Posted: Wed Jan 09, 2013 8:18 Post subject: WCR-GN: How To Flash DD-WRT Using Serial Console
Hello Everyone!
I have managed to get the Buffalo WCR-GN flashed with DD-WRT and I'm posting all
of the information here in the hope that it will help others. Also, I'm a long
time user of DD-WRT and I want to give back to the community.
There are other topics in this forum that discuss
details on flashing DD-WRT onto a WCR-GN, but I found
the information fragmented across many posts and topics. Some of the information was wrong. To all
who provided details and information I have used
many thanks!
First, before we proceed:
The instructions below may BRICK YOUR DEVICE. In other words, it may stop doing anything
useful! proceed at your own risk! Please don't blame if things go wrong!
1. INTRODUCTION
I started by asking Buffalo tech support if they could assist me in flashing DD-WRT via
the web interface provided by the firmware that ships with the unit. Below is the exchange
that occurred between the helpful Buffalo tech support person and myself:
Re: [Ticket#2013010210006759] Contact Form: Keith XXXXX
As we do not provide a version of our DD-WRT firmware for this unit, we are unable to
assist with voiding the router's warranty by flashing of our routers to non-Buffalo
DD-WRT. My apologies for any inconvenience this may cause.
Thank you,
Cristen
Buffalo Technical Support <info@buffalotech.com>
Visit The Buffalo Forums - http://forums.buffalotech.com/
Technical support is provided to customers in US and Canada.
Telephone Support: (866) 752-6210
01/02/2013 21:50 - wrote:
Area of Interest: Technical Support
First Name: Keith
Last Name: XXXXXXX
Email: keith@XXXXXXXX
Buffalo Product: Wireless Networking
Operating System: Linux
Connection Type: Wireless
How may we assist you?
I have several Buffalo WCR-GN wireless routers. I wish to install DD-WRT on them
and while there is a DD-WRT build for this router, the router refuses to accept
the update via the Buffalo web interface on the router. Some online have hinted
that the Buffalo firmware that ships with the router requires firmwae updates
to be encrypted. Is this true? Do you have any technical information that would
assist those of us who wish to use DD-WRT on th WCR-GN?
Thanks,
Keith
Keith XXXXXXX <keith@xxxxxxx>
Jan 7 (1 day ago)
to Buffalo
Cristen,
No trouble, I'll just have to do it myself. I am a degreed electrical engineer
who designs computers for a living. I will, of course, post instructions on the net
so others who wish to reprogram their routers can do the same. I'll make sure to
post the data in as many forums as possible, along with your most helpful reply
on this matter.
best regards,
Keith XXXXXX.
Well I am a man of my word, so here we go!
2. HARDWARE
I have attached several photos of the unit in various
stages of disassembly and modification.
3. FLASHING DD-WRT
First I tried flashing DD-WRT using the Buffalo firmware web interface. I could
not get that to work. Searching on the net I found posts from others that speculated
that Buffalo encrypts their fimware somehow and this flashing DD-WRT via the web
interface would not work. There are also posts that mention a serial console
interface and the ability to use the serial interrface to flash DD-WRT via the router's
bootloader. Turn's out that's the way that DD-WRT needs to be flashed the first time.
3.A PREPARE THE ROUTER
In order to access the serial port, you need to take apart the router, locate the
JP1 connector and install pins in order to attach a serial cable. Refer to the attached photos. There
are two screws under the gray rubber feet. Gently
lift the rubber feet and save then to stick on later.
The screws are the Torx style (like that's going to stop anyone). Once you have the screws out, gently pry the case halves apart to access the circuit board.
3.B ATTACHING THE CABLE
Refer to the attached photos to see the JP1 serial
connector pins identified and a photo of the USB
TTL serial connector connected to the WCR-GN.
NOTE: The cable needs to have TTL voltage levels, NOT RS-232 levels!
NOTE: If you have a different cable, you can use a voltmeter to determine which pin
on your serial cable is is the "TX Data" pin. Measure the voltage between the GND pin
of you cable (that's the black wire for my cable) and each of the data pins. The
pin with 3.3 volts on it is the "TX Data" pin. The TX Data pin on your cable goes to the
"RX Data" pin on the WCR-GN JP1 connector.
Strictly speaking, you don't have to do it the way I describe if you want to attach the serial cable a
different way.
3.C SETTING UP THE TERMINAL COMMUNICATIONS PROGRAM
I flashed the WCR-GN using the Kermit terminal communications program and Linux, so
the instructions below are Linux specific.
Here is the command file for Kermit:
Quote:
set line /dev/ttyUSB0
echo off
set modem type none
set speed 57600
set flow none
set carrier-watch off
connect
It's a good idea to test you terminal program first before proceeding.
To do this, short the TX DAta and RX Data pins of your USB to TTL serial cable together
and type something. You should see the characters echoed on the screen. Unshort the
pins and you should not see characters on the screen. If all is working, proceed. if not,
fix your setup.
3.D CONNECT THE CABLE TO THE WCR-GN
Connect your serial cable to the WCR-GN as follows:
Quote:
Serial Cable WCR-GN
---------------------------
GND GND
TX Data RX Data
RX Data TX Data
3.E POWER UP THE WCR-GN
Plug the power cable into the WCR-GN and you should see the bootloader come up.
You will have 5 seconds to make a selection from the bootloader's menu. If you
do not, the bootloader will automatically boot the Buffalo firmware. Don't worry
if you miss the 5 second window. You can always pull power and start again.
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP.
You will want to use menu option 2, but first you need to set up a
tftp server on your Windows PC or Linux PC. The net is full of help on
how to do this so I won't go over it here. Whichever OS you use
(Windows or Linux) BE SURE to test your setup before proceeding.
3.F GET THE FIRMWARE
As mentioned elsewhere in this forum, the experimental build of
DD-WRT for the WCR-GN is at this link:
Get the "firmware.tftp" file and install it on your computer
such that your TFTP server can find it. I renamed it to "firmware.bin".
4 FLASH THE FIRMWARE
Pull power from the WCR-GN, re apply power and quickly select menu option 2.
It looks like this:
Quote:
You choosed 2
0
2: System Load Linux Kernel then write to Flash via TFTP.
Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
Pick "Y" and then enter the IP addresses of the WCR-GN and the TFTP Server.
I used the defaults:
Quote:
Please Input new ones /or Ctrl-C to discard
Input device IP (10.10.10.123) ==:10.10.10.123
Input server IP (10.10.10.3) ==:10.10.10.3
Enter the filename of the DD-WRT firmware. As mentioned above, mine is named
"firmware.bin":
Quote:
Input Linux Kernel filename () ==:firmware.bin
As soon as you hit carriage return, the WCR-GN will TFTP the firmware from your PC
and flash it. As soon as the firmware is flashed, the WCR-GN will reboot and
you'll see the DD-WRT firmware boot. Here's what that looks like:
Quote:
netboot_common, argc= 3
NetTxPacket = 0x80FE4280
KSEG1ADDR(NetTxPacket) = 0xA0FE4280
NetLoop,call eth_halt !
NetLoop,call eth_init !
Trying Eth0 (10/100-M)
Waitting for RX_DMA_BUSY status Start... done
Header Payload scatter function is Disable !!
ETH_STATE_ACTIVE!!
Using Eth0 (10/100-M) device
TFTP from server 10.10.10.3; our IP address is 10.10.10.123
Filename 'firmware.bin'.
TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: *
ArpTimeoutCheck
Got ARP REPLY, set server/gtwy eth addr (00:1a:4b:7d:fa:40)
Got it
T #
first block received
################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#############################################
done
Bytes transferred = 3554081 (363b21 hex)
NetBootFileXferSize= 00363b21
raspi_erase_write: offs:50000, count:363b21
raspi_erase: offs:50000 len:360000
raspi_write: to:50000 len:360000
raspi_read: from:3b0000 len:10000
raspi_erase: offs:3b0000 len:10000
raspi_write: to:3b0000 len:10000
Done!
## Booting image at bf050000 ...
raspi_read: from:50000 len:40
Image Name: DD-WRT v24 Linux Kernel Image
Created: 2011-12-20 14:44:09 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 858598 Bytes = 838.5 kB
Load Address: 80000000
Entry Point: 80255000
raspi_read: from:50040 len:d19e6
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80255000) ...
## Giving linux memsize in MB, 16
Starting kernel ...
LINUX started...
THIS IS ASIC
Linux version 2.6.23.17 (root@dd-wrt) (gcc version 4.5.4 20110526 (prerelease) (Linaro GCC 4.5-2011.06-0) ) #2657 Tue Dec 20 15:40:12 CET 2011
The CPU frequency set to 320 MHz
16M RAM Detected!
CPU revision is: 0001964c
Determined physical RAM map:
memory: 01000000 @ 00000000 (usable)
Built 1 zonelists in Zone order. Total pages: 4064
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock4 rootfstype=squashfs noinitrd
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 10800008, status = 1100ff00
PID hash table entries: 64 (order: 6, 256 bytes)
calculating r4koff... 0030d400(3200000)
CPU frequency 320.00 MHz
Using 160.000 MHz high precision timer.
console [ttyS1] enabled
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 13344k/16384k available (1958k kernel code, 3040k reserved, 425k data, 112k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Generic PHY: Registered new driver
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
ralink spi driver
system type: RT3350
boot type: 3
deice id : c2 20 16 c2 20 (2016c220)
MX25L3205D(c2 2016c220) (4096 Kbytes)
mtd .name = raspi, .size = 0x00400000 (4M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
found squashfs at 122000
Creating 6 MTD partitions on "raspi":
0x00000000-0x00030000 : "uboot"
0x00030000-0x00040000 : "uboot-config"
0x00040000-0x00050000 : "factory-defaults"
0x00050000-0x003f0000 : "linux"
0x00122000-0x003f0000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x003f0000-0x00400000 : "nvram"
Load Ralink DFS Timer Module
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
io scheduler noop registered
io scheduler deadline registered (default)
Ralink gpio driver initialized
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
rt3052 access driver initialization.
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V1.0
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
system type: RT3350
boot type: 3
Ralink APSoC Hardware Watchdog Timer
u32 classifier
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
ctnetlink v0.93: registering with nfnetlink.
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
IPP2P v0.8.2 loading
ClusterIP Version 0.8 loaded successfully
TCP bic registered
TCP cubic registered
TCP westwood registered
TCP highspeed registered
TCP hybla registered
TCP htcp registered
TCP vegas registered
TCP scalable registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Welcome to PF_RING 3.2.1
(C) 2004-06 L.Deri <deri@ntop.org>
NET: Registered protocol family 27
PF_RING: bucket length 128 bytes
PF_RING: ring slots 4096
PF_RING: sample rate 1 [1=no sampling]
PF_RING: capture TX No [RX only]
PF_RING: transparent mode Yes
PF_RING initialized correctly.
PF_RING: registered /proc/net/pf_ring/
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
MAC_ADRH -- : 0x00000000
MAC_ADRL -- : 0x00000000
device br0 left promiscuous mode
device br0 entered promiscuous mode
device br0 left promiscuous mode
device br0 entered promiscuous mode
RtmpOSNetDevDetach(): RtmpOSNetDeviceDetach(), dev->name=ra0!
RT305x_ESW: Link Status Changed
0x1300 = 00064380
br0: topology change detected, propagating
br0: port 1(vlan1) entering forwarding state
0x1300 = 00064380
device ra0 entered promiscuous mode
br0: port 2(ra0) entering learning state
wland: No such file or directory
RT305x_ESW: Link Status Changed
br0: topology change detected, propagating
br0: port 2(ra0) entering forwarding state
device vlan2 entered promiscuous mode
device vlan2 left promiscuous mode
etherip: Ethernet over IPv4 tunneling driver
/bin/sh: can't create /proc/sys/net/bridge/bridge-nf-call-arptables: nonexistent directory
/bin/sh: can't create /proc/sys/net/bridge/bridge-nf-call-ip6tables: nonexistent directory
/bin/sh: can't create /proc/sys/net/bridge/bridge-nf-call-iptables: nonexistent directory
At this point you are up and running. You can button up the router and enjoy!
As a final note, I have not tested the DD-WRT firmware! If it does not work correctly on the WCR-GN, hopefully someone can help get it working.
PS: ABOUT THE BOOTLOADER
The bootloader is Das U-Boot [url]www.denx.de[/url
This router uses a very old version of U-Boot which has a limited set of commands enabled. U-Boot offers much more functionality, but the extra features have not been enabled at compile time.
You can browse the commands by hitting option 4 when the router powers up instead of option 2. That looks like this:
Quote:
You choosed 4
0
4: System Enter Boot Command Line Interface.
U-Boot 1.1.3 (Sep 30 2009 - 21:47:05)
RT3052 #
RT3052 # help
? - alias for 'help'
bootm - boot application image from memory
cp - memory copy
erase - erase SPI FLASH memory
go - start application at address 'addr'
help - print online help
md - memory display
mdio - Ralink PHY register R/W command !!
mm - memory modify (auto-incrementing)
mw - memory write (fill)
nm - memory modify (constant address)
printenv- print environment variables
reset - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
RT3052 #
Using the commands, you can do things like set a different timeout to autoboot the firmware or
poke around in the system. If you look carefully
at the transcript earlier in this post, you'll see
this:
Quote:
*** Warning - bad CRC, using default environment
You see this because Buffalo did not store the environment in the board's non volatile memory (NVM). Instead, when the bootloader CRCed the portion of
NVM where the environment is stored, the CRC failed. This causes the bootloader to fall back to a default environment compiled into the bootloader executable.
(I know these details because I have used U-BOOT extensively and ported it to custom hardware)
If you use the bootloader command "saveenv", the bootloader will store the default environment into the non volatile memory, after which you can edit or add to the environment.
Posted: Wed Feb 06, 2013 16:29 Post subject: Just a Thought
If you still have one of these routers with the original firmware, and a serial console, maybe you can get to the busybox command line and look for the encryption bynary, maybe bcrypt, or whatever they call it.
I figure if the firmware is encrypted, it first needs to decrypt it before it loads it into memory
once decrypted, we can probably break down the header/data part of the buffalo firmware and replace it with DD-WRT so it can be flashed via the Web GUI
Hi can You help me with understanding this ?
When my u-boot start i cannot choose other number in menu.
Automatically number 3 is selected so i cannot upload new firmware over tftp...
##### The CPU freq = 360 MHZ ####
estimate memory size =16 Mbytes
--->Set rt305x Gpio falsh, added by luowl for w150m, 20091014
.............................
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
You choosed 3
0
3: System Boot system code via Flash.
## Booting image at bc050000 ...
raspi_read: from:50000 len:40
. Image Name: 3G150M_SPI Kernel Image
Created: 2013-01-18 1:46:10 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 2467205 Bytes = 2.4 MB
Load Address: 80000000
Entry Point: 80401000
raspi_read: from:50040 len:25a585
...................................... Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80401000) ...
## Giving linux memsize in MB, 16
Posted: Thu Apr 18, 2013 5:31 Post subject: Re: Just a Thought
ruben00 wrote:
If you still have one of these routers with the original firmware, and a serial console, maybe you can get to the busybox command line and look for the encryption bynary, maybe bcrypt, or whatever they call it.
I figure if the firmware is encrypted, it first needs to decrypt it before it loads it into memory
once decrypted, we can probably break down the header/data part of the buffalo firmware and replace it with DD-WRT so it can be flashed via the Web GUI
Good point. I hadn't thought of that. I'm starting to loose interest in the WCR-GN because the DD-WRT builds don't work in client bridge mode which is what I need. If I had more time I'd be willing to work the problem, but it's not an option for me right now.
Yes I've played around with it quite a bit. I configured DD-WRT to connect to my wired network and act as an AP but could not get clients to see the AP reliably. Sometimes they would not see the AP at all. I also tried client bridge mode, although the only option in DD-WRT was "client" and I had to check a box to specify "bridged". Not what I was used to doing with DD-WRT on my WRT54G and not surprisingly it did not work.
I think it's going to take a guru to get things working right. Hope it happens because it's an inexpensive router - and it chaps me that Buffalo encrypts their firmware to make it hard for us to upgrade the router.
Sometimes they would not see the AP at all.Think this problem has plagued with dd-wrt.If using a programmer to write the firmware.WIFI is fairly stable.
Posted: Wed Sep 18, 2013 4:58 Post subject: Success on first serial upload !!!
Ok, so for everyone who follows this thread, I can confirm that the firmware does load and run (minus wifi) which I dont mind as i have other wifi routers for this.
I circled around a solution to get the firmware loaded for a few days, bought way too many cables and pins and connectors and stuff (didnt but they cable that KeithO points too, perhaps that would have saved me a bundle, yes, it would have)
What I ended up with that worked was an osepp FTDI USB to serial breakout board that did the job quite nicely. Its a 3.3V/5V jumpered option ( choose 3.3v). See the image above, the VCC power cable is not connected and not
used.
I bought some header pins which I soldered onto the side pins of the FTDI at GND,TXD and RXD. Soldered pins into the TTL pins as per keith0 mapping above, and ready-made cable connected the pins as per the mapping above.
I have three WCR-GN, and the first one I upgraded to v1.08 firmware off of the buffalo website ....
DONT DO THIS.
My three routers came with V1.04 pre-installed, which kicks to the serial console right out of the gate. V1.08 appears to have dumped the serial
console or changed up com speeds as I get absolutely no output on boot
and when it does start talking (about 3 mins in) it dumps what appears to
be some other speed setting or character dump.
So I was able to flash two right out of the box, the third now at v1.08 may
have to stay that way unless anyone can advise how I get the door open to
the console connection such that I might wipe the nvram and reload
original firmware, which may/may not restore the serial console.
An additional item, one still must have a TFTP server setup as the router
polls the PC for this via the serial connection and pulls down the file.
Its not a push from the PC. Anyone having flashed before and wants to
correct or add any additional information to this thread please do.
Again, great instructions and key for me getting this router upgraded to
dd-wrt. thank you thank you thank you.
Posted: Sat Oct 05, 2013 11:30 Post subject: Re: Success on first serial upload !!!
sukanaqin wrote:
V1.08 appears to have dumped the serial console or changed up com speeds as I get absolutely no output on boot and when it does start talking (about 3 mins in) it dumps what appears to
be some other speed setting or character dump.
My v1.08 unit does send readable output to the RS-232 port. The settings were 57600 8N1 with no flow control. However, it will not accept input, and it always 'choosed' 3.
One suggestion for Windows users. USB to RS-232 adapters have a bad reputation due to driver problems. Using Windows device manager, I've found that most of these adapters are model 2303 manufactured by Prolific http://www.prolific.com.tw. Visit the website and upgrade your PC with the latest drivers.
Posted: Sat Oct 05, 2013 15:16 Post subject: Re: Success on first serial upload !!!
telserv wrote:
sukanaqin wrote:
V1.08 appears to have dumped the serial console or changed up com speeds as I get absolutely no output on boot and when it does start talking (about 3 mins in) it dumps what appears to
be some other speed setting or character dump.
My v1.08 unit does send readable output to the RS-232 port. The settings were 57600 8N1 with no flow control. However, it will not accept input, and it always 'choosed' 3.
One suggestion for Windows users. USB to RS-232 adapters have a bad reputation due to driver problems. Using Windows device manager, I've found that most of these adapters are model 2303 manufactured by Prolific http://www.prolific.com.tw. Visit the website and upgrade your PC with the latest drivers.
Thanks to Keith for this very detailed procedure!
USB to RS-232 adapters will not work and you risk burning the routers serial port if you use them.
All routers serial ports are 3.3V TTL level so you need to use an USB to TTL adapter. _________________ Kernel panic: Aiee, killing interrupt handler!
Posted: Mon Mar 09, 2015 8:42 Post subject: Wifi Work on WCR-GN
After searching on internet over months and making many trials with pain, I finally get dd-wrt to work with wifi signal on my WCR-GN router. I try to share my finding and observation here. Perhaps others may try if encounter the same problem.
I tried with different dd-wrt build on my WCR-GN router with v1.08 firmware. As reported by others in many threads, the wifi was not working at all. No wifi signal was detected from router. The router did not receive wifi signal as adjacent AP was not found when pressing “site-survey” button or “Wiviz” button on web GUI.
Last week, I found a threat www.right.com.cn/forum/thread-149466-1-1.html and made a trial (on the latest 20141222-r25697 build I lastly flashed) according to the instructions:
1. download the “mtbk.bin” file from that thread and change the MAC address at location indicated on the thread.
2. enable SSH and send the file to router /tmp folder with WINSCP
3. issue the command: cat /tmp/mtbk.bin > /dev/mtdblock2 on router through telnet
4. restore the factory default setting to erase nvram & reboot
When I checked the router MAC address with web GUI, I discovered that dd-wrt showed 2 diffferent MAC addresses (only different in last digit), one for WAN, and another for LAN & Wireless. I tried the Wireless MAC on “mtbk.bin” file. There was still no wifi signal after router reboot. dd-wrt also reported the same 2 different MAC addresses.
I then tried to change the MAC address in “mtbk.bin” file with WAN one and performed the above step 2~4 again. After restoring the factory default setting, strong wifi signal was detected. Adjacent AP can be found when “site-survey” button on web GUI was pressed. dd-wrt reported one MAC address for WAN, LAN and Wireless. wifi on my WCR-GN was working immediately.
I then tried to change the MAC address in “mtbk.bin” file back to the original Wireless one and performed above step 2~4 again. dd-wrt reported again 2 different MAC addresses, but strong wifi signal still can be detected. I forgot to make a backup copy of mtdblock2 from router before change. There is no way for me now to return to find the different in the download file and the original one in the router.
However, when the “Wiviz” button on web GUI is pressed, the wireless LED turns off, and the wifi signal from WCR-GN totally disappears. Although the wireless LED turns on again 1~2 second later, the wifi signal was not restored even after exiting “Wiviz” unless the router is reboot.
Finally, there remains a problem with WCR-GN I need to solve. When I tried with dd-wrt 2013-04-19-r21061 and later build, the LAN is not stable, disconnect and connect again very often. The web GUI showed that the CPU model is detected being Ralink RT3350 id:1 rev:2 and set the CPU clock to 384MHz. This was also shown through TTL serial. Once the boot up log shows CPU clock set to 384MHz, unreadable characters are shown and no command can be entered through TTL serial.
For 2013-02-11-r20675 build and before, the CPU clock is left at 320MHz (same speed as boot up before kernel start) and there is no LAN unstable problem (although the wifi is not working). Complete boot up log was displayed and command can be entered through TTL serial.
The CPU datasheet stated the clock is only 320MHz. The SDRAM on my WCR-GN is EM639165TS-6G. The datasheet indicates that the max frequency is only 166MHz. The unstable is suspected due to CPU overclocking and exceeding SDRAM frequency limit. I would like to set the CPU speed back to 320MHz. I had tried “nvram set clkfreq=” command, but the CPU clock remains 384MHz. There is no “clkfreq” entry with “nvram show” command. Can anyone help with this?
))))