Posted: Thu Oct 30, 2014 11:18 Post subject: Buffalo WHR-1166D: Initial DD-WRT Firmware Install?
Beginning with the r25139-testing release, a directory for the Buffalo WHR-1166D has been provided. I have tried to install this DD-WRT release and successive beta releases from the factory code without success.
The factory method of upgrading firmware rejects the firmware releases as Invalid Firmware, Reboot Router. I have also had no success with the TFTP method of installing the firmware during boot of the router.
My WHR-1166D is the US model. I have tried installing both the DD-WRT firmware-us.bin and firmware.uimage and with both factory releases 1.30 and 1.50 of the Buffalo firmware.
Any ideas on how to install the initial copy of DD-WRT firmware for a WHR-1166D?
Posted: Wed Nov 05, 2014 14:35 Post subject: R25251 - Still "Invalid firmware. Reboot now"
I just tired flashing the DD-WRT revision R25251 firmware-us.bin and firmware.uimage into a US WHR-1166D using the Buffalo factory firmware version 1.3.
No Go - "Invalid firmware. Reboot now"
Has anyone been able to get the DD-WRT WHR-1166D firmware into a WHR-1166D with factory firmware?
Posted: Thu Nov 27, 2014 19:38 Post subject: dd-wrt on WHR-1166D - similar problems with WHR-1166D-EU
I have identical problems with the WHR-1166D-EU version of the buffalo. I tried several firmware versions (v1.0, v1.4, v1.6) and several release of the dd-wrt from the beta download folder
Posted: Tue Dec 09, 2014 17:42 Post subject: Tried all Firmware Images through 12-03-2014-r25544
I have tried every image available since the firmware for a DD-WRT version for the WHR-1166D became available without success.
My WHR-1166D was purchased in the US but I have also tried the EU, JP and uimage images as well as the US version.
I have also tried the TFTP method(s) in other postings for different devices without success.
Anyone with knowledge on how to take apart this series of Buffalo units without destroying the case? It is one of these plastic designs that either was never intended to be taken apart or there is a trick in knowing how to do it.
Posted: Wed Apr 01, 2015 1:35 Post subject: Re: Tried all Firmware Images through 12-03-2014-r25544
tmi wrote:
I have tried every image available since the firmware for a DD-WRT version for the WHR-1166D became available without success.
My WHR-1166D was purchased in the US but I have also tried the EU, JP and uimage images as well as the US version.
I have also tried the TFTP method(s) in other postings for different devices without success.
Anyone with knowledge on how to take apart this series of Buffalo units without destroying the case? It is one of these plastic designs that either was never intended to be taken apart or there is a trick in knowing how to do it.
Posted: Sat Apr 25, 2015 23:08 Post subject: Re: Tried all Firmware Images through 12-03-2014-r25544
tmi wrote:
I have tried every image available since the firmware for a DD-WRT version for the WHR-1166D became available without success.
My WHR-1166D was purchased in the US but I have also tried the EU, JP and uimage images as well as the US version.
I have also tried the TFTP method(s) in other postings for different devices without success.
Anyone with knowledge on how to take apart this series of Buffalo units without destroying the case? It is one of these plastic designs that either was never intended to be taken apart or there is a trick in knowing how to do it.
I was able to accomplish this a few months ago. I was flashed my 2 WCR-GN routers. Since I had already purchased the serial to USB, and this also being a Buffalo, I figured they may be the same or at least similar. I followed this page to the letter. The process is pretty much identical.
http://www.dd-wrt.com/phpBB2/viewtopic.php?p=776923
Opening the WHR-1166D (I have NA) was the only challenge. The single torque screw is located just above the switch (auto, router, bridge). It's also covered by the black decal. It snaps off once you get that off. I've done it a few months back, I recall using a large flat-head screwdriver to snap the side panel off. I have taken images, hope they can help. The flash was successful. Aside from the LEDs not flashing, everything works
Posted: Wed Jul 01, 2015 5:04 Post subject: Still no success, but some progress
I have been playing with my WHR-1166D (US) tonight in another attempt to load DD-WRT onto it. I have opened the case and connected a USB-TTL serial adapter to the console port, but I am unable to duplicate morenodred's results because I cannot interrupt the boot process with a keypress. There is no delay after U-Boot loads; it just says "you choosed 3" and proceeds to boot. I had previously upgraded my router to v1.70; perhaps it modified the boot image to prevent the console from breaking out of the boot process.
I have, however, discovered something interesting that I do not believe has been reported before. It is possible to TFTP-boot this router by holding the AOSS button down at power-up. The WHR-1166D will look for a file named "firmware_WHR-1166DHP.ram" at 192.168.11.168. I tried renaming the headerless "firmware.uimage" from r27456; it loads, but crashes when it doesn't find any mounted volumes.
Now, I'll have to spend a few days figuring out how to build a working TFTP boot image. If I am successful, this will give us a method to get DD-WRT running on this router without opening the case.
Posted: Wed Jul 01, 2015 7:00 Post subject: Dump of DD-WRT booting via TFTP into RAM on WHR-1166D
This shows what happens when I send an image file to my WHR-1166D using the method described in the previous post. Perhaps someone more experienced can figure out a solution to the kernel panic at the end.
My thought is that one could use the AOSS button to load a copy of DD-WRT into RAM, then use the firmware update process to save a proper copy into flash.
Code:
U-Boot 1.1.3 (Nov 22 2013 - 20:20:04)
Board: Ralink APSoC DRAM: 128 MB
relocate_code Pointer at: 87fb4000
enable ephy clock...done. rf reg 29 = 5
SSC disabled.
spi_wait_nsec: 29
spi device id: ef 40 18 0 0 (40180000)
find flash: W25Q128BV
raspi_read: from:30000 len:1000
raspi_read: from:30000 len:1000
*** Check if data is correct or not...
*** Data is correct.
============================================
Ralink UBoot Version: 4.1.2.0
Buffalo UBoot Version: 1.03
--------------------------------------------
ASIC 7620_MP (Port5<->Phy)
DRAM component: 1024 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 128 MBytes
Flash component: SPI Flash
Date:Nov 22 2013 Time:20:20:04
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 580 MHZ ####
estimate memory size =128 Mbytes
ICPLUS Phy1
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP. 0
aossgpio=[0]
AOSS button is pressed
raspi_read: from:40028 len:6
netboot_common, argc= 3
NetTxPacket = 0x87FE5900
KSEG1ADDR(NetTxPacket) = 0xA7FE5900
NetLoop,call eth_halt !
NetLoop,call eth_init !
Trying Eth0 (10/100-M)
Waitting for RX_DMA_BUSY status Start... done
ETH_STATE_ACTIVE!!
TIMEOUT_COUNT=10,Load address: 0x80a00000
Loading: Got ARP REQUEST, return our IP
T Got ARP REPLY, set server/gtwy eth addr (00:15:c5:49:10:fc)
Got it
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#########
done
Bytes transferred = 8028747 (7a824b hex)
NetBootFileXferSize= 007a824b
raspi_read: from:30000 len:10000
Erasing SPI Flash...
raspi_erase: offs:30000 len:10000
.
Writing to SPI Flash...
raspi_write: to:30000 len:10000
.
done
Automatic boot of image at addr 0x80A00000 ...
raspi_read: from:30000 len:10000
Erasing SPI Flash...
raspi_erase: offs:30000 len:10000
.
Writing to SPI Flash...
raspi_write: to:30000 len:10000
.
done
## Booting image at 80a00000 ...
Image Name: DD-WRT v24 Linux Kernel Image
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1075855 Bytes = 1 MB
Load Address: 80000000
Entry Point: 8000d730
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8000d730) ...
## Giving linux memsize in MB, 128
Starting kernel ...
Linux version 3.10.81 (root@dd-wrt) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.01 r39555) ) #899 Sat Jun 27 07:53:44 CEST 2015
Board has DDR2
Analog PMU set to hw control
Digital PMU set to hw control
SoC Type: Ralink MT7620A ver:2 eco:6
bootconsole [early0] enabled
CPU revision is: 00019650 (MIPS 24KEc)
MIPS: machine is Ralink MT7620a + MT7610e evaluation board
Determined physical RAM map:
memory: 08000000 @ 00000000 (usable)
Zone ranges:
Normal [mem 0x00000000-0x07ffffff]
Movable zone start for each node
Early memory node ranges
node 0: [mem 0x00000000-0x07ffffff]
Primary instruction cache 64kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512
Kernel command line: console=ttyS0,57600n8 root=/dev/mtdblock4 rootfstype=squashfs noinitrd
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Writing ErrCtl register=0004d06e
Readback ErrCtl register=0004d06e
Memory: 126512k/131072k available (2498k kernel code, 4560k reserved, 405k data, 228k init, 0k highmem)
NR_IRQS:256
CPU Clock: 580MHz
systick: running - mult: 214748, shift: 32
genirq: Flags mismatch irq 7. 00014600 (timer) vs. 00014600 (systick)
Calibrating delay loop... 766.77 BogoMIPS (lpj=3833856)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 512
pinctrl core: initialized pinctrl subsystem
NET: Registered protocol family 16
pci: ralink soc = 6
PCI host bridge /pcie@10140000 ranges:
MEM 0x0000000020000000..0x000000002fffffff
IO 0x0000000010160000..0x000000001016ffff
bio: create slab <bio-0> at 0
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
pci_bus 0000:00: root bus resource [io 0x10160000-0x1016ffff]
pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
pci 0000:00:00.0: PCI bridge to [bus 01]
pci 0000:00:00.0: bridge window [mem 0x20000000-0x200fffff]
pci 0000:00:00.0: bridge window [mem 0x20100000-0x201fffff pref]
pci 0000:00:00.0: card - bus=0x0, slot = 0x0 irq=0
pci 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
Switching to clocksource systick
NET: Registered protocol family 2
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
rt-timer 10000100.timer: maximum frequency is 2441Hz
squashfs: version 3.0 (2006/03/15) Phillip Lougher
msgmni has been set to 247
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20) is a 16550A
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
Ralink gpio driver initialized
m25p80 spi32766.0: w25q128 (16384 Kbytes)
6 ofpart partitions found on MTD device spi32766.0
Creating 6 MTD partitions on "spi32766.0":
0x000000000000-0x000000030000 : "u-boot"
0x000000030000-0x000000040000 : "u-boot-env"
0x000000040000-0x000000050000 : "factory"
0x000000050000-0x000000ef0000 : "linux"
scan from offset 50000
0x000000f00000-0x000001000000 : "User_CFG"
0x000000ef0000-0x000000f00000 : "nvram"
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
gsw: setting port4 to ephy mode
ralink_soc_eth 10100000.ethernet (unregistered net_device): port 0 link up (100Mbps/Full duplex)
libphy: mdio: probed
ralink_soc_eth 10100000.ethernet: connected port 5 to PHY at mdio-bus:05 [uid=02430d91, driver=Generic PHY]
ralink_soc_eth 10100000.ethernet: loaded mt7620 driver
ralink_soc_eth 10100000.ethernet eth0: ralink at 0xb0100000, irq 5
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
u32 classifier
Performance counters on
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1976 buckets, 7904 max)
ctnetlink v0.93: registering with nfnetlink.
ipip: IPv4 over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
ipt_CLUSTERIP: ClusterIP Version 0.8 loaded successfully
TCP: bic registered
TCP: cubic registered
TCP: westwood registered
TCP: highspeed registered
TCP: hybla registered
TCP: htcp registered
TCP: vegas registered
TCP: scalable registered
NET: Registered protocol family 17
Bridge firewalling registered
8021q: 802.1Q VLAN Support v1.8
searching for nvram
nvram size = 0
List of all partitions:
1f00 192 mtdblock0 (driver?)
1f01 64 mtdblock1 (driver?)
1f02 64 mtdblock2 (driver?)
1f03 14976 mtdblock3 (driver?)
1f04 1024 mtdblock4 (driver?)
1f05 64 mtdblock5 (driver?)
No filesystem could mount root, tried: squashfs
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,4)
Rebooting in 1 seconds..
Posted: Sat Aug 29, 2015 11:35 Post subject: buffalo_whr_1166d
Hi
Can anybody tell me how to install buffalo_whr_1166d-webflash.bin onto this router, and if it cant why bother creating the software and updates? I'm totally confused, has anybody on the planet installed this without opening the unit? This may have been covered somewhere but I cant find it. I've tried all the suggestions on this site but nothing works.
thanks
I have a jp model. and I saw the method to flash ddwrt to whr1166dhp.
first, boot the headerless official whr600d firmware using tftp boot.
next , flash ddwrt whr600d firmware using update tab in webui .
You can boot the ddwrt but in my case didn't work Wi-Fi 5Ghz, LAN port, etc.
So do I. I have a 300HP2，and I successfully installed dd-wrt and other firmware on it. First, the router only accept official dd-wrt version 300HP2D 22750b，after that， I flashed into other dd-wrt versions. but with other dd-wrt wan port do not work. I opened ssh and telnet ports and flashed u-boot file. With an u-boot, I can flash into any firmware as I wish. As to WHR-1166D， I also have an u-boot， but I can not open SSH& telnet ports with official firmwares, not do I have any official dd-wrt to accept.
