Gargoyle Forum

Posted: **Thu Feb 09, 2012 9:16 pm**

Ah, the famous printenv:

ar7100> printenv                                                                
bootargs=console=ttyS0,115200 root=31:03 rootfstype=jffs2 init=/sbin/init mtdpa)
bootcmd=bootm 0xbe060000                                                        
bootdelay=4                                                                     
baudrate=115200                                                                 
ethaddr=02:AA:BB:CC:DD:1A                                                       
ipaddr=192.168.11.1                                                             
serverip=192.168.11.2                                                           
tmp_ram=81F00000                                                                
tmp_bottom=83F00000                                                             
fw_eaddr=BE060000 BFFDFFFF                                                      
uboot_eaddr=BE000000 BE03FFFF                                                   
u_fw=erase $fw_eaddr; cp.b $fileaddr BE060000 $filesize; bootm BE060000;        
ut_fw=tftp $tmp_ram firmware.bin; erase $fw_eaddr; cp.b $fileaddr BE060000 $fil;
ut_uboot=tftp $tmp_ram u-boot.bin; protect off $uboot_eaddr; erase $uboot_eaddr;
melco_id=RD_BB08009                                                             
tftp_wait=4                                                                     
uboot_ethaddr=02:AA:BB:CC:DD:1A                                                 
DEF-p_wireless_ath0_11bg-authmode=psk                                           
DEF-p_wireless_ath0_11bg-crypto=tkip+aes                                        
DEF-p_wireless_ath0_11bg-authmode_ex=mixed-psk                                  
custom_id=0                                                                     
buf_ver=1.07                                                                    
build_date=Dec 21 2009 - 10:37:30                                               
pincode=43890293                                                                
DEF-p_wireless_ath0_11bg-wpapsk=yu2a734nhsaef                                   
buf_crc=8A51875E                                                                
region=US                                                                       
product=WZR-HP-G300NH                                                           
hw_rev=2                                                                        
accept_open_rt_fmt=1                                                            
stdin=serial                                                                    
stdout=serial                                                                   
stderr=serial                                                                   
loadaddr=81F00000                                                               
ethact=eth1                                                                     
                                                                                
Environment size: 1163/131068 bytes

Posted: **Thu Feb 09, 2012 9:47 pm**

OK, Bad Magic Number on buffalo_to_ddwrt_webflash-MULTI.bin, trying wzrhpg300nh-pro-v24sp2-14998.bin

Posted: **Thu Feb 09, 2012 10:51 pm**

Hmmm. The official buffalotech bin has a bad magic number. I'll try the other files. For those who are interested, the files I am trying are:
DD-WRT (Professional) Firmware for the WZR-HP-G300NH
Latest Buffalo (User-Friendly) Firmware Update
DD-WRT (Professional)(Alpha) firmware for the WZR-HP-G300NH (Version 1)
Firmware Update

Edit: Further checking shows only the 'original' firmware and the gargoyle firmware have the magic number 27 05 19 56 mentioned here: http://scarygliders.net/2010/02/23/hack ... -hp-g300n/ but both have extra stuff in the front, so I 'fixed' them with a hex editor. I got the original firmware here: http://www.dd-wrt.com/phpBB2/download.php?id=13418 but you need to register and be logged in to get it.

Waiting for the SLOOOWWWW upload to finish so I can test it.

Posted: **Fri Feb 10, 2012 6:17 am**

Well, it seems that all my testing was for not. Entering the cp.b command as listed on the different sites (‘cp.b $fileaddr BE060000 $filesize) has been failing because $fileaddr is not set. I've been getting an error each time.
*sigh* It takes almost 45 minutes to transfer some of these images. I'm done for now, router still bricked, but I have a day-job I have to go to.

Wish there was a ready-made serial transfer buffalo image. Most of them seem to be made for tftp or webflash.

Statik

Posted: **Fri Feb 10, 2012 8:33 am**

OK, last update for this part.

So, here's what finally worked. I used the recovery bin from the DD-WRT forums. I used ghex (in Linux Mint) to remove the initial characters from the file so that the magic number was the first four bytes of the file. I then uploaded this file to the router over serial.
iminfo said the image was good.
Now was the tricky part. All of the instructions used variables in the copy command. The original command was cp.b $fileaddr BE060000 $filesize but fileaddr was not defined and filesize seemed to be incorrect, so I replaced those variables with the actual values. (I'm at work now or I'd post the entire command I used).

Lastly I used the bootm be060000 command which booted the image. It loaded the image and booted fairly far into the process before erroring. It then rebooted itself. This time the boot seemed to function properly and I hooked up the LAN cable and I could get into the original Buffalo web gui! Yay!

So, tonight and this weekend I will be testing that image out, probably doing a web upgrade to the latest firmware. I might, then, move to the Buffalo DD-WRT firmware and test that.

Now that I know how to get this thing back to stock, I would love to get gargoyle running on it. Help with that would be appreciated.

Thanks!
Statik

Posted: **Sat Feb 11, 2012 7:36 am**

Alright! I now have this router running the Buffalo 'Professional' DD-WRT, build 14998.
The instructions on this site, for upgrading to Gargoyle, are here:
http://www.gargoyle-router.com/wiki/dok ... -hp-g300nh

Now, I did something like this at the start of the process and ran into trouble. Can someone verify these instructions? I've noticed that gargoyle is only 5MB while all the other images are 18-20MB. Is that ok?

Thanks!

Statik

Edit: I telnet'd in and did a dmesg to check a couple of things. The partitions and the chipset being important. Here are the relevant parts:
<5>Creating 7 MTD partitions on "ar9100-nor0":
<5>0x00000000-0x00060000 : "RedBoot"
<5>0x00060000-0x01fc0000 : "linux"
<5>0x00160000-0x00c40000 : "rootfs"
<5>0x00c40000-0x01fc0000 : "ddwrt"
<5>0x01fc0000-0x01fe0000 : "nvram"
<5>0x01fe0000-0x02000000 : "board_config"
<5>0x00000000-0x02000000 : "fullflash"

<4>rtl8366rb_phy_setup ethUnit=0

I think that means I'm ok. I'll give this a try later today.

Wish me luck!

Posted: **Sat Feb 11, 2012 8:45 am**

OK, that didn't work. I was back to the semi-bricked router.

So, I need help. I'm bringing the router back to the Buffalo official 'Professional' DD-WRT and I need guidance on how to get Gargoyle on it since the official procedure seems to fail.

Anyone want to give me a hand? If you need more information, just ask, I'll post whatever I can.

Thanks!

Statik

Gargoyle Forum

WZR-HP-G300NH-R Fail

Re: WZR-HP-G300NH-R Fail

Re: WZR-HP-G300NH-R Fail

Re: WZR-HP-G300NH-R Fail

Re: WZR-HP-G300NH-R Fail

Re: WZR-HP-G300NH-R Fail

Re: WZR-HP-G300NH-R Fail

Re: WZR-HP-G300NH-R Fail