Anybody up to help a fellow firmware tester stuck?
What you need....
1) Pumpkin.exe and PuTTY.exe
2) a ddwrt firmware of your choice. Use an older already tested firmware to start with.
3) TTL USB cable
4) this is the tricky part, an open router to get to the serial port.
Now try this.....
1) get the size of the fw. you choose to use by right clicking the fw. and clicking properties then write down the size on disk as you see it omitting the commas and spaces
2) Put that number in this code
flash -noheader -size=PUT FW. NUMBER HERE 192.168.11.2:webflash.bin nflash1.trx
3) rename the fw. you chose to webflash so that it looks like webflash.bin and put it in a folder on your desktop
4) install Pumpkin and then open it and click on the options and link the TFTP root directory to the folder on your desktop that you placed the fw. in, then click ok.
5) connect to a lan port on the router and set the ipv4 static address as 192.168.11.2 then Subnet as 255.255.255.0 then default gateway as 192.168.11.1 then DNS as 192.168.11.1
6)go to device manager to check what COM port is being used by the TTL USB when you connect it to your PC then run PuTTY.exe and click on serial for Connection Type on the window that opens then type the COM port to which ever one you are using then change the speed to 115200 then under Category on the left, click on Serial under SSH and change flow control to None then OPEN
7) Assuming you have the TTL cable connected properly to the router, press the AOSS button on the router while pressing the router's power button to power up the router. If Pumpkin asks for the firmware.ram just ignore it and then at CFE press ctrl & C, once you have a successful break, type nvram erase then copy and paste the flash -noheader -size=PUT FW. NUMBER HERE 192.168.11.2:webflash.bin nflash1.trx with the proper fw. size in the code and hit enter and Pumpkin should now say that the router is requesting webflash.bin, click accept. If it was successful you should see the ACK moving from 0 to size of the fw. you are using and it will stop when the whole file is installed then the router's logo will/should blink like a police car's lights for a second or two then the router will reboot into the new fw. and you should now have a working router again.
remember to remove the static IPV4 address, remove the TTL USB and connect the router normally.
Posted: Sat May 14, 2016 19:15 Post subject: Buffalo WXR-1900DHP
My router started doing a reboot loop last Sunday. I originally went through the process earlier in this thread of going to OpenWRT then to old DD-WRT to current DD-WRT in February. I have not done anything since nor tried to upgrade DD-WRT. Suddenly last Sunday this problem started. I went ahead to go through the whole reflash process again. I can get OpenWRT to install and come up fine. However whenever I try to do the upgrade to DD-WRT whether using the old version of DD-WRT or a current version it always goes back to the constant rebooting. I am assuming there is possibly some type of hardware problem, but the weird thing is that OpenWRT does not seem to have a problem at all. I can always get back to OpenWRT by doing the CFE TFTP of the OpenWRT trx file.
After flashing to DD-WRT I am seeing the below as part of the booting process. Any assistance would be appreciated.
Available 7 bytes at (off,len):
(1,1) (16,2) (32,2) (48,2) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0)
Scanning device for bad blocks
Bad eraseblock 65 at 0x000000820000
Bad eraseblock 93 at 0x000000ba0000
Bad eraseblock 202 at 0x000001940000
Bad eraseblock 224 at 0x000001c00000
Bad eraseblock 243 at 0x000001e60000
Bad eraseblock 674 at 0x000005440000
Bad eraseblock 748 at 0x000005d80000
Bad eraseblock 753 at 0x000005e20000
Bad eraseblock 834 at 0x000006840000
Options: NO_SUBPAGE_WRITE,
Buffalo WXR-1900DHP dualboot part
Creating 1 MTD partitions on "brcmnand":
0x000006000000-0x000007f00000 : "ddwrt"
blk_update_request: I/O error, dev mtdblock2, sector 0
SQUASHFS error: sb_bread failed reading block 0x0
VFS: Cannot open root device "1f02" or unknown-block(31,2): error -19
Please append a correct "root=" boot option; here are the available partitions:
0100 4096 ram0 (driver?)
0101 4096 ram1 (driver?)
0102 4096 ram2 (driver?)
0103 4096 ram3 (driver?)
0104 4096 ram4 (driver?)
0105 4096 ram5 (driver?)
0106 4096 ram6 (driver?)
0107 4096 ram7 (driver?)
0108 4096 ram8 (driver?)
0109 4096 ram9 (driver?)
010a 4096 ram10 (driver?)
010b 4096 ram11 (driver?)
010c 4096 ram12 (driver?)
010d 4096 ram13 (driver?)
010e 4096 ram14 (driver?)
010f 4096 ram15 (driver?)
1f00 1024 mtdblock0 (driver?)
1f01 960 mtdblock1 (driver?)
1f03 64 mtdblock3 (driver?)
1f04 64 mtdblock4 (driver?)
1f05 131072 mtdblock5 (driver?)
1f06 31744 mtdblock6 (driver?)
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)
CPU0: stopping
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.10-rc1 #786
Hardware name: Northstar Prototype
Backtrace:
Function entered at [<c001b03c>] from [<c001b204>]
r7:c0421f20 r6:60000193 r5:c0440e9c r4:00000000
Function entered at [<c001b1ec>] from [<c015d8e0>]
Function entered at [<c015d84c>] from [<c001cdbc>]
r7:c0421f20 r6:00000000 r5:00000000 r4:c045316c
Function entered at [<c001ccac>] from [<c0009388>]
r7:f0100100 r6:c0421f20 r5:f010010c r4:c042fb18
Function entered at [<c0009314>] from [<c0009e80>]
Exception stack(0xc0421f20 to 0xc0421f68)
1f20: c6bd4248 00000000 0000064e c000a9a0 c0420000 c042f8e0 c0366974 c041b224
1f40: c0421f90 c03f28c8 00000000 c0421f7c c0421f80 c0421f70 c0018d44 c0018d48
1f60: 60000013 ffffffff
r9:c03f28c8 r8:c0421f90 r7:c0421f54 r6:ffffffff r5:60000013 r4:c0018d48
Function entered at [<c0018d0c>] from [<c006a318>]
Function entered at [<c006a2e8>] from [<c006a424>]
Function entered at [<c006a31c>] from [<c0012a84>]
r7:c0453014 r4:00000000
Function entered at [<c0012a04>] from [<c03cac40>]
Function entered at [<c03ca928>] from [<0000807c>]
r9:413fc090 r8:0000406a r7:c0435dd4 r6:c03f28c4 r5:c042f860 r4:c0453120
Rebooting in 10 seconds..D
I got something similar when i put OpenWRT and flashed back to ddwrt on my 1750dhpd and my way to fix it was to press the reset button on the router then, while still pressing the reset button, press the power on/off button on the router then press the router's power button to power on the router then i stopped pressing the reset button and let the router reboot.
You can aslo try to use the USB TTL serial cable and press control and C to get a break in the CFE then put nvram erase then go and see if the boot loop gets fixed.
When you did the nvram erase did you see the CFE produce this >0 if yes then i feel you need to use make the router request a fw from pumpkin via the flash -noheader command which looks like this, flash -noheader -size=21381120 192.168.11.2:webflash.bin nflash1.trx where the size = the size of the firmware you are using to flash the router and the 192.168.11.2 is the address you use for the Internet Protocol Version 4 (TCP/IPv4) properties...i am going to assume you don't know what i am saying so let me explain this with the attachment.
You will need to rename the fw to webflash.bin then place it in pumpkin's root directory, connect to the router's LAN port not the wan port to a PC and the USB TTL cable to the PC, then after you run the erase nvram and get the >0 you then have to place the flash -noheader -size=21381120 192.168.11.2:webflash.bin nflash1.trx code in the CFE then hit enter.
If you did it correctly the router should accept the flash then you go into the web gui and flash another fw via the web gui and you should be good.
Brimmy, I am sorry I think you maybe confusing what I am saying. I had previously gotten DD-WRT up and working on this router in February following the instructions from stealthdave on page 5 of this thread. My router worked fine for about 3 months. Then last week it stopped working. I then proceeded to try going through the whole process again which basically involves the steps you just described. The problem is the router never seems to like the dd-wrt firmware, it always fails with the errors I posted then goes into the bootloop. I have tried several different versions of the firmware, including kong builds, and even Buffalo stock firmware. The only firmware it likes is OpenWRT. Can you tell me why I am getting the various errors with DD-WRT firmware that I posted? Thanks.
It could be that you have not managed to clear the nvram properly/clearly. Also, are you sure you have downloaded and installed the correct DDWRT fw for your router?
I too was getting this issue with my wzr-1750dhp coming from the 2.27 buffalo fw and the only thing that has managed to stop it for me is to properly clear the nvram then reflah with a BS ddwrt fw then reflash again with another BS ddwrt fw through the web gui, then and only then is everything safe/working. I don't feel it is a hardware issue i feel it was the 2.27 and later fw that creates the issue, why i don't know. The thing about the >0 in the CFE is to make sure you have cleared the nvram totally. Another thing i have noticed is the router asks for a firmware.ram disk if you power on the router while pressing the AOSS button and no one seems to know what or where to get that ram disk from but i did use that method to be able to get to clear my nvram in the CFE.
Regarding the OpenWRT fw, i too installed that and got the reboot loop when i tried to reinstall a ddwrt fw but this only happened on my wzr-1750dhp, the 1750dhpd had no issue going from ddwrt to OpenWRT and back to ddwrt.
Hope i have not confused you or anyone else, I was just sharing how i overcome this reboot loop crap.
Does anyone have any other ideas? The nvram does seem to accept the clear, not sure how to validate, and nvram still has all the values. If it is not clearing properly what can be done to force it to?
Thanks
I think a lot of people tried to type that very long commands. Here is what I did.
flash -noheader : nflash1.trx
Dont hit Enter yet, open ur Pumpkin hit Put File, locate the file, input Remote Host 192.168.11.1 and leave it there, dont hit Ok yet.
Now go back to your serial console hit Enter then switch to Pumpkin, hit Ok
flash -noheader : nflash1.trx_recover
Dont hit Enter yet, open ur Pumpkin hit Put File, locate the file, input Remote Host 192.168.11.1 and leave it there, dont hit enter yet.
Now go back to your serial console hit Enter then switch to Pumpkin, hit Ok.
Issue following commands:
nvram erase
flash -erase nflash1.brcmnand
reboot
After u issue those above commands, im sure any settings of previous firmware will be gone for good.
Just to make things clear, before installing any new firmware. I often issue these commands:
flash -erase nflash1.trx
flash -erase nflash1.trx_recover
The problem I am having now: No reset button with any firmware including Kong firmware. The latest Kong firmware is so broken with 1900dhp eventhough it looks just fine then the next few seconds, wifi just keep dropping then comeback then repeat
Im looking for a way to revert it back to factory build. Original firmware seems being encrypted. I tried to decrypt it but failed with openwrt 15.05 firmware-utils tools. Any suggestions, im all ears!
PS: You dont need to set DNS. all u need is your IP 192.168.11.2, subnet mask 255.255.255.0, gateway 192.168.11.1
DNS is domain name server for internet browsing
I've been running this build since it released:
DD-WRT v3.0-r29440M kongac (c) 2016 NewMedia-NET GmbH
Release: 04/19/16
root@WXR-1900DHP:~# uname -a
Linux WXR-1900DHP 3.10.101 #135 SMP Thu Apr 14 23:42:14 CEST 2016 armv7l DD-WRT
the only issue I have with it is some log spam (once about every 4 minutes):
Jun 1 01:07:31 WXR-1900DHP user.warn igmpproxy[3835]: MRT_DEL_MFC; Errno(2): No such file or directory _________________ Routers:
WXR-1900DHP - Active (main) - v3.0-r36070M kongac (05/31/18 )
WZR-N600DHP - Wired AP - v3.0-r33679 BS (11/04/17)
WNDR-3400 - retired to its box for several years
29850 or 29875 something. I installed NXT firmware so I dont remember correctly what it was. But surely it was the one released in May. Not the latest one in Jun.
29850 or 29875 something. I installed NXT firmware so I dont remember correctly what it was. But surely it was the one released in May. Not the latest one in Jun.
How do you revert back to DD-WRT NXT after install this DD-WRT version?
Posted: Thu Dec 01, 2016 12:34 Post subject: Flash wrx-1900 dhp router
Been working the past couple of days after work trying to install DD-wrt on my Buffalo WXR-1900DHPD router. I upgrade to the latest version 1.3.4. I followed the instruction from the thread but getting an error Command Status 21. Here are the steps I followed.
USB-TTY Serial adapter
STEP 1 - OPEN THE ROUTER
STEP 2 - SERIAL CONNECTION
Connect the leads from the USB-TTY Serial adapter to the 4-pin
Connect the USB cable to your computer. Install any necessary hardware drivers for the serial cable. (Links below)
Run a terminal program like PuTTY for Windows or screen for *NIX systems and connect to your serial port.
TURN ON YOUR ROUTER!
Able to see the boot process happening on putty
STEP 3 - DOWNLOAD FIRMWARE AND INSTALL TFTP SERVER
Install a TFTP server on your computer
Open TFTP Server (Win)
Download OpenWRT firmware and copy it to your TFTP server folder. Rename it to openwrt.trx for convenience.
Download an old version of DD-WRT (factory-to-dd-wrt.bin) and copy it to your TFTP server folder. Rename it to firmware.ram for convenience.
STEP 4 - INSTALL OPENWRT FIRMWARE VIA CFE
Connect your computer's ethernet to one of the router's LAN ports.
MANUALLY set your computer's IP address to 192.168.11.2! (I was unable to get a DHCP address, but manually setting the address worked for me.)
With the serial cable connected and the terminal app from Step 2 running, start (or restart) your router.
As soon as you turn it on, start pressing CTRL-C until you get the CFE> prompt.
Code:
CFE> flash -noheader 192.168.11.2:firmware_.ram nflash1.trx
Reading 192.168.11.2:firmware_.ram: Failed:Timeout Occurred Command Status 21.
First time to try flash a router and not sure what I am doing wrong.. I think it's not seeing the firmware_.ram file but don't known enough of about Linux to tell. Help please...
--
Pastor Mike Ingle
Healing the Nations Church
7665 Hwy 78
Dora, Alabama
Posted: Wed Jan 25, 2017 15:37 Post subject: Re: Flash wrx-1900 dhp router
I am follow page 5 step to upgrade to DDWRT firmware and work well over 2 months.
yesterday, I disconnect WAN port and the router going to bootloop.
I try to re-flash again follow the steps. seems the the problem is same as below log
the system crash and always reboot after 10 sec at last line.
How to fix my problem? somebody can help me, thank you.
Rebooting in 10 seconds..Digital core power voltage set to 1.0V
c_ddr_init: sdram_config=0x014b sdram_ncdl=0x00000320 sdram_refresh=0x0000081c
BUFFALO CFE Version 1.00 [DDRCLK:400]
Decompressing...Decompressing...done
Found a ST compatible (Marconix) serial flash with 16 64KB blocks; total size 1MB
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.14.62 (r437318)
================================================================================
tmpr current 70 (274)
tmpr normal_thresh=98 bootable_thresh=115
current 70 < thresh 116, booting FW...
================================================================================
DDR clock change and Calibrate... [400->800]
Digital core power voltage set to 1.0V
c_ddr_init: sdram_config=0x014b sdram_ncdl=0x00000320 sdram_refresh=0x0000081c
BUFFALO CFE Version 1.00 [DDRCLK:800]
Memory Test start(0x07E00000) end(0x08000000) size(2097152)
Data line test start:0x07e00000 pattern 0x00000001 0x00000003 0x00000007 0x0000000F 0x00000005 0x00000015 0x00000055 0xAAAAAAAA
Address line test start:0x07e00000 len:0x200000 pattern 0xAAAAAAAA 0x55555555
Fill test patnum:2
fill Pattern 5555AAAA Writing... Reading...
fill Pattern AAAA5555 Writing... Reading...
Decompressing...Decompressing...done
Found a ST compatible (Marconix) serial flash with 16 64KB blocks; total size 1MB
CFE version 6.37.14.62 (r437318) based on BBP 1.0.37 for BCM947XX (32bit,SP,)
Build Date: Tue Sep 2 09:23:49 JST 2014 (root@fc17.localdomain)
Copyright (C) 2000-2008 Broadcom Corporation.
Memory Test start(0x00000000) end(0x07E00000) size(132120576)
Data line test start:0x00000000 pattern 0x00000001 0x00000003 0x00000007 0x0000000F 0x00000005 0x00000015 0x00000055 0xAAAAAAAA
Address line test start:0x00000000 len:0x7e00000 pattern 0xAAAAAAAA 0x55555555
Fill test patnum:2
fill Pattern 5555AAAA Writing... Reading...
fill Pattern AAAA5555 Writing... Reading...
Memory Test start(0x88000000) end(0xA0000000) size(402653184)
Data line test start:0x88000000 pattern 0x00000001 0x00000003 0x00000007 0x0000000F 0x00000005 0x00000015 0x00000055 0xAAAAAAAA
Address line test start:0x88000000 len:0x18000000 pattern 0xAAAAAAAA 0x55555555
Fill test patnum:2
fill Pattern 5555AAAA Writing... Reading...
fill Pattern AAAA5555 Writing... Reading...
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found a Mxic NAND flash:
Total size: 128MB
Block size: 128KB
Page Size: 2048B
OOB Size: 64B
Sector size: 512B
Spare size: 16B
ECC level: 8 (8-bit)
Device ID: 0xc2 0xf1 0x80 0x1d 0xc2 0xf1
DDR Clock: 800 MHz
Info: DDR frequency set from clkfreq=1000,*800*
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.14.62 (r437318)
CPU type 0x0: 1000MHz
Tot mem: 524288 KBytes
remember to remove the static IPV4 address, remove the TTL USB and connect the router normally.
