Flash Your Buffalo WBR-G54, WLA-G54, ...

From DD-WRT Wiki

Jump to: navigation, search

[edit] ... WLA-G54C, WBR2-G54, WBR2-G54S


WARNING: Use only dd-wrt v24 SP1 final or v23 SP2 final (15.sep.2006). Some beta versions are buggy and will brick your router.

v24 SP1 works!!, if not try v23 SP2 (9/15/06 build). --Jmeunier 05:16, 25 Feb 2010 (CEST)

v23 SP2 Final works fine. --korhojoa 17:10, 14 Sep 2006 (CEST)

Special Note : WLA-G54C - There are two different hardware versions

Version 1: FCC ID left to WLA-G54C on sticker - this one is not recognised correctly with v23 SP2 final and LAN will be dissabled. Note: It does send a BOOTP request out of the LAN port. But nothing else.
Version 2: FCC ID under WLA-G54C on sticker - this one is working perfectly with v23 SP2 final

Please also mention that WLA-G54L has boot wait=off in CPE and does not have JTAG

WARNING: Currently no way to go back to original firmware (I did it once, but could not reproduce)

[edit] Flashing using TFTP [Suggested Method]

Before flashing be sure to restore to factory defaults. This is extremely important! Buffalo routers have a tendency to keep old data in the nvram. I recommend flashing it with OpenWRT as indicated below in the troubleshooting section, and then issuing a 'mtd erase nvram' command. Then you can overwrite OpenWRT with DD-WRT.

Before flashing with DD-WRT, also check to see if you can connect to the router wirelessly.

Follow directions under Installation#Flashing_the_Buffalo_WHR-G54S_and_WHR-HP-G54

Note for WBR2-G54 users: Users have reported that once they install DD-Wrt, they have been unable to restore the original Buffalo 2.30 firmware (even via tftp after removing the first 35 bytes). A few users have reported success with a later version of Buffalo firmware, 2.32, that they obtained through Buffalo Tech Support; they were able to tftp this 2.32 version, after they had adjusted the header as shown below.

For specific info regarding the WBR-G54 see this thread.

[edit] Flashing using Buffalo's WEB interface [Alternate Method]

Easy methode: For some models you can use ddadder program....

Use the DD-WRT generic version with the added Buffalo header. After successful transfer please wait 2-3 min., or until router reboots.

Inspecting the original Buffalo firmware one can see the custom header (before HDR0).

WBR-G54, WBR-B11 (34 bytes)

00h:  57 42 52 2D 42 31 31 20 32 2E 32 30 20 31 2E 31 ; WBR-B11 2.20 1.1
01h:  36 0A 66 69 6C 65 6C 65 6E 3D 33 32 31 39 34 35 ; 6.filelen=321945
02h:  36 0A                                           ; 6.

WLA-G54 (34 bytes)

00h:  57 4C 41 2D 47 35 34 20 32 2E 30 35 20 31 2E 30 ; WLA-G54 2.05 1.0
01h:  32 0A 66 69 6C 65 6C 65 6E 3D 32 35 34 37 37 31 ; 2.filelen=254771
02h:  32 0A                                           ; 2.

WLA-G54C (35 bytes)

00h:  57 4C 41 2D 42 31 31 43 20 32 2E 32 30 20 31 2E ; WLA-B11C 2.20 1.
01h:  30 35 0A 66 69 6C 65 6C 65 6E 3D 32 37 31 31 35 ; 05.filelen=27115
02h:  35 32 0A                                        ; 52.

WBR2-G54 (35 bytes)

00h:  57 42 52 32 2D 47 35 34 20 32 2E 33 30 20 36 2E ; WBR2-G54 2.30 6.
01h:  30 33 0A 66 69 6C 65 6C 65 6E 3D 33 35 35 39 34 ; 03.filelen=35594
02h:  32 34 0A                                        ; 24.

WBR2-G54S (36 bytes)

00h:  57 42 52 32 2D 47 35 34 53 20 32 2E 33 30 20 36 ; WBR2-G54S 2.30 6
01h:  2E 31 30 0A 66 69 6C 65 6C 65 6E 3D 33 35 32 36 ; .10.filelen=3526
02h:  36 35 36 0A                                     ; 656.

WZR-G108 (35 bytes)

00h:  57 5A 52 2D 47 31 30 38 20 32 2E 34 31 20 31 2E ; WZR-G108 2.41 1.
01h:  30 31 0A 66 69 6C 65 6C 65 6E 3D 34 35 39 35 37 ; 01.filelen=45957
02h:  31 32 0A                                        ; 12.

You will need to insert (prepend) these bytes onto the DD-WRT generic firmware if you want to flash using Buffalo's WEB interface. You generally need to adjust the "filelen=" number to reflect the size of DD-WRT (though it may work without these "filelen=" adjustments).

==Buffalo's default IP address:== Router will also listen to this address during boot. It will answer to pings with TTL=128. (DD-WRT answers with TTL=64)

Buffalo WBR2-G54/WBR2-G54S users: Remember to set the IP address to before continuing. These white soap boxes' hardware use this IP address in their bootloader. If you have trouble, flash it first with Generic DD-WRT -firmware, turn off after first boot, and after plugging the power cord back in, wait 2 seconds, press Reset-button, let it enter troubleshoot mode (couple minutes), then power off second time, and power back on and it should work. Note: Do not turn on device while holding the Reset-button, since that might signal the bootloader to erase some vital configurations which are known only inside Buffalo Tech. Just wait 2 seconds and then start holding the button, this signals the WRT firmware to use troubleshoot-mode and it kind of repairs the NVRAM... (worked for me, Esa Häkkinen 2006-02-02 <esa.hakkinen@evtek.fi>)

Buffalo WBR-G54 Users: You must upgrade the router to the latest Buffalo Firmware for it to accept the dd-wrt file modified by ddadder, you can get it here: Latest Firmware --Jmeunier 05:25, 26 July 2008 (CEST)

[edit] After flash

You will be able to access the router at Do not restore to factory defaults, but you can erase the nvram. Telnet to the router (username: root , password: admin , mtd erase nvram [enter], reboot [enter].

Please note: If you do restore to factory defaults, the router will respond at Maybe you will no longer be able to access the router via LAN ports. Try using the WAN port, or through the wireless connection (ssid = linksys, ch.6, no encryption). Once you are connected, please telnet to the router and erase nvram (username: root , password: admin , mtd erase nvram [enter], reboot [enter]. This will bring back the LAN ports at

Please note: Clearing nvram will also change the MAC addresses from 00:07:40:xx:xx:xx (Melco Inc.) to 00:90:4c:xx:xx:xx (Epigram Inc.). If you need original MACs back, telnet to the router and do the following: (Use LAN MAC address from the label from router's back side)

nvram set et0macaddr=xx:xx:xx:xx:xx:xx
nvram commit

You can also clone WAN and WLAN MACs using the GUI interface ("Setup"->"MAC Address Clone")

You can now enjoy your DD-WRT....

[edit] Upgrading to new DD-WRT version

Once the router runs DD-WRT, please use the generic version when upgrading firmware. (Starts with HDR0, i.e. dd-wrt.v23_generic.bin).

last revision: 14.june.2006

[edit] If you cannot access your router (no ping, or logon problems) or are getting constant rebooting

If you can telnet/ssh into the router Telnet/ssh into it. Username: root Password: admin (or then, in some cases, the old admin password)

Now do

nvram set http_passwd = "password" [ENTER] nvram commit [ENTER]

Now try logging in with the new password. When you have logged in, go to the Administration tab, and change the password. This will fix the logon problems in both ssh and web interface.

[edit] If you can't get into the router, or it keeps rebooting

We will have to reflash the router with OpenWRT to get it to boot, and when that is done, the settings will be erased, and DD-WRT will be reflashed onto it.

Download openwrt white russian from here

Then, tftp it onto the router, and go to the ip address of the router. ie. http://192.168.x.x When there, click on any of the links, and it will prompt you to set the root user password. Do so, and ssh into the box.

do "mtd erase nvram"


When this is done, type in reboot, and watch the connection get dropped. Now then, be ready, and tftp in the micro (or mini) edition, and wait for the box to come back online. When it is online, ENJOY!

I was having a similar problem where I could see the router, and it even worked for routing internet traffic, but it refused the default or any other password. No reset method would help. I flashed to openwrt White Russian (as mentioned above, except I used RC4, which probably doesn't matter), set the password to the default of admin, and flashed back to dd-wrt through the openwrt web interface, checking the option to erase nvram and jffs2 partition. Everything works now. -mcoope3

--korhojoa 17:10, 14 Sep 2006 (CEST)

WBR-G54: The JTAG pin-out / procedure for de-bricking the router is here

This document includes the procedure for erasing the NVRAM with an un-buffered parallel cable and Linux (also documentation for other mods) --Jmeunier 19:33, 25 February 2010 (CET)