Overclock.net › Forums › Components › Network Hardware › [Guide] Recovering a bricked Buffalo Airstation N450 Router (WZR-HP-G450H)
New Posts  All Forums:Forum Nav:

[Guide] Recovering a bricked Buffalo Airstation N450 Router (WZR-HP-G450H)

post #1 of 6
Thread Starter 
Update (July 2013)

It is possible to recover the later versions with a U-Boot version that does not support Ctrl-C, but it requires the use of TFTP for the firmware upload. The router will wait for a TFTP connection for a few seconds before booting, but almost impossible to time this correctly without having the serial interface connected. So based on experience from fernandoavc the best option is to follow this guide and then, once you get to the point where you can see it's waiting for a TFTP connection (in Putty), you should instead initiate the firmware upload from Pumpkin. Best chance of success is when you use a hub between the router and your PC (because Windows often closes down the NIC when it's not detecting a connected device, and it's very slow to re-open it).


Update (June 2013)

Please note that the procedure described below will not work for all versions of this router. Some versions, don't know which exactly, will have a modified version of U-Boot (identified version 1.07, only confirmed working version is 1.0) that does not accept the ctrl-c command line needed for the firmware update. And it appears that TFTP update during boot is not an option either.

Thanks goes to fernandoavc for this information and his work towards recovering these newer models.

If anyone found a way to update these newer models, please let me know and I'll update the thread and of course give full credit.






I've had this router for some time and been really happy with it, it's got lots of nice features, gigabit switch, 450Mbit wireless, high power/long range etc. Never had any problems with it, I just set it up when I first got it and it's been running ever since.



Buffalo Airstation N450

Anyway, it got bricked and in a few post I will go though the way I found to recover it and with all the hours I spent on it I thought I would share in case others get into the same situation. It's quite a long procedure, so I'll split it into a few posts.

First, how it got bricked (skip this if you just want the technical details)

Last weekend I just wanted to make a couple of minor setup changes and then I noticed it said there was a firmware update available for download in the web UI. So I thought, I'll just update the firmware while I'm at it, so I clicked the update button, waited for it to complete (actually I just left it there for like 20 minutes or something) it had reached 100% and said it was complete, but I couldn't contact it anymore. There was a red LED blinking on the front, but nothing I really paid attention to. I then left it a bit longer and finally decided to try restart it. (power on/off) It never came back to life worriedsmiley.gif. Finally I checked the manual (probably for the first time biggrin.gif) and it said 2 blinks means the firmware is screwed up. Not sure how it happened, but possibly Internet drop out or something during the update.

Hmm, OK, not so good, as I didn't have internet anymore with the router gone, so had to rig up some temporary internet connection and do some googling. Conclusion was that it had to be send in for replacement, no recovery procedure available from Buffalo. Except a few people suggesting TFTP uploading a 3rd party firmware. Tried it many times, but was never able to get a TFTP connection to the router. But I did find some technical details suggesting there is a TTL level serial port on the PCB and that it's running U-Boot so it might be possible to upgrade the firmware that way. I found lots of documentation on the 300 model, but not much on the 450 model and the procedures for the 300 model don't work on the 450 model (tried them)

I had to make a decision either send it in and wait for a replacement or give it a go. (Opening it up will of course void any warranty) I concluded sending it in for fix/replacement would probably take weeks so I would have to buy another one for use in the meantime anyway worriedsmiley.gif, so I decided to open it up.

Step 1 - Tools and software needed:

  1. Putty (free termal utility) need this to talk to U-Boot.
  2. Pumpkin (TFTP server and client)
  3. U-Boot overview manual, just in case.
  4. OpenWrt firmware for the router, thanks OpenWrt. (can't use the original firmware, it's encrypted, more details later)
  5. Hex editor (have to slightly modify the firmware header to make U-Boot accept it)
  6. You also need to make sure you have some serial port available (must be 3.3V TTL more details later)

Edited by jvjessen - 7/25/13 at 12:14pm
post #2 of 6
Thread Starter 
Step 2 - Opening the router:

Warning: Opening it will of course void any warranty

(Sorry for poor quality pictures, shot them with mobile)

There are 4 screws, but they are seated really deep and got some weird safety head on them:



Took some time, but it is possible to unscrew them if you can find a small screwdriver that kindof fits, this is the one I used:



Alternatively you could drill the heads off with a sharp 4-5 mm drill, just be really careful. (you don't really need the screws really, it just clicks back together, I guess the screws are mostly there to prevent people from opening it rolleyes.gif)

It's open:

post #3 of 6
Thread Starter 
Step 3 - Connecting the serial port.

I use one of these little USB to Serial TTL level things, I had one already I've used for other projects in the past:



If you use this or a similar device, you just need to hook up 3 wires (GND, RXD and TXD)

I do this so I can talk to the U-Boot in the router from Putty.

This is where you should connect it:



GND connects to PCB GND
RXD connects to PCB TXD
TXD connects to PCB RXD

I just use a small pin header,



Then hold it in place with a bit of pressure using some tape: (too lazy to solder it in place, it's just temporarily needed)



Now it's time to run Putty and see if we can talk to the router.

Find out what COM port your serial is on (Win7 - Device Manager/Ports will show the COM ports available)

Configure putty to serial 115200, 8, N, 1:





Start the session (Click Open in Putty)

Connect power to the router and if you've got everything connected and done right, you will see this (in Putty window)



Start pressing CTRL-C continuously until you get the U-boot prompt:

post #4 of 6
Thread Starter 
Step 4 - Configure network between PC and Router

In Putty type: printenv and hit enter:



This will show the u-boot router configuration:



Write down ethaddr and serverip, need those for later.

Plug in a piece of patch cable between the router and your PC, use this port on the router (others might work, but just use this one)



Then configure your PC's network adapter to the server ip from earlier:



Open a CMD prompt as administrator and run these commands:

route print



Find your network lan adapter in the list and take note of the number in front, in mine the ID number is 17

Then run:

netsh interface ipv4 add neighbors 17 192.168.11.1 02-aa-bb-cc-dd-23 (with the correct values)

and

arp -s 192.168.11.1 02-aa-bb-cc-dd-23 (again with the correct values from u-boot)



This will associate the u-boot MAC address with the ip address so we can contact it.

One more detail I found is that this switch must be in the position shown here:



Back to putty and try see if we can ping the PC from the router:

in the ar7240> prompt write:

ping 192.168.11.2



If you get the host ... is alive, everything is good, if not, re-check the configuration, disable firewall virus scanners etc and try again.
post #5 of 6
Thread Starter 
Step 5 - Uploading the firmware (yeah, almost there)

To upload the firmware we need Pumpkin, make sure it's installed and running.

Configure the download path to somewhere easily accessible and make sure it's running as server:



Open the firmware in the HxD hex editor (see first post):



The firmware must start with 27 05 19 56 if there is anything in front of that sequence, delete it and save the file.

Now copy the modified firmware file to the download path you just configured in Pumpkin (c:\temp), and rename it to something simple, e.g. firmware.bin. Make sure you got firewall etc disabled.

Back to putty, type

tftpboot 81f00000 firmware.bin (don't get the address wrong, if you manage to delete u-boot you could be in trouble)



then Pumpkin will pop up a dialog asking you to give access to the file:



Once it's done uploading the new firmware, type this command in Putty:

run u_fw

it's a macro that will install the new firmware, then you see a lot of output in Putty, just wait for it a few minutes or so.

when it's done, in putty, hit enter and you should see this (haven't tried the suggested drink recipe, but I'm sure it's good with all that alcohol biggrin.gif)



Then go back and re-configure your LAN ip address to 192.168.1.2 (the OpenWrt firmware will give your router the address 192.168.1.1 by default)

Open a browser and point to 192.168.1.1, this will bring up the web UI and you can start configuring. For details go to the OpenWrt website for a quick guide. It's quite easy.



OK, that was a lot of typing, hope someone will benefit from it.

I don't know if the OpenWrt firmware is better or worse than the original, but it works fine for me so far and I don't have to go buy and new router.

Any comments, corrections or questions are most welcome.
Edited by jvjessen - 11/26/12 at 10:02pm
post #6 of 6
i got same problem whit you:
New Posts  All Forums:Forum Nav:
  Return Home
  Back to Forum: Network Hardware
Overclock.net › Forums › Components › Network Hardware › [Guide] Recovering a bricked Buffalo Airstation N450 Router (WZR-HP-G450H)