# [Guide] Recovering a bricked Buffalo Airstation N450 Router (WZR-HP-G450H)



## jvjessen

Step 2 - Opening the router:

Warning: Opening it will of course void any warranty

(Sorry for poor quality pictures, shot them with mobile)

There are 4 screws, but they are seated really deep and got some weird safety head on them:



Took some time, but it is possible to unscrew them if you can find a small screwdriver that kindof fits, this is the one I used:



Alternatively you could drill the heads off with a sharp 4-5 mm drill, just be really careful. (you don't really need the screws really, it just clicks back together, I guess the screws are mostly there to prevent people from opening it







)

It's open:


----------



## jvjessen

Step 3 - Connecting the serial port.

I use one of these little USB to Serial TTL level things, I had one already I've used for other projects in the past:



If you use this or a similar device, you just need to hook up 3 wires (GND, RXD and TXD)

I do this so I can talk to the U-Boot in the router from Putty.

This is where you should connect it:



GND connects to PCB GND
RXD connects to PCB TXD
TXD connects to PCB RXD

I just use a small pin header,



Then hold it in place with a bit of pressure using some tape: (too lazy to solder it in place, it's just temporarily needed)



Now it's time to run Putty and see if we can talk to the router.

Find out what COM port your serial is on (Win7 - Device Manager/Ports will show the COM ports available)

Configure putty to serial 115200, 8, N, 1:





Start the session (Click Open in Putty)

Connect power to the router and if you've got everything connected and done right, you will see this (in Putty window)



Start pressing CTRL-C continuously until you get the U-boot prompt:


----------



## jvjessen

Step 4 - Configure network between PC and Router

In Putty type: *printenv* and hit enter:



This will show the u-boot router configuration:



Write down ethaddr and serverip, need those for later.

Plug in a piece of patch cable between the router and your PC, use this port on the router (others might work, but just use this one)



Then configure your PC's network adapter to the server ip from earlier:



Open a CMD prompt as administrator and run these commands:

*route print*



Find your network lan adapter in the list and take note of the number in front, in mine the ID number is 17

Then run:

*netsh interface ipv4 add neighbors 17 192.168.11.1 02-aa-bb-cc-dd-23* (with the correct values)

and

*arp -s 192.168.11.1 02-aa-bb-cc-dd-23* (again with the correct values from u-boot)



This will associate the u-boot MAC address with the ip address so we can contact it.

One more detail I found is that this switch must be in the position shown here:



Back to putty and try see if we can ping the PC from the router:

in the ar7240> prompt write:

ping 192.168.11.2



If you get the host ... is alive, everything is good, if not, re-check the configuration, disable firewall virus scanners etc and try again.


----------



## jvjessen

Step 5 - Uploading the firmware (yeah, almost there)

To upload the firmware we need Pumpkin, make sure it's installed and running.

Configure the download path to somewhere easily accessible and make sure it's running as server:



Open the firmware in the HxD hex editor (see first post):



The firmware must start with 27 05 19 56 if there is anything in front of that sequence, delete it and save the file.

Now copy the modified firmware file to the download path you just configured in Pumpkin (c:\temp), and rename it to something simple, e.g. *firmware.bin*. Make sure you got firewall etc disabled.

Back to putty, type

*tftpboot 81f00000 firmware.bin* (don't get the address wrong, if you manage to delete u-boot you could be in trouble)



then Pumpkin will pop up a dialog asking you to give access to the file:



Once it's done uploading the new firmware, type this command in Putty:

*run u_fw*

it's a macro that will install the new firmware, then you see a lot of output in Putty, just wait for it a few minutes or so.

when it's done, in putty, hit enter and you should see this (haven't tried the suggested drink recipe, but I'm sure it's good with all that alcohol







)



Then go back and re-configure your LAN ip address to 192.168.1.2 (the OpenWrt firmware will give your router the address 192.168.1.1 by default)

Open a browser and point to 192.168.1.1, this will bring up the web UI and you can start configuring. For details go to the OpenWrt website for a quick guide. It's quite easy.



OK, that was a lot of typing, hope someone will benefit from it.

I don't know if the OpenWrt firmware is better or worse than the original, but it works fine for me so far and I don't have to go buy and new router.

Any comments, corrections or questions are most welcome.


----------



## michaeltj

i got same problem whit you:


----------



## unbicker

Great instructions







, Thanks., saved my day
Two remarks:

1. I needed to put a switch in between the Router and my PC. A direct connection did not work.
2. You can install the original encrypted buffalo firmware by decrypting it first. To do so follow these steps (on linux, will probably work on other systems too):

*Decrypt original Buffalo firmware:*

get the files buffalo-enc.c buffalo-lib.c buffalo-lib.h from firmware-mod-kit
Compile: gcc -o buffalo-enc buffalo.c buffalo-enc.c
Get the encrypted, original firmware from the buffalo website
Open the file in a binary editor and remove the first few bytes to just before the second start section
./buffalo-enc -d -i infile.enc -o outfile.bin


----------



## Vlad01

I am sucesfuly uploading OpenWrt firmware to router with *Japan* firmware WZR-HP-G450H,
There was firmware - WZR-HP-G450H Ver.1.86 (R1.13/B1.00) (Japan Interface).
but,
*I am not deleting 4 bytes from firmware OpenWrt!*
Only full firmware.

Then I am *unlocking 12 & 13 channels*,
commands SSH:

cd /tmp
wget http://luci.subsignal.org/~jow/reghack/old/reghack.mips.elf
chmod +x reghack.mips.elf
./reghack.mips.elf /lib/modules/*/ath.ko
./reghack.mips.elf /lib/modules/*/cfg80211.ko
reboot

How we can mod this file
http://luci.subsignal.org/~jow/reghack/old/reghack.mips.elf
for unlocking channel 14 and more ?

Some info:
http://luci.subsignal.org/~jow/reghack/README.txt


----------



## imperator100

Dear
This same model of router and to me it seems blocked didn 't understand this about the TFTP server pumpkin ... that you need to install something on your computer.
I also want to upgrade the firmware and it looks like I messed up. I'm sending a link page to see if it is the right upgrade was or not. I took it from the official site Buffalo.technology.com
Now the router is no longer able to log in with the IP 192.168.11.1
It said that was successfully updated firmware but now only light all LEDs on the router and can not access it to adjust it.
The CMD laptop see default gateway address 192.168.11.1 and 192.168.11.2 ......
When I type in the broswer IP 192.168.11.1 will not open the page .... I happen sometimes offer authentication but when you type in your username and password can not find in the window but do not write that page tells dd-wrt than Air Station.
I'm not sure whether it is blocked by the router but it seems to me that is so I threw it as your example.
I would ask you if you can help and see this zip The file you send to see if you know whether it was appropriate. Otherwise I unpacked before I upgraded the firmware.
More to mention only the fact that when the upgrade is completed open the MSN site instead of buffalo dd-wrt.
I immediately suspected that something was wrong and unfortunately it turned out that way.
The router has worked flawlessly, but now will not.
Thank you in advance for your reply ... best regards ....

WZR-HP-G450H_userF-1.86 (zip file)
http://www.buffalo-technology.com/support/downloads/


----------



## instinctless

hi,
have bricked my router while i was writing mtd.
now i found this solution and bought one of the rs232 converters.
hm what shall i say, terminal seems to be ****ed up. nothing happens on the console. its not the converter. i tried it on my old wrt54g with serial extension. it works like a charme on this box.

is there any way to get wzr working again?


----------



## Vlad01

I can't do it again a second time. I ruined this ******* open-wrt again.
But I can’t flash it again, constantly and under any circumstances there is no ping to 192.168.11.2. With no other computers too, macs and PC.
I see that there is a connection, the LEDs light green when connected and I see the connection in Windows and MacOS, but there is no ping. Never.
What kind of ram in buffalo did all this come up with?
I see the opportunity in U-BOOT to flash through the serial, but how to do this in practice, I can not imagine.


----------

