diff --git a/include/image-commands.mk b/include/image-commands.mk
index e0f2918..7d124ec 100644
--- a/include/image-commands.mk
+++ b/include/image-commands.mk
@@ -11,6 +11,39 @@ define Build/uImage
 	@mv $@.new $@
 endef
 
+define Build/buffalo-enc
+	$(eval product=$(word 1,$(1)))
+	$(eval version=$(word 2,$(1)))
+	$(eval args=$(wordlist 3,$(words $(1)),$(1)))
+	$(STAGING_DIR_HOST)/bin/buffalo-enc \
+		-p $(product) -v $(version) $(args) \
+		-i $@ -o $@.new
+	mv $@.new $@
+endef
+
+define Build/buffalo-enc-tag
+	$(call Build/buffalo-enc,'' '' -S 152 $(1))
+endef
+
+define Build/buffalo-tag-dhp
+	$(eval product=$(word 1,$(1)))
+	$(eval region=$(word 2,$(1)))
+	$(eval language=$(word 3,$(1)))
+	$(STAGING_DIR_HOST)/bin/buffalo-tag \
+		-d 0x01000000 -w 1 \
+		-a $(BUFFALO_TAG_PLATFORM) \
+		-v $(BUFFALO_TAG_VERSION) -m $(BUFFALO_TAG_MINOR) \
+		-b $(product) -p $(product) \
+		-r $(region) -r $(region) -l $(language) \
+		-I $@ -o $@.new
+	mv $@.new $@
+endef
+
+define Build/buffalo-dhp-image
+	$(STAGING_DIR_HOST)/bin/mkdhpimg $@ $@.new
+	mv $@.new $@
+endef
+
 define Build/netgear-chk
 	$(STAGING_DIR_HOST)/bin/mkchkimg \
 		-o $@.new \
diff --git a/tools/firmware-utils/Makefile b/tools/firmware-utils/Makefile
index 69cba69..2504678 100644
--- a/tools/firmware-utils/Makefile
+++ b/tools/firmware-utils/Makefile
@@ -80,6 +80,7 @@ define Host/Compile
 	$(call cc,jcgimage, -lz -Wall)
 	$(call cc,mkbuffaloimg, -Wall)
 	$(call cc,zyimage, -Wall)
+	$(call cc,mkdhpimg buffalo-lib, -Wall)
 endef
 
 define Host/Install
diff --git a/tools/firmware-utils/src/buffalo-enc.c b/tools/firmware-utils/src/buffalo-enc.c
index 794659e..08fad4e 100644
--- a/tools/firmware-utils/src/buffalo-enc.c
+++ b/tools/firmware-utils/src/buffalo-enc.c
@@ -35,6 +35,7 @@ static char *product;
 static char *version;
 static int do_decrypt;
 static int offset;
+static int size;
 
 void usage(int status)
 {
@@ -54,6 +55,7 @@ void usage(int status)
 "  -v <version>    set version to <version>\n"
 "  -h              show this screen\n"
 "  -O              Offset of encrypted data in file (decryption)\n"
+"  -S              Size of unencrypted data in file (encryption)\n"
 	);
 
 	exit(status);
@@ -118,7 +120,7 @@ out:
 static int encrypt_file(void)
 {
 	struct enc_param ep;
-	ssize_t src_len;
+	ssize_t src_len, tail_dst, tail_len, tail_src;
 	unsigned char *buf;
 	uint32_t hdrlen;
 	ssize_t totlen = 0;
@@ -131,8 +133,12 @@ static int encrypt_file(void)
 		goto out;
 	}
 
-	totlen = enc_compute_buf_len(product, version, src_len);
-	hdrlen = enc_compute_header_len(product, version);
+	if (size) {
+		tail_dst = enc_compute_buf_len(product, version, size);
+		tail_len = src_len - size;
+		totlen = tail_dst + tail_len;
+	} else
+		totlen = enc_compute_buf_len(product, version, src_len);
 
 	buf = malloc(totlen);
 	if (buf == NULL) {
@@ -140,12 +146,21 @@ static int encrypt_file(void)
 		goto out;
 	}
 
+	hdrlen = enc_compute_header_len(product, version);
+
 	err = read_file_to_buf(ifname, &buf[hdrlen], src_len);
 	if (err) {
 		ERR("unable to read from file '%s'", ofname);
 		goto free_buf;
 	}
 
+	if (size) {
+		tail_src = hdrlen + size;
+		memmove(&buf[tail_dst], &buf[tail_src], tail_len);
+		memset(&buf[tail_src], 0, tail_dst - tail_src);
+		src_len = size;
+	}
+
 	memset(&ep, '\0', sizeof(ep));
 	ep.key = (unsigned char *) crypt_key;
 	ep.seed = seed;
@@ -241,7 +256,7 @@ int main(int argc, char *argv[])
 	while ( 1 ) {
 		int c;
 
-		c = getopt(argc, argv, "adi:m:o:hlp:v:k:O:r:s:");
+		c = getopt(argc, argv, "adi:m:o:hlp:v:k:O:r:s:S:");
 		if (c == -1)
 			break;
 
@@ -276,6 +291,9 @@ int main(int argc, char *argv[])
 		case 'O':
 			offset = strtoul(optarg, NULL, 0);
 			break;
+		case 'S':
+			size = strtoul(optarg, NULL, 0);
+			break;
 		case 'h':
 			usage(EXIT_SUCCESS);
 			break;
diff --git a/tools/firmware-utils/src/buffalo-lib.h b/tools/firmware-utils/src/buffalo-lib.h
index ba8a508..7eb9bf5 100644
--- a/tools/firmware-utils/src/buffalo-lib.h
+++ b/tools/firmware-utils/src/buffalo-lib.h
@@ -69,6 +69,26 @@ struct buffalo_tag2 {
 	uint8_t		unknown2[3];
 } __attribute ((packed));
 
+struct buffalo_tag3 {
+	unsigned char	product[TAG_PRODUCT_LEN];
+	unsigned char	brand[TAG_BRAND_LEN];
+	unsigned char	ver_major[TAG_VERSION_LEN];
+	unsigned char	ver_minor[TAG_VERSION_LEN];
+	unsigned char	region_code[2];
+	uint32_t	region_mask;
+	unsigned char	unknown0[2];
+	unsigned char	language[TAG_LANGUAGE_LEN];
+	unsigned char	platform[TAG_PLATFORM_LEN];
+	unsigned char	hwv[TAG_HWVER_LEN];
+	unsigned char	hwv_val[TAG_HWVER_VAL_LEN];
+	uint8_t		unknown1[24];
+
+	uint32_t	total_len;
+	uint32_t	crc;
+	uint32_t	len1;
+	uint32_t	base2;
+} __attribute ((packed));
+
 #define ENC_PRODUCT_LEN		32
 #define ENC_VERSION_LEN		8
 #define ENC_MAGIC_LEN		6
diff --git a/tools/firmware-utils/src/buffalo-tag.c b/tools/firmware-utils/src/buffalo-tag.c
index b5db72e..6d479f7 100644
--- a/tools/firmware-utils/src/buffalo-tag.c
+++ b/tools/firmware-utils/src/buffalo-tag.c
@@ -48,6 +48,7 @@ static uint32_t base2;
 static char *region_code;
 static uint32_t region_mask;
 static int num_regions;
+static int dhp;
 
 void usage(int status)
 {
@@ -63,6 +64,7 @@ void usage(int status)
 "  -d <base2>\n"
 "  -f <flag>       set flag to <flag>\n"
 "  -i <file>       read input from the file <file>\n"
+"  -I <file>       read input from the file <file> for DHP series\n"
 "  -l <language>   set language to <language>\n"
 "  -m <version>    set minor version to <version>\n"
 "  -o <file>       write output to the file <file>\n"
@@ -227,6 +229,37 @@ static void fixup_tag2(unsigned char *buf, ssize_t buflen)
 		tag->crc = htonl(buffalo_crc(buf, buflen));
 }
 
+static void fixup_tag3(unsigned char *buf, ssize_t totlen)
+{
+	struct buffalo_tag3 *tag = (struct buffalo_tag3 *) buf;
+
+	memset(tag, '\0', sizeof(*tag));
+
+	memcpy(tag->brand, brand, strlen(brand));
+	memcpy(tag->product, product, strlen(product));
+	memcpy(tag->platform, platform, strlen(platform));
+	memcpy(tag->ver_major, major, strlen(major));
+	memcpy(tag->ver_minor, minor, strlen(minor));
+	memcpy(tag->language, language, strlen(language));
+
+	if (num_regions > 1) {
+		tag->region_code[0] = 'M';
+		tag->region_code[1] = '_';
+		tag->region_mask = htonl(region_mask);
+	} else {
+		memcpy(tag->region_code, region_code, 2);
+	}
+
+	tag->total_len = htonl(totlen);
+	tag->len1 = htonl(fsize[0]);
+	tag->base2 = htonl(base2);
+
+	if (hwver) {
+		memcpy(tag->hwv, "hwv", 3);
+		memcpy(tag->hwv_val, hwver, strlen(hwver));
+	}
+}
+
 static int tag_file(void)
 {
 	unsigned char *buf;
@@ -237,7 +270,9 @@ static int tag_file(void)
 	int ret = -1;
 	int i;
 
-	if (num_files == 1)
+	if (dhp)
+		hdrlen = sizeof(struct buffalo_tag3);
+	else if (num_files == 1)
 		hdrlen = sizeof(struct buffalo_tag);
 	else
 		hdrlen = sizeof(struct buffalo_tag2);
@@ -270,7 +305,9 @@ static int tag_file(void)
 		offset += fsize[i];
 	}
 
-	if (num_files == 1)
+	if (dhp)
+		fixup_tag3(buf, fsize[0] + 200);
+	else if (num_files == 1)
 		fixup_tag(buf, buflen);
 	else
 		fixup_tag2(buf, buflen);
@@ -299,7 +336,7 @@ int main(int argc, char *argv[])
 	while ( 1 ) {
 		int c;
 
-		c = getopt(argc, argv, "a:b:c:d:f:hi:l:m:o:p:r:sv:w:");
+		c = getopt(argc, argv, "a:b:c:d:f:hi:l:m:o:p:r:sv:w:I:");
 		if (c == -1)
 			break;
 
@@ -319,6 +356,9 @@ int main(int argc, char *argv[])
 		case 'f':
 			flag = strtoul(optarg, NULL, 2);
 			break;
+		case 'I':
+			dhp = 1;
+			/* FALLTHROUGH */
 		case 'i':
 			err = process_ifname(optarg);
 			if (err)
diff --git a/tools/firmware-utils/src/mkdhpimg.c b/tools/firmware-utils/src/mkdhpimg.c
new file mode 100644
index 0000000..e61d042
--- /dev/null
+++ b/tools/firmware-utils/src/mkdhpimg.c
@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) 2016 FUKAUMI Naoki <naobsd@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ *
+ */
+
+#include <sys/stat.h>
+#include <err.h>
+#include <fcntl.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "buffalo-lib.h"
+
+#define DHP_HEADER_SIZE	20
+
+static char *progname;
+
+static void
+usage(void)
+{
+
+	fprintf(stderr, "usage: %s <in> <out>\n", progname);
+	exit(EXIT_FAILURE);
+}
+
+int
+main(int argc, char *argv[])
+{
+	struct stat in_st;
+	size_t size;
+	uint32_t crc;
+	int in, out;
+	uint8_t *buf;
+
+	progname = argv[0];
+
+	if (argc != 3)
+		usage();
+
+	if ((in = open(argv[1], O_RDONLY)) == -1)
+		err(EXIT_FAILURE, "%s", argv[1]);
+
+	if (fstat(in, &in_st) == -1)
+		err(EXIT_FAILURE, "%s", argv[1]);
+
+	size = DHP_HEADER_SIZE + in_st.st_size;
+
+	if ((buf = malloc(size)) == NULL)
+		err(EXIT_FAILURE, "malloc");
+
+	memset(buf, 0, DHP_HEADER_SIZE);
+	buf[0x0] = 0x62;
+	buf[0x1] = 0x67;
+	buf[0x2] = 0x6e;
+	buf[0xb] = 0xb1;
+	buf[0xc] = (size >> 24) & 0xff;
+	buf[0xd] = (size >> 16) & 0xff;
+	buf[0xe] = (size >> 8) & 0xff;
+	buf[0xf] = size & 0xff;
+
+	read(in, &buf[DHP_HEADER_SIZE], in_st.st_size);
+	close(in);
+
+	crc = buffalo_crc(buf, size);
+	buf[0x10] = (crc >> 24) & 0xff;
+	buf[0x11] = (crc >> 16) & 0xff;
+	buf[0x12] = (crc >> 8) & 0xff;
+	buf[0x13] = crc & 0xff;
+
+	if ((out = open(argv[2], O_WRONLY | O_CREAT | O_TRUNC, 0644)) == -1)
+		err(EXIT_FAILURE, "%s", argv[2]);
+	write(out, buf, size);
+	close(out);
+
+	free(buf);
+
+	return EXIT_SUCCESS;
+}
diff --git a/tools/firmware-utils/src/trx.c b/tools/firmware-utils/src/trx.c
index aa1f5be..dc5bb67 100644
--- a/tools/firmware-utils/src/trx.c
+++ b/tools/firmware-utils/src/trx.c
@@ -100,7 +100,7 @@ int main(int argc, char **argv)
 	int c, i, append = 0;
 	size_t n;
 	ssize_t n2;
-	uint32_t cur_len, fsmark=0;
+	uint32_t cur_len, fsmark=0, magic;
 	unsigned long maxlen = TRX_MAX_LEN;
 	struct trx_header *p;
 	char trx_version = 1;
@@ -121,7 +121,7 @@ int main(int argc, char **argv)
 	in = NULL;
 	i = 0;
 
-	while ((c = getopt(argc, argv, "-:2o:m:a:x:b:f:A:F:")) != -1) {
+	while ((c = getopt(argc, argv, "-:2o:m:a:x:b:f:A:F:M:")) != -1) {
 		switch (c) {
 			case '2':
 				/* take care that nothing was written to buf so far */
@@ -243,6 +243,15 @@ int main(int argc, char **argv)
 				}
 
 				break;
+			case 'M':
+				errno = 0;
+				magic = strtoul(optarg, &e, 0);
+				if (errno || (e == optarg) || *e) {
+					fprintf(stderr, "illegal numeric string\n");
+					usage();
+				}
+				p->magic = STORE32_LE(magic);
+				break;
 			default:
 				usage();
 		}
