Overclock.net banner

1 - 11 of 11 Posts

1,179 Posts
Discussion Starter #1
Update (July 2013)

It is possible to recover the later versions with a U-Boot version that does not support Ctrl-C, but it requires the use of TFTP for the firmware upload. The router will wait for a TFTP connection for a few seconds before booting, but almost impossible to time this correctly without having the serial interface connected. So based on experience from fernandoavc the best option is to follow this guide and then, once you get to the point where you can see it's waiting for a TFTP connection (in Putty), you should instead initiate the firmware upload from Pumpkin. Best chance of success is when you use a hub between the router and your PC (because Windows often closes down the NIC when it's not detecting a connected device, and it's very slow to re-open it).

Update (June 2013)

Please note that the procedure described below will not work for all versions of this router. Some versions, don't know which exactly, will have a modified version of U-Boot (identified version 1.07, only confirmed working version is 1.0) that does not accept the ctrl-c command line needed for the firmware update. And it appears that TFTP update during boot is not an option either.

Thanks goes to fernandoavc for this information and his work towards recovering these newer models.

If anyone found a way to update these newer models, please let me know and I'll update the thread and of course give full credit.

I've had this router for some time and been really happy with it, it's got lots of nice features, gigabit switch, 450Mbit wireless, high power/long range etc. Never had any problems with it, I just set it up when I first got it and it's been running ever since.

Buffalo Airstation N450

Anyway, it got bricked and in a few post I will go though the way I found to recover it and with all the hours I spent on it I thought I would share in case others get into the same situation. It's quite a long procedure, so I'll split it into a few posts.

First, how it got bricked (skip this if you just want the technical details)

Last weekend I just wanted to make a couple of minor setup changes and then I noticed it said there was a firmware update available for download in the web UI. So I thought, I'll just update the firmware while I'm at it, so I clicked the update button, waited for it to complete (actually I just left it there for like 20 minutes or something) it had reached 100% and said it was complete, but I couldn't contact it anymore. There was a red LED blinking on the front, but nothing I really paid attention to. I then left it a bit longer and finally decided to try restart it. (power on/off) It never came back to life
. Finally I checked the manual (probably for the first time
) and it said 2 blinks means the firmware is screwed up. Not sure how it happened, but possibly Internet drop out or something during the update.

Hmm, OK, not so good, as I didn't have internet anymore with the router gone, so had to rig up some temporary internet connection and do some googling. Conclusion was that it had to be send in for replacement, no recovery procedure available from Buffalo. Except a few people suggesting TFTP uploading a 3rd party firmware. Tried it many times, but was never able to get a TFTP connection to the router. But I did find some technical details suggesting there is a TTL level serial port on the PCB and that it's running U-Boot so it might be possible to upgrade the firmware that way. I found lots of documentation on the 300 model, but not much on the 450 model and the procedures for the 300 model don't work on the 450 model (tried them)

I had to make a decision either send it in and wait for a replacement or give it a go. (Opening it up will of course void any warranty) I concluded sending it in for fix/replacement would probably take weeks so I would have to buy another one for use in the meantime anyway
, so I decided to open it up.

Step 1 - Tools and software needed:

  1. Putty (free termal utility) need this to talk to U-Boot.
  2. Pumpkin (TFTP server and client)
  3. U-Boot overview manual, just in case.
  4. OpenWrt firmware for the router, thanks OpenWrt. (can't use the original firmware, it's encrypted, more details later)
  5. Hex editor (have to slightly modify the firmware header to make U-Boot accept it)
  6. You also need to make sure you have some serial port available (must be 3.3V TTL more details later)

1,179 Posts
Discussion Starter #2
Step 2 - Opening the router:

Warning: Opening it will of course void any warranty

(Sorry for poor quality pictures, shot them with mobile)

There are 4 screws, but they are seated really deep and got some weird safety head on them:

Took some time, but it is possible to unscrew them if you can find a small screwdriver that kindof fits, this is the one I used:

Alternatively you could drill the heads off with a sharp 4-5 mm drill, just be really careful. (you don't really need the screws really, it just clicks back together, I guess the screws are mostly there to prevent people from opening it

It's open:


1,179 Posts
Discussion Starter #3
Step 3 - Connecting the serial port.

I use one of these little USB to Serial TTL level things, I had one already I've used for other projects in the past:

If you use this or a similar device, you just need to hook up 3 wires (GND, RXD and TXD)

I do this so I can talk to the U-Boot in the router from Putty.

This is where you should connect it:

GND connects to PCB GND
RXD connects to PCB TXD
TXD connects to PCB RXD

I just use a small pin header,

Then hold it in place with a bit of pressure using some tape: (too lazy to solder it in place, it's just temporarily needed)

Now it's time to run Putty and see if we can talk to the router.

Find out what COM port your serial is on (Win7 - Device Manager/Ports will show the COM ports available)

Configure putty to serial 115200, 8, N, 1:

Start the session (Click Open in Putty)

Connect power to the router and if you've got everything connected and done right, you will see this (in Putty window)

Start pressing CTRL-C continuously until you get the U-boot prompt:


1,179 Posts
Discussion Starter #4
Step 4 - Configure network between PC and Router

In Putty type: printenv and hit enter:

This will show the u-boot router configuration:

Write down ethaddr and serverip, need those for later.

Plug in a piece of patch cable between the router and your PC, use this port on the router (others might work, but just use this one)

Then configure your PC's network adapter to the server ip from earlier:

Open a CMD prompt as administrator and run these commands:

route print

Find your network lan adapter in the list and take note of the number in front, in mine the ID number is 17

Then run:

netsh interface ipv4 add neighbors 17 02-aa-bb-cc-dd-23 (with the correct values)


arp -s 02-aa-bb-cc-dd-23 (again with the correct values from u-boot)

This will associate the u-boot MAC address with the ip address so we can contact it.

One more detail I found is that this switch must be in the position shown here:

Back to putty and try see if we can ping the PC from the router:

in the ar7240> prompt write:


If you get the host ... is alive, everything is good, if not, re-check the configuration, disable firewall virus scanners etc and try again.

1,179 Posts
Discussion Starter #5
Step 5 - Uploading the firmware (yeah, almost there)

To upload the firmware we need Pumpkin, make sure it's installed and running.

Configure the download path to somewhere easily accessible and make sure it's running as server:

Open the firmware in the HxD hex editor (see first post):

The firmware must start with 27 05 19 56 if there is anything in front of that sequence, delete it and save the file.

Now copy the modified firmware file to the download path you just configured in Pumpkin (c:\temp), and rename it to something simple, e.g. firmware.bin. Make sure you got firewall etc disabled.

Back to putty, type

tftpboot 81f00000 firmware.bin (don't get the address wrong, if you manage to delete u-boot you could be in trouble)

then Pumpkin will pop up a dialog asking you to give access to the file:

Once it's done uploading the new firmware, type this command in Putty:

run u_fw

it's a macro that will install the new firmware, then you see a lot of output in Putty, just wait for it a few minutes or so.

when it's done, in putty, hit enter and you should see this (haven't tried the suggested drink recipe, but I'm sure it's good with all that alcohol

Then go back and re-configure your LAN ip address to (the OpenWrt firmware will give your router the address by default)

Open a browser and point to, this will bring up the web UI and you can start configuring. For details go to the OpenWrt website for a quick guide. It's quite easy.

OK, that was a lot of typing, hope someone will benefit from it.

I don't know if the OpenWrt firmware is better or worse than the original, but it works fine for me so far and I don't have to go buy and new router.

Any comments, corrections or questions are most welcome.

1 Posts
Great instructions
, Thanks., saved my day
Two remarks:

1. I needed to put a switch in between the Router and my PC. A direct connection did not work.
2. You can install the original encrypted buffalo firmware by decrypting it first. To do so follow these steps (on linux, will probably work on other systems too):

Decrypt original Buffalo firmware:
  1. get the files buffalo-enc.c buffalo-lib.c buffalo-lib.h from firmware-mod-kit
  2. Compile: gcc -o buffalo-enc buffalo.c buffalo-enc.c
  3. Get the encrypted, original firmware from the buffalo website
  4. Open the file in a binary editor and remove the first few bytes to just before the second start section
  5. ./buffalo-enc -d -i infile.enc -o outfile.bin

2 Posts
I am sucesfuly uploading OpenWrt firmware to router with Japan firmware WZR-HP-G450H,
There was firmware - WZR-HP-G450H Ver.1.86 (R1.13/B1.00) (Japan Interface).
I am not deleting 4 bytes from firmware OpenWrt!
Only full firmware.

Then I am unlocking 12 & 13 channels,
commands SSH:

cd /tmp
wget http://luci.subsignal.org/~jow/reghack/old/reghack.mips.elf
chmod +x reghack.mips.elf
./reghack.mips.elf /lib/modules/*/ath.ko
./reghack.mips.elf /lib/modules/*/cfg80211.ko

How we can mod this file
for unlocking channel 14 and more ?

Some info:

1 Posts
This same model of router and to me it seems blocked didn 't understand this about the TFTP server pumpkin ... that you need to install something on your computer.
I also want to upgrade the firmware and it looks like I messed up. I'm sending a link page to see if it is the right upgrade was or not. I took it from the official site Buffalo.technology.com
Now the router is no longer able to log in with the IP
It said that was successfully updated firmware but now only light all LEDs on the router and can not access it to adjust it.
The CMD laptop see default gateway address and ......
When I type in the broswer IP will not open the page .... I happen sometimes offer authentication but when you type in your username and password can not find in the window but do not write that page tells dd-wrt than Air Station.
I'm not sure whether it is blocked by the router but it seems to me that is so I threw it as your example.
I would ask you if you can help and see this zip The file you send to see if you know whether it was appropriate. Otherwise I unpacked before I upgraded the firmware.
More to mention only the fact that when the upgrade is completed open the MSN site instead of buffalo dd-wrt.
I immediately suspected that something was wrong and unfortunately it turned out that way.
The router has worked flawlessly, but now will not.
Thank you in advance for your reply ... best regards ....

WZR-HP-G450H_userF-1.86 (zip file)

1 Posts
have bricked my router while i was writing mtd.
now i found this solution and bought one of the rs232 converters.
hm what shall i say, terminal seems to be ****ed up. nothing happens on the console. its not the converter. i tried it on my old wrt54g with serial extension. it works like a charme on this box.

is there any way to get wzr working again?

2 Posts
I can't do it again a second time. I ruined this ******* open-wrt again.
But I can’t flash it again, constantly and under any circumstances there is no ping to With no other computers too, macs and PC.
I see that there is a connection, the LEDs light green when connected and I see the connection in Windows and MacOS, but there is no ping. Never.
What kind of ram in buffalo did all this come up with?
I see the opportunity in U-BOOT to flash through the serial, but how to do this in practice, I can not imagine.
1 - 11 of 11 Posts