattern 5555AAAA Writing… Reading…
    fill Pattern AAAA5555 Writing… Reading…
    fill Pattern 0000FFFF Writing… Reading…
    fill Pattern FFFF0000 Writing… Reading…
    fill Pattern AAAAAAAA Writing… Reading…
    Top of RAM usable for U-Boot at: 84000000
    Reserving 250k for U-Boot at: 83fc0000
    Reserving 256k for malloc() at: 83f80000
    Reserving 44 Bytes for Board Info at: 83f7ffd4
    Reserving 36 Bytes for Global Data at: 83f7ffb0
    Reserving 128k for boot params() at: 83f5ffb0
    Stack Pointer at: 83f5ff98
    Now running in RAM – U-Boot at: 83fc0000
    Dev ID2:2222
    Name: AMD-SPANSION Flash id: 0x1227E, Size: 33554432 bytes.
    Flash: 32 MB
    In: serial
    Out: serial
    Err: serial
    Memory Test
    uboot use 83F5FFB0 – 84000000
    Memory Test start(80000000) end(83F00000) size(03F00000)
    Pattern 00000000 Writing… Reading…
    Memory Test OK
    ### buf_ver=[1.02] U-Boot Ver.=[1.02]
    ### build_date(env)=[Feb 16 2009 - 10:47:08] build_date(bin)=[Feb 16 2009 - 10:47:08]
    ag7100_enet_initialize…
    : cfg1 0xf cfg2 0×7114
    rtl8366sr_phy_setup ethUnit=0
    Realtek 8366SR switch ID 0×8366
    Realtek Greeen Ethernet Setup
    eth0: 02:aa:bb:cc:dd:1a
    eth0 up
    : cfg1 0xf cfg2 0×7114
    eth1: 02:aa:bb:cc:dd:1a
    eth1 up
    eth0 02:AA:BB:CC:DD:1A
    , eth1 02:AA:BB:CC:DD:1A

    Trying eth0
    eth0 is duplex
    eth0 link down
    FAIL
    Trying eth1
    eth1 link down
    FAIL

    tftp server(receive) go, waiting:1[sec]
    Trying eth1
    eth1 link down
    FAIL
    Trying eth0
    eth0 is duplex
    eth0 link down
    FAIL
    Load address: 0x81f00000

    TftpServer Timeout;
    Trying eth0
    eth0 is duplex
    eth0 link down
    FAIL
    Trying eth1
    eth1 link down
    FAIL
    no file was loaded.
    ## Booting image at be060000 …
    Bad Magic Number
    # LED(0×2) Blink[2] (Please press ‘Ctrl+c’ to stop)

  • Beau

    Hey, bit off topic, I just bought an WZR-HP-G300NH second hand and found that the AC adaptor they provide was totally wrong, doesn't even fit. Now just having troulbe finding details about the orignal AC adaptor. Can anyone tell me the output voltage. I think it's 12v 2amps. Is that right? And just as important, if anyone tell tell me the pin type it has on the end….I've read a few different  things like 5.0mm x 3.0mm male DC plug. Just that 3.0mm sounds a bit large for the centre hole I see at the back of the device. 
    Any info welcome. Thanks!

  • tommiy

    Accessed my WZR-HP-AG300H via the bufpy login. The changes are done directly by ubootenv which has set, get, del and list options. Setting a variable saves it permanently.

  • LA3005 , [url=http://ighdpbzuppen.com/]ighdpbzuppen[/url], [link=http://kshotrssmxpt.com/]kshotrssmxpt[/link], http://nmzvyvmwwgaa.com/

Leave a Reply

  

  

  


*

You can use these HTML tags

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>