OpenWrt Forum Archive

Topic: WZR-900DHP OpenWrt installation

The content of this topic has been archived on 16 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hello everyone!

I have this european model of Buffalo WZR-900DHP and I'm wondering is this even supported by OpenWrt. I tried to flash a couple of images found from … /mips74k/.

However all my efforst to install OpenWrt resulted in a bricked router. After few hours of tweaking and googling I was able to revert back to dd-wrt using the CFE web-gui. Despite of all that trouble I would still like to install OpenWrt - mostly because I want to implement my own QOS and stuff..

Did I just try to flash a wrong file or is it impossible to install it on this thing?

The snapshot provided seems otherwise great, but the nl80211 driver initialization fails, disabling both WLAN interfaces.

The symptoms look like the ones described in earlier bug descriptions:

It looks like the firmware has difficulties reading the MAC address for the wireless interfaces.

Meanwhile, dd-wrt's beta firmware linked below gets both the 2.4 and 5 GHz radios up, but the transmission power is ultra weak. The signal dies of within a meter or so of the AP. Changing the transmit power via the web GUI or via telnet and wl txpwr seems to have little or no effect. … zr-900dhp/

What can I do to help getting the radios to work with the OpenWRT firmware?

Despite numerous attempts, I've been unable to restore Buffalo's original firmware images on this device.

It seems like the WZR-900DHP-EU doesn't accept TFTP uploads even though boot_wait has been enabled in the NVRAM. I've tried the arp tricks and the magic IP, but at no point during boot does the device answer to ARP or ICMP requests with this IP. Neither does it open the TFTP ports for receiving the upload.

Instead, the device tries to TFTP download the file linux.trx-recovery from upon boot. While the device is fetching linux.trx-recovery, a CFE web gui is enabled. By throttling the TFTP server, I've tried to use the CFE gui to upload Buffalo's firmware images, but the CFE claims that the images are invalid and refuses to flash them.

I've also tried converting Buffalo's firmware images into .trx files with dd bs=32 skip=1, but no go. According to the following post, it seems that Buffalo's firmware images are encrypted and indeed, the files seem to begin with the characters 'bgn'.

Thus, the firmware images are not accepted by mtd or dd-wrt's web GUI. With mtd the error is "bad trx header", perhaps unsurprisingly. dd-wrt just reboots back into the previous firmware, ignoring the update.

For some Buffalo devices, there exists a modified firmware image that is acceptable by the dd-wrt web gui (and possibly mtd). After flashing the modified image, one can the follow up by flashing one of the Buffalo encrypted images. However, I've been unable to figure out how to hack such an image for the WZR-900DHP. Any pointers?

The buffalo-enc tool from the firmware-mod-kit (v 0.99) has been successful in decrypting previous Buffalo firmware images: … 710#758710

However, it doesn't seem to be working with either wzr900dhp-pro-v23sp2-23709a-eu.bin, wzr900dhp-userfriendly-2.13-eu, or wzr_900dhp_eu_214.

The beginning of the file seems similar, with the 'bgn' and two 'start' sequences, but buffalo-enc still admits defeat:

[buffalo-enc] *** error: unable to decrypt 'buffalo_prof_firmware/wzr900dhp-userfriendly-2.13-eu'

Cutting off the first 208 bytes with dd from the image and then retrying with buffalo-enc results exactly the same error.

(Last edited by pervert on 11 Jan 2015, 18:13)

Thanks nopid!

The firmware image wzr600dhp2d-v24sp2-23709b.bin begins with the familiar HDR0 and is acceptable by mtd.

Using that image I was able to get to the dd-wrt branded by Buffalo, and then onwards from there to wzr_900dhp_eu_214.

Does your wifi work with the official firmware?
No matter what firmware i try or how often I reset my nvram, the wifi signal remains very weak.

Maybe the wifi problems are related to this:

loader version info doesnt match or is not set (required v0.03, configured=NULL)
power table 2.4G is empty in boot parameter
power table 5G is empty in boot parameter

CFE version (r396477) based on BBP 1.0.37 for BCM947XX (32bit,SP,)
Build Date: Wed Apr 2 15:17:43 CEST 2014 (root@dd-wrt.buildserver)
Copyright (C) 2000-2008 Broadcom Corporation.

Bootloader version v0.03 boot_version v0.03
Project name : WG9116H22
Press CTRL+C to cancel startup...
Committing NVRAM...
power table 2.4G is empty in boot parameter
power table 5G is empty in boot parameter


I see that the trunk has a new version generated daily, but does the new firmware covers the power issues?

Other question:
Does anybody know if the WZR-900DHP2 fw is compatible with the DHP?


This device uses two BCM4331, we have only b43 driver for this chipset and its support for it is very limited.

Hello everybody!
Can anybody help me to install OpenWrt on this device: WZR-900DHP-EU (BCM4707 ARM)?
I succeeded to install dd-wrt on it and revert back to official firmware without any problems.
But I cannot find a way to install OpenWrt.
Succeeded to upload via CFE web-gui the *.trx file from: … x/generic/
got a successful confirmation but after router restarts it is still the original firmware...
Please, give me a hint.


The discussion might have continued from here.