OpenWrt Forum Archive

Topic: [HELP needed] WZR-HP-G300NH back to original firmware

The content of this topic has been archived on 20 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

My upgrade path was:

Factory firmware to dd-wrt buffalo_to_ddwrt_webflash-MULTI.bin via WebGUI
to dd-wrt wzr-hp-g300nh-dd-wrt-webupgrade-MULTI via WebGUI
to openwrt backfire via "mtd -w linux openwrt-ar71xx-wzr-hp-g300nh-jffs2-tftp.bin"

Now I can't flash back to original firmware via tftp. My TFTP works well with ubuntu laptop connected to the switch. I've tried all dd-wrt, buffalo 1.72, buffalo 1.74, buffalo 1.60 firmwares.

It always shows slow blink red led after reboot.

The only firmware now I can flash is openwrt-ar71xx-wzr-hp-g300nh-jffs2-tftp.bin (or squashfs either)

I made binary compare mtd partitions in dd-wrt and openwrt and found it identical for both dd-wrt (backed up before) and openwrt:

dd-wrt                        openwrt
--------                       --------
mtd0 RedBoot         =   mtd0_u-boot + mtd1_u-boot-env
mtd5 board_config  =    mtd5_art

Here is dmesg log regards to mtd partition during flash:

.........
ar91xx-flash ar91xx-flash: using static partition mapping
Creating 7 MTD partitions on "ar91xx-flash":
0x000000000000-0x000000040000 : "u-boot"
0x000000040000-0x000000060000 : "u-boot-env"
0x000000060000-0x000000160000 : "kernel"
0x000000160000-0x000001fc0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=420000,
len=1BA0000
0x000000420000-0x000001fc0000 : "rootfs_data"
0x000001fc0000-0x000001fe0000 : "user_property"
0x000001fe0000-0x000002000000 : "art"
0x000000060000-0x000001fc0000 : "firmware"
.........

Why I can't flash it back with factory firmware?
Should I use mtd or dd to rewrite "kernel" mtd partition with dd-wrt "linux" mtd backup?

Thank you

HollowKnight wrote:

Now I can't flash back to original firmware via tftp. My TFTP works well with ubuntu laptop connected to the switch. I've tried all dd-wrt, buffalo 1.72, buffalo 1.74, buffalo 1.60 firmwares.

It always shows slow blink red led after reboot.

First of all, see if you can access U-Boot. If not, read the following link or connect a dummy switch with router and laptop. Buffalo WZR-HP-G300NH - OpenWrt Wiki - Unable to transfer image via TFTP (transfer times out then router boots normally)

And try tftping the firmware build by BS on this page.

Thanks FYI,

TFTP works well for me. My WZR-HP-G300NH is EU and US model, not JP

u-Boot partition still there and load well every boot.

I will try to access u-Boot by pressing Ctrl+C during tftp.

I mean, according to BS, "this binary here should work on any router in any country." And the next message said, "and in case you want to revert. flash this binary from dd-wrt webgui." I think "these two binaries" might be your best chance.

Hello,

I wondered how tftp worked for you on the latest 10.03 release after you installed DD-WRT on your device? I am unable to do this.
I have a WZR-HP-G300NH and was unable to use TFTP either in Ubuntu or WinXP or Vista to flash the image openwrt-ar71xx-wzr-hp-g300nh-jffs2-tftp.bin to the router.
I have flashed many Linksys routers but am not able to get this one flashed.
Yes, I have a static IP and static arp entry for the router, but I was not able to replace the Buffalo firmware.
Finally I installed the DD-WRT image buffalo_to_ddwrt_webflash-MULTI.bin which worked straight from Buffalo's webinterface. I figured once DD-WRT was on the router I could flash  openwrt-ar71xx-wzr-hp-g300nh-jffs2-tftp.bin.
Alas, no luck. I have tried this approximately 100 times over the last three days and have read every forum post, FAQ, readme and wiki that I could find.
I have tried 3 different network cards, 3 different computers, tried a hub between the router/computer to keep the link alive, but the router just boots up as normal and no TFTP is ever successful.

I would appreciate any help whatsoever on this issue. Perhaps the only way to do this is to SCP the file into DD-WRT using telnet, but I haven't found any docs on how to do that and don't want to brick the unit.

Looking forward to your response.

(Last edited by zyamb on 8 Sep 2010, 03:17)

Update:

I just SCP'd the file into DD-WRT and ran the command:

mtd -r write /tmp/firmware.bin linux

The router rebooted and all I get is a blinking red Diag light.

Hello Zyamb,

I believe you can still tftp to your router since u-Boot partitition (or RedBoot in dd-wrt) remain untouched. If so, tftp again with dd-wrt firmware to gain access to the router via ssh or telnet.

Before writing to flash using command mtd I have stripped off first 0x20 (32) bytes from openwrt-ar71xx-wzr-hp-g300nh-jffs2-tftp.bin using dd command

dd -bs=32 -skip=1 if=openwrt-ar71xx-wzr-hp-g300nh-jffs2-tftp.bin of=firmware.bin

according to howto guide @ http://wiki.openwrt.org/doc/howto/uninstall

Firmware file to be write to flash starts at offset 32.

0000  23 20 41 69 72 73 74 61  74 69 6F 6E 20 50 75 62  # Airstation Pub
0010  6C 69 63 20 46 6D 74 31  00 00 00 00 00 00 00 00  lic Fmt1........
0020  27 05 19 56 8C 8E 20 49  4C 70 96 52 00 0D 86 F1  '..V.. ILp.R....
0030  80 06 00 00 80 06 00 00  13 72 3C FB 05 05 02 03  .........r<.....
0040  4D 49 50 53 20 4F 70 65  6E 57 72 74 20 4C 69 6E  MIPS OpenWrt Lin
0050  75 78 2D 32 2E 36 2E 33  32 2E 31 36 00 00 00 00  ux-2.6.32.16....
0060  6D 00 00 80 00 CC 9A 29  00 00 00 00 00 00 04 00  m......)........
0070  4E 25 40 07 F1 86 7F 28  2C 6B 1B CB E4 EE 3B 7C  N%@....(,k.??.;|

I am still cant get back from openwrt to dd-wrt using tftp method. Red Diag Light is blinking after reboot, and the router can work only boot if I reflash openwrt via TFTP.

I guess that the config flash partition mtd4 nvram (in dd-wrt) or mtd4 user_property (in openwrt) remain the same after tftp flashing so dd-wrt can not load initial configuration to complete boot. This partition can only correcty load under openwrt. Despite of many times reflashing my webgui password to openwrt remain the same.

Now I am about to rewrite dd-wrt mtd1-linux, mtd2-rootfs, mtd3-ddwrt and mtd4-nvram back to the MTD flash. I've backed up all mtd partition from dd-wrt before flashing to open-wrt.

I am still concern if it can brick my router, because different mtd partition layout in openwrt and dd-wrt.

Will let you know if it works.

u-Boot partitition still there untouched after you've done mtd -w linux firmware.bin so the router start TFTP session at every reboot for sure.

I connect my router (a LAN port, not blue WAN port) to a Linksys WRT54GC acting as both ADSL Gateway and Switch, then my netbook running Ubuntu net remix to the same switch. I run the following command on a terminal console on the netbook, leaving the Buffalo router unpowered

sudo ifconfig eth0 192.168.11.2 netmask 255.255.255.0

sudo arp -s 192.168.11.1 00:11:22:33:44:55 <-- you can find this number at the Buffalo bottom as SSID: 001122334455, replace it with your routers actual SSID number

tftp 192.168.11.1
at tftp prompt, issue following commands:

tftp> verbose
tftp> binary
tftp> timeout 60
tftp> rexmt 1
tftp> trace

and finally
tftp> put firmware.bin

Press Enter and plug-in power to your router
The console will display series of retrying responses for 3-4 seconds then tftp session will start. The whole process takes only 20-30 seconds. The router will reboot with new flash image.

Update

Following advises by LOM in dd-wrt forum. Thanks LOM

http://www.dd-wrt.com/phpBB2/viewtopic. … 188#482188

I've successfully reverted back from openwrt to dd-wrt using openwrt WebGUI update, just need to strip 32 bytes header from wzr-hp-g300nh-dd-wrt-webupgrade-MULTI.bin file.

dd bs=28 skip=1 if=wzr-hp-g300nh-dd-wrt-webupgrade-MULTI.bin of=firmware.bin

So firmware binary starts with 5 bytes 27 05 19 56 10

Then we can flash in openwrt WebGUI browser screen.

dd-wrt WebGUI accepts factory firmware.

Hi HollowKnight,

Thank you VERY much for your detailed replies. You did get farther than I did, here's my progress.

Rehash:
-Using Buffalo's GUI, I flashed to DDWRT using this bin file:   buffalo_to_ddwrt_webflash-MULTI.bin
-Enabled SSHd and SCP'd openwrt-ar71xx-wzr-hp-g300nh-jffs2-tftp.bin to the router.
-Used command:  mtd -r write /tmp/openwrt-ar71xx-wzr-hp-g300nh-jffs2-tftp.bin linux
-The router rebooted and all I get is a blinking red Diag light.

Now to get OpenWRT on:

1. I copied your setup and installed Ubuntu remix on a netbook as well. Netbook and Buffalo both connected into Linksys WRT54G router set at 192.168.11.5. Netbook static IP at 192.168.11.10. Set static arp entry for Buffalo on netbook.
{Note: My DDWRT IP was 192.168.1.1, but TFTP'ing to that IP didn't work. This confirms that the mtd command to put openwrt on did in fact work, because u-boot was listening at 192.168.11.1.}

2. dd bs=32 skip=1 if=openwrt-ar71xx-wzr-hp-g300nh-jffs2-tftp.bin of=firmware.bin

3. TFTP'd firmware.bin to 192.168.11.1...................success!!

Well, almost...

TFTP sent a whole bunch of data across. Eventually the red diag light was blinking and the TFTP session was still going.

My Terminal session filled up so all I could paste was this:

sent DATA <block=356, 512 bytes>
received ACK <block=356>
sent DATA <block=357, 512 bytes>
received ACK <block=353>
received ACK <block=357>
sent DATA <block=358, 512 bytes>
received ACK <block=354>
received ACK <block=358>
sent DATA <block=359, 512 bytes>
received ACK <block=355>
discarded 1 packets
received ACK <block=356>
received ACK <block=357>
received ACK <block=358>
sent DATA <block=359, 512 bytes>
received ACK <block=359>
sent DATA <block=360, 512 bytes>
received ACK <block=360>
sent DATA <block=361, 512 bytes>
received ACK <block=359>
received ACK <block=361>
sent DATA <block=362, 512 bytes>
received ACK <block=360>
received ACK <block=362>
sent DATA <block=363, 512 bytes>
received ACK <block=363>
sent DATA <block=364, 512 bytes>
received ACK <block=361>
received ACK <block=364>
sent DATA <block=365, 512 bytes>
received ACK <block=365>
sent DATA <block=366, 512 bytes>
received ACK <block=362>
received ACK <block=363>
discarded 1 packets
received ACK <block=364>
received ACK <block=365>
sent DATA <block=366, 512 bytes>
received ACK <block=366>
sent DATA <block=367, 512 bytes>
received ACK <block=367>
sent DATA <block=368, 512 bytes>
received ACK <block=368>
sent DATA <block=369, 512 bytes>
received ACK <block=366>
received ACK <block=369>
sent DATA <block=370, 512 bytes>
received ACK <block=367>
discarded 1 packets
received ACK <block=368>
received ACK <block=369>
discarded 1 packets
sent DATA <block=370, 512 bytes>
sent DATA <block=370, 512 bytes>
sent DATA <block=370, 512 bytes>
sent DATA <block=370, 512 bytes>
sent DATA <block=370, 512 bytes>
received ACK <block=370>
sent DATA <block=371, 512 bytes>
received ACK <block=371>
sent DATA <block=372, 512 bytes>
received ACK <block=372>
sent DATA <block=373, 512 bytes>
received ACK <block=373>
sent DATA <block=374, 512 bytes>
received ACK <block=371>
received ACK <block=374>
sent DATA <block=375, 512 bytes>
received ACK <block=375>
sent DATA <block=376, 512 bytes>
received ACK <block=372>
received ACK <block=373>
discarded 1 packets
received ACK <block=374>
received ACK <block=375>
sent DATA <block=376, 512 bytes>
received ACK <block=376>
sent DATA <block=377, 512 bytes>
received ACK <block=377>
sent DATA <block=378, 512 bytes>
received ACK <block=378>
sent DATA <block=379, 512 bytes>
received ACK <block=376>
received ACK <block=379>
sent DATA <block=380, 512 bytes>
received ACK <block=380>
sent DATA <block=381, 512 bytes>
received ACK <block=377>
received ACK <block=381>
sent DATA <block=382, 512 bytes>
received ACK <block=378>
received ACK <block=382>
sent DATA <block=383, 512 bytes>
received ACK <block=383>
sent DATA <block=384, 512 bytes>
received ACK <block=379>
received ACK <block=380>
discarded 1 packets
received ACK <block=381>
received ACK <block=382>
received ACK <block=383>
sent DATA <block=384, 512 bytes>
received ACK <block=384>
sent DATA <block=385, 512 bytes>
received ACK <block=385>
sent DATA <block=386, 512 bytes>
received ACK <block=384>
received ACK <block=386>
sent DATA <block=387, 512 bytes>
received ACK <block=387>
sent DATA <block=388, 512 bytes>
received ACK <block=385>
received ACK <block=388>
sent DATA <block=389, 512 bytes>
received ACK <block=389>
sent DATA <block=390, 512 bytes>
received ACK <block=386>
received ACK <block=387>
discarded 1 packets
received ACK <block=388>
received ACK <block=389>
sent DATA <block=390, 512 bytes>
received ACK <block=390>
sent DATA <block=391, 512 bytes>
received ACK <block=391>
sent DATA <block=392, 512 bytes>
received ACK <block=392>
sent DATA <block=393, 512 bytes>
received ACK <block=390>
received ACK <block=393>
sent DATA <block=394, 512 bytes>
received ACK <block=394>
sent DATA <block=395, 512 bytes>
received ACK <block=391>
discarded 1 packets
received ACK <block=395>
sent DATA <block=396, 512 bytes>
received ACK <block=393>
discarded 1 packets
received ACK <block=394>
received ACK <block=395>
sent DATA <block=396, 512 bytes>
received ACK <block=396>
sent DATA <block=397, 512 bytes>
received ACK <block=397>
sent DATA <block=398, 512 bytes>
received ACK <block=398>
sent DATA <block=399, 512 bytes>
received ACK <block=396>
discarded 2 packets
received ACK <block=399>
sent DATA <block=400, 512 bytes>
received ACK <block=400>
sent DATA <block=401, 512 bytes>
received ACK <block=399>
discarded 1 packets
received ACK <block=400>
sent DATA <block=401, 512 bytes>
received ACK <block=401>
sent DATA <block=402, 512 bytes>
received ACK <block=402>
sent DATA <block=403, 512 bytes>
received ACK <block=403>
sent DATA <block=404, 512 bytes>
received ACK <block=401>
received ACK <block=404>
sent DATA <block=405, 512 bytes>
received ACK <block=402>
received ACK <block=405>
sent DATA <block=406, 512 bytes>
received ACK <block=403>
received ACK <block=406>
sent DATA <block=407, 512 bytes>
received ACK <block=407>
sent DATA <block=408, 512 bytes>
received ACK <block=404>
received ACK <block=405>
discarded 1 packets
received ACK <block=406>
received ACK <block=407>
sent DATA <block=408, 512 bytes>
received ACK <block=408>
sent DATA <block=409, 512 bytes>
received ACK <block=409>
sent DATA <block=410, 512 bytes>
received ACK <block=410>
sent DATA <block=411, 512 bytes>
received ACK <block=408>
received ACK <block=411>
sent DATA <block=412, 512 bytes>
received ACK <block=412>
sent DATA <block=413, 512 bytes>
received ACK <block=409>
received ACK <block=410>
discarded 1 packets
received ACK <block=411>
received ACK <block=412>
sent DATA <block=413, 512 bytes>
received ACK <block=413>
sent DATA <block=414, 512 bytes>
received ACK <block=414>
sent DATA <block=415, 512 bytes>
received ACK <block=415>
sent DATA <block=416, 512 bytes>
received ACK <block=413>
received ACK <block=416>
sent DATA <block=417, 512 bytes>
received ACK <block=414>
discarded 1 packets
received ACK <block=415>
received ACK <block=416>
sent DATA <block=417, 512 bytes>
received ACK <block=417>
sent DATA <block=418, 512 bytes>
received ACK <block=418>
sent DATA <block=419, 512 bytes>
received ACK <block=417>
received ACK <block=419>
sent DATA <block=420, 512 bytes>
received ACK <block=418>
discarded 1 packets
received ACK <block=419>
sent DATA <block=420, 512 bytes>
received ACK <block=420>
sent DATA <block=421, 512 bytes>
received ACK <block=421>
sent DATA <block=422, 512 bytes>
received ACK <block=422>
sent DATA <block=423, 512 bytes>
received ACK <block=420>
received ACK <block=423>
sent DATA <block=424, 512 bytes>
received ACK <block=421>
discarded 1 packets
received ACK <block=422>
received ACK <block=423>
sent DATA <block=424, 512 bytes>
received ACK <block=424>
sent DATA <block=425, 512 bytes>
received ACK <block=425>
sent DATA <block=426, 512 bytes>
received ACK <block=426>
sent DATA <block=427, 512 bytes>
received ACK <block=424>
received ACK <block=427>
sent DATA <block=428, 512 bytes>
received ACK <block=428>
sent DATA <block=429, 512 bytes>
received ACK <block=425>
received ACK <block=426>
discarded 4 packets
sent DATA <block=429, 512 bytes>
sent DATA <block=429, 512 bytes>
sent DATA <block=429, 512 bytes>
sent DATA <block=429, 512 bytes>
received ACK <block=429>
sent DATA <block=430, 512 bytes>
received ACK <block=430>
sent DATA <block=431, 512 bytes>
received ACK <block=431>
sent DATA <block=432, 512 bytes>
received ACK <block=432>
sent DATA <block=433, 512 bytes>
received ACK <block=430>
received ACK <block=433>
sent DATA <block=434, 512 bytes>
received ACK <block=431>
discarded 1 packets
received ACK <block=432>
received ACK <block=433>
sent DATA <block=434, 512 bytes>
received ACK <block=434>
sent DATA <block=435, 512 bytes>
received ACK <block=435>
sent DATA <block=436, 512 bytes>
received ACK <block=436>
sent DATA <block=437, 512 bytes>
received ACK <block=434>
received ACK <block=437>
sent DATA <block=438, 512 bytes>
received ACK <block=435>
discarded 1 packets
received ACK <block=436>
received ACK <block=437>
sent DATA <block=438, 512 bytes>
received ACK <block=438>
sent DATA <block=439, 512 bytes>
received ACK <block=439>
sent DATA <block=440, 512 bytes>
received ACK <block=440>
sent DATA <block=441, 512 bytes>
received ACK <block=438>
received ACK <block=441>
sent DATA <block=442, 512 bytes>
received ACK <block=442>
sent DATA <block=443, 512 bytes>
received ACK <block=439>
received ACK <block=440>
discarded 1 packets
received ACK <block=441>
received ACK <block=442>
sent DATA <block=443, 512 bytes>
received ACK <block=443>
sent DATA <block=444, 512 bytes>
received ACK <block=444>
sent DATA <block=445, 512 bytes>
received ACK <block=445>
sent DATA <block=446, 512 bytes>
received ACK <block=443>
received ACK <block=446>
sent DATA <block=447, 512 bytes>
received ACK <block=447>
sent DATA <block=448, 512 bytes>
received ACK <block=444>
received ACK <block=445>
received ACK <block=448>
sent DATA <block=449, 512 bytes>
received ACK <block=449>
sent DATA <block=450, 512 bytes>
received ACK <block=446>
received ACK <block=450>
sent DATA <block=451, 512 bytes>
received ACK <block=447>
received ACK <block=451>
sent DATA <block=452, 512 bytes>
received ACK <block=452>
sent DATA <block=453, 512 bytes>
received ACK <block=448>
received ACK <block=453>
sent DATA <block=454, 512 bytes>
received ACK <block=449>
received ACK <block=454>
sent DATA <block=455, 512 bytes>
received ACK <block=450>
received ACK <block=455>
sent DATA <block=456, 512 bytes>
received ACK <block=451>
received ACK <block=456>
sent DATA <block=457, 512 bytes>
received ACK <block=452>
received ACK <block=457>
sent DATA <block=458, 512 bytes>
received ACK <block=453>
received ACK <block=458>
sent DATA <block=459, 512 bytes>
received ACK <block=454>
received ACK <block=459>
sent DATA <block=460, 512 bytes>
received ACK <block=460>
sent DATA <block=461, 512 bytes>
received ACK <block=455>
discarded 1 packets
received ACK <block=457>
discarded 1 packets
received ACK <block=458>
received ACK <block=459>
discarded 2 packets
sent DATA <block=461, 512 bytes>
sent DATA <block=461, 512 bytes>
sent DATA <block=461, 512 bytes>
sent DATA <block=461, 512 bytes>
received ACK <block=461>
sent DATA <block=462, 512 bytes>
received ACK <block=462>
sent DATA <block=463, 512 bytes>
received ACK <block=463>
sent DATA <block=464, 512 bytes>
received ACK <block=464>
sent DATA <block=465, 512 bytes>
received ACK <block=462>
received ACK <block=465>
sent DATA <block=466, 512 bytes>
received ACK <block=466>
sent DATA <block=467, 512 bytes>
received ACK <block=463>
received ACK <block=464>
discarded 1 packets
received ACK <block=465>
discarded 1 packets
received ACK <block=467>
sent DATA <block=468, 512 bytes>
received ACK <block=468>
sent DATA <block=469, 512 bytes>
received ACK <block=469>
sent DATA <block=470, 512 bytes>
received ACK <block=468>
discarded 1 packets
received ACK <block=469>
sent DATA <block=470, 512 bytes>
received ACK <block=470>
sent DATA <block=471, 512 bytes>
received ACK <block=471>
sent DATA <block=472, 512 bytes>
received ACK <block=472>
sent DATA <block=473, 512 bytes>
received ACK <block=470>
received ACK <block=473>
sent DATA <block=474, 512 bytes>
received ACK <block=471>
discarded 1 packets
received ACK <block=472>
received ACK <block=473>
sent DATA <block=474, 512 bytes>
received ACK <block=474>
sent DATA <block=475, 512 bytes>
received ACK <block=475>
sent DATA <block=476, 512 bytes>
received ACK <block=476>
sent DATA <block=477, 512 bytes>
received ACK <block=474>
received ACK <block=477>
sent DATA <block=478, 512 bytes>
received ACK <block=475>
received ACK <block=478>
sent DATA <block=479, 512 bytes>
received ACK <block=479>
sent DATA <block=480, 512 bytes>
received ACK <block=476>
received ACK <block=480>
sent DATA <block=481, 512 bytes>
received ACK <block=477>
received ACK <block=481>
sent DATA <block=482, 512 bytes>
received ACK <block=482>
sent DATA <block=483, 512 bytes>
received ACK <block=478>
received ACK <block=479>
discarded 1 packets
received ACK <block=480>
received ACK <block=481>
received ACK <block=482>
sent DATA <block=483, 512 bytes>
received ACK <block=483>
sent DATA <block=484, 512 bytes>
received ACK <block=484>
sent DATA <block=485, 512 bytes>
received ACK <block=483>
received ACK <block=485>
sent DATA <block=486, 512 bytes>
received ACK <block=486>
sent DATA <block=487, 512 bytes>
received ACK <block=484>
received ACK <block=487>
sent DATA <block=488, 512 bytes>
received ACK <block=485>
discarded 1 packets
received ACK <block=486>
received ACK <block=487>
discarded 1 packets
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
sent DATA <block=488, 512 bytes>
Transfer timed out.

tftp>


===

Now I still have a red Diag light blinking.

Any thoughts would be appreciated, also which firmware I should try to flash to this unit at this stage.

Thanks!

Update:

I just tried the standard openwrt image, openwrt-ar71xx-wzr-hp-g300nh-jffs2-tftp.bin.

TFTP was again "successful" in sending files until the timeout...

It got to:

sent DATA <block=2406, 512 bytes>

Seems like the entire file is not transferred quickly enough.

I now tried tftp'ing the official buffalo 1.74 firmware as described on this page, and the file transferred over correctly with tftp, all 21541116 bytes in 50.9 seconds (phew!). The router did not reboot though, I left it about 20 minutes. Rebooting it manually does nothing either, same old blinking Red light.

Zyamb

TFTP and WebGUi are the best way for flash fw. mtd command is tricky and we should have enough space on the router to contain fw file, enable telnet or sshd, maybe external usb... so better avoid it.

1. If you can still on with openwrt WebGUI:

Use file wzr-hp-g300nh-dd-wrt-webupgrade-MULTI.bin, strip first 28 bytes
dd bs=1 skip-28 if=wzr-hp-g300nh-dd-wrt-webupgrade-MULTI.bin of=myfirmware.bin

Use open WebGUI to flash myfirmware.bin. I've reverted back to dd-wrt by this way. It took 20 mins to fully reflash and boot.

2. TFTP
Use openwrt tftp images. Those files have 32 bytes header.

Actual flash starts at 0x20 offset
0020  27 05 19 56 8C 8E 20 49  4C 70 96 52 00 0D 86 F1  -'..V.. ILp.R....-
0030  80 06 00 00 80 06 00 00  13 72 3C FB 05 05 02 03  -.........r<.....-
0040  4D 49 50 53 20 4F 70 65  6E 57 72 74 20 4C 69 6E  -MIPS OpenWrt Lin-
0050  75 78 2D 32 2E 36 2E 33  32 2E 31 36 00 00 00 00  -ux-2.6.32.16....-

Now I can back and forth any firmware I want, just remember
openwrt WebGUI accepts RAW fw image, that starts with above bolded 5 bytes
openwrt tftp require a 28-bytes header. Speed some time to look at those files and you can modify headers as your needs.

The best way to start new upgrade path is back to factory firmware 1.60 first. Then flash it with buffalo-to-ddwrt followed by dd-wrt-webupgrade.

Hope it helps

Thank you very much HollowKnight. I didn't reply back in a while because it took some time to figure out what was wrong. In the end I added a new 5-port 10/100 switch which allowed the tftp'd images to fully transfer to the router. I started fresh with a new buffalo firmware and from there flashed openwrt without a problem! Phew! Seems like this router is very picky on which router/switches/network ports are used. For the record I just used a plain D-Link DSS5+.

Thanks again.

Scary Gliders » Hacking around the Japanese Buffalo WZR-HP-G300NH

Zgembo posted the following on February 23, 2010 at 11:41 pm.

hello there,

thanks for the guide on this, it may come handy… btw, have you tried changing “region=JP” parameter and checking if it would accept stock english firmware?

Zgembo posted the following on October 2, 2010 at 10:17 pm.

an update:

I got myself Japanese WZR-HP-G300NH, and ran into same problems. Messing a bit with the u-boot console and comparing boot variables with non-Japanese WZR-HP-G300NH, i found out an interesting setting, simply typing:

ar7100> setenv accept_open_rt_fmt 1
ar7100> saveenv
Will enable flashing any compatible firmware via TFTP! Tested with OpenWRT 10.03

OpenWrt / WZR-HP-G301NH Bricked?

DD-WRT Forum :: View topic - WZR-HP-G300NH support

LOM wrote:

Sorry, I don't know what header type OpenWRT uses for their gui update, I only knew that they were using Buffalos Open Format for tftp and assumed that they had kept that also for sys upgrade.

If the sysupgrade file start with 0x27051956 then it is without firmware header in which case you can remove the 28 dd-wrt firmware header bytes so it starts with the same pattern.

DD-WRT Forum :: View topic - WZR-HP-G300NH support

LOM wrote:

Scary gliders guide was intended for bypassing his JP region restriction but can also be used for a normal update. It is based on on loading a header-less image (one that starts with the U-Boot magic 0x27051956) to ram and then writing it to flash.
I can see no reason for why you can't get that working with a dd-wrt webupgrade file with the HDR0 part removed.

The normal way of doing the tftp flashing is to send an encrypted file (Buffalo stock firmware or buffalo_to_dd-wrt) when the router starts up.

You can also break into the cfe from a serial terminal and start the transfer with the ut_fw command.
ut_fw expects the file name to be firmware.bin.

The discussion might have continued from here.