It will be a different number if the image size is different. You need that hex number for the copy procedure. VERIFY YOUR IMAGE!
If you see anything other than the above then you either transferred the wrong image or your have not corectly edited the image so that the header starts at the begining of the file. If so, then either transfer the image once more or re-edit an original dd-wrt tftp image file to make this the case, and then perform the tftp transfer once more.
Before we copy, we need to clear the area of flash memory where the firmware is stored. This is done by the following:
The next step is to copy that area of memory to where the default booting firmware is stored. Okay, so, we know we have downloaded the image to memory location 0x81f0000. On this model I have, the stored firmware resides at 0xbe060000. I know this by looking at the u-boot environment variables which we did above by using the “printenv” command. Now we need to copy the tftp’ed image from the temporary area to the permanent firmware area. So, in my case, I need to copy a64000 bytes of memory from temporary ram area 81f0000 to the firmware storage area be060000
And there you have it. You had bricked your Japanese WZR-HP-G300N and now you have managed to install DD-wrt using the tftp image and a few u-boot commands. This procedure will also work for other firmware, like OpenWRT (And it the X-WRT project which makes a web front-end to OpenWRT). I hope this has been helpful!
I don’t know the exact meaning of your question, but I found that magic number mentioned in a dd-wrt post after a google search. Also, hex editors have a search function.
Lastly, I’m pretty sure al firmware images should have this – it’s just that the Buffalo ones are encrypted.
thanks for the guide on this, it may come handy… btw, have you tried changing “region=JP” parameter and checking if it would accept stock english firmware?
Sorry for my slow replies – I’ve been incapacitated due to an abcess and have been in a huge amount of pain for the last few days – this morning’s been the first time I’ve been pain-free so I’m all :D this morning ;)
You can change the region code. I changed it to US in order to try to convince the buffalo firmware to install the US version at one point, and yes it accepted the Bufallo US version, BUT, it semi-bricked the unit in that yes, it would boot up, but the web pages became unavailable – which is why I had to hack deeper into the router and figure out how to get dd-wrt (or even OpenWRT) working on the thing :)
NOTE you only need to connect up GND, TX, and RX – leave the Vcc unconnected – the serial circuitry on board is already powered from the motherboard. On your terminal emulator you’ll need to set it to 115200,8,N,1 with no hardware or software flow control.
Sorry for my slow replies – I’ve been incapacitated due to an abcess and have been in a huge amount of pain for the last few days – this morning’s been the first time I’ve been pain-free so I’m all this morning
You can change the region code. I changed it to US in order to try to convince the buffalo firmware to install the US version at one point, and yes it accepted the buffallo US version, BUT, it semi-bricked the unit in that yes it would boot up but the web pages became unavailable – which is why I had to hack deeper into the router and figure out how to get dd-wrt (or even OpenWRT) working on the thing
NOTE you only need to connect up GND, TX, and RX – leave the Vcc unconnected – the serial circuitry on board is already powered from the motherboartd. On your terminal emulator you’ll need to set it to 115200,8,N,1 with no hardware or software flow control.
I changed region code from JP to EU (or US) and succeed flash to english stock firmware by using the revert firmware EU from BrainSlayer (dd-wrt).
Thanks for the useful info again. I needed this just in case something goes wrong, but fortunately it never did. I got my WZR-HP-G300NH via rakuten, but from cheapest shop for 8.000円, and i think they were selling Taiwanese version of the router, which came preinstalled with english, and with Chinese-style power adapter, strange indeed. I flashed OpenWRT (Kamikaze r19704 built from source) immediately without even being aware of JP version problems, and it worked like charm since first day.
When you were hacking around the insides of the router, did you see if the leads to the wireless antennae were on connectors or soldered to the board?
With the stock “ear/flap” antennae on my WZR-HP-G300NH, my upstairs desktop’s wireless adapter (a D-link DWL-G120) cannot see the network, whereas it can see my old Linksys WAP54G with a $15 set of high-gain antennae attached. If the WZR-HP-G300NH’s antenna leads are on connectors rather than soldered, I was thinking I could mod RP-TNC pigtails in and attach my old antennae. But I’m not willing to void the warranty just to check.
Hi, Yes the antennae are connected via a connector rather than soldered to the board – at least on MY unit anyway. I seem to recall there being pictures of the board some had taken I’m not at home right now but what I”ll do is take some pictures of the motherboard and either make a new post or add them to this one as an update.
Thank you very much for your blog post about WZR-HP-G300N. I’ve read through this blog post few times. Currently, I have an Japanese version of WZR-HP-G300N, it won’t accept the stock US/EU firmware. May I ask your expertise which is the best way that I can have the EU/US stock firmware installed on it? (I really don’t want to go for DD-WRT since it doesn’t have NAS feature and I’m waiting for June 2010 release about Buffalo DD-WRT firmware).
Reply : Hi, thanks… to be honest, I think it’s better to be patient in your case and wait for the new buffalo dd-wrt-based firmware. I tried changing the firmware from .jp to .us and got a semi-bricked WZR (which was the reason I set about hacking it in the first place ;) )
If you look at the article you’ll see the environment variable called region. In the .jp models it’s set to JP , so you would use the setenv command to change that to be US. However, do this at your own risk, and remember to save the changes otherwise after a reboot of the router you will lose them – everything you need to learn about how to do this is in the article :)
I just modified my region=AP to EU since they locked the 3G support in AP region machine. After I changed region code, 3G feature is unlocked.
If your routor is Japanese version, you might need to flash to DDWRT first, and using the revert firmware after the region changed, since there is no multi-language support for Japan domestic version.
Please refre to the post above for the connection cable detail, you can modified from CA-42 or purchase from RS, DigiKey whatever. If your computer is still have the serial port, you can just using 3 wire to connect GND, RX, TX to the routor.
It seems like everything it’s OK with this region change, except the fact that it will not recognize the stock firmwares / upgrade.
Sorry to hear that, as I review my previous post, I forget to mention about the serial to TTL circuit on the serial port connection and such carelessness mis-leaded you to take the action which damage your routor.
Actually the logic high/low definition between serial and TTL are different, thus we need a convertor to transform in between. I am so sorry .
Er, Vuhotang, did you just say you wired straight from your 9-pin serial interface on your PC to the WZR motherboard?
Did you read where I mentioned you need a USB SERIAL< -->TTL Serial cable? The motherboard’s serial interface works at TTL signal levels. You’ve probably done your WZR some damage, unfortunately.
This is the first time I open the router and see its motherboard. I have prepared a DKU-5 cable and known its pinouts (Tx, Rx & GND) but poor me I don’t know how to connect the cable to WZR motherboard in order to console the router. I though it would be like some other router that having some text (Rx, Tx, GND) on the board.
In your very blurry picture “wzr3.jpg”, the serial port is the one called J1 (if I remember correctly).
NOTE you only need to connect up GND, TX, and RX – leave the Vcc unconnected – the serial circuitry on board is already powered from the motherboard.
On your terminal emulator you’ll need to set it to 115200,8,N,1 with no hardware or software flow control.
I got myself Japanese WZR-HP-G300NH, and ran into same problems. Messing a bit with the u-boot console and comparing boot variables with non-Japanese WZR-HP-G300NH, i found out an interesting setting, simply typing:
I have this router and am trying to get it working. (Well actually I ordered the N and it came as an H, I don’t know if that makes it an NH or a different animal.) You site is extremely helpful, but I can7t seem to view the comments. When I click on them at the side I get an empty page.
Checking the DD-wrt forums all the link relating to the files have been removed, and I can’t seem to find the information/firmwares I need to get this router operational. I think the comments here would be extremely helpful. I am using firefox on an Ubuntu laptop. Anything special I need to do to see the comments?
There seemed to be a problem with one of the plugins I was using. Sorry about that – and thanks for pointing it out!
I received my cable yesterday after work and was up to all hours of the night fiddling with it. The pinouts are different than what is here, but I was able to find the right combination (I’ll post it later — at work right now). A nice trick is that the ground on the board will show all other voltages as positive, so once you have the ground figured out then you have a 50/50 chance of getting the TX/RX right (I of course got it wrong…twice ;) )
The big issue is that Uboot seems locked. I tried your procedure and have been totally unable to get the boot sequence to abort. I can TFTP a file over, but it also seems to be ignored. I have been googling like mad but can’t seem to find any information regarding this. I am getting ready to start trying voodoo and was hoping that before that someone will point out something completely obvious that solves the mystery of the locked uboot!
I’m working on the same model router that you have (WZR-HP-AG300H). Can you let me know what pinout connections are working for you with your TTL cable?
However, in my test, the simple “accept_open_rt_fmt” method does not work on u-boot 1.02. I guess it should work in later u-boot (> 1.02 at least).
i have DD-G300 N v2 bricked with DD-WRT V1 now i want to put original firmware i establish connection between router and PC via Serial port i can send fimware using hyper terminal kermit protocol router will receive and store in 0*80f00000 also i can copy it to flash but after booting it says EEprm error and i need to ctrl+c ant suggestion
Thanks for this great article and discussion thread. I too live in Tokyo and am trying to install English language firmware on my Buffalo WZR-HP-AG300H. Per your comment: ” I could by a conveniently available USB to TTL serial cable.”
Where did you find this cable in Tokyo? I live in Roppongi Hills and haven’t had any luck finding a store that carries these.
I’m at work right now so can’t be more specific at that. I’ll try to post a link to the cable as soon as I can.
Thanks for the quick reply Kevin. If you have a chance to post more details, I’d certainly be grateful.
I browsed the RS Components online store and found that they carry several types of USB TTL serial cables, most of which are manufactured by FTDI (in the UK). Their site has a nice page outlining the types of USB TTL serial cables the produce:
As I stated earlier, I’m going through the same process of hacking my Buffalo WZR-HP-AG300H so I can load the dd-wrt firmware and establish a VPN connection to my VPN provider in the US, thereby allowing all devices that connect to the router to appear as if they are coming from the US. This should let me access geo-restricted content on NetFlix, Pandora, HBO GO, Hulu+, etc.
I’m happy to share my findings, successes, and failures along the way with anyone interested, either in this posting or another forum (any suggestions?)
Thanks Kevin, that’s just what I needed to know. Interesting that the RS site sells the “-WE” wire ended version of this cable for 160 yen more than the version with the 6 pin SIL connector.
Wow!!! I have one of those japanese models. I tried to install a EN or EUR firmware and the router just refuse to update, since the firmware wasnt the same region.
Alem, hi again. I did some googling and that cable does seem to be mentioned a few times in relation to this model of router. The datasheet link you provided doesn’t say if it’s a 3.3V TTL-level cable – it’s very important you ensure that is the case, but yes that particular cable type is specifically mentioned, so I assume it would work – I’ve not used it myself though so, just be careful how you hook it up :)
Alem, hi again. I did some googling and that cable does seem to be mentioned a few times in relation to this model of router. The datasheet link you provided doesn’t say if it’s a 3.3V TTL-level cable – it’s very important you ensure that is the case, but yes that particular cable type is specifically mentioned, so I assume it would work – I’ve not used it myself though so, just be careful how you hook it up
I will try to find one of those two cables (the nokia cable is more easy to find and cheaper). 3.3v is really necessary? the motherboard doesnt power on itself using the ac adapter?
3.3V stands for the TTL signal level of the circuitry of the router. The router, of course, should use its AC adapter when you are communicating with it via your cable and the terminal program you are using.
Please remember only to use the Rx, Tx, and GND of your cable. Do not connect any other wires – you could severely damage your router’s motherboard!
If you have a techie friend who’s into electronics I suggest you ask them to connect your cable, if you’re not sure how to do this yourself. You could just be saving yourself from owning an expensive brick :)
Well, I’ll probably have to pay someone to do this, but that was my intention since I dont have any experience in welding things. Thanks
I’ll need to do till the step 3 right? When I use crtl+c, then I use the commands Zgembo says to let it accept any firmware?
Actually you can download a Live CD version of linux which will boot straight off the CD/DVD and you can then use it as normal. Try http://www.ubuntu.com for this. There are also terminal emulators available for Windows though at time of writing I can’t remember their names so search Google for that info.
Great read. How can I load a JP firmware onto a US-bought WZR-HP-G300NH ? Trying to enable ipv6 so I can watch iptv programs and still have internet here in Japan.
thanks for the info. question – using this method for changing country code – can i load original English language firmware to Japanese model?
Unfortunately for me the WCN-HP-GN I purchased here in Shanghai seems to also have a restriction on firmware region. I would love to get dd-wrt on this unit so that I could load an Open VPN package. No need for me to elaborate on the importance of a VPN here.