Posted: Sat Feb 23, 2013 9:05 Post subject: WZR-D1800 De-Bricking Thread
I need some help. I think I bricked my WZR-D1800H. after the DD-WRT firmware was loaded. The Buffalo logo turned white, and the two flashing icons was flash red. It was doing that for 10mins... so I did a 30/30/30 reset thinking it was done.
so now I have a solid Buffalo RED LED logo. I am assuming that means it's bricked.
I tried this method....but it can't tftp.
Does the WZR-D1800H have a special MAC address to tftp the original firmware?
Joined: 21 Nov 2010 Posts: 278 Location: North America
Posted: Sat Feb 23, 2013 14:09 Post subject:
mbze430 wrote:
I need some help. I think I bricked my WZR-D1800H. after the DD-WRT firmware was loaded. The Buffalo logo turned white, and the two flashing icons was flash red. It was doing that for 10mins... so I did a 30/30/30 reset thinking it was done.
so now I have a solid Buffalo RED LED logo. I am assuming that means it's bricked.
I tried this method....but it can't tftp.
Does the WZR-D1800H have a special MAC address to tftp the original firmware?
The LED pattern seems to indicate a successful upgrade. The bottom orange LED normally turns blue when the WAN port is connected to the Internet.
The router is probably 'soft' bricked. What firmware was on the router before flashing and which firmware did you flash ??
I'm not aware of any special MAC addresses for flashing on the WZR-D1800H.
Do you have access to the serial console port on the inside ??
I need some help. I think I bricked my WZR-D1800H. after the DD-WRT firmware was loaded. The Buffalo logo turned white, and the two flashing icons was flash red. It was doing that for 10mins... so I did a 30/30/30 reset thinking it was done.
so now I have a solid Buffalo RED LED logo. I am assuming that means it's bricked.
I tried this method....but it can't tftp.
Does the WZR-D1800H have a special MAC address to tftp the original firmware?
The LED pattern seems to indicate a successful upgrade. The bottom orange LED normally turns blue when the WAN port is connected to the Internet.
The router is probably 'soft' bricked. What firmware was on the router before flashing and which firmware did you flash ??
I'm not aware of any special MAC addresses for flashing on the WZR-D1800H.
Do you have access to the serial console port on the inside ??
- Magnetron1.1
For whatever it's worth, I had a similar issue a few days ago but it only appeared after I cycled power when trying to clean up wiring. I had done soft reboots and reset defaults several times on the recent firmwares and had no problems until I removed power. Not sure which fw I was on at the time, I think 20740.
I assumed it had bricked and I would need to tftp but couldn't ping. Eventually just through trial and error and some combination of button pressing I got it running again, I think the key was the reset button underneath. I'm sure there is a method to it but I don't know exactly how or what timing solved it, I just know it's working fine now and I don't plan to power it down again anytime soon.
Also if you read this BrainSlayer, thanks for continuing to work on this. An update from my earlier MAC comment, now with 20740 LAN/WAN/WL0 are :07, :06 and :07; :05 is gone entirely (in 20718 LAN/WAN/WL0 were all :05, in 19364 they were :05, :06 and :07); WL1 has not changed in any build. Don't know if this is expected behavior or not but just wanted to pass that along. I haven't had time to play with this build but much it seems stable so far. Danke!
So i tried to TFTP the Buffalo firmware and failed, LED was solid red.
I figured I'll go to the living room and continue trying since the router is in my son's room.
So after a minute or two, I plug the router back in, and lo and behold, the LED is white!
No clue wtf, but I'm up and running!
Router Name DD-WRT
Router Model Buffalo WZR-D1800H
Firmware Version DD-WRT v24-sp2 (02/20/13) giga - build 20740
Kernel Version Linux 3.8.0 #7 Wed Feb 20 17:00:51 CET 2013 mips
Static DHCP stoped working. Tried to enter everything one more time, it didn't work.
So I thought I need to go back, deleted all changes on various sub-pages using "Save" button, and when finally I...
Rebooted
So...
When I power on router I have quick blink of all lights including White Buffalo, then red Buffalo takes over. But - every 15 seconds again all lights including white Buffalo.
30/30/30 Reset does not work
Tried TFTP - no success - on the other hand file is almost 18MB
When I am pinging router my answer is Request timed out, but just after powering on I have Destination host unreachable.
What else I can do?
*** EDIT #1 ***
Just few seconds ago I got 5 ping reply from router with TTL=100
*** EDIT #2 ***
It only works when there is white Buffalo sign and AOSS button is pressed
*** EDIT #3 ***
It seems like device reboots every 15-20 seconds (that's why there is white buffalo sign), and when AOSS button is pressed ping replies. Trying with TFTP without luck. Any suggestions?
Static DHCP stoped working. Tried to enter everything one more time, it didn't work.
So I thought I need to go back, deleted all changes on various sub-pages using "Save" button, and when finally I...
Rebooted
So...
When I power on router I have quick blink of all lights including White Buffalo, then red Buffalo takes over. But - every 15 seconds again all lights including white Buffalo.
30/30/30 Reset does not work
Tried TFTP - no success - on the other hand file is almost 18MB
When I am pinging router my answer is Request timed out, but just after powering on I have Destination host unreachable.
What else I can do?
*** EDIT #1 ***
Just few seconds ago I got 5 ping reply from router with TTL=100
*** EDIT #2 ***
It only works when there is white Buffalo sign and AOSS button is pressed
*** EDIT #3 ***
It seems like device reboots every 15-20 seconds (that's why there is white buffalo sign), and when AOSS button is pressed ping replies. Trying with TFTP without luck. Any suggestions?
I've had that happen after trying the 30/30/30 on one of these. Somehow the NVRAM gets corrupted and causes the reboot loop. You'll need to open it up, connect to the serial header pins and erase the area of the flash that stores the settings... Sorry I can't help further as my memory isn't the greatest.
Posted: Sat Jun 01, 2013 4:38 Post subject: Need firmware.ram image for wzr-d1800h recovery
I too bricked my wzr-d1800h and I can get it to respond to ping while pressing AOSS button while it boots up. It will look for a file called firmware.ram from IP address 192.168.11.2, but every firmware image I have tried is unsuccessful. The router just goes into reboot loop again. Does anyone have any ideas on this?
Ok, so I bricked my router and I would really appreciate some help if anyone has it.
I hooked up to the serial port and tried to flash it, but so far I haven't been able to get it to work.
I've been flashing nflash1.trx since that looked like the device it is trying to boot from.
I have tried both ddwrt flash files as well as the wzrd1800h-191 firmware from buffalo.
Any suggestions would be much appreciated!!
Here is my serial log:
Code:
BUFFALO CFE Version 1.04
Memory Test start(0xA0100000) end(0xA8000000) size(33292288)
Data line test start:0xa0100000 pattern 0x00000001 0x00000003 0x00000007 0x0000000F 0x00 000005 0x00000015 0x00000055 0xAAAAAAAA
Address line test start:0xa0100000 len:0x7f00000 pattern 0xAAAAAAAA 0x55555555
Fill test patnum:2
fill Pattern 5555AAAA Writing... Reading...
fill Pattern AAAA5555 Writing... Reading...
Decompressing...done
CFE version 6.30.15.3 (r315282) based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Tue Apr 24 09:04:01 JST 2012 (root@fc15.localdomain)
Copyright (C) 2000-2008 Broadcom Corporation.
Init Arena
Initializing PCI. [normal]
PCI bus 0 slot 0/0: vendor 0x14e4 product 0x0800 (flash memory, rev 0x01)
PCI bus 0 slot 1/0: vendor 0x14e4 product 0x4715 (ethernet network, rev 0x01)
PCI bus 0 slot 4/0: vendor 0x14e4 product 0x471a (USB serial bus, interface 0x10, rev 0x 01)
PCI bus 0 slot 4/1: vendor 0x14e4 product 0x471a (USB serial bus, interface 0x20, rev 0x 01)
PCI bus 0 slot 5/0: vendor 0x14e4 product 0x0820 (PCI bridge, rev 0x01)
PCI bus 0 slot 6/0: vendor 0x14e4 product 0x0820 (PCI bridge, rev 0x01)
PCI bus 0 slot 7/0: vendor 0x14e4 product 0x052e (undefined subclass 0xff, interface 0xf f, rev 0x01)
PCI bus 0 slot 8/0: vendor 0x14e4 product 0x080e (RAM memory, rev 0x01)
PCI bus 0 slot 9/0: vendor 0x14e4 product 0x0534 (undefined subclass 0xff, interface 0xf f, rev 0x01)
Init Devs.
Boot partition size = 262144(0x40000)
Found an ST compatible serial flash with 8 64KB blocks; total size 0MB
Found a Samsung (1 bit-cell) NAND flash with 2048B pages or 128KB blocks; total size 128 MB
bcm_robo_enable_switch: EEE is disabled
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.30.15.3 (r315282)
CPU type 0x19749: 600MHz
Tot mem: 131072 KBytes
Joined: 21 Nov 2010 Posts: 278 Location: North America
Posted: Sun Jun 02, 2013 1:21 Post subject:
fbvolpb89 wrote:
CFE> flash -noheader : nflash1.trx
Reading :: Done. 25620788 bytes read
Programming...done. 25620788 bytes written
*** command status = 0
CFE> go
check_trx: start nflash1.trx
Invalid boot block on disk
check_trx: exit nflash1.trx
fw is broken
blinking led 2
break key pressed!!
*** command status = -31
CFE>
CFE> flash -noheader : nflash1.trx<== Correct syntax.
Reading :: Done. 25620788 bytes read <== Wrong firmware.
Programming...done. 25620788 bytes written
*** command status = 0
CFE> go
check_trx: start nflash1.trx
Invalid boot block on disk
check_trx: exit nflash1.trx
fw is broken <== You flashed wzrd1800h-191 f/w which is encrypted. TheCFEcan't unpack encrypted firmwares. Use WZR-D1800H_MULTI.trx build 21286. Don't use WZR-D1800H_MULTI.bin as it is also encrypted.
PuTTY Log of successful flash session:
CFE> flash -noheader : nflash1.trx
Reading :: Done. 18444288 bytes read
Programming...done. 18444288 bytes written
*** command status = 0
CFE> go
check_trx: start nflash1.trx
check_trx: exit nflash1.trx
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: Failed.
Could not load :: Timeout occured
Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
Loading: .. 1312820 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00019749 (MIPS 74Kc)
Found an ST compatible serial flash with 8 64KB blocks; total size 0MB
found nvram at 50000
map cfe nvram at 78000
End of Putty Log of successful flash session
CFE> flash -noheader : nflash1.trx
Reading :: Done. 25620788 bytes read
Programming...done. 25620788 bytes written
*** command status = 0
CFE> go
check_trx: start nflash1.trx
Invalid boot block on disk
check_trx: exit nflash1.trx
fw is broken
blinking led 2
break key pressed!!
*** command status = -31
CFE>
CFE> flash -noheader : nflash1.trx<== Correct syntax.
Reading :: Done. 25620788 bytes read <== Wrong firmware.
Programming...done. 25620788 bytes written
*** command status = 0
CFE> go
check_trx: start nflash1.trx
Invalid boot block on disk
check_trx: exit nflash1.trx
fw is broken <== You flashed wzrd1800h-191 f/w which is encrypted. TheCFEcan't unpack encrypted firmwares. Use WZR-D1800H_MULTI.trx build 21286. Don't use WZR-D1800H_MULTI.bin as it is also encrypted.
PuTTY Log of successful flash session:
CFE> flash -noheader : nflash1.trx
Reading :: Done. 18444288 bytes read
Programming...done. 18444288 bytes written
*** command status = 0
CFE> go
check_trx: start nflash1.trx
check_trx: exit nflash1.trx
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: Failed.
Could not load :: Timeout occured
Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
Loading: .. 1312820 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00019749 (MIPS 74Kc)
Found an ST compatible serial flash with 8 64KB blocks; total size 0MB
found nvram at 50000
map cfe nvram at 78000
End of Putty Log of successful flash session
- Magnetron1.1
wow, thank you so much. That of course did the trick. I don't know why I didn't realize that.
