Buffalo WHR-600D

Post new topic   Reply to topic    DD-WRT Forum Index -> Ralink SoC based Hardware
Goto page Previous  1, 2, 3, 4, 5, 6  Next
Author Message
sergeyuskach
DD-WRT Novice


Joined: 16 Jan 2009
Posts: 1

PostPosted: Fri Nov 21, 2014 14:16    Post subject: whr-600d Reply with quote
I was trying to get dd-wrt form my router WHR-600D
from European site, but I cannot do it there system did not accept my serial # and after I made voice call for the Buffalo support they refuse to help me with it.
Is anyone was able to download and install it in US?
Did it worked, I with I can have dd-wrt on my whr-600d in US. thanks for the help.
Sponsor
realskudd
DD-WRT Novice


Joined: 25 Nov 2014
Posts: 5

PostPosted: Tue Nov 25, 2014 15:56    Post subject: Reply with quote
fedoracooper, I had a similar experience but mine didn't go so well. After flashing the router through the web UI, I got straight into the boot loop.

I ended up wiring up a serial header and running it through my Arduino Uno in tristate mode. I found that I was getting a kernel panic, just as I suspected:

http://www.fpaste.org/153932/41693094/


Because of this, I had no network access to the router, and thus, no TFTP actions worked at all.

I attempted to reboot the router and fiddle with the boot menu options:

Code:

Please choose the operation:

   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.


I only worked with options 2, 3, 4, and the undocumented option 0.

Option 2:
Option 2 gave prompts, asking me what IP I wanted to use for the router and what IP was serving the firmware, and what the firmware filename was. This seemed promising, but in the end I found that it was not working properly:

The MAC address that the router was telling itself to use (shown via the "printenv" command) was 00:AA:BB:CC:DD:10, but what it was registering via ARP was 00:00:AA:BB:CC:DD. I thought this was going to cause a problem, so I set some persistent ARP table entries on my computer, but that didn't help anything.

Wireshark showed the ARP announce and queries as I expected, and it seemed as though things were reporting properly. The TFTP packets were interesting though. The computer would issue the "WRITE" packet, but it would be met with a corrupt response. The router's "READ" packets seemed correct as well, but since they didn't line up with what the computer was sending, they were unmet.

I gave up on TFTP at this point, save for some fiddling with it via Option 4, which I'll get to in a minute.

Option 3:
This is the default option on the router, and it will just boot whatever the "bootcmd" is set to. For me, this was the "tftpboot" command, which apparently failed back to booting a local image. This was where I got stuck in the kernel panic boot loop.

Option 4:
As you'd expect, option 4 gives you a shell to work with. However, you're quite limited here. I'll post a log of the shell help later, but basically you can read memory, load a file in Kermit mode to a specific memory location, or fiddle with the environment variables and persist them.

Option 0:
For the heck of it, I attempted to hit every undocumented integer at the boot menu to see what would happen, starting with 0. This is also where I stopped. Instead of having to manually go into option 4 and use the "loadb" command to load up a file via Kermit mode, this option plopped you at the same options but with a different starting offset. I figured this would be the way to do it, so I forged ahead.

I first tried with the Buffalo factory firmware (whr600d-160), but it didn't work. I got a "Bad magic number,23845C1F" and the boot process stopped. I tried again with the DD-WRT "firmware-us.bin" and had a similar result, but with a different magic number: 90BF8611.

These numbers seem to be coming from a value in the flash though, which tells me that I need to erase the flash. However, the "erase" command doesn't seem to work, even if I use it as the uboot documentation says.
realskudd
DD-WRT Novice


Joined: 25 Nov 2014
Posts: 5

PostPosted: Tue Nov 25, 2014 17:46    Post subject: Reply with quote
So as it turns out, loadb and boot option 0 both attempt to load the file into address 0x80100000, but the kernel is booting from 0xbc050000. Because of this, I've attempted to loadb starting at 0xbc050000 with the Buffalo factory image.

Doing a 'md 0xbc050000' shows the DD-WRT image header presently, so I'm hoping that once this Kermit send finishes I'll see the generic "Linux Kernel Image" starting around 0xbc050050 instead.
realskudd
DD-WRT Novice


Joined: 25 Nov 2014
Posts: 5

PostPosted: Tue Nov 25, 2014 18:45    Post subject: Reply with quote
No dice:

Code:
U-Boot 1.1.3 (Mar 22 2013 - 22:31:55)
MT7620 # md 0xbc050000
bc050000: 1186bf90 11a3a6ff ffffffff ffffffff    ................
bc050010: ffffffff b1a0aaac d2cdc6c9 a8adabad    ................
bc050020: cfcfffff cacdcfff a8beadba b9b6adb2    ................
bc050030: 76ef7748 56190527 10a4e28f 62596d54    Hw.v'..V....TmYb
bc050040: 46a61000 00000080 d08a0080 8bb676b9    ...F.........v..
bc050050: 03020505 572d4444 76205452 4c203432    ....DD-WRT v24 L
bc050060: 78756e69 72654b20 206c656e 67616d49    inux Kernel Imag
bc050070: 00000065 8000006d 308ac000 00000000    e...m......0....
bc050080: 6f000000 a3fffffd 76cd7fb7 71cd50ed    ...o.......v.P.q
bc050090: e86bab79 926d8364 41fd7c4c a61b686f    y.k.d.m.L|.Aoh..
bc0500a0: 7c60aaf0 289315c0 6ea38794 8764a222    ..`|...(...n".d.
bc0500b0: 22e06d41 c98475fa 79b6999b 307e8451    Am.".u.....yQ.~0
bc0500c0: 66e8b710 ef7f22aa e35b7ba0 f06f4c2b    ...f."...{[.+Lo.
bc0500d0: 603b6306 6d83ea3a 36e1f577 24176b0f    .c;`:..mw..6.k.$
bc0500e0: 73c0f305 19e3ab26 4bb835a0 1f0f6e0b    ...s&....5.K.n..
bc0500f0: a8310c43 e7a066fd 2ce0c540 967ffb2d    C.1..f..@..,-...
MT7620 # loadb
## Ready for binary (kermit) download to 0x80100000 at 57600 bps...
## Total Size      = 0x00000000 = 0 Bytes
## Start Addr      = 0x80100000
MT7620 # loadb 0xbc050000<INTERRUPT>
MT7620 # loadb 0xbc050000
## Ready for binary (kermit) download to 0xBC050000 at 57600 bps...
## Total Size      = 0x0053df46 = 5496646 Bytes
## Start Addr      = 0xBC050000
MT7620 # md 0xbc050000
bc050000: 1186bf90 11a3a6ff ffffffff ffffffff    ................
bc050010: ffffffff b1a0aaac d2cdc6c9 a8adabad    ................
bc050020: cfcfffff cacdcfff a8beadba b9b6adb2    ................
bc050030: 76ef7748 56190527 10a4e28f 62596d54    Hw.v'..V....TmYb
bc050040: 46a61000 00000080 d08a0080 8bb676b9    ...F.........v..
bc050050: 03020505 572d4444 76205452 4c203432    ....DD-WRT v24 L
bc050060: 78756e69 72654b20 206c656e 67616d49    inux Kernel Imag
bc050070: 00000065 8000006d 308ac000 00000000    e...m......0....
bc050080: 6f000000 a3fffffd 76cd7fb7 71cd50ed    ...o.......v.P.q
bc050090: e86bab79 926d8364 41fd7c4c a61b686f    y.k.d.m.L|.Aoh..
bc0500a0: 7c60aaf0 289315c0 6ea38794 8764a222    ..`|...(...n".d.
bc0500b0: 22e06d41 c98475fa 79b6999b 307e8451    Am.".u.....yQ.~0
bc0500c0: 66e8b710 ef7f22aa e35b7ba0 f06f4c2b    ...f."...{[.+Lo.
bc0500d0: 603b6306 6d83ea3a 36e1f577 24176b0f    .c;`:..mw..6.k.$
bc0500e0: 73c0f305 19e3ab26 4bb835a0 1f0f6e0b    ...s&....5.K.n..
bc0500f0: a8310c43 e7a066fd 2ce0c540 967ffb2d    C.1..f..@..,-...
MT7620 #
realskudd
DD-WRT Novice


Joined: 25 Nov 2014
Posts: 5

PostPosted: Tue Nov 25, 2014 19:11    Post subject: Reply with quote
Word of advice: Use a well-known TFTP server. The things I was using just weren't doing what was expected. Now though, I'm using TFTPD32 and it's doing exactly what one would expect.

However, I'm still getting "Bad Magic Number" regardless of which image file I use. This tells me that my bootloader is pointing at the wrong start address.
Malachi
DD-WRT Guru


Joined: 17 Jul 2012
Posts: 7209
Location: Columbus, Ohio

PostPosted: Tue Nov 25, 2014 20:04    Post subject: Reply with quote
I may have the unencrypted buffalo factory firmware at home. Magnetron gave it to me.
I've since pitched the router because i couldn't even get serial out put after a case of brain fart.
I am not sure if this is the one.

_________________
I am far from a guru, I'm barely a novice.
realskudd
DD-WRT Novice


Joined: 25 Nov 2014
Posts: 5

PostPosted: Tue Nov 25, 2014 23:19    Post subject: Reply with quote
Nice. I appreciate it.

I did make a huge bit of progress since my last post. Here's what I did:

OpenWRT has a build just for the WHR-600D, so I grabbed it. The openwrt-ramips-mt7620a-whr-600d-squashfs-sysupgrade.bin build to be specific. I put this in my TFTP directory on my computer and rebooted the router. When the boot menu came up, I selected option 2 and pointed everything to this particular image. Once it was done the router rebooted itself and BAM! Right into the OpenWRT build. I did a few tests and verified that it was indeed working, and put the board back in the case and buttoned it all up.

Now, I know that OpenWRT is not DD-WRT, and it's painfully obvious. However, I couldn't get the DD-WRT or factory Buffalo images to work. Everything I tried with them resulted in a "Bad Magic Number" error.

If anyone is in a similar situation, I suggest you do what I did. You'll need the ramips/mt7620a build of OpenWRT.

If any of the DD-WRT guys are watching this, know that there are people who want to use DD-WRT and that I am one of them.
Ielej
DD-WRT Novice


Joined: 14 Nov 2012
Posts: 3

PostPosted: Thu Nov 27, 2014 11:23    Post subject: Reply with quote
dunno it's similar realskudd, but here is how:
brand new whr-600d via WEB UI upgraded to 11-20-2014-r25408, now boot loop - it starts and about after 15 seconds reboot. now what? Crying or Very sad
jspace
DD-WRT Novice


Joined: 02 Feb 2008
Posts: 7

PostPosted: Thu Nov 27, 2014 22:09    Post subject: Unbrick / restore factory firmware on Buffalo WHR-600D Reply with quote
How to unbrick / restore factory firmware on Buffalo WHR-600D using the TTL serial port.
***On next posts you can find also the procedure WITHOUT THE TTL serial connection (17dec2014)***
(WHR-600D factory firmware looks that isn't encrypted)

Procedure rev.1 27nov2014

- Download original factory firmware (for example "whr600d-160").
- Open it with hex editor (I used frhed 1.6.0).
- Delete the first 52 bytes (is the header). After that you'll see that the file will start with this bytes sequence "27 05 19 56".
- Save the edited firmware in the TFTP server folder with a new name (for example "firmware_WHR-600D.ram").
- Set static IP on PC side (like 192.168.11.168) and run TFTP server on that IP.
- Now we are ready to flash the router using the TFTP server and serial terminal.
- Check that the router is off with the mode switch set to "Auto" position, the serial port connected with baud rate 57600, network cable connected.
- From serial terminal, immediately after power on the router, press "2" (is the U-boot option "Load system code then write to Flash via TFTP").
- Then you can read the output text to interact with the upload procedure.
- When the flashing will be completed the router will reboot itself, all leds will come on.
- Set automatic IP on PC side.
- When the power led will stop to blink it's possible to access to the router web interface (192.168.11.1).
- User=admin - password=password
- If everything gone right you should see the factory firmware running.

DONE!

- Now from the web interface is possible also to flash the original "WHR-600D professional firmware (dd-wrt based)"

- If someone want to directly restore the DD-WRT (not pro) using the U-boot (option "2") must use "firmware.uimage" rev.24461 (DD-WRT Path: Downloads›betas›2014›06-23-2014-r24461›buffalo_whr_600d). In this case DO NOT need to edit the firmware file with hex editor.

I hope that this procedure will help you to unbrick and/or restore the desired firmware.


Last edited by jspace on Wed Dec 17, 2014 15:33; edited 2 times in total
Ielej
DD-WRT Novice


Joined: 14 Nov 2012
Posts: 3

PostPosted: Fri Nov 28, 2014 7:47    Post subject: Reply with quote
ty jspace for workaround. I didn't do it (that thing with serial port and opening router case, don't have much knowledge), but managed somehow to boot up router with couple more times plug/unplug power cable.
downloaded 02-04-2014-r23503 firmware and with crossed fingers pressed upgrade button Smile now it's working stable and booting. should I revert default firmware or leave it as is?
jspace
DD-WRT Novice


Joined: 02 Feb 2008
Posts: 7

PostPosted: Fri Nov 28, 2014 9:37    Post subject: Reply with quote
Ielej wrote:
ty jspace for workaround. I didn't do it (that thing with serial port and opening router case, don't have much knowledge), but managed somehow to boot up router with couple more times plug/unplug power cable.
downloaded 02-04-2014-r23503 firmware and with crossed fingers pressed upgrade button Smile now it's working stable and booting. should I revert default firmware or leave it as is?


Thank you Ielej for your feedback!

To flash the firmware using the AOSS button did you set tftp server with IP 192.168.11.168 and firmware file name "firmware_WHR-600D.ram"?
Which "r23503 firmware" file did you use? (uimage / webflash / us jp eu)

Ielej, I think you can leave as is.
Anyway I want to try to do some tests to see if is possible revert to factory firmware using the AOSS button.
Ielej
DD-WRT Novice


Joined: 14 Nov 2012
Posts: 3

PostPosted: Fri Nov 28, 2014 11:08    Post subject: Reply with quote
didn't try tftp, because while reading Your post router booted up normally.
had couple WZR-600DHP2 routers and with no problems installed latest ddwrt firmwares. strange.
won't install ddwrt for now on 600D
taydu
DD-WRT Novice


Joined: 11 Dec 2009
Posts: 8

PostPosted: Mon Dec 01, 2014 3:51    Post subject: Reply with quote
I just flash the latest beta (25408 11/20/2014) and it won't connect with my cable modem.

Anyone know how to get it to connect?
zmcgrew
DD-WRT Novice


Joined: 07 Dec 2014
Posts: 2

PostPosted: Sun Dec 07, 2014 5:34    Post subject: Reply with quote
realskudd wrote:
I ended up wiring up a serial header and running it through my Arduino Uno in tristate mode.


Can you explain this? Apparently my Google-fu isn't as strong as it once was. It seems I simply need to hook a wire from GND to Reset on the Arduino, and then from Pin 0 and Pin 1 to the board in the same configuration as is shown here: http://wiki.openwrt.org/toh/buffalo/wzr-hp-ag300h

In this case, RX (Arduino Pin 0) goes to RX, and TX (Arduino Pin 1) goes to TX on the WHR-600D board.

Did I miss something, or am I just not getting a good connection?

Also, I assume the serial port settings are 115200, 8N1?

Thanks for the help guys. I've never had this much trouble installing DD-WRT before, and haven't actually had to hook a serial console up to a router since about 2006/2007! I guess I got lucky with the last couple of routers I bought. =)
templeofdoom
DD-WRT Novice


Joined: 10 Dec 2014
Posts: 4

PostPosted: Wed Dec 10, 2014 22:04    Post subject: Serial terminal Reply with quote
OK, so is the Arduino required to get a serial terminal to the router on the header pins?

What role does that serve over a standard serial cable hacked to the pins on the router?

What is tristate mode?

I have a serial connection to the router with TX RX and Ground, but I get only garbage out of the router.

VT100, 57600 8/N/1
Changes to the baud rate get essentially the same.

Thanks!
Goto page Previous  1, 2, 3, 4, 5, 6  Next Display posts from previous:    Page 2 of 6
Post new topic   Reply to topic    DD-WRT Forum Index -> Ralink SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum