Here’s the simplest method I know of for flashing a TM-AC1900 to a RT-AC68U or RT-AC68P. As this is a free resource please write questions in the comments below – do not call or email my business or use contact form regarding this subject.
LEGAL DISCLAIMER:
Your warranty is now void. Bay Area Tech Pros does not provide any warranty of this item whatsoever, whether express, implied, or statutory, including, but not limited to, any warranty of merchantability or fitness for a particular purpose or any warranty that the contents of this item will be error-free. In no respect shall Bay Area Tech Pros incur any liability for any damages, including, but not limited to, direct, indirect, special, or consequential damages arising out of, resulting from, or any way connected to the use of this item, whether or not based upon warranty, contract, tort, or otherwise; whether or not injury was sustained by persons or property or otherwise; and whether or not loss was sustained from, or arose out of, the results of, this item, or any services that may be provided by Bay Area Tech Pros.
WARNING:
Do not update to new Asus or Merlin builds without executing code for fixing mtd5 partition. (see below)
How to flash AC1900 to AC68U:
- Install WinSCP, Putty, and a file archiver (click this link for ez). Install the Asus Restore Utility, mirror.
- Create a folder on your desktop, name it “router”.
- Download this file and extract it to the newly made router folder. It contains a firmware to downgrade to, a firmware to upgrade to, and mtd-write.
- Set static IP for PC.
start > run > ncpa.cpl > double click Ethernet > properties > IPV4 >
IP: 192.168.29.5
Subnet: Default (255.255.255.0)
Gateway: 192.168.29.1 - Place router into Recovery/Restore mode
Start with powered off router.
Hold reset button and turn on router while holding reset for 10 seconds. - Go to 192.168.29.1 in a web browser
If Mini-CFE webpage won’t load use Asus Restore Utility
If having trouble with this step perform NVRam Reset and try #6 again (see step #18) - Flash TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx
- Wait for reboot <5 mins – WiFi lights on router will turn on when boot is complete
- Log in to router (admin:password)
- Go to Administration > System > Enable SSH > Yes > Apply
Ezlink: http://192.168.29.1/Advanced_System_Content.asp - Open Putty and WinSCP and connect them to 192.168.29.1 using a admin:admin or admin:password
Tip: In WinSCP select SCP as file protocol, in Putty SSH - In putty type:
cat /dev/mtd0 > original_cfe.bin - In WinSCP refresh the window on the right side and note that original_cfe.bin is present
- Copy original_cfe.bin to a local drive
- Upload original_cfe.bin to https://cfeditor.feng.si/ > Select 1.0.2.0 US AiMesh as Source CFE > Download the new .bin > rename it to new_cfe.bin
- Upload new_cfe.bin & mtd-write & FW_RT_AC68U_30043763626.trx to router through WinSCP
- In Putty type:
chmod u+x mtd-write./mtd-write new_cfe.bin bootmtd-write2 FW_RT_AC68U_30043763626.trx linux - Perform NVRAM Reset, wait for reboot <5 mins
a. Power off router
b. Wait 10 seconds
c. Press and hold WPS button
d. Power up the router and continue to hold WPS button for 15-20 seconds until power LED starts blinking very quickly. - Reset PC IP back to default
- Log in to router using 192.168.1.1 and the router is now an AC68U with 64MB jffs
username:/password is now: admin:admin - Enable SSH (see #10) and execute the code for fixing MTD5 partition that is listed below.
Ezlink: http://192.168.1.1/Advanced_System_Content.asp - You can now flash Asus, Merlin, Advanced Tomato, Tomato, and DD-WRT firmwares.
Code for fixing MTD5 partition so you can update to latest firmware:
(this is entered in Putty after enabling SSH on the router)
cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && rebootVideo Examples:
Windows
Macintosh
References Used:
- Snbforums.com flash instructions: flashInstructions_cDec04_16.pdf
- Bootymonger from slickdeals: slickdeals.net
- Wherever I found https://cfeditor.pipeline.sh/
- Comment from Albert Lee
Flashable Operating Systems:
Helpful information:
- Asus Rebadger is a script that automates this process on a Windows 10 PC.
- If you have a fast connection you may benefit from Merlin or official builds as they have enabled hardware acceleration which allows the router to handle higher speeds.
- You may check router cpu speed at http://192.168.1.1/Tools_Sysinfo.asp
- If the 30/30/30 reset doesn’t work try this:
1. power off device
2. hold reset 20 seconds
3. power on device holding reset until power light blinks slowly - If you can’t get Mini-CFE or Asus Restore utility to work try the method outlined in this comment.
- There is discussion on the topic at whirlpool forums.
Alex,
Thanks for the instructions. Does this downgrade apply for any firmware version? I am running 3.0.0.4.376_3181.
The purpose of the downgrade is to enable Telnet/SSH as that option does not exist in newer firmware. If you cannot enable Telnet/SSH, whatever version you have, then you must downgrade. If you can enable Telnet/SSH then just skip ahead to step 12.
Hello thanks for this hack, I have a problem with my cfe I get it ok but it’s empty.
I can’t find a way to get it to renew. Says its invalid when I upload it.
Thanks for any suggestions you may have.
John,
This should help you out: https://www.snbforums.com/threads/t-mobile-cellspot.19435/page-10#post-243869
make sure you statically assign an IP when you switch it to AP mode.
I had lots of trouble with the 3181 firmware but it worked. Some of the issues I had were due to either the USB to Ethernet adapter, Ethernet cable, or the firewall software. If you run into issues you might want to consider swapping out the items mentioned above.
Good luck!
I missed the command to delete or fill the mtd5 Asus with FF etc. Anyone able to advise that?
After performing the 10/10/10 reset prior to flashing the TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx, I am consistently not receiving the Wifi lights. I tried to upload the FW but I get an “invalid transfer error”. What am I doing wrong? I cannot for the life of me, get the wifi lights to go back on.
I was wondering I have a question.
First of all I’m not tech savvy and I do not have access to a computer.
I was wondering do you purchase them yourself like at those prices are like $50 then also flashing and turn around and resell them because if you do I like to know at what site in Amazon or wherever you sell them at to look at them because I like to purchase one considering that since again I do not have a computer or tech savvy and currently I incapacitated due to a surgery from an injury from a fall and the surgery was performed in the VA Center in San Juan. I’m a US Marine retired.
You can contact me if you wish [EMAIL REMOVED]’.
If you don’t flash them and sell them if you know anyone who does that you’re comfortable with and know who they are if you can forward that information to them or to me I would greatly appreciate it.
Rather than paying someone to flash and ship a router just buy a more expensive router.
First, if you don’t have a computer, what do you need a router for? If it’s just to get wifi for your phone or tablet, any cheap ($30) router will be fine. The TM-AC1900 is a fairly high-end router with lots of power. More than needed for many people.
STEP 28.Flash FW_RT_AC68U_30043763626.trx is VERY Important. You have to flash to this specific firmware before flashing to any later ASUS firmware versions or custom firmware.
From the slickdeals thread:” NOTE: If you are flashing later versions of Asus or Merlin 376.xxxx or ANY version of 378.xxxx or 380.xxxx (Asus or Merlin), you must flash to a firmware that will expand your rootfs partition from 32M to 64M first. Asus 376.3626 is recommended. Flash Asus 376.3626 and after installation, reset NVRAM. This will expand your rootfs partition and allow the new firmwares to install correctly!”
Thank you for putting all this together!
Thanks, I left a note in the guide to reference this. I don’t recall doing that when I flashed my router though. If I get another one of these routers I’ll verify the procedure.
my tmobile ac1900 firwire version is 3.0.0.4.376_3181-g247286a.. but it never goes to rescue mode.. what could be reason… i am following ur instructions as written, please help.. i want to flash this router
If it never goes to rescue mode I cannot help you as that sounds like a hardware defect. More likely, however, is that you’re improperly describing not being able to connect to the router while it is in rescue mode. You’ll need to confirm your issue and provide some more information as to what you’re doing and experiencing for me to provide assistance.
as @skn99 said, I’m having same issue. I tried the method describe in this article, 10 sec hold, turn off router while holding for 10sec, and turn on the router while hold 10 sec. I even timed with the stopwatch and tried other method found on internet but no luck. I have same firmware (3.0.0.4.376_3181). I wish there’s better way to describe the issue, but it’s simply not going into rescue mode… going into rescue mode might be different in this firmware?
try this:
1. power router off
2. hold reset button 20 seconds
3. power on and hold until power light flashes slowly
The newest firmware seems to make the rescue mode much more difficult to enter into and stay in. When I received a TMC-AC1900 with the 3.0.0.4.376_3181-g247286a firmware on, to enter into rescue mode I had 1) power of the router 2) hold down all three of the Reset, WPS, and Wifi On/Off buttons down 3) power on the router and wait till the power LED on the front starts blinking rapidly 4) release the WPS and Wifi On/Off buttons but continue holding the Reset button down, the Power LED should now start blinking slowly and you will be in Rescue mode. You may need to continue holding the reset button through the entire firmware flash.
I also noticed that rescue mode is either unstable or has a short time limit on it, so I would recommend having a browser(Chrome) open to 192.168.29.1 and constantly refresh while you restart the router holding the Reset button down. It may take you to a page with something about “Your settings have been applied…”, just keep hitting the refresh until the Mini-CFE page comes up. You will then have to quickly select the firmware file you’re trying to upload and click upload. If you’re using Chrome, it will tell you the status of the upload. If it fails to upload, restart the router with the method above and try again. The Asus Rescue Utility seems to fail every time during upload, so I would steer clear of it, though it will tell you if your router is in Rescue Mode.
Also, just a note on Step 12. In order to use WinSCP you must also enable the SSH Daemon in that same page along with Telnet. SCP uses SSH and is not enabled by default.
I have uncovered another piece of the puzzle for those of you having a difficult time getting into recovery/restore mode.
I have read through all the posts up and down a couple times and noticed that a few people have the misfortune of getting devices that cannot, for the life of them, no matter what method they use, get the power led to slowly blink (aka get into recovery/restore mode).
I was one those unfortunate individuals. This is what worked for me. It is uses Rob’s method in addition to my discovery.
1) Power off the router
2) Hold down the Reset, WPS, and Wifi On/Off buttons
3) Power on the router and wait till the power LED on the front starts blinking rapidly
4) Release the WPS and Wifi On/Off buttons but continue holding the Reset button down. For most, the power LED will begin blinking slowly. For the unfortunate few, it will still be solid.
5) Continue Rob’s process as if the power LED is blinking. Open to 192.168.29.1 and refresh the browser until the Mini-CFE page comes up. Flash firmware 1708.
6) Continue Alex’s tutorial from here on out
Note: Once firmware 1708 is flashed, the 30/30/30 method will work all the time.
I was able to convert AC1900 to AC68U successfully as well as update to the latest Asus firmware. Running smoothly now.
Good luck guys and thanks for the all the info.
mine is 3.0.0.4.376_3199, used your method and works !!
make sure:
111. LED light ON- pressed in. other wise not goona work!!!
follow these steps
1) Power off the router
2) Hold down the Reset, WPS, and Wifi On/Off buttons
3) Power on the router and wait till the power LED on the front starts blinking rapidly
4) Release the WPS and Wifi On/Off buttons but continue holding the Reset button down. For most, the power LED will begin blinking slowly.【Mine does not blinking slowly, it turns solid after I release WIFI on/off+WPS button, but Iam able to flash now】
didn’t see any one have the same verson (3199) like mine, only 2 differences. led on + appears solid light instead blinking slowly.
continue my flash, YAAA
After Step 4, the LED light did not blink slowly but it turned solid. However, I was still able to flash it.
Initially, I was using ASUS restoration utility and I was getting a message that the router was not in recovery mode. But then, I used mini-CFE and was able to flash the router.
Thank you guys for your help.
i have same version 3199 as “tony says”. with 3 button pressed following the same step as his and I can confirm “no slow blinking power light” but I have the Mini CFE screen. However when I upload the stock TM firmware 1703, I repeatedly have this error:
Receive file size=16949297 The file transferred is not a valid firmware image.
I have re-downloaded this firmware from multiple sources and all end up with the same result.
Anyone has this issue and way to resolve it?
Great Tips you guys. I got an 3.0.0.4.376_3181-g247286a firmware version also
I did Rob’s three finger and a pen while looking at a light (sheesh how bad can they make it!) trick, I didn’t get the flashing light, and I proceeded as Mitesh stated. One time I saw the CFE screen so I had home, and moved fast, but no upload. Most of the time it would show the “wait, settings are changed screen” which comes after the WPS and power on causes a reset.
So I wondered, maybe there’s a hybrid here? Maybe they disabled the flashing light, but the three fingered method was mostly causing a nvram reset. So I tried the original method, power off, hold reset only, power on while still holding reset, and ignore the light (which doesnt blink)
I hit refresh continually on the browser….
It went right into the CFE upload screen first time! So give that a shot too…
I used Chrome, it shows the file uploading in the lower left, you should finally see this:
Receive file size=16949294
Upload completed. System is going to reboot.
Please wait a few moments.
Continue
So please post up if this works, I’m sure this will get some more of the refurbs off the market until the next bad patch
Thanks All
PS OMG I wrote all this and I was still offline through the ASUS, thank god it was still cached in there whew!
For others having a hard time with 3.0.0.4.376_3181-g247286a firmware which my device came with already flashed, I tried all these steps and random variations over and over with no success, in the end what worked to my surprise was stop worrying about counting seconds and flashing lights and:
1) Power off
2) Holding reset button in using a clamp and a small scrap of plastic to make CERTAIN it stayed pressed.
3) Power on
4) Manually refresh browser until Mini-CFE flash page was displayed
5) Flash to 1708, reboot
Follow the instructions here
Once that was done, flashed the latest ASUS firmware and reboot, then configure operation mode to “AiMesh node” and it worked first time.
THANKS! I am uploading NOW!!! :)
I had the version 3181 and got stuck at the page where it said something to the effect that “settings have changed…”
I followed hoopsurfer suggestion at 2018/01/11 at 8:39 PM and worked like charm. This is what I did.
1. Power off the router
2. Opened a chrome browser window and typed in 192.168.29.1 (don’t hit enter yet)
3. Hold in the reset button
4. Power on and hit enter the browser window
5. Keep refreshing.. CFE comes up in short order.
6. Browse to the 1703 firmware you downloaded and select and upload
7. As others have suggested, the bottom left of browser window shows progress in percent.
8. Once it reached 100%, got the message “Receive file size=16949294 Upload completed. System is going to reboot. Please wait a few moments. Continue”
9. After few minutes, I clicked “Continue” and got the login screen.
10.NOTE: Through out the upgrade, I held reset in but once in a while, I released it accidentally but didn’t seem to affect.
This is the type I needed.
Thanks, Rob
I tried it and it worked!. Thanks for the post. Much appreciated.
I recall I thought mine wasn’t going to rescue mode… but it was just that the light wasn’t flashing as expected.
Found your Slickdeals link. BIG ups for crafting this together for us. I’m rolling up my sleeves tonite and thankful to have something so much more concise and clear than other instructables. THX THX THX
PS. Had my unit since last July. My motive is when TMobile finally hit me with the _3181 auto update sometime in Feb, something def went fucky: Lots of stalled file transfers on various LAN connected volumes. Took a month of head scratching and old router swaps before I figured it out.
First, Thanks for this post. I get the white light on the back to flash but unable to get Asus Restore Utility to see the router.
I’ve been having issues with the TMO Stock firmware and 5 GHz dropping out. Will flashing fix this issue. I suspect it is a firmware issue and not a hardware because i have experienced this with 3 routers.
Thanks
So, I finally decided to do this… wow… I did it just to run the stock firmware from asus…
It is not a quick thing to do… and had to take parts from several different compilations..
1703 is absolutely necessary…. the guides for cme make that part an easy change, but after getting this far, I was stuck, it wouldn’t load the .3626…
It somehow got caught with a partial load as some parms were changed, it identified as asus, but as a 1703 build… restore would do anything as it felt it was not in recovery.. gui said all tmobile and asus builds were invalid, as would the mini webgui…
Main web gui would say newer was available, but it too was invalid..
After what I can only guess was around router reboot 200, the mini gui finally decided to take the 3626… and was able to upgrade to newest build from there with no issues..
The time I did get out to take i was holding reset as I submitted the boot file… as I had done many times before…
If you decide to do this (and if you have a family that likes to use the wifi) I recommend having another router to act in it’s place, and undertake when you have plenty of time to research other ways to make stuff happen..
Btw, before downgrading I was able to toggle tenetD on as well as sshD… neither worked.. but did show errors on the syslog after turning them on… the error seemed unrelated to either daemon, but only occurred after forcing enable through the web page unhiding…
Big thanks to all who have made this possible!
Hi, and thanks for writing this up. I need a little push in the right direction.
Everything went smoothly (downgraded firmware, reset nvram, enabled telnet) until step 13.
Firefox and Putty connect to the router with no problem, but WinSCP won’t connect to the router – it continuously errors out with “Connection refused”. I have SCP selected as the file protocol, but am stuck without being able to connect WinSCP to the router.
I used the same IP/login/password that I used to connect Putty. I also tried connecting WinSCP without Putty or the browser connected, same issue.
In the WinSCP login screen, I changed File protocol to SCP, entered the router’s IP (192.168.29.1) and the login and password, clicked “Login”, and got “Searching for host…” then “Network error: Connection to 192.168.29.1 refused”.
And so I’m stuck. Any suggestions, please?
Never mind. Did a bunch of reading and looking at videos, and found a way around having to use WinSCP, which I never got to work.
I used a USB stick and Putty for accessing the router files.
That web site that patches the .bin file for you that you found saved a lot of time and anguish, BTW.
And one other thing – if anyone uses the USB stick method, the version of mtd-write that was in the zip file with the images did not work for me; I had to find and use version 2 before everything started working correctly.
So I ran into the same issue that Bob did. Step 13 did not work – SCP would not connect.
The issue is SCP does not work over Telnet. For me, the fix was to enable SSH as well as Telnet in the router at step 13. Once I did this, SCP worked right away. Hope it helps some others!
I just wanted to leave a comment to say thank you for this great write-up! I got mine up and going without a hitch.
Hi guys,
I was able to get everything done multiple times over but one problem I’ve seen. Not sure my router is working at 100% right now or just 99%. When connected to the router through ethernet, the laptop recognizes the router as cellspot, whether I have asus firmware or merlinwrt. Is that supposed to happen? Or is there something I’m missing?
Does it say the router is an AC68U when you log in at 192.168.1.1 ?
Hi Alex,
I have a problem.
26 steps are done, but after I can not Flash FW_RT_AC68U_30043763626.trx.
If I use Mini-CFE always lost connection and no answer.
If I use Asus Restore Utility after 40%-50% apload router automatic restart.
Do you have any ideas?
Regards,
Rez
Try to do an nvram reset and then flash a Merlin or official build. Let me know if that works.
If you’re getting “Connection Refused” for step 13, you need to enable SSH along with telnet.
Thanks, I’ve adjusted the guide to reflect this. There’s no reason to enable Telnet if SSH is enabled, and SSH is accessible through both Putty and WinSCP.
Thank you so much for this guide. I looked at several guides including YouTube and kept finding conflicting or confusing information. Not only was this super easy to follow, my router is ridiculously stable. I couldn’t make stable WiFi calls before, but now I can even stream uncompressed bluray mkv files over WiFi without issues running Asus Merlin. This router is crazy awesome now. I almost gave up on flashing it before finding your guide.
Couple notes…
For OSX users/Newer OSes with built-in hardening, Diffie Hellman rejects will occur; either find a machine with an older OS, or you’ll need to add the cipher to SSH config (and remove when you’re done).
Asus firmware restoration REQUIRED for step 24. The mini-cfe page does not do the trick for step 24, you HAVE TO use the firmware restore utility. Worked fine on my Mac. In step 24, DO make sure your router takes 192.168.1.1, not 192.168.29.1; something is going on here, I had to do it a couple time, including using 1.0.2.1 for it to take 192.168.1.1 and then use the restore utility.
Do verify you completed the CFE upload correctly after 20 by running “nvram get bl_version” after and it’ll be 1.0.2.0 or 1.0.2.1 afterwards depending which you choose. I choose 1.0.2.1 personally.
On step 20, pull the plug instead. Known issue that some folks (like myself) don’t have it actually work unless you pull the plug instead of issuing a soft-reboot. (see step above to make sure it took before proceeding).
mtd-write version 2 should be used if you use a USB drive (I did). The Slickdeal goes into this. For version 2, also follow the slickdeals thread.
Hello, thank you for this information. I performed my flashes with Windows 10 and did not experience any rejects so it may only be an issue for OSX.
The solid confirmation that AFR is required for step 24 is appreciated. I’ve adjusted the guide on that step.
In regards to verifying the cfe upload, I did do that the first time I flashed this. However I flashed 6 more routers after that and did not bother with it because I am lazy and they came from the same source (tanga). I am noob in this regard and don’t know the difference between the versions and doubt it matters for the end result.
I won’t adjust step 20 as it worked perfectly for me with the putty command within context of this guide. Same goes for mtd-write. Though I’m sure someone troubleshooting following another guide will find your information useful.
Thanks for this update. I am on a Mac using the latest version of OS X (High Sierra) and find it impossible to make any connection to the router using a Mac.
I was able to upload the older version of the firmware and enable SSH but I cannot connect I found to it.
I used online instructions on how to create a pair of SSH keys (public and private) and the router asked for the passphrase. But it will never connect fully. I have tried Cyberduck, Mountainduck, Forklift and Mac Terminal and nothing works.
I would appear I need access to a Windoze machine because even Parallels uses the Mac OS X for networking.
Called AppleCare. Useless. Called ASUS. Useless.
Until I can get into the file system of the router, I am dead in the water.
The error message from Cyberduck reads:
Interoperability Failure
EOF while reading packet. Please contact your web hosting service provider for assistance.
Any suggestions? I have no access to a Windows machine.
Is this the error you are getting?
https://www.petenetlive.com/KB/Article/0001245
If so, I tried what was suggested here and I could connect.
how do you confirm the rootfs is 64 MB?
flashing FW_RT_AC68U_30043763626.trx in step 24 expands it to 64m
if it didn’t then the guide would be useless as it wouldn’t be possible to flash ac68 builds
so it’s confirmed
In Putty, you can check your current partition size using the command:
df -h
If you have a 32MB partition, jffs will also be around 32MB. If you have upgraded to 64MB, jffs will show something closer to 64MB.
That’s from my original guide :-). That’s the jffs partition, but it expands when rootfs expands, so it’s easy to check.
Nice work putting this together, Alex, and thanks for the proper citation!
I can’t do step 24 for the life of me. Restore utility can never connect, and CFE says the new firmware is an invalid image. Can anyone help? Thanks!
I’m having the same issue
Check again, the guide has been rewritten and Step 24 is no longer required.
Check again, the guide has been rewritten and Step 24 is no longer required.
I recently started the flashing process on one of these I got a few months back.
Got all the way to the step where I flashed the CFE and rebooted it, At that point, none of the 5 wired ports respond in regular or recovery mode. No pings, no http, nothing.
The wireless still works. I can get the web interface up. I can ping it wirelessly. I can still ssh onto the router via the wireless nic.
I’m kinda at a loss. I suspect the CFE busted the mac addresses of the 2 Ethernet controllers in the device somehow. Not really sure how though, because the macs lineup in the original and new CFE files. I did choose 1.2.0.1 on the CFE website. I wonder if that is the problem.
Just run back through the steps and try with 1.2.0.0 and do an nvram reset.
For future reference, I reflashed the original CFE back onto it and it revived the wired ports. Another build of the new CFE worked fine. Must have been a bad file.
This process worked flawlessly for me. It took less than 30 minutes, I now have a full blown ASUS AC68U running the latest ASUS firmware.
Thank you!
Thanks for the post! I followed it and it works flawlessly. There is no need for PuTTy or WinSCM if you’re on Mac (like me), just the plain old terminal works great. Thanks again.
Thanks for this tip, was just searching for this when looking for winscp alternatives lol
As a first time flasher, could you please provide a little more detail on how to do all the steps on an Apple MacBook Pro using Terminal? Especially the part about how to connect the computer to the router and log in in order to issue the commands, upload, and download, etc. Could I use Cyberduck instead of Terminal?
How much time should I budget to complete this conversion?
What version of Mac OS are you using?
I cannot make an SSH connection into the file system of the router, even after downgrading the firmware and enabling SSH, Port 22.
I thought maybe creating a public and private RSA key set would help. But no.
The error message from Cyberduck reads:
EOF while reading packet. Please contact your web hosting service provider for assistance.
When i log into the router admin it shows FW version 3.0.04.376.1703 and putty shows ASUSWRT RT-AC68U_3.0.0.4Was able to complete process up to step #12 and can connect both WSCP and Putty router but when i enter the command line the original_cfe.bin does not get created, What am i missing?
Hit the refresh buttno on the winscp window and it should show the original cfe
Thanks Alex, I tried that and also did a search from root directory for that file but in vain, I’m not getting an error from putty neither, when i hit enter after pasting the command i get back to admin@TM-AC1900:/tmp/home/root# but the original.cfe file is nowhere to be found on 192.168.29.1, what am i doing wrong?
I have no idea what you’re doing wrong, sorry. Try starting again from step 1 and maybe you can find it or refer to another guide.
I’m having the same problem as you, Steve. I can not for the hell of it find original_cfe.bin in the dev folder. I tried reflashing the FW 5 times last night, with no luck :(. I wonder if anyone else is having this problem…
same problem
I was able to downgrade the firmware to the first TM version, but I’m stuck after loading the Asus CFE. I tried 1.0.2.0 and 1.0.2.1 with a couple different mtd-write versions, but I could never get it to load the mini-CFE and the Recovery tool could never find the router (yes, I set a static IP, tried using both 192.168.1.* and 192.168.29.*). My last attempt, I followed some forum post I found saying I should first set it to AP mode then try to go into recovery mode. I did this after flashing 1.0.2.1 with mtd-write v3; now I think I may have bricked it..
It still seems like it responds to the button presses; if I turn it on holding reset and leave it pressed for like 30 seconds, the power button will start to blink. I can also do the WPS button nvram reset, and I can see the lights responding. But after doing either of these, I still cannot connect or talk to the router. Before that, every time I did the WPS nvram reset, it would go back into normal running mode and I could enable SSH or configure the router like normal.
I’ve also tried doing 30/30/30 reset and just leaving it unplugged for a while, but I can’t get it back to normal working mode. Any thoughts?
I had the same thing happen. :( Sad times.
I’m stuck on step 25… minicfe says the firmware is incompatible and the discovery utility doesn’t seem to have any options to upload firmware.
Also on the Wipe NVRAM portion, are steps a b c d how to do it or are they to be done after doing it some other way?
Did you find a work round for this.
Realized the install had not completed properly and didn’t have the firmware restore tool installed.
However I guess I am not getting into rescue mode as the restore tool says the device is not in rescue mode and the power button never flashes slowly.
Tried both holding the reset button as described and holding all 3 buttons as the other user described… it doesn’t want to go into rescue mode…
I am having the same issue. I tried Rob Holland’s method. In his method I get to the point where the power light begins rapidly blinking but when I let go of the reset button it goes solid.
I tried the 30/30/30 method which doesn’t work.
I tried the alternate method (power off device, hold reset 20 seconds, power on device holding reset until power light blinks slowly) which also doesn’t work.
Am I doing something here?
Unfortunately, I get stuck at step 19
./mtd-write new_cfe.bin boot
it returns: ./mtd-write Input/Output error
Any clues? I’ve tried rebooting the router, clearing the nvram, …
HELP!!!
did you copied new file with exact name “new_cfe.bin” (no spaces, with “_” sign?) to the root folder with winSCP as it says in the manual?
Thank you very much. Your instructions are dead on. I had problem accessing the router after the upgrade as it automatically kept switching the subnet on me. In the end it worked out and upgraded the router to the recent stock firmware and would not be happier.
BTW Step 23 really means repeat “Enter recovery mode (repeat Step 5)”. I was doing the alternate method of entering recovery on the latest TMO firmware (from Rob Holland comment) — this was ONLY necessary during initial step 5. Once flashed with the 1703 firmware Step 5 instructions applied. That could have saved me an hour.. hoping it saves someone else. This procedure DOES work as of 10/3/2017.
Thank you very much for such a precise and easy to follow instructions. I did a lot of googling to find out this but instructions at other sites are too clumsy.
Well done for such a great job !!!
Worked like a charm. 0 issues, just make sure you follow the steps to the letter.
Can confirm, jsut did this step by step for firmware 3.0.0.4.376_3181. Just don’t forget to set router into AP mode before connecting with PC with static IP and after downgrade to _1703 version otherwice you will not get miniCFE page or Asus firmware restoration tool to connect to router (this info is not very clear stated in the manual).
Actully I was able to set the _1703 file via miciCFE page (was holding reset button till the file started to upload (chrome shows in the left down corner this info)), but for the upgrade to Asus file _3626 miniCFE didn’t load (or was not uploading new firmware, cannt recall) but Asus firmware restoration tool was able to connect and did the job. NVRAM reset was made without any problems.
Many thanks for this manual.
This is a gem. I hope the universe bestows wonders in your general direction. Thanks mate!
I took notes when flashing my TM-AC1900 a year ago and there are parts of these directions that could be greatly simplified.
The T-Mobile firmware includes mtd-write2 so uploading a copy of mtd-write is not necessary. mtd-write2 can be used to write both the new CFE and the AsusWRT firmware image in the same step.
The telnet option is still available in the T-Mobile firmware but hidden in the web interface, so downgrading to a different firmware version is not necessary as long as you have a USB drive to store files since scp won’t be available.
Steps 2-10 can be replaced with:
1. Go to the T-Mobile firmware’s Administration->System page (http://192.168.29.1/Advanced_System_Content.asp)
2. Right-click and select “Inspect” or “Inspect Element”.
3. Look for an element with name=”enable_telnetd” in the inspector window
4. Remove the “hidden” attribute by selecting it and pressing Backspace/Delete until it is gone
5. Select “Enable Telnet” on the web page and click “Apply”
Steps 16-24 can be replaced with:
1. Copy new_cfe.bin and FW_RT_AC68U_30043763626.trx to a USB drive.
2. Insert the USB drive in one of the router’s USB ports.
3. `mtd-write2 /tmp/mnt/*/new_cfe.bin boot`
4. `mtd-write2 /tmp/mnt/*/FW_RT_AC68U_30043763626.trx linux`
Lol, that’s awesome!
3. `mtd-write2 /tmp/mnt/*/new_cfe.bin boot`
4. `mtd-write2 /tmp/mnt/*/FW_RT_AC68U_30043763626.trx linux`
the above are input via putty, right? Thanks and will give it a try soon. waiting my TM router comes
this element is not present in the latest TMO firmware 3181. I’ve searched for it within the window using control F. I can see the other hidden elements and edit and delete them. Telnet is not one of the options.
Thanks for the confirmation.
The telnet option is there on the 3199 firmware. I am not a guru and I got there in Chrome by logging into the router then system. On the system tab I right clicked inspect. Then go to the Misc heading on the router display and right click inspect. Then search for telnet control F and it shows up in the box (32 of 5 when searching) and you will see display “none”
remove the none to look like this
That puts the telnet there but the radio buttons are not operable
To fix that I can’t seem to copy it but when I click on the attribute I changed the value of the radio button and was able to select the Yes button and apply.
When I go back in even though I do not see it –if I select the element again it is enabled
My next step to is try to upgrade this router so I am following the instructions here – the first time I tried I could not even get it into recovery mode
The suggestion from Albert Lee about using Putty to upload the firmware image solved the issue I was having where I could no longer enter recovery mode after writing new_cfe.bin. The router would have the flashing power light, but the ASUS rescue app would find the router and indicate that it was not in recovery mode. Similarly, the router would not respond to a ping. Using putty to write the firmware was much easier and solved all of my problems. Since I was not using a USB drive, I modified the command to be: mtd-write */FW_RT_AC68U_30043763626.trx linux
Thanks for the instruction. I was stuck at Step 24, couldn’t enter mini-CFE and Asus restore utility always aborts at about 50%. To flash FW_RT_AC68U_30043763626.trx, I eventually did the following:
1) enabled sshd in the router,
2) scp the mtd-write and FW_RT_AC68U_30043763626.trx,
3) ssh into the router, performed the following:
./mtd-write2 FW_RT_AC68U_30043763626.trx linux
4) reboot the router by powering it off
– reboot via command prompt will result in seg-fault, since we just wiped the system,
5) erased the nvram, and waited for couple of minutes.
your instruction to use mtd-write2 to flash the ram probably saved me a few hours of work. Thanks.
Thanks Mikeong.
I was able to follow the steps you posted on mine when it would not go to recovery mode.
Only thing I did that was not the same is I used mtd-write rather than mtd-write2.
I am now on the 3626 firmware and will move on from here.
You saved me hours of trying to hold two buttons down, while pushing in a [recessed] reset switch, and turning the power on off while trying to observe the front panel power LED, simultaneously using a mouse to try to use the Asus restore. Maybe I am uncoordinated lol
Anyway, I knew that there had to be a simpler way, and this was it.
Follow this instruction, I successfully brick my router.
How can I rescue it?!
never mind. my router is back and successfully flashed to 3626 after I change my static IP to “Obtain the IP address automatically”.
./mtd-write FW_RT_AC68U_30043763626.trx linux
is the best solution.
It seems that even if you enable telnet and ssh in browser using “Inspect Element” only sshd_enabled:1 will be sent as form data during POST in “Apply”. Nothing about Telnet.
But problem is that even if sshd_enabled:1 is getting sent to backend, it does not enable ssh and Putty still failing.
Any ideas? I already tried to reboot router
Unable to login after step 8. Neither login combo works. Any suggestions?
Reset router holding the reset button as it is powered on, it will reset the password to admin:admin or admin:password.
I’m had the same problem.
For me, password reset was by holding reset button for 10-seconds while it was already powered on, then waiting for it to reboot.
Got a 2015 TM-AC1900 with stock FW 3108 from Ebay, followed this tutorial then successfully updated the FW to Asus Merlin 380.68_4. Thanks for putting this together.
A couple of things I noticed while flashing my router:
1). Default admin password for TM and Asus’ FW is different. Swap between admin / password to figure it out if system says your password is wrong.
2). Clearing NVRAM — make sure you do so each time you update FW (this includes downgrading between TM 3108 and 3107; between TM 3107 to Asus AC68U FW; and between AC68U FW and Tomato / Merlin FW; and after you flash to Merlin FW…)
3). Step 28 — once you are on Asus FW_RT_AC68U_30043763626 FW, you can directly upload Merlin FW from router’s UI: update firmware option, instead of booting to rescue mode then using Firmware Restoration Utility (this option actually didnt work for me — which is weird…)
I got stuck at step 23 BUT i have found a work around that worked for me.
To get into recovery mode power off the router. When you power it on, make sure you are pushing and holding down the RESET button at the same time as powering on. The power light will then blink afterwards, the back light will not blink so pay attention to the power light on the front.
The Asus firmware restoration did not work for me so I used the CFE mini browser to upload. MAKE SURE YOUR CACHE IS CLEARED before using the CFE browser. It will not complete if you dont take that step. You can also use Google Chromes incognito mode if you dont want to clear cache.
Thank you! The cache clearing/incognito tip helped immensely. Should have thought of it but didn’t.
Worked exactly as written, with no hassles or workarounds needed. Thanks for taking the time to make this guide, Alex.
Stuck at step 9. Neither admin:admin, nor admin:password work for me to log in. Any thoughts?
Factory reset the device by holding the reset button. That should clear the password.
Thanks. Worked flawlessly
I’m having a problem getting back into recovery mode after rebooting on telenet after clearning NVRAM on step 23
I went from Merlin back to stock… Merlin didn’t add anything I needed. Any discernible advantage to over clocking?
Overclocking will help if you’re installing apps from optware/entware like owncloud (which you’re not since it is running stock) or a bunch of vpn servers or a media server. Otherwise, if you’re not pushing the router, it will probably give it longer life to run at lower clocks.
Also it isn’t really overclocking, the stock speed for the ac68u router is 1ghz, but the ac1900 one runs at 800mhz even though it has the same hardware (citation needed).
Settings have been updated. Web page will now refresh.
Changes have been made to the IP address or port number. You will now be disconnected from TM-AC1900.
To access the settings of TM-AC1900, reconnect to the wireless network and use the updated IP address and port number.
this is all im getting ughh
What have you tried? Tried a factory reset? Tried flashing from minicfe or recovery tool? Have you read the other comments here and their solutions for getting past step 23? You’ve got to give more detail, otherwise you’re just complaining and making it difficult to give you any help.
So I left the router off over night and was able to get it into recovery mode but ran in to more problems after that. I wasn’t able to flash FW_RT_AC68U_30043763626.trx. It said that this firmware was invalid. I tried using the asus utilities but it didn’t work also. I tried using the stock built and got firmware was invalid
I was able flash step 4 and start all over. I gave more time after rebooting. I was successful after this. Thanks.
JUST TAKE YOUR TIME.
I bought two TM1900ACs and both were on 3181. One worked with Rob Hollands 3 button instructions, the other one did not. This is what worked for me on the other! Credit goes to awrsantos @ snbforums! Link here: https://www.snbforums.com/threads/t-mobile-cellspot.19435/page-10#post-243869
The exact instructions didn’t work for me. At step 4f, I released the reset button once the CFE page loaded and continued. Everything else otherwise worked!
1) Disconnect the router from the network/internet, only 1 wired Ethernet cable should be plugged
into any LAN port, DO NOT do any firmware related flashing via WIRELESS
2) Restore FACTORY DEFAULTS of the Router, this should set the IP of the router to 192.168.29.1
3) Set your computer to use a static IP of 192.168.29.88
4) Place router into Rescue/Recovery/Restore Mode
a) Turn power off to the router by disconnecting the power cable
b) Wait 10 seconds
c) Press and Hold the Reset button
d) Restore power to router while continuing to hold Reset button
e) Continue to hold Reset button for 8 seconds while entering 192.168.29.1 on browser
f) Wait for MiniCFE webpage to appear
5) Flash the T-Mobile firmware version 3.0.0.4_376_1703 TRX file using the “Asus Firmware
Restoration Tool” or “MiniCFE webpage.” Continue to hold Reset button while flashing custom
firmware
a) TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx
6) Wait 5 mins
7) Perform NVRAM RESET
a) Turn power off to the router by disconnecting the power cable
b) Wait 10 seconds
c) Press and hold the WPS button
d) Restore power to router while continuing to hold WPS button
e) Continue to hold WPS button for 20 seconds then let go
8) Wait 5 mins
9) The firmware should now be downgraded and you can verify by longing into the router and
checking the firmware version through the web browser interface.
I cannot get the command cat /dev/mtd0 > original_cfe.bin to work. always says
-sh: can’t create original_cfe.bin: Input/output error
I can’t find original_cfe.bin either. Must be a recent FW block of some sort coming from T-Mobile.
The procedures for entering restore mode is wrong. Just power off the device and wait for 10 sec. Hold the reset button, power on, and continue to hold until the power light is flashing.
Thanks for this write up! It worked flawlessly!!
Im on step 15 and I got the original_cfe.bin file but everytime I upload nothing happens. I did the values and everything. My size of the file is at 0KB is that suppose to be right?
Probably not. If you open the file in notepad is it blank?
I have the same issue… and yes it is blank
Hi I keep trying to upload the original cafe but it keeps saying invalid.
Any ideas.
Thanks.
Hi. Thanks for this. I was able to flash the downgrade. The cfe browser will start uploading the Asus FW but it says invalid image. When I try the Asus restoration software, it says not in rescue mode. Any ideas? Thanks.
I got to step 23 and tried to load but can’t get into recovery anymore
I’m on step 11 and when I open putty and put in the IP I am setting a pop up called PuTTY Security Alert. It says “The first key-exchange algorithim supported by the server is diffie-hellman-group1-sha1, which is below the configured warning threshold. Do you want to continue with this connection?”
I have no idea what this means. Did I do something wrong?
If you want to make the connection you press yes, if you don’t want to flash the firmware you press cancel.
I just purchased one of these (refurbished) directly from TMobile’s website … mine came preloaded with the TMobile 3.0.0.4.376_3169 firmware. Lucky for me, the router’s admin-page still exposes the option “enable SSH”, so I was able to enable SSH from the TM1900’s from admin-page, and skip steps 1-11 of the guide.
From my Windows PC, when I run putty.exe to login to the router, the login-banner says this:
ASUSWRT TM-AC1900_3.0.0.4 Fri Mar 11 09:41:31 UTC 2016
Since my TM-AC1900 came preloaded with firmware from 2016, I thought the rootfs might already be expanded…
admin@(none):/# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 14208 14208 0 100% /
devtmpfs 127744 0 127744 0% /dev
tmpfs 127852 1492 126360 1% /tmp
/dev/mtdblock6 31488 1080 30408 3% /jffs
/dev/mtdblock7 1280 388 892 30% /T-Mobile
Ok, on second thought, maybe not … I think I better flash the ASUS firmware “3626” just to make sure the rootfs gets expanded (if it isn’t already)!
….
After flashing with the latest official ASUS RT-AC68U firmware:
admin@RT-AC68U:/# uname -a
Linux RT-AC68U 2.6.36.4brcmarm #1 SMP PREEMPT Thu Nov 16 14:29:00 CST 2017 armv7l GNU/Linux
admin@RT-AC68U:/# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 39936 39936 0 100% /
devtmpfs 127756 0 127756 0% /dev
tmpfs 127860 300 127560 0% /tmp
/dev/mtdblock4 64256 1728 62528 3% /jffs
Those of you having issues with the FW_RT_AC68U_30043763626.trx coming up as an invalid firmware or the asus restore utility telling you that the router isn’t in recovery mode even though you can see the mini-cfe page when you try to log in for step 24, go back and start from step 9 again. I had this problem and researched and tried everything I could find online for 2.5 hours before reloading the cfe file and then everything went as it was supposed to. From what I found online the CFE file is what is determining if the firmware is valid or not and it’s what T-mobile used to lock out the use of Asus firmware.
Thank you so much for this guide! UPNP and Xbox Live NAT was not working on T-Mobile firmware. All the steps worked like a charm on T-Mobile’s latest firmware 3.0.0.4.376_3181. I must be one of the lucky ones getting it into recovery mode with latest firmware. Step 5 worked for me. Only issues I had was the learning curve for moving files in WinSCP. Pretty simple once I realized you can click and drag to copy/move files.
i can’t get the new_ cfe.bin to upload to router using winscp. I had no problem downgrading the firmware to 1703. I’ve tried just about everything. The file checks out with cfe.exe. I’m probably making a simple mistake but can’t figure it out. Any suggestions would be appreciated.
Did you check your spelling? I can see you have a space after the underscore in your comments.
After you flash the Asus firmware does the SSID and stuff change from the tmobile ones that were predefined?
I can’t tell if I was having issues flashing or not. The model updated in the management console, but the ssid and management IP stayed the same. I was expecting it to change to 192.168.1.1 or something after the asus firmware was flashed.
Made it to Step 23 but now I can’t get the router in recovery mode. Tried the method in Step 3 and by holding down the Reset, WPS, and Wifi On/Off buttons described by Mitesh Patel and Rob Holland. The power light never blinks or turns on and 2.4G/5G WAN lights never turn on. What am I doing wrong?
I noticed that the lights were different on the second NVRAM Reset. I was able to flash through the ASUS util anyway.
Worked great and much appreciated. Can’t remember the last time a guide didn’t require me to deviate from the instructions at least once. Wonderful Guide!!!
Hi,
Thanks for this guide. I managed to get on the router, but after several NVRAM resets, I’m still unable to get it to expand the rootfs to 64MB.
So, when I ssh in and do a df, I get this:
admin@(none):/tmp/home/root# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 27776 27776 0 100% /
devtmpfs 127740 0 127740 0% /dev
tmpfs 127848 3932 123916 3% /tmp
/dev/mtdblock4 64256 1692 62564 3% /jffs
One thing I had to do that was different. The Asus utility couldn’t find the router, so I did a
./mtd-write new_cfe.bin boot
./mtd-write FW_RT_AC68U_30043763626.trx linux
I’m sure the firmware on it now is Asus because the gateway IP address is now 192.168.1.1 instead of the 29.1.
I’ve been using the WPS button to do the NVRAM reset. Is that incorrect? Am I just screwing up the NVRAM reset? You power off, hold WPS, power on while holding WPS for 20 seconds?
TIA for any tips.
Thank you, Alex, for the great write up! Everything worked great, except for after Step #8 I had to do a reset to get the default password to work.
This is the most concise and easiest to use Guide. Just updated my Cell Spot.
Thanks
I received two of the SD TMO rebuilt units today and promptly sat down with these instructions. It went off without a hitch. I did accidentally connect to the WAN port, and struggled aimlessly to get the recovery mode initiated. Self-inflicted, and easily resolved.
However, now that both are up, I have a real issue. Both units have the same MAC address for the LAN and wireless cards! When both are powered up, they naturally become unresponsive.
I’ve been able to manually change the LAN MAC on one of them, and that has resolved the responsiveness issue, but since both 2.4 and 5.0 radios have the same MAC between the two, I’m guessing I’ve a whole other set of issues when it comes to wireless reliability.
Has anyone seen this before?
Well, after a bit of detective work, it looks like I accidentally flashed the same new_cfe.bin to both routers – even though I explicitly renamed them uniquely to prevent that from happening.
By looking at the original CFEs I could see the mac addresses in each one (thanks to +notepad) – and chose the unique one. Instead of starting over, I uploaded the CFE to the site (per instructions) and renamed/moved the modified results back to the router with WinSCP. I then ran the mtd-write commands just for the CFE. After reboot, the affected router had unique mac addresses for all interfaces.
Can’t imagine anyone else will be as careless as me, but if it happens, let’s hope this helps…
Hi Eric Well guess what? I just did the same thing today and realized when I tried to connect the third rt AC68U (TM AC1900) to the new AiMesh. Two of the three have the same MAC address.
Could you please be more specific on how to fix? I also don’t think I have the original CFE from the second unit anymore. I have three of these for my network needs. I guess I was a little careless this third time around.
OK. Had to use Hex editor to change MAC address back to original. Built an old new new CFE and changed the name to match mtd uploaded with WinSCP cmd with Putty and low and behold old mac address is back.
I messed up as well and accidentally copied the same CFE to two routers. I went back in and modified the original CFE with a hex editor and changed the MAC addresses to where they should be; however, only my 2G wireless is working. My 5G shows up when I’m scanning for WAPs, but I cannot connect to it or gain an Internet connection. When I modified the hex I gave the 5G a “two up” number from the 2G MAC address. Any ideas?
Add me to the list. Don’t understand why some folks are mucking around with the “original” cfe. You flashed the new_cfe more than once. Everything in the new_cfe is ok with the exception of the MAC address. So fix just that and reflash the new_cfe. I don’t understand why Asus put the address in the cfe. Each router must have a unique address. For such a requirement the unique data is usually stored in a FPGA or other onboard chip. Putting it in flashable cfe just creates the headaches we’re experiencing.
I’m working the same problem by using the same CFE.bin to both routers which now have the same WLAN MAC addewaawa. I’ve tried using both a hex editor (HXD) and Notepad ++ but I can’t seem to find the MAC Addresses in either the old or new CFE.bin files. I’m not sure if I have the correct settings on the HEX editor. Any help you can provide is appreciated.
Worked OLD and New both methods for me on 3181 versions.
First, Thanks! Second, the router CPU speed link didn’t work for me. Third, here’s some notes on the steps that could help the next person along.
4.1) Connect your laptop/computer to the router’s #1 LAN port (do not use the blue WAN port).
7.1) Wait for the following message: “Receive file size=16949294. Upload completed. System is going to reboot. Please wait a few moments.”
8.1) refresh browser/navigate to 192.168.29.1
11.1) select YES for all the warning popups
16.1) in WinSCP, using the left window, navigate to the “Router” folder you created. Drag and drop the files to the right window
19.1) wait for PuTTY to repsond with “linux: CRC OK”
20 e) the Router’s blue power light in front should rapidly flash
20 f) release the WPS button
20 g) the front lights should flash then return to normal, 2.4 and 5 GHz lights will illuminate
Thanks for the great write up, Alex! Aside from getting it into restore mode, everything went great and I’ve updated mine to the latest stock ASUS RT-AC68U firmware (FW_RT_AC68U_300438218881). Funniest thing though, my router still shows as a TM-AC1900, both on the login page and after logging in (I’ve linked to a screenshot). Shouldn’t it show as a ASUS RT-AC68? Any way to force the change?
https://imgur.com/a/UY9Jp
Thanks again!
Tim
forgot to ad the other pic…
https://imgur.com/a/gQL7Z
If you load that same page in a private browser window does it still show that? Could be left over cache.
I’ve tried loading it in Chrome and Explorer (with and without private browsing) and it still loads the same. I was thinking it may have something to do with the custom cfe that was created, using the web editor.
The mac addresses and WPS pin were all copied over correctly, but perhaps there is/are some field(s) that identify the router make/model that may have been missed in the process. Is there any way to easily view/search/compare the contents of old_cfe.bin and new_cfe.bin, to check for remnants of TM-AC1900?
(sorry for the double-post below…I forgot to reply to your post and started a new comment by mistake)
Is there any harm in simply re-writing new.cfe.bin to the router? That wouldn’t affect my current firmware (FW_RT_AC68U_300438218881) and there’s no need to enter restore mode, right? Just simply perform steps 17, 18 and 20 from your guide?
I don’t think there will be any harm in doing that, I’d run through all the steps of the guide again just to be sure.
Well…I went through all the steps again, and no change. It still shows as a TM-AC1900.
Any thoughts?
Apparently, the third time’s a charm…finally, all the branding shows ASUS RT-AC68.
Of course, NOW I can’t get the overclock to stick. It reverts back to 800, 666 after the reboot. I had it OC’d initially, but now it doesn’t want to. ;-/
Strange, for sure, but I’m not overly concerned about it…this router is definitely a diva, though! :-D
Did you end up running trough all the steps or just the last three multiple times to finally get it to show ASUS-AC68 ?
Thx
I know this was a long time ago,
but I got the overclock to stick by editing the CFE, uploading it, and then doing an NVRAM reset, which you have to set up again after, but the cpu and ram stay at what I set in the CFE.
I followed the steps, and the router is accessed as 192.168.1.1, and FW is 3626, but the display is still showing as TM-AC1900. How do I get the name changed to rt-ac68u?
This has to be a problem with your CFE BIN file. Verify the version with this command from putty.
nvram get bl_version
if the version is not 1.0.2.0, then you did not get your CFE downgraded to the ASUS version, you are probably at 2.1.2.6 which is the T-Mob version. Follow steps 14-20 very carefully, in step 15 be sure to rename your bin file. if you don’t the command is using the wrong name. There will be no error from this mistake, so you won’t notice it when you send the command.
I have done this on 4 of these routers over the past 4 months, one was just a few days ago, all of the steps work fine.
As stated many times, the only step that can be tricky is getting in to restore mode.
Thank you for bringing attention to the treacherous renaming issue! That fixed my problem…
Thank you and every that made this happen got my tm-ac1900 to a asus ac68u with this guide. Happy Holidays everyone
I’ve tried loading it in Chrome and Explorer (with and without private browsing) and it still loads the same. I was thinking it may have something to do with the custom cfe that was created, using the web editor.
The mac addresses and WPS pin were all copied over correctly, but perhaps there is/are some field(s) that identify the router make/model that may have been missed in the process. Is there any way to easily view/search/compare the contents of old_cfe.bin and new_cfe.bin, to check for remnants of TM-AC1900?
Thanks so much for putting this together, super helpful and very well written!
If I may make a suggestion, I think you should mention that the original CFE bin file is 524288 bytes (exactly 512K) while the one I downloaded from the CFE service (rt-ac68u_1.0.2.0_us.bin) is 231923 bytes. I was worried to see a much smaller CFE, and did some extra searches to ensure that smaller was indeed safe (it was: everything worked perfectly :)
This instruction did work work for me.
I was on TMC-AC1900 with the 3.0.0.4.376_3181-g247286a firmware
Rob Holland, instruction on how to place the router on
step 5: “Place router into Recovery/Restore mode”
help alot….
I like to provide a hint,
that you need to check the router firmware after
Step 7
you need to confirmed that flashing on step 7 occur.
* I did not check, I was waiting for a complete or successful message ….this was my mistake
Also you will need access to a different computer on step 15
as this step requires you to be on the internet to access the website…
a USB is very helpful here…
I decided just to stay with the stock version of RT-AC68U and later did a firmware update of RT-AC68U latest firmware, through the wireless settings
best of luck
For step 15 I just turned my wifi on and connected to my other router. Or you can unplug the router cable and connect directly to the modem.
Thank you so much for this wonderful tutorial.
The only little snag I had was getting the router into recovery mode.
I just had to follow the steps twice and the mini-CFE automatically came up on 192.168.29.1 page that was already open from the first attempt.
Maybe have a tip to open the page before powering on the router into recovery so it can be seen as soon as it goes into recovery mode?
In any case THANK YOU!
So i have two of these. One worked flawlessly and shows R68U in the web interface and in the telnet.
The second one shows R68u in telnet but the web interface still shows AC1900. Do you know what is going on?
Ok I got it, had to start over from scratch.
I used a combination of this thread, the comments, the instructions in slickdeals ( esp. the CFE flashing 2.0 thread), the youtube video for doing it on Windows 10 linked in the slickdeals thread, and was able to finish it successfully. So thanks.
My original version was 3181. A few of my observations/suggestions –
When doing NVRAM reset using the WPS button, you should press the NVRAM till the power button flashes quickly. Once you release it, only refresh browser to login to the router when both the Wi-Fi lights start flashing as well. [This gets around timing it for 10-20 seconds etc]
When i tried using mtd-write2 included in the t-mobile firmware to also write the new CFE (as indicated in the comments by Albert Lee), I would get a “Bad trx header”. I tried constructing the CFE using the automatic tool, hand-edit it for both the 1.0.2.0 and 1.0.2.1, but it only worked when I downloaded the mtd-write v2, copied it to the USB and then ran it. the mtd-write2 included in the t-mobile firmware worked to flash the firmware, but not the CFE. I see your steps also say to do the same. Not sure if that was the result of the same behavior.
Again, thanks for the writeup and the contributing comments by people!
I’m at Albert Lee’s steps 16-24, and also get “Bad trx header” using mtd-write2 included in the t-mobile firmware to write the new CFE. i downloaded the mtd-write2 onto my USB. How do I upload mtd-write2, new_cfe.bin and the firmware in Putty? My first time doing something like this. I’m not sure how to type it all out. Thanks.
I had the same issue. I downloaded “MTD-Write v2” from the link this site: https://www.snbforums.com/threads/asus-routers-cfe-dumps-collection.17793/ (look for “MTD-WRITE (ARM)” section). When you unzip, you will see that the filename is still mtd-write, but I guess we just have to trust that snb knows what they’re doing :)
Then I copied the mtd-write I just downloaded to the same folder as my new_cfe.bin (use WinSCP for this)
Then I doublechecked that new_cfe.bin and original_cfe.bin MAC and Secret code matched (if your original_cfe.bin isn’t in the same dir as new_cfe.bin, just reference the fully qualified path in the command):
grep mac ./original_cfe.bin ./new_cfe.bin
grep secret ./original_cfe.bin ./new_cfe.bin
Then I ran this command
mtd-write -i new_cfe.bin -d boot
When the router rebooted, I checked the nvram version and I was back to 1.0.2.0. From there I downloaded the latest firmware .trx from the Merlin sourceforge, upgraded via the regular web GUI and everything is working as expected! Hope this helps!
Worked well me for today. Upgraded to the latest ASUS firmware dated 11/30/2017 after flash. Though I could not get it to go into restore/mini cfe mode initially but using the power off/hold wps/wifi/reset simultaneously till power LED flashes and then letting go of the reset button method worked. I think this method is more reliable and should be part of the guide.
As some noted, the router still says it’s a TM-1900AC though it’s running the latest ASUS firmware and all, not too concerned about that.
Does it make a difference if the name hasn’t changed? I got the latest ASUS firmware installed and while it shows the correct version of that version it still shows the TM-1900AC name. Just hoping this doesn’t make any difference in how it operates before I hand it off to my in-laws.
Thanks in advance!
So it seems that it does make a difference in that the router will not update to newer firmware via the GUI as it indicates a device mismatch. I tested this out by trying to update to the firmware released on 01/02 and got the error multiple times. I repeated Steps 17 onwards again but used the latest firmware this time and sure enough it took the latest 384.x release that way though the GUI still identifies it as a TM-1900AC (after another NVRAM reset still). This morning I edited the cfe file, this time using the 1.0.2.1 as the base and changed the region code to all regions to get the additional 5 Ghz bands and while the new cfe took fine (I can see the extra bands in the GUI), it still identifies as a TM-1900AC. At this point it seems that there is something still left somewhere that makes it identify as TM-1900AC vs vanilla 68U. Not a huge issue for me since I can flash new firmware through telnet/putty if needed but still a minor annoyance.
I was able to correct this on mine. In my case it never took the 1.0.2.0 CFE but updated the firmware appropriately.
To verify use “nvram get bl_version” to see what CFE version, mine was still 2.1.2.6 even though it was running the latest Asus firmware. (My screw up was the naming of the new_cfe.bin, mine was somehow new_cfe.bin.bin and thus didn’t write.)
To fix it, repeat steps 11-16 from this guide to get a clean new_cfe.bin, since you are on the updated software the ip should be 192.168.1.1 and you should be able to login to the router GUI to enable SSH to connect with Putty (No recovery mode needed). Once you have the clean CFE then switch over to Bootymonger’s guide to upload the CFE, after the NVRAM hardware reset step everything should be good to go.
I got hung up on this as well. When reading the instructions to rename the cfe file as “new_cfe.bin”, I renamed it in the file explorer not realizing this was causing it to actually be named “new_cfe.bin.bin”. This resulted in it retaining 2.1.2.6 and kept the name. Redoing steps 11-16 worked like a charm. Kind of a silly mistake on my part, but it might be worth noting in the guide that the name only needs to be changed to “new_cfe” as its already a bin file.
Despite it running the new firmware, so long as it still identified as the TM-1900AC, it would not allow me to flash to merlin through the gui. Once I addressed the new_cfe.bin issue, everything works like a charm. Running the latest merlin now. Thanks for the guide!
You don’t have file extensions visible, the file name is new_cfe.bin
Thanks for the updated instructions! I used the old ones in early Dec, and had to do some trial and error to get things to work right, but that was still the best source! I picked up another TM-AC1900, and I’m wondering: Is the CFE used for this downgrade compatible with the new AiMesh features of the new ASUS firmware?
The latest SlickDeal on this router has some notes on a new CFE to use to enable AiMesh: https://slickdeals.net/f/11119759-asus-tm-ac1900-dual-band-gigabit-router-refurbished-48-free-s-h?p=110565659#post110565659
I’ll wait for it to be out of beta before checking it out, right now it seems there are some issues:
https://www.snbforums.com/threads/official-beta-aimesh-beta-firmware-for-rt-ac68u-rt-ac86u-rt-ac5300-rt-ac88u.40745/page-12#post-354838
Thanks, I may take a crack at it and I’ll let you know how it goes. I’ll be wanting to set up two routers in mesh, with the base by my cable modem, and 3 devices plugged in by ethernet to the satellite. Right now it is in bridge mode, but on a separate SSID.
Anyone know why the step to copy the CFE @ step 12 results in file not found and creates an blank file?
Be sure to leave a blank space after the “cat” command. :-)
In this example below, I put in a double-space so you can see it better, but in puTTY, just type in a single blank space:
cat /dev/mtd0 > oriinal_cfe.bin
Also be sure to type the digit zero, not the letter “O” in “mtd0”
Thanks for the information. Just bought a TM-AC1900 off Amazon for $59 and by following your instructions I now have a RT-AC68U for a fraction of the cost. Right now, the AC68U is selling on Amazon for $135.00 so I saved 56%!
I couldn’t get the router to boot into recovery, so thanks to the poster who suggested pressing the WPS, Wi-FI and reset buttons…that worked for me.
Also I did get an BUS error after completing step 19, but everything seems to be working just fine.
I’m using my new router with the AI Mesh firmware along with my AC88U and now I have a Mesh network that runs great, no more dead spots on the 3rd floor of my condo!
Hi, that’s what I was planning to do. I have a dumb question/problem, I have a dell xps a newer laptop with no Ethernet port.
I have an adapter that lets me connect wired(ethernet to usb), will i be able to do the steps meant for changing to static IP?
yes
As mentioned in earlier posts, I recently converted a TM-AC1900 to ASUS-AC68U without any issues, except inability to overclock. I just got another one and followed the same steps listed above and everything went perfectly…except the overclock. The listed procedure goes fine but, after reboot, the clock settings revert back to 800,666 on both routers. Both used cfe 1.0.2.0 (US), and are currently on stock ASUS firmware (FW_RT_AC68U_300438218881).
Can others confirm that after the overclock procedure, they actually rechecked, nvram get clkfreq, and the overclock settings remain and didn’t reset beck to 800,666?
Has something changed recently, disabling ability to overclock? I would at least like to get to the 1000,800 settings of a stock ASUS-AC68U.
I am seeing the same thing (clkfreq reverts back to 800,666 after a reset). After doing the nvram commit it shows the 1000,800 but after the reset it reverts back. I am using the firmware that came out last week, 3.0.0.4.384.10007.
I will confirm that the same has happened to my router. If anyone knows how to make this stick please leave a reply.
Same thing is happening to me.
Hmm actually if you look at `cat /proc/cpuinfo` BogoMIPS seem to increase to 2398.61 even though `nvram get clkfreq` returns the same old 800,666
Does this mean, its actually overclocked? I checked mine and your correct,BOGOMIPS changed and its sticking after commit
Are you using Merlin or stock ASUS?
I just flashed mine to latest Merlin, and the overclock sticks after a reboot.
I have the latest Merlin firmware with CFE 1.0.2.1 and overlock does NOT stick after reboot
I have had success by editing the CFE and uploading it, then doing and NVRAM reset.
I did the hardware reset, and I had to redo all the settings. You could try:
mtd-erase2 nvram
and then reboot, but it will probably be the same.
I used CFE editor from https://www.snbforums.com/threads/asus-routers-cfe-dumps-collection.17793/
and changed clkfreq, it’s near the top in advanced mode.
Showing higher BogoMIPS in cpuinfo, persisting through reboots.
Receive “Not found, error 404” message when trying to post question. Message is shorter than others on this page.
I don’t have any length requirements for comments. This is just the standard comment feature that comes with WordPress blogs. Your other comment test comment worked fine but I deleted it just now.
I got a TM1900 refirb from Amazon for $59, and was able to follow the steps described here to get it operating as a regular AC68U.
Thank you so much for collecting up this information and also to the folks commenting with additional info and links.
I now have it working with my existing AC68U in AIMesh mode!
Am I allowed to upgrade firmware normally or do I need to do special steps?
It shows i’m on 3.0.0.4.376_3626, is this the latest one?
Thanks for writing these instructions. Able to downgraded TM 1900 fw to 1703. Item 12 couldn’t get the CFE bin in putty. When typed in “cat/Dev/mtd0 > original_cfe.bin” error message came out ” -sh: cat/dev/mtd0: not found” what am I missing? TIA!
>When typed in “cat/Dev/mtd0 > original_cfe.bin” error message >came out ” -sh: cat/dev/mtd0: not found”
it is cat /dev/mtd0
i.e space between “cat” and “/”
also its “dev” not ‘Dev”. these commands are case-sensitive.
I receive a password request in Putty when I type cat/Dev/mtd0 > original_cfe.bin,
I tried password and admin to no luck
To set the router in recovery/restore mode was hold all these buttons together… Reset, WPS and Wifi in/off instead of just the reset
I can’t find AiMesh node when searching. Anyone have similar issues or have a solution? I followed all the steps and updated to the last Asus firmware. I have 2 TM-AC1900 routers: one connected as a AiMesh router and the other reset as an AiMesh node
Have you flashed the beta AiMesh CFE? Or did you just follow this guide? This guide does not touch upon the AiMesh CFE, you’ll need to look elsewhere (snbforums.com)
Your Cfe.bin may need to be updated from Step 18 otherwise the router is not recognized to do AI Mesh.
1. Step #18 should have been weitten like this in the putty:
./mtd-write -i new_cfe.bin -d boot
This is to ensure that the new_cfe.bin gets written successfully. Then making sure the renamed uploaded cfe.bin thru SCP is the one generated from this site from step 15: https://cfeditor.pipeline.sh/
Otherwise once the mac address was updated and new label was made to RT-AC68U, AI mesh node was enabled.
This a really helpful guide though overall. Thanks to Alex!
Try setting the router to Aimesh node manually in the network map settings (operation mode top left side link), let it finish and reboot and then run the search from the main router, it should come up and then you’ll be able to configure it, update to latest firmware.
I just followed this and not only had none of the problems getting it into recovery that others had, but was able to overclock on Merlin firmware and it seems to have stuck after reboot. Maybe this is just a hardware difference and some units are easier to get to do this than others?
Thank you very much for posting this.
The router came with the latest T-Mobile firmware. I was able to successfully flash this back to Asus official firmware. One issue was with Step 7, during the firmware transfer, it would get interrupted at 68% with the Mini-CFE on Chrome. I had to factory reset it more than once, then switched to Internet Explorer and it transferred successfully. Seems like Merlin is very popular so I flashed it.
This was my first time flashing firmware on a router. Many thanks for this wonderful guide! It was simple to follow and the easiest one out there.
You a G
This is a great guide and a LOT of work went into making it work smoothly.
Just carefully follow the most recent instructions and it works.
Thank you Alex, for your efforts.
These instructions are excellent – but one thing could make them even better. The AC-1900 that I purchased required an extra set of steps between step 8 and 9 as currently written (January 2018). After flashing “TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx” and rebooting, the NVRAM *must* be reset for admin/password to work in step 9.
To do so: turn the router off, press and hold the WPS button (on the side), turn router power on while holding the WPS button down until the power LED starts flashing (about 20 seconds), then release the WPS button. [Same as in Step 20 in the procedure.]
Once I figured that part out, everything else worked exactly as written and I have a working RT-AC68U!
Thanks for the writeup. I have two fine working cellspot routers that have been converted over to merlin successfully. The routers are very stable and cover even the remote parts of my house. The method you describe here is perfect!! I did not make any changes to the method described here.
thanks again.
Do you need the 1.0.2.0 AiMesh CFE in order for AiMesh to work once converted to RT-AC68U?
I upgraded two TM-AC1900s to the RT-AC68Us but can’t get AiMesh to work.
The .7z file from mega.nz with the mt_write is corrupt. I can not unzip it with winrar or 7zip. Anybody have a mirror?
Try downloading it again. It works fine here.
I installed newest version of winrar. works now. thanks.
Thank you Alex for this guide. I was able to convert 2 routers following these instructions.
I can’t just find that damn node!!!!!!!!!!!
Has anyone been able to do AiMesh with two converted routers? it is proving very difficult for me. I see on this thread that I might need a new CF file or something of that sort. The thing is that I can see the AiMesh icon on both routers, it is just that they cannot find each other. Not much, but I am willing to donate $20 for anyone willing to write a nice guide on how to update converted AC68U routers to do AiMesh.
I plan on writing/updating this guide for AiMesh once the cfe is out of beta and ready for customer deployment. Last time I checked there were some bugs with the AiMesh CFE and isn’t up to par for deployment so I’m not messing with it yet.
Thank you Alex. Looking forward to the updated guide.
Thanks for this, everything was spot on, although I had a little trouble at first getting it into recovery mode in the beginning. I had just picked up a TMO ac68U and tried about 8 different ways to get it to get the mini- CFE page. i think the new instructions above are correct, but chrome was not showing the page for some reason. switching to IE win10 Edge DID show it.
after getting past that point, everything else was great, including overclocking (which seems to have been committed )
I found on a post on SNB forum an engineer guide to CFE mode. The instructions do not mention waiting 1:30 minutes for the CFE to appear. I tried to access immediately after releasing the reset switch.
Also, the NVRAM reset requires waiting 5 minutes for it to work. I actually wrote the time down in order to be patient.
Even though I did the CFE.bin change and everything as per the directions, The ASUS page still shows TM-AC1900, but the update went through, and I have one router setup with AIMesh as the router, waiting on the second router to arrive to set up as a node. Access it in network settings. I got the 20308 version running.
One other issue, I tried the ASUS Router APP on my phone, but it did not see the router, so I could not get it to work. I noticed that the update has a setting to use TELNET and SSH, so if someone could help me get the WINSCP and PUTTY to note the name change, maybe the app would work. It isn’t beneficial, but would be nice as a future reference.
I am relatively new to firmware/CFE flashing so I am watching this with interest. I have one factory stock RT-AC68U with firmware 3.0.0.4.384_10007 and two TM-AC1900 routers that I would like to setup in AI Mesh mode. From what I have been reading there is not currently a stable CFE to flash the AC1900 routers? Also I am reading that I will need to modify one of the CFEs so that I do not have MAC overlap between the two routers once I convert them to AC68Us?
Yes that’s correct. I suggest you flash with this guide and then follow a aimesh cfe guide once it is out of beta.
I know this website provides quality dependent articles or reviews and extra stuff, is
there any other site which presents these kinds of information in quality?
Worked like a charm following the steps above.
Was able to add the modified router into my mesh, but this required manually setting the router to Aimesh mode, let it reboot, and then run the search from the main router.
Was not able to overclock though, seems settings are overwritten on boot.
Are you using a genuine ASUS AC68u as your main router? How is the mesh setup working out for you so far?
After flashing to AC68U, why doesn’t the router show an aiprotection section like a regular AC68u?
Have you flashed the latest ac68u builds? It should have ai protection.
Aiprotection is not visable in AP mode. I had to reconfigure my network so I can use the device in router mode.
Thanks for this great resource. I was able to follow all of these steps and get the AIMesh setup using the 1.0.2.0 US AIMesh CFE.
However, it seems like my AIMesh node goes offline at least once a day and needs to be reset. I’m thinking I would be better off setting it up as an access point.
Is anyone else having this issue? Any suggestions would be appreciated.
Thank you for this superbly clear and precise guide! When dealing with something as critical as re-flashing, such detail is absolutely essential!
I can confirm that overclocking (to 1200,800) works on Advanced Tomato.
Two different routers seem stable and there seems to be little effect on temp (at moderate workloads).
Thanks!
P.S. Very much looking forward to AiMesh version. That will be a great excuse to do this a few more times.
I got the AiMesh to work by using “1.0.2.0 US Aimesh” as the source
Have you had any problems with the node going offline?
Thanks for these instructions. They worked like a charm though I had to use the 30-30-30 reset method.
My router was a new one from Amazon. It came with 376.2827 but as soon as I got it running it auto updated to 376.3199, a very recent TM-AC1900 firmware.
After I followed these instructions, I updated the firmware from the ASUS site. It updated to 384.20308, a firmware that was released yesterday. All seems well except for one thing. On the admin page when I changed the password and tried to save it, it gave me an error with the time zone. It simply wouldn’t accept Pacific time and the DST start/end time fields were not usable — they wouldn’t pull up any values. Following something I found on the web, I had to set the time to GMT and then I could save my admin password.
I’d like to sync the time properly so I’ll see if ASUS offers a newer firmware — they released two versions in the last week. Or I may go for the latest Merlin.
For 3199 firmware issue, follow this document. I was able to flash successfully to RT-68U
https://docs.google.com/document/d/1NsZMONmJ70zMmoAKKQJXbTVKytaPJptWTpqih1TD5n8/edit#
Hi Alex,
I did all the steps and all went fine but my router model name is still TM-AC1900.
I am running the latest Asus AIMesh firmware
3.0.0.4.384_20308-gead790e
I also have the choice to setup AiMesh router or Node.
How can I change the router name into Asus RT-AC68U??
Thx.
double check your new_cfe.bin make sure you rename the file the website output because it will not be new_cfe.bin. I had the same thing happen to me just re-up the files and try it again and NVRAM reset at the end and you should be RT-AC68U
I can’t add my units to aimesh. For some reason, aimesh can’t detect the new nodes. On another forum, they think we need to use CFE 1.0.2.5 instead of 1.0.2.0. Can we update the instructions on how to do that?
Now I see that we need to use an aimesh-enabled version of 1.0.2.0 and the CFEditor website now has that option: 1.0.2.0 US AiMesh.
I don’t have my original CFE file anymore but I upload my current modified CFE to the website to update it to the AiMesh version?
use step 12 to get your cfe
Alex, should we wait for a CFE out of beta?
Can anyone help me out in getting into restore mode? My Refurbished T-mobile ac1900 just arrived today and I couldn’t get it into restore mode. I’ve done alot of varied steps already and I still couldn’t get into it.
Already tried the step in this guide which ends up on the router having power led and lan led on and responds to pings but not loading the CFE Mini Web Server and firmware restoration tool tells me that the router is not in restore mode. It constantly responds to pings however and it will be in this state until I turn it off and on like it’s really on firmware restore mode.
I also tried holding the reset, WPS, and wifi buttons at the same time but still no luck. I tried this one too https://slickdeals.net/forums/showpost.php?p=85157887&postcount=5538
sadly I’m still stuck.
I tried using both my PC that is running on Windows 10 using Chrome and my laptop running on Windows 7 using Chrome and IE 9. Firmware Version is 3.0.0.4.376_3181
While making this post, I played with the Wifi toggle button a bit and it doesn’t feel so responsive. Sometimes it toggles, sometimes no, sometimes it behaves as if it was pressed two times. I tried pressing it normally a couple of times and it doesn’t seem to respond to like 5-7 presses. Even pressing hard and firmly sometimes flukes at it.
Could it be possible that the reason for my trouble is a faulty Wifi toggle button? Cause the blinking of power led also happens if I press and hold the WPS button before powering on which triggers the NVRAM reset right? It stops almost as soon as I let go of the WPS button.
I however, was able to make the CFE Mini web server show up by having a tab keep on loading 192.168.29.1/index.asp, holding the reset button after the router has fully started normally, power led starts blinking then letting go after 5 seconds, pressing and holding the reset button again immediately once all leds lit up once. From this step, I tried both letting go of the reset button and holding it but the result is the same where the CFE Mini web server page shows up but that only lasts for like a second. If I try to refresh the page after that, it would either give me ERR_CONNECTION_RESET or the tab gets stuck trying to get a response from the destination.
It’s like the firmware is intentionally dropping my attempts to connect to the mini web server.
I got mine this through amazon and the seller was Mobile Dist. It’s backed with a 90 day warranty which I’m really hoping I could use if all else fails.
I had to use Firefox to upload 1703 firmware. Chrome didn’t work although I managed to make CFE Mini web show up in Chrome.
Oh I see Thank you for this reply
I will give it a try with Firefox
In case I’ll need it, would you tell me what version of firefox did you use? Are you already using Firefox Quantum or still the old one?
It doesn’t matter what version of firefox is used.
I used Firefox Quantum 58.0.2 (64-bit). I changed 5G to higher channel (157). The default channel 44 resulted in very short coverage range.
THANK GOODNESS I WAS ABLE TO FLASH IT
MANY THANKS!!! I really thought I was gonna have wasted investment there T_T
Thank you for Alex too for the reply. The version didn’t matter at all, so long as it’s firefox.
Thanks, you’re clear concise steps worked perfectly! Step 7 image would not flash in recovery but worked fine in normal boot, so skipped step 5 and follow the rest to the letter. I also used my Linux box with ssh/scp no issues.
Skip step 5? Using CFE Mini Web server?
I’ll probably check out on this, might be the same case as mine. Though I already tried using Asus Restore Utility and it didn’t work in normal boot.
To everyone who would possibly be facing the same struggle as I had in trying to do this guide’s Step 5, whether you may be running Firmware version 3181 or 3199 (my router auto updated just 3 days ago after getting connected to the internet)
The most reliable way for me to get the router to restore mode:
1. Boot up normally first
2. Go check if you could load 192.168.29.1
3. If it’s good, go load 192.168.29.1/index.asp
4. Press and hold the reset button for 8 seconds or more
5. Eventually, all leds in front of the router should light up and that’s when you should press and hold the reset button again
6. Reload your index.asp tab if it doesn’t auto reload
7. Mini CFE Web Server should load and quickly upload your firmware
8. Once the page stops loading and shows you how many bytes have been uploaded, let go of the reset button in relief and your router should be up and good soon
It’s best if you are in a calm state of manner when executing these steps
I’m not really not understanding how to even get the initial downgrade to take. I’ve tried about 10 times now and CFE does not change the firmware. Router just sticks with the one LAN port and power LED on no matter how long I wait. Web page updates to “Settings have been updated.” blah blah. Asus Restore Utility can’t find the router. Step 8 needs more details. Router has 3181 at the moment.
I too followed all steps, no errors, product ID still says Product IDTM-AC1900, does this mean flash did not take effect?
Same here. TM-AC1900 is shown all over the places.
On “Firmware Upgrade” page it shows “3.0.0.4.384_20308-gead790e”
admin@TM-AC1900:/tmp/home/root# nvram show | grep -i cfe
pmon_ver=CFE 6.37.14.86 (r456083)
size: 44213 bytes (21323 left)
admin@TM-AC1900:/tmp/home/root# nvram show | grep -i tm | sort
size: 44213 bytes (21323 left)
MULTIFILTER_TMP=
TM_EULA=0
asus_device_list=TM-AC1900>192.168.1.1>xx:xx:xx:xx:xx:xx>0>wireless2a>255.255.255.0>1
cfg_device_list=192.168.1.1>xx:xx:xx:xx:xx:xx>1
computer_name=TM-AC1900-7D80
daapd_friendly_name=TM-AC1900-7D80
dms_friendly_name=TM-AC1900-7D80
lan1_netmask=255.255.255.0
lan_netmask=255.255.255.0
lan_netmask_rt=255.255.255.0
lld2d_hostname=TM-AC1900
modem_roaming_scanlist=/tmp/cops.txt
odmpid=TM-AC1900
tm_debug=0
tm_device_name=
tm_partition_num=
tm_ui_setting=0
tm_usb_path_pid=
tm_usb_path_serial=
tm_usb_path_vid=
tm_vol_size=0
wan0_netmask=0.0.0.0
wan0_netmask_x=0.0.0.0
wan0_xnetmask=0.0.0.0
wan1_netmask_x=0.0.0.0
wan_netmask_x=0.0.0.0
wps_device_name=TM-AC1900
wps_modelnum=TM-AC1900
Your router showing TM-AC1900 means you didn’t install the CFE correctly. You need to redo steps 9 through 18 again. These steps convert the T-Mobile CFE to an Asus Aimesh CFE.
This is exactly the issue.
What I missed was in step 15 I did not rename the .bin file and in step 18 the mtdwrite did not report any error when new_cfe.bin didn’t even exist.
It’s all good now. Thank you.
I need some help or advice.
I used a ported version of PuTTY on my Mac to gain access to the file system in the router and can navigate throughout the TM-AC1900 file system. Nothing else would work to connect. Even Mac Terminal failed to connect. PuTTY gets right in no problem as one might expect.
I am stuck trying to SSH into the router to download the original_cfe.bin file.
I am on an Apple Mac and running OS X High Sierra.
Since everyone on this thread is on a Windows device, and there is no SCP protocol tool available for a Mac, I have come to the conclusion that doing this conversion using a modern Mac is simply impossible.
No SSH tool that runs on a Mac will successfully connect to the TM-AC1900 router with the downgraded firmware that allows turning SSH on. I tried Cyber Duck, Mountain Duck, Forklift, Transmit and Interarchy. Not a one of them will connect to the router.
It is possible that the hardware on the router is the problem because no company in their right mind would create an SSH tool for Mac if there was something inherrently wrong with OS X that killed SSH on the Mac platform.
I need to find a Windows computer to try to complete this conversion. I don’t know anyone with a Windows machine that would let me use it because my friends aren’t technical enough to understand what I was doing and would freak out if they watched.
Does anyone know of a company in San Francisco that rents time on a Windows machine? Or that I could pay to complete the conversion? It appears this is easy to do on a Windows machine.
I consider myself pretty technical but I am not a command line expert and rely on a GUI to get things done.
This was so totally ridiculously easy once I used Windows.
I can assure you that it is simply not possible to connect a 2017 Mac running OS X High Sierra to a 2014 model Asus Router via SSH. I spent 7 hours yesterday trying.
I downloaded Parallels (Trail Mode Available). I downloaded Windows 10.
From there it was a snap using Windows on my Mac to follow all the steps.
I now have an RT-AC68U!!
I just wanted to chime in and say that these instructions worked perfectly on a refurb 1900 that I just got from Amazon. It still had firmware from 2014 (release firmware?). Thank you for the write up.
Worked flawlessly. Thumbs up for the author.
This guide really simplified the other over abundance of information on the net about this process, your guide had me up and running in about 15 – 20 minutes. Much appreciated as I had been wanting to do this for a year now and always came to the conclusion it was to much of a pain in the a** before reading your guide that was laid out really well.
Glad I came across your guide as it made the task very easy –
Thanks for the guide! It worked for me perfectly on the latest T-Mobile firmware (3199), if anyone is wondering.
Step 15 on the Asus Router flash needs to be updated to reflect selecting 1.0.2.0 US AiMesh. That website was recently updated. Without seleting that CFE build the router will never find the node.
Thanks for the instructions. I managed to download the 3626 firmware, but the 192.168.1.1 page still shows TM-AC1900 at the top. I also tried to install the newest firmware, hoping to enable AIMesh, but I could not get it installed, either by the file on a USB Thumbdrive or directly downloading. Did I miss a step, or is the TM-AC1900 on the page preventing the update from installing?
Thank you very much for sharing this guide! It is very straightforward and easy to follow.
Another success story here. Things mostly worked for me, with a few modifications.
In step 5 (Place router into Recovery/Restore mode) I did the hold down reset for a bit, power off, then power on again, or something along those lines. For me, the blinky lights didn’t indicate anything different, *and* I couldn’t connect to 192.168.29.1 from my Mac laptop, which was connected via wire directly to the router. I went back to my Linux workstation, which is also of course directly wired to the router, and went to see what the deal might be. I went to reload the login screen and was presented with the miniCF page! I think the reason for this might be that I have a custom subnet, 10.0.69.* (get your mind out of the gutter – I was born in 69…). From that point, I followed the instructions to a T and everything worked great. Thanks so much for providing this howto! Oh, and I was on the latest 3199 T-Mobile firmware when I did this.
Finally nailed it. Once you have ssh is totally easy.
I had the 3199 version and had many problems.
At the end i was able to get into recovery mode y holding reset before, after and during the flash of the downgraded version.
Besides that i had to change to esge explorer because for sone reason incognito chrome never worked!!!
Thanks everybody!!!
This all worked flawless for me. Thanks so much for the detailed instructions!
I do have a question:
When I log into the server it tells me that there is an update available (RT-AC68U_3.0.0.4_384_20308-gead790e) but it doesn’s seem to want to install it.
Is this supposed to happen?
Download the latest update manually from the asus website.
I downloaded manually the update from the website but still can’t update to the new version. Any suggestions?
Try the merlin builds instead. If those don’t work then something likely went wrong in the process, most likely being that the process is only part way done or a step was skipped.
Use putty to transfer to router that should work. or clear nvram and try again.
Hi Everyone,
It looks like I’m stuck in
When I try to connect with Putty and WInSCP
I get a warning message about saying something about
In Putty that the host key has change
and in WinSCP i get the following message
the first key exchange algorithm supported by the server is diffie-hellman-group1-sha1, which is below the configuration warning threshold
do you want to continue with the connection?
Yes or no?
I hit yes
I will try to add picture links to this problem, later.
them in
step 12 ( i type)
In putty type:
cat /dev/mtd0 > original_cfe.bin
—–then putty is asking a password
i tried putting typing password as the password and then i get access denied.
so i’m stuck at this point.
Do you guys know what I can do or what am I doing wrong.
Thank you for your help
instead of typing in the admin username you are typing in a command. Log in first, then enter commands.
im stuck at the same spot. putty is asking for a password and “password” isn’t working. Did I miss something?
nevermind I see what you mean
Well done explicit instruction. I was able to flash to asuswrt firmware successfully with your help. Thanks.
I have flashed to Tomato firmware, now want to flash to Asus firmware. Do I complete all the steps, or where do I pick up at? Easiest way to get there.
No, just load up recovery mode and flash any trx. These steps only need to be done once.
WHY?
WHY?
Can someone explain why it would be worth the 2-3hrs to flash the ac1900 to the RT-AC68U?
Is it worth it for the average user?
Thanks.
2-3 hours? Where are you getting that number from?
Has anyone here actually gotten an AiMesh setup working, using a converted TM-AC1900 as the primary router? Was it as simple as loading a new CFE, using 1.0.2.0 US AiMesh (rt-ac68u_1.0.2.0_us_am.bin), and then updating to the latest official ASUS RT-AC68 f/w?
Currently, I’m using three converted TM-AC1900’s in a typical router/AP setup and would like to switch to AiMesh, but if the TM-AC1900 won’t work well as the primary, I’ll just buy a new, genuine, RT-AC68U for that purpose.
Thanks!
I went through the steps in flashing 2 ASUS TM-AC1900 routers to RT-AC68U with firmware Version 3.0.0.4.384.20308 to set up an AiMesh network. Both have been successfully flashed. I was able to set one as the router but not able to search the other router to set it up as a node. Can someone please help?
A better place to ask for help with the aimesh cfe is in the snbforums aimesh beta thread.
https://www.snbforums.com/threads/official-beta-aimesh-beta-firmware-for-rt-ac68u-rt-ac86u-rt-ac5300-rt-ac88u.40745/
While that thread is a good source of info, since AiMesh is out of beta, that thread has been locked…here is the new ‘Official Release’ thread that has taken it’s place.
https://www.snbforums.com/threads/official-release-aimesh-firmware-v3-0-0-4-384-10007-for-all-supported-products.43125/
Nice, thanks for the heads up. Now that it is stable I’ll be doing some testing with aimesh in the next week hopefully.
Nice! Can’t wait to hear the results and your recommendations.
Can anyone confirm if the 1.0.2.0 AiMesh option on the cfeditor site works to get these working as the AiMesh router? I followed the instructions exactly, so I didn’t use the AiMesh option, and that part definitely isn’t working with these.
Can I just follow the CFE steps to switch from the 1.0.2.0 CFE to the 1.0.2.0 AiMesh CFE?
Thanks, by the way, your writeup is pretty awesome!
Yes, use the 1.0.2.0 AiMesh option if you ever intend to use ASUS AiMesh, otherwise, you’ll scratch your head for a week wondering why your AiMesh router couldn’t detect or connect to your AiMesh node(s). You’d use this CFE in place of the regular CFE.
Hi Alex,
i have follow your steps and successfully flashes my AC1900 to AC68U but…my router model still show TM-AC1900 in the Tool – Sys Info…
any ideas where i have did wrong?
Thank you for the step-by-step instructions.
BTW, I tried step 7 using Mozilla Firefox (ESR 52.5.0, 64-bit on Windows 10 Home) but it didn’t work. Tried again using IE 8 and it worked perfectly.
Muito obrigado!
How do you do a NVRAM reset?
Step #20
one of the easier upgrade process for this super router. I am starting to play with the AiMesh option with an existing model.
excellent guide!
Thanks for the write up. Got it done via Ubuntu without having to go to Windows, and it worked okay with a couple of minor issues.
I want to flash my tm ac1900 to stock FW to use Aimesh, should i use the BL 1.0.2.0 US or
1.0.2.0 Aimesh from https://cfeditor.pipeline.sh/ ?
Any expirience ?
Same happend to me but when i checked the BL version it was still 1.2.1.6, so the boot loader was not replaced, i repeated the steps 16,17 and 18 once the BL was correctly replace the name changed to RT AC-68U and i could flash the newest asus software
Step 15:
Which is the most current CFE to use? It seems that that website (https://cfeditor.pipeline.sh/)may have been updated with newer CFE’s since the BayAreaTechPros instructions?!
ie. Does 1.0.2.1 US incorporate AiMesh?
1.0.2.1 US
1.0.2.0 US
1.0.2.0 US AiMesh
1.0.2.5 US (RT-AC68P/V2)
Answer: I used 1.0.2.0 US AiMesh and it worked fine. Updated the firmware on the AC68U via web interface with no issues…..AiMesh works perfectly!!
Thanks for that info. Will test myself when I get a new batch.
Nathan, are you using a converted tm-ac1900 for your main router in your aimesh setup, or just for the node(s)?
The cfeditor website has been updated with an alternate AiMesh enabled CFE. The 1.0.2.5 US (RT-AC68P/V2) CFE will turn your T-mobile router into an RT-AC68P which will, by default, run the router’s CPU at 1ghz instead of 800mhz. Not that big of a difference, but some people report that the router’s U.I. feels a little snappier. Check out the following thread for more info on this CFE.
https://www.snbforums.com/threads/aimesh-on-the-t-mobile-tm-ac1900.43278/page-28
So if you want to run AiMesh on your T-mobile router, you now have two working options!
Can someone help, i cant get pass step 11. Putty and winscp says that connection refused to 192.168.29.1
Why is the connection refused? Do you have SSH enabled in rotuer? Is your firewall blocking it?
I followed this guide just prior to the 1.0.2.0 US AiMesh option becoming available on the https://cfeditor.pipeline.sh/ site. So while my router shows the AiMesh Node as an option, it doesn’t actually detect any compatible devices on my network (I have another, properly flashed device, currently running in standard AP mode, but running 1.0.2.0 US AiMesh).
So, for my router running regular 1.0.2.0, would I just start the process at step 10, enabling SSH, to get it on 1.0.2.0 US AiMesh? There’s no need for me to downgrade the firmware or anything prior to that, right?
Correct. The only reason for downgrade is to enable ssh…if you already have ssh access, no downgrade is necessary.
Excellent. Thanks, Tim.
This no longer works after upgrading the bios to 3.0.0.4.384_20624-g14d2f02. The Router still says it is an AC68U, but you can no longer use AiMesh with the router after firmware updating it.
And downgrading the firmware doesn’t fix the issue.
Yes this happened to me as Well. Do not update to the new firmware. Aimesh will no longer be available if you do.
Is that an official Asus firmware?
My app said that there was an update available, so I updated from my pc. After that both ac1900 went offline but still said rt-ac68u. Could not get the aimesh to connect. So I called tec Support and the CSR ask what firmware that I was running, and when I told him it was the 3.0.0.4.384_20624-g14d2f02 he seam surprise that I was running this. He said that it had been only released for one day, but he said that was the latest firmware and should be fine. With his help we could not get back into the aimesh nor could we down grade back to _3.0.0.4_384_20308. Then I tried to downgrade using the method from here and could not get into cfe . So now im stuck with two ac1900 that are useless.
If downgrading the firmware doesn’t fix the missing AiMesh with the latest firmware update. Check the CFE version. It is possible the latest firmware updated the CFE to 1.0.2.9. If so one has to roll the CFE back to a prior version in addition to rolling back the firmware.
Fortunately I still had the CFE generated when first running these steps so I simply used SSH to roll the CFE back. Then rolled back the firmware. Basically start from Step 16 in the directions. I was able to get AiMesh back by staying with the previous firmware (3.0.0.4.384_20308).
People are reporting the latest firmware that breaks the AiMesh appears to work fine in all other respects. So if one doesn’t need AiMesh they should be OK with the latest firmware.
Cannot stress this enough. Do an NVRAM clear either when starting from scratch or from step 16 with the steps above. Doing an NVRAM clear at the very end will fix the Daylight Saving Time broken/missing on the System Administration page if one experiences it.
I can’t get into recovery mode to do this.
I was not able to either. However i was able to use the asus recovery tool. Ran the firmware updater. I did have my adapter set to 192.168.29.5 but it wouldn’t connect. I was able to connect wirelessly via 192.168.1.1. I did finish clearing the NVRAM but I had to return to work before I could see if AiMesh was back. As I too did the firmware update and it took my node out of the mesh.
I am going to return these two back to amazon and get two more, then start fresh.
Hope you got the refurbished units, otherwise that would be very unfair to the seller.
Yes they are.
I made the mistake of updating to the 3/26/2018 firmware and one(strangely just 1 out of 2) cellspot router reverted back to the TM branch of the firmware.
After the update I have been unable to get it into recovery mode again and am stuck with T-mobile’s crappy firmware without AiMesh.
They’ve removed the SSH access from the firmware page (you can still see it commented out and hidden in the source).
Not sure exactly why the other router did not revert to the TM firmware.
Exact same thing happened to me. This update is now on there support page for download. Wondering would you lose AiMesh if it was an official Rt-Ac68u? If so, then they should be coming with a fix.
Why is my download speed considerably slower when its connected to my AiMesh Node? Has anyone else had this problem? Is there a setting that can be changed to make it better?
Are you using the node router? If so you could have a weak connection in between the two routers.
Yes it’s the node. My signal strength is 5 bars when I check from the ac-5300 to ac68u. They are less than 10ft apart. Ac-5300 is in my Living room and ac68u in the garbage.
Have to revert all the way back to the old firmware to be able to enable SSH again.
Has anyone had issues getting the AIMesh option to show up on their converted TM-1900? I have two that I just converted and used the 1.0.2.0 US AiMesh cfe, but it still doesnt show up, even after multiple factory resets. I’m using the latest ASUS firmware (384_20624), could that be the issue? I get the option in QIS, but when I try to set up an AiMesh router, it skips and goes straight to the page for setting up the radio. It’s no the end of the world if i cant get it to work, but I’d like to try it out at least once.
Yes, the 384_20624 is broken for AiMesh. I am thinking this is a new CFE issue that needs to get adapted for use in the TM1900.
Could you provide links to all the downloads from their respective sources? I can get putty, winscp and 7zip no prob, but I’m hesitant downloading random files from mega and installing them.
Thanks,
Ed
Don’t overthink it…Considering this thread has been going strong for a year, if there were anything funny going on with any of the files, it would’ve come to light by now.
A quick Google search for both “WinSCP” and “Putty SSH” provides exactly what you request. I am pretty sure nothing special is needed for a compression program as Windows’ built in app or 7zip works fine
https://i.imgur.com/VbVXHIm.jpg
I flashed the 1.0.2.0 US AiMesh CFE, but the AImesh is not working properly. What can I do if I want to re-flash up to 1.0.2.5 CFE?
Why do you think 1.0.2.5 CFE will be any different? What specific issue are you having with AiMesh? What firmware version are you using? There is a huge thread on AiMesh and this router at the following link: https://www.snbforums.com/threads/aimesh-on-the-t-mobile-tm-ac1900.43278/
It is not clear what bumping up to 1.0.2.5 CFE does other than give a slight bump in CPU Clock speed (from 800 to 1000) and the unit name on the router administration pages changes from AC68U to AC68P. If you really want to change the CFE just follow the steps in the directions at the top where one copies the CFE to the router and writes it.
Thanks for the guide! Just a headsup on prerequisites for newbies like me:
1. Plug your computer directly into one of the ethernet ports on the back of the router.
2. Leave your router plugged into your internet gateway. You’ll need this for getting your new cfe file
Great guide. Thanks for posting. Once completed and I had the FW_RT_AC68U_30043763626.trx firmware, I did some wifi speed testing on 2.4 and 5.0, and it maxed out at my full bandwidth (~110 Mbps)…perfect. I upgraded to the last ASUS firmware: Version 3.0.0.4.384.20624, published 3/27/18 and my wifi speed cut in half (~45 Mbps). Did a quick Google search and found some discussion around TM-AC1900 issues with that firmware but it has only been a couple days since it came out. Downloaded the previous version of the Asus firmware, Version 3.0.0.4.384.20308 and updated it manually from within the firmware check/update option and it stated that it updated successfully. Upon reboot of the router, it reverted back to the original TM-AC1900 3.0.0.4.376_3199 firmware. Thoughts? Which update firmware version should I be using?
I ran into a similar problem. My FW was reverted back to 3199 after I tried to flash Merlin within the firmware check/update option. I tried to re-do the whole thing. But all attempts of downgrading to 1703 has failed even though I could get in mini CFE. Are you able to downgrade?
Hey I am having this exact issue. Followed steps, everything went smoothly (third router I am doing this on).
However, for this one, when I tried to flash Merlin, my FW reverted back and it seems that I can no longer downgrade either. I can get into mini CFE, but it is rejecting all firmware as “not valid firmware.”
It seems that it is stuck in upgrade limbo.
Same to me!
I tried every thing but nothing happened!
“not valid firmware.” comes out every time.
I think CFE changed into higher version。To solve this must enable SSH，but I cant do this now。
who can help us？
I too have the same problem as three previous post. Can some please shed some light on the subject and that would be greatly appreciated
I am having the same issue. Does anyone have a resolution?
WORD OF CAUTION: DO NOT UPDATE FIRMWARE BEYONDVERSION 20308. THERE IS A NEWER UPDATE THAT WILL NOT WORK WITH AIMESH.
HELP, Please!!
I was able to follow these steps and flashed the router to AC68P. Everything worked until…..I tried to flash the latest Merlin while plugged in a external hard drive. The flash wasn’t successful because of the plugged in device. I unplugged and restarted the router, only to find out the router was reverted back to TM firmware 3.0.0.4.376_3199.
Fine, I thought no big deal just re-do the whole thing. There comes the problem. I could get in mini CFE no problem, but I keep getting “Receive file size=16949294. This is not a valid firmware”…. I’ve tried switching all 4 land ports. no luck….
What was wrong with the router? Did the unsuccessful attempt flashing it the Merlin broke it? I can still get in the router interface and use it as Tmobile….
Any thoughts?
Same here
FYI there has been some updates that will allow the use of the latest Asus AC68U https://www.snbforums.com/threads/aimesh-on-the-t-mobile-tm-ac1900.43278/page-47
So I had mine setup as a aimesh node, and it was working… then I deviced to update the firmware.
Seem like my router is now a TM-AC1900 again with 3.0.0.4.376_3199. The only way I can get the recovery page to show up is the hold down the reset button while hitting 192.168.29.1
When I upload the older TM firmware, it says its not valid. Am I totally fucked now?
If you figure this out please let me know….. I’m having the exact same issue… GRRRRRRRR I should have paid the extra 50 bucks… this has been a huge PITA
Found a post from Frank and it worked!!!!!!! back to the start again (running tm 3.0.0.4.376_1703) a version that allows to enable SSH……
Long story short, keep the reset button held in order to upload the old version of firmware once you are running the new tmobile firmware v xxx.3199
From Frank!! Thank you Frank if you see this!!!!
—–
Finally nailed it. Once you have ssh is totally easy.
I had the 3199 version and had many problems.
At the end i was able to get into recovery mode y holding reset before, after and during the flash of the downgraded version.
Besides that i had to change to esge explorer because for sone reason incognito chrome never worked!!!
Thanks everybody!!!
worked on one but not the other… not sure why this would be.. back to square 1.. one is working but for some reason the other the same process did not work.
Been there, did that. Still invalid firmware. It doesn’t matter if I hold the reset or not during the firmware load.
I just followed the guide on two units. I used the 1.0.2.5 CFE as I don’t need aimesh. I will used them as APs + wired switches.
Both units still show TM-AC1900 at the top in the title.
Both units are now on 3.0.0.4.376_3626 stock.
Is everything ok up to here? Asking since I don’t see the title change to RT-AC68U or RT-AC68P. However, I do have SSH.
Assuming all is ok, can someone tell me what is the latest Merlin firmware that I can upgrade to without reverting to some TM CFE stock option?
Thanks,
No, it should show AC68P. You may have missed an nvram reset along the way.
guys tried to do a manual install of the latest 68p firmware and it reverted completely back to a tm1900 with latest firmware!!!!!!! the only way around this seems to be to unplug the wan when doing a firmware upgrade and disable autoupdate. also, my tm1900 automatically updated its firmware when i plugged it in. beware everyone not to plug in wan when switching firmwares!!
t-mobile updated my cfe!! I can no longer downgrade firmwares. It locked it. If I try to use a previous firmware I get a firmware no valid error from the miniweb page. Also, asus restore utility does not detect a rescue mode
so unhappy!
i was successful in flashing my TM-AC1900 to AC68U, but when i did a recent Asus firmware upgrade, it screwed the AiMesh. This prompted me to update the firmware back to the old Asus (RT-AC68U_3.0.0.4_384_20648-g21e3702), which ended up converting my router back to TM-AC1900 with 3199 firmware. :(
i’m now stuck with a TM-AC1900… is there a way to bring it back to stock to AC68U?
I’m in the exact same boat. I was successful in flashing to a AC68P. I did a firmware update and it completely converted me back to a tm-1900 and i can’t flash back to old firmware. It says invalid firmware. I think we are unlucky and got locked out.
Same boat… so sad now…
I got my TM-1900 flashed to an AC68U and was able to add it as a node. I then made the mistake to update the firmware on my original AC68U. This updated both routers to 3.0.0.4.384.20648. The TM-1900 was running but no longer part of the network. I had to do a factory reset of the TM-1900. You press and hold the reset button on the router until the power light on the router begins to flash, and then release the button. Wait until it reboots and then connect to it. You’ll go through the setup wizard. Set it up as a standard router then log back in and enable SSH. Then follow all the steps starting at #16 (you still have your new_cfe.bin, right?).
What’s annoying is after you do a factory reset with the 648 firmware, the TM-1900 wizard shows the option to make the router into an AiMesh Node. BUT, my AC68U still can’t see it. So the most recent firmware the TM-1900 can run is 3.0.0.4.384_20308-gead790e. My AC68U is still running v648.
this solution still working. I tested it.
is there any solution for those of us now stuck on the tm-1900 (during an upgrade of our 68p firmware, asus seems to have reverted us!) ? telnet, ssh all disabled. Unable to downgrade as mini web cfe says every firmware i try is an invalid firmware/image.
very frustrated!
This TM-AC1900 to RT-AC68U conversion isn’t perfect, that’s for sure.
Here’s the issues … 1) cannot check for new firmwares from web interface 2) doesn’t enable aimesh and there’s no aimesh popup after web interface login.
Aside from that, if you download the firmware manually and update the modified router while it’s connected to the internet, there’s a good chance it will revert back to a T-Mobile firmware.
When it does that, it probably? stays on the asus cfe and now it won’t allow any T-Mobile firmware downgrades or Asus firmware upgrades either from web interface or recovery.
You also cannot re-enable telnet or ssh via html hack, so as far as I can tell there’s no way to modify it again … Any ideas?
Worked for me!!!!
I had little trouble loading Mini-CFE but after few minutes the page loaded and everthing went smooth.
Thanks
I flashed the 1.0.2.0 US AiMesh CFE, but the AImesh is not showing, any suggestions for AIMesh ?
Thanks,
Same here, no AI Mesh icon, please help
Roll back to RT-AC68U_3.0.0.4_384_20308-gead790e, reset and you will have it.
I just completed another TM-AC1900 conversion last night.
I had the same problem as many above that from the T-mobile 3.0.0.4.376_3199 I could not put the router into recovery mode. After an hour of trying, I found the the Reset/WPS/Wifi button solution and with the mini-CFE page I was able to load the 1703 version.
Another BIG issue was that Asus removed all but the latest T-AC68U_3.0.0.4_384_20648 version from their website. The last safe version is 308 was no longer available. After 15 minutes of google/bing. I found the a link to the 308 version on a dutch website. Since the file came from an Asus server, most likely will be removed soon. So hurry up before it goes.
As far as the upgrade from 308, last week I found instruction on snbforum with couple of lines of code which I was able to use and update my other without reverting my router to TM. Unfortunately Asus made snbforum remove the whole discussion from their site so I no longer have it.
Does anybody have the instructions. I think the instructions came from a guy name XVortex and I even remember that it was on page 47 of the forum but that’s all I remember.
I found the instructions on Google cache. I tried it on a router last week and worked. You need to do this BEFORE attempting to upgrade to the 648 FW version
cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot
Credits go to @XVortex tested/written up by @Ronald Schwerer.
Any tips on how to transform a router that was rolled back to TM-AC1900? The Recovery Console will complain both older TM-Mobile firmware and Asus firmware has invalid signatures. The Asus Restore Utility won’t connect to the router.
Basically as near as I can tell, what is needed is either a way to change the firmware signatures to something that will be accepted, or another way to gain shell access.
Until there is a solution, I would highly recommend against trying to use the Asus Firmwares, as at any time your router could permanently revert to broken firmware.
Is yours AC68 U or P before it rolled back to TMo? Of what i gather it may be limited to the “P” CFEs going to 1.0.2.9?
I have 3.0.0.4.376_3199 I’m pretty techy but still nothing is letting me downgrade to version 1703 of firmware. I can get to the mini cfe flashing page but still I get invalid firmware when I try to downgrade. I too downloaded latest merlin firmware and it got reverted back to t-mobile firmware and now stuck with this firmware. Anybody have a solution? I tried holding reset while flashing but also a no go with this firmware. Someone please help us.
I upgraded to firmware .20624 on 3/27, how can I revert back to .20308?
I’m worred about getting locked to ac1900 firmware if I take the wrong steps.
Also the threads trying to fix this issue at SNB forums have been deleted today making it harder to find information on this.
Can anyone help?
so SNB Forums deleted that thread. Go grab it off of the google cache while you can! I tried to grab a bunch of the latest pages that included the fix for updating to the latest firmware. Here’s the link: https://mega.nz/#!fT4mDBab!DQxKvfhDX8WiafG9lPhF8AflY84REu-9C7pnaodvVTo
The thread never publicly said how to update a locked TM router.
I know it can be done, I’ve done it, but I don’t have the steps
required anymore because I lost my private messages on SNB …
You didn’t write any of the steps down offline before posing to SNBforums? Do you remember any of the steps or what you did? Posting them, even if partial, may help others figure out a way.
Aren’t these the steps?
http://forums.redflagdeals.com/amazon-com-refurbished-t-mobile-rt-ac68u-dual-band-gigabit-router-us-48-15-2185681/
SNBForums removed the big AiMesh thread on these TM-AC1900 routers that had lots of good information. And issued a notice they will be removing any additional discussion (on their site) about converting these routers. :-(
https://www.snbforums.com/threads/snbforums-policy-on-asus-tm-ac1900-conversion-discussion.46018/
Not only that, they removed people’s PM’s on the subject.. Time to move the discussion here.
I managed to salvage the important steps to upgrade to the latest firmware. Here’s the mini guide. Use at your own risk, but I personally tested with my 3 units:
0. DONT PLUG THE ROUTER TO THE INTERNET. Before you start, you should:
Download manually Asus Firmware 20308 (RT-AC68U_3.0.0.4_384_20308-gead790e)
Download manually Asus Firmware 20648 (RT-AC68U_3.0.0.4_384_20648-g21e3702). This is the latest as of April 12, 2018 and works with AiMesh once you follow this mini-guide.
1. Follow the instructions on this page. They work perfectly. Make sure when you get to step 15, where you select the version select 1.0.2.0 AiMesh, NOT 1.0.2.5
2. Once you get to step 22 and everything is nice and dandy, you will want to do a manual firmware upgrade to the 20308 firmware. You can use the router’s web interface at 192.168.1.1 to do this without any issues.
3. Once updated to 20308, enable SSH once again on the router (Go to Administration > System > Enable SSH > Yes > Apply)
4. Putty once again into the router, this time at 192.168.1.1
5. Issue the following commands:
cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot
The router will reboot, wait for it the usual 2 minutes. This will delete the TMobile certificates on the router, and will let you update to newer firmware. I’m pretty sure there is no turning back after this.
6. Now you can manually update the firmware to the 20648 version, the latest available now (as of April 12, 2018). I dunno if this is future proof. You can update using the user interface manually without issues.
7. If you are paranoid, you can putty to the router once you finish and re-flash the 1.0.2.0 US CFE file you already created on step 15.
Thanks for that.
Thank you!
Just FYI for those who hasn’t gone through this:
The reason we are preforming this following command:
cat /dev/mtd5 > /jffs/mtd5_backup.bin
is to make a back up of the mtd5 partition (similar to making a back up of CFE). Before you proceed to anything other step,
SCP that file out of the router!
otherwise you’ll lose it forever.
That being said, you’ll probably never need it unless you want to flash the router to TM-1900 for return purposes.
Since snbforums has decided to deleted all traces of flashing TM-1900 to the latest AImesh firmware I wanted to post this code that @Vortex posted to get you on the latest firmware without it reverting back to a TM-1900. There are other steps involved and this code is ONLY for wiping the MD5 partition so stock firmware will not revert it back.
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot
Here is the SSH code I saved from the SNB forum discussion if you would also like to permanently remove mtd5 fro. The T-Mobile router. This may be an important step in case ASUS rolls out a new firmware that checks for this TM-AC1900 only partition (does not exist on a real 68U). The extra code writes FF’s to remove all traces of the partition. This is not my own code and all credit goes to out to all the great guys that contributed to the SmallNetBuilders forum thread that got deleted.
cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
ln -s /sbin/rc mtd-erase
./mtd-erase -d asus
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot
Oops.. There it is!
Out in the wild.
Thanks for the info.
I am currently on firmware version 20308. Just to be clear, if I perform these steps, I can then upgrade to v20648 using the built-in firmware upgrade method and I will retain aimesh functionality?
I was on 20308. I did a factory reset, enabled ssh, ssh’d in and entered all the commands, upgraded to Merlin’s 384.4_2 release using the normal built-in firmware upgrade method and everything is gravy. I decided against using aimesh and went back to an ethernet-connected AP. Merlin never did us dirty like Asus did, so I’m staying clear of it for now.
Now we just need the information on how to recover a TMO router that has been auto rolled back to the TMO firmware and one is having trouble flashing new firmware to the unit. Supposedly it involves some sort of “webserver” but the person who posted about it lost the info when SNBforums wiped/nuked people’s posts and PM’s on the TM-AC1900.
The webserver in question is just the ASUS built in recovery mini webserver. It becomes increasingly hard to push the router into recovery mode. The trick that worked for me is:
_
1. Change the PC IP to 192.168.29.2 / 255.255.255.0
2. Find a steady way to hold the Reset button on the router, because you will spend a lot holding it.
3. Open a Command Prompt on your PC and use the command: ping -t 192.168.29.1
4. Open your web browser and type on the address bar 192.168.29.1 BUT DONT press Enter yet.
5. Here comes the fun part.
6. Hold RESET for 10 seconds, Power off router holding RESET still. Wait 10 seconds more. Power back on still holding reset.
7. Look at your command window and wait for the exact moment when the router starts again to respond to pings.
8. Press enter on the web browser so the mini-cfe webserver starts. Press refresh a million times. It will open eventually. If you are unsuccesful after around 15 pings or so, start over.
9. Once the miniweb server opens, you have a few seconds to click browse and select the first firmware mentioned in the guide on this page. (TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx)
10. When you start the flashing, release the Reset button. Nothing will happen but wait… like 3 minutes. It will eventually say success and you will be able to start the guide over here along the extra steps I mentioned before.
11. Done!
Okay sooooo…..
It would be nice to get the people who figured this all out to make a Reddit thread or something….
This shouldn’t even be a big deal? It’s the same hardware. Router hacking has been around for a long time and also this is an older model anyways?
Seems like a waste of resources.
Anywho…. So I see the commands to remove the traces of the T-Mobile AC1900 but wouldn’t the key be to add a AC68U/P certificate or id or whatever it is after?
I thought I had read if you flash DD-WRT or Tomato that will also clear all the traces of the AC1900 and then you can flash the CFE and Firmware too?
I’d look in the archives and PM the people who helped contribute and ask them to crowd source somewhere like Reddit or Discord, somewhere and continue work on this…. Then give Alex here the info to update this page.
I believe it was XVortex and Ronald Schwerer….. I’m sorry if I forgot anyone else who also helped….
Need a place where people can crowd source. However it looks to be pretty much fixed.
I don’t get the big deal of taking an out of warranty router and giving it new life? Not like we’re gonna keep this router forever either? This does hurt ASUS a bit as many may choose to look elsewhere….
They have bigger things to focus on then one piece of hardware….
this does not work for those who get reverted and locked on 3199. Webserver method from SNBforum is the only known way that could effectively hack into the router and allow downgrade to 1703 again.
Correct. The webserver method is apparently NOT the steps mentioned elsewhere in this site. One can read Docbill’s posts starting on cached page 61 as they explain the problems they had after being rolled back to the TMO firmware. Specifically see Docbill’s posts on the cached page 64 and 66.
See this link for a listing of cached pages from the now nuked SNBforum thread.
http://whrl.pl/Re8fXq
Docbill #1202 page 61
Docbill #1206 page 61
Docbill #1212 page 61
Docbill #1217 page 61
Docbill #1231 page 62
Docbill #1240 page 62
Docbill #1241 page 63
Docbill #1264 page 64
Docbill #1307 page 66
If you are registered there, could you perhaps share the method here?
been trying to register to the new message boards (https://whirlpool.net.au/profile/?action=register), but i don’t seem to receive the email they send to start the registration process..
“If you are registered there, could you perhaps share the method here?”
There is much hesitation on sharing one specific hack since it involves exploiting a CVE security vulnerability in the rolled back TMO 3199 firmware to push different firmware to the router so one can enable SSH. Once SSH is enabled, previously discussed methods of pushing new firmware to the unit along with removing the MTD5 can be performed.
It is probably best to join that other forum and contact user 003detsiwt or other users in that forum via PM to obtain the exploit workaround directions.
The general fear is if the exploit directions are published Asus will quickly patch the exploit locking people into the older vulnerable TMO firmware.
The webserver thing was due to a user on the SNBforum who couldn’t get into the CFE. Their post started on page 61 of the now nuked SNB AiMesh TM-AC1900.
Any luck fixing this. I updated my router Ac5300 and it disconnected from the unit as a node. I tried starting over on the he tm1900 and it tells me the file size of the tm-ac1900_3.0.0.4_376_1703-g0ffdbba.trx is an incorrect size.
Firmware shows as 3.0.0.4.376_3199-ge62f8ab
Have you found a workaround? I have exactly the same issue.
Same Issue, it is solved yet?
I had followed all of the directions as indicated and the router was working great! Until today when I logged on to the router and it indicated there was a firmware update. After running the update the router is back to the TM AC 1900 firmware. I’m not sure how this happened but you probably do NOT want to run any updates!
Did you remove the MTD5 ?
I have upgraded to 3.004.384.20624 . However, it did not revert me back to the TMAC1900 firmware even if I reset the router. IP is at 192.168.1.1
The original Process I used CFE 1.0.2.0 not 1.0.2.0 AiMesh. How do I fix it so I can use AiMesh.
Thanks for your help!
Cant seem to enter Recovery/restore mode any advise?
Use the Asus FIrmware Restore Tool. I could not for the life of me get the MiniCFE page to load to upload the older firmware, but I was able to put it in rescue mode. If the TTL is 100, it’s in rescue mode and the tool will work.
This is a great article. I do have a question regarding the recent updates and AIMesh. I used the AM version of the update, but do not see any additional functionality in the firmware to actually enable AM. Am I missing something? I purchased this to utilize it as an AM node, as I have a retail AC68U for my main router.
After dumping “linux” mtd of converted TM-AC1900 with firmware 20308, I found that 16MiB hidden trx data placed at 0x0300 0000 – 0x0400 0000. The hidden data seems to be a TM firmware, have T-Mobile directory (which is empty), have no cfes but only tmo_2.1.2.6.bin. Maybe a factor of FW roll-back? Because my router also has been roll-backed to TM firmware while upgrading to 20648, but luckily it was available to downgrade to TM-1703 again.
Anyone who have genuine AC68U, please dump “linux” mtd and verify that the region is empty (filled with 0xFF) or contains any contents like TM-AC1900.
So has anyone had any luck downgrading from 3199 after being updated to 3199?
Just wanted to let others know that it’s easy to brick a RT-AC68U converted from TM-AC1900. I followed the given procedure and indeed it worked. The problem was that media bridge connections kept getting dropped. I then upgraded to the latest Asus FW (3.0.0.4.384_20648) which unbeknownst to me not only blocks flashing of 3rd party FW like Merlin, but it also reverts the installed FW to TM. So when I attempted a flash of Merlin 380.70 not only did the flash fail, but I ended up with a TM-AC1900 (3.0.0.4.376_3199) which was a RT-AC68U (3.0.0.4.384_20648) before the flash attempt. That is some seriously malicious code by Asus. It’s one thing to block unapproved 3rd party mods, but it’s quite another to actively alter a piece of equipment that is private property. Asus has transgressed from the unethical into the illegal. What makes this so egregious is that I explicitly asked Asus if there were any future flashing impacts if their latest FW was flashed. They clearly and unambiguously said no. Regardless of how this plays out for me I wanted to share this so others don’t get burned. Please take care in flashing newer FWs.
Were you using CFE 1.0.2.5? That seems to the the common trigger for quite a few who had their firmware rolled back to the TMO firmware when using the official Asus firmware. The workaround is DO NOT use 1.0.2.5 CFE, and instead use 1.0.2.0. Then use previously posted directions to remove the MTD5 from the router, then one can upgrade to C86U firmware 3.0.0.4.384.20648 or 3.0.0.4.384.20308 without being rolled back to the TMO firmware.
I’d say a better workaround is not to use official Asus builds on a modded router after they’ve made it clear they will resort to sabotaging your devices.
Made it clear how? Where? How would anyone know that by just following your procedure which as an end result leaves the modded router flashed as 30043763626 which is an official Asus build. I did not come across any hints or warnings that said starting from 30043763626 be careful because Asus is looking to lock out FWs and the way they do it is with official FW that contains traps. Maybe it would be helpful to include such a warning immediately preceding the beginning of the procedure or include URLs to SNB forum threads that cover this subject (yes, I learned about these *after* bricking my router).
Are you asking if I made it clear or if Asus made it clear?
Asus started reverting the firmware version from AC68 to AC1900 on flashed routers, so it is pretty clear they are taking your physically owned devices and doing what they want with them. As for this guide, there’s been a WARNING encased in a red box linking to a snbforum source since before snbforums got purged. So maybe what would be helpful is if we had a time machine, so I could go back in time and write that warning before Asus began this beahavior, and so you could go back in time and scroll up on your mousewheel before writing your comment.
That box wasn’t in the procedure as recently as end of March. I saved the full HTML just in case. And the underhanded behavior by Asus seems to have started long before that. It didn’t help that Asus flat out lied to me when I sent them an explicit query on this subject. I was assured by them that flashing to their latest official FW would *not* impact upgrades/downgrades. I guess my bricking the router was the result of a perfect storm, incomplete information and deliberate deception by Asus. I apologize if it seems like I’m being critical of your efforts, that’s not at all the case. I just wanted to lay out my scenario to see if anyone could help and also as a warning to keep others from falling into the same trap. Thanks for making the procedure available, it is greatly appreciated.
Thanks SmithB. If I understand correctly my working router which is at 3.0.0.4.384_20648 is not a goner yet. It would revert to TMO if I attempted a flash of Merlin, Tomato, DD-WRT, or a newer Asus FW. Having bricked my media bridge I definitely will not repeat that error. How about if I flashed back to 30043763626 or a FW between that and 3.0.0.4.384.10007 ? Is that safe or do I need to get to CFE 1.0.2.0 first and if so how do I do that? And how do I remove MTD5? Many thanks.
Router is at 3.0.0.4.384_20648.
I ran these commands in telnet:
nvram get boardrev – 0x1100
nvram get HW_ver – 170
nvram get bl_version – 1.0.2.0
I guess that answer’s SmithB’s concern about CFE 1.0.2.5. I was not using it, I was using 1.0.2.0 all along. Specifically for the bricked media bridge I tried flashing Merlin on top of 3.0.0.4.384_20648 and that apparently caused the revert to TMO. So since I’m at 1.0.2.0 on the good router can I flash back to 30043763626 without doing damage? How about other Asus FW like that has AIMesh (3.0.0.4.384_20648 had it removed)?
Generally you can roll back to prior firmware from within the firmware interface, but doing so may introduce issues if one is using AiMesh as it has been (if I remember right) indicated that AiMesh works best when all nodes/master router are using the same firmware version. Also using older firmware means the possibility of certain security vulnerabilities not being fixes. Generally it’s best to use the latest firmware if possible.
.
AiMesh was working fine using 3.0.0.4.384_20648 firmware with CFE 1.0.2.0 AiMesh US for me on two TMO routers when I tested it.
Many thanks. Your comments have been a big help.
@vegas_pete: The router would typically roll back to the earlier TMO firmware if using just the Asus firmware. It is claimed that the Merlin firmware has the rollback disabled so one is potentially taking a risk using the Merlin firmware because it uses the Asus firmware as a base.
.
Using third party firmware like Tomato or DDWRT shouldn’t potentially roll back to the TMO firmware, assuming they are not built using the Asus firmware as a base like Merlin firmware is.
.
The code for removing the MTD5 partition is listed above in the BayAreaTechPro directions under the “Code for fixing MD5 partition so you can update to latest firmware” section.
@SmithB: Sorry, still not connecting all the dots. Parts of your first paragraph don’t make sense to me. The latest Asus FW (3.0.0.4.384_20648) did *not* cause a rollback – my router is at 3.0.0.4.384_20648 and appears healthy. My media bridge also accepted 3.0.0.4.384_20648 without rollback. What caused the rollback on the media bridge (i.e. bricking) was attempting to flash Merlin. I need to clearly understand this subject. With the router now at 3.0.0.4.384_20648 you’re saying that flashing *any* Asus FW will rollback to TMO? Even much older FW versions that were created before Asus instituted this rollback nonsense? And can such older (not newer!) FW be flashed after applying the MD5 partition fix? What I’m trying to get to is 2 RT-AC68Us that have stable AIMesh. I ordered a replacement AC1900 for the bricked media bridge so getting that replacement to the AIMesh FW version should be a non-issue since the conversion procedure works. Getting the router counterpart (which is now at 3.0.0.4.384_20648) to the same AIMesh FW is the problem I’m trying to solve. I hope that clearly explains what I’m trying to do and why (I may still be harboring misconceptions).
The automatic rollback from the Asus firmware to the earlier TMO firmware was happening ONLY (not shouting – just emphasizing) with the Asus firmware. It was an automatic process apparently. Having one’s router bricked when moving/flashing from the Asus firmware to the Merlin firmware is probably a different issue. Could be a corrupted flash and the router tried to recover using older firmware or just up and bricked.
.
The TMO router rollback issue didn’t affect everyone (I wasn’t affected on two TMO routers). Apparently a small subset of people using these TMO routers, who didn’t delete the MTD5 partition, got rolled back automatically when they ran the embedded firmware update option within the Asus firmware to update to the latest (at that time) Asus firmware. Read through the Forums.Whirlpool link where several people discuss their problems with the Asus firmware upgrade and being rolled back to the earlier TMO firmware.
https://forums.whirlpool.net.au/forum-replies.cfm?t=2693988&p=1
Thanks, that helped a lot. With my router at 3.0.0.4.384_20648 it looks like I should perform the MTD5 partition fix procedure before attempting a downgrade.
I keep getting the following message when I attempt to login using WinSCP:
Cannot initialize SFTP protocol. Is the host running an SFTP server?
What do I need to do to proceed?
“What do I need to do to proceed?”
Change the protocol in WinSCP to SCP.
User DocBill on the forums.whirlpool.net.au site has publicly posted a workaround for users stuck on 3199 firmware and other firmware versions and cannot roll back or enable SSH. Use at your own risk!
.
From AC1900 To AC68U After Revert
https://docs.google.com/document/d/1NsZMONmJ70zMmoAKKQJXbTVKytaPJptWTpqih1TD5n8/edit?usp=sharing
Wow Thanks SmithB,
hmm though it looks like USB method is the easiest route to take.. correct?
If one cannot downgrade then yes the USB method may be easier than using the web server method. It appears people have been successful using either method.
I had an AC1900 that reverted and could not be re-flashed to AC68U — the google doc helped me figure out how to reflash the devices. Instructions about MTD5 should prevent reversion again.
Hello All,
I flashed my router 3-4 months back and right now using Merlin firmware(version 384.4).
Can I run the following command now? or it will brick my router?
cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot
Please advise.
Thanks
Thanks for the instructions.
I wonder what is in the original AC68U /dev/mtd5 partition. My TMO router has tmo-XXXXXXXXXXXX.tgz file, which contains TMO certificate and router certificate and key.
It can be viewed by
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
ll /tmp/asus_jffs/
I did all the steps including final:
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
ln -s /sbin/rc mtd-erase
./mtd-erase -d asus
rm -rf /jffs/.sys/RT-AC68U
And
./mtd-erase -d asus
didn’t work for me. It just hanged doing nothing to /dev/mtd5
After that with cfe 1.0.2.0 US AiMesh asus firmware reported router as RT-AC68U
but with cfe 1.0.2.5 firmware still reported as TM-AC1900
After that I’ve created a file with size of /dev/mtd5 partition filled with FFs and flashed it with dd to /dev/mtd5:
dd if=ffs.bin of=/dev/mtd5
I verified that contents of /dev/mtd5 was all FFs.
After that with cfe 1.0.2.5 the router is reported as RT-AC68P
If you try that remember the nickname of dd command – ‘Data Death’
Make sure you use right if=/dev/mtd5 param or you can destroy your router without warning.
do you have detailed steps? Your steps read too much in paragraph form to follow.
./mtd-erase -d asus failed for me too. though I am technical, not so well versed in Linux and other lingo. do you have specific steps if this persists? Thank you in advance.
Just wanted to say thanks for this walkthrough! I just got my refurbished TM-AC1900 yesterday and everything worked flawlessly.
I can also confirm the “Code for fixing MD5 partition” section works as I am fully updated to the latest Merlin firmware.
Ditto… I just updated two TM-AC1900 using the instructions and it all worked like a charm (used the 1.0.2.0 for AIMESH CFE 68U). Used the “Code for fixing MD5 partition” and it must have worked since I was able to update both routers to latest ASUS firmware. The AiMesh selection is there, so it is time to give it a go and see how well it works. Kudos to all!
I remember there was a guide how to overclock this thing to 1ghz and make it stick on stock Asus firmware. It was about editing some file and then uploading to the router. Cannot find this information anymore, can someone please help?
Thanks!
The guide had to do with updating CFE in Hex editor to 1000,800. Seems like I bricked my router by not finding that guide and just editing bin file blindly…
I literally followed every step in this guide including the MD5 fix and I can say 100% that my TM-AC1900 is now an RT-AC68U. I already had an original RT-AC68U as my main router so this was bought to flash and make into an AIMesh node.
Some additional instructions:
After the MD5 fix, download the official latest RT-AC68U firmware from the Asus website.
Extract the file from the zip download and manually flash (current latest at this time is 3.0.0.4.384_20648). This is done in the web GUI by the way.
Once done, reset to factory default (either in GUI or by holding down reset button for 10 seconds) and once it’s done correctly you should be at the router setup page.
At this point, do a scan on the main router and you should see the new device as an available node and you can start pairing.
Mine works great, no issues, and I get my full internet bandwidth (100Mbps/ 20Mbps).
Kudos to the OP and those who assisted in the making of this tutorial.
Thanks everyone. I was able to downgrade using the USB method. I’m on the latest merlin with the cfe (ai mesh version). I cannot for the life of me get the overclock to stick. Any advice? It resets after every reboot. In fact, it doesn’t work at all. Although it returns the overclocked values in the gui and nvram check, the cpu check doesn’t show an increased value.
For those having trouble getting the clkfreq to stick after reboot, try the following directions. They worked for me to make an alternate clkfreq stick after reboot. One can try a variety of clkfreq’s to see which works best for them; 800,666, 1000/666, 1000/800, 1200/800, or 1400/800. The commands (change asuscfeclkfreq and clkfreq to your preferred values):
nvram set asuscfeclkfreq=1000,800 && nvram set asuscfecommit=1
nvram set clkfreq=1000,800
nvram commit && reboot
thank you you’re method works in terms of keeping it after reset. I haven’t come across this method before so very much appreciated. The other commands for overclock wouldn’t keep it after reset. What firmware are you on?
While it shows up in the gui as frequency of 1000 and also in the nvram get clkfreq,
it doens’t seem to have actually overclocked.
Processor : ARMv7 Processor rev 0 (v7l)
processor : 0
BogoMIPS : 1998.84
processor : 1
BogoMIPS : 1998.84
My understanding is the bogomips value should now be 2400ish
Any ideas? Did asus disable this? what firmware and cfe are you using?
Currently running CFE 1.0.2.0 AiMesh US and Asus firmware 3.0.0.4.384_20648 on two TMO routers. Have the clkfreq set to 1000,800. The BogoMIPS is: 1998.84.
.
Not sure where your seeing the clkfreq should be 2400ish. It appears, per one person’s post elsewhere, their Asus RT-AC68U is at clkfreq=1000,666 with BogoMIPS at 1998.84. See this link: http://whrl.pl/ReTTyD
.
Don’t remember what the BogoMIPS was at the stock TMO clkfreq of 800,666.
The update works!
” cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs (gets rejected “-sh: unmount: not found”)
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot ”
I did this running “RT-AC68U_3.0.0.4_384_20308”, run the commands, wait for the reboot.
Then I manually installed the latest FW (04/22/2018) RT-AC68U_3.0.0.4_384_20648-g21e3702
The router rebooted and now I have AI-Mesh with the TM-1900 as a AC68U
Thanks to all for your work and updates!
I’ve installed 2 routers with AiMesh and latest firmware version without problems. This is the procedure I’ve followed in MacOS
Set static IP
IP: 192.168.29.5
Subnet: Default (255.255.255.0)
Gateway: 192.168.29.1
Place router into Recovery/Restore mode
Hold reset button 10 seconds
Power off router (keep holding reset)
Wait 10 seconds, keep holding reset
Power on router holding reset for 10 more seconds
Go to 192.168.29.1 in a web browser (Firefox) holding reset button and refresh until
you see mini-cfe browser to upload TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx
After reboot go to 192.168.29.1 in a web browser (Firefox)
Log in to router (admin:password)
Go to Administration > System > Enable SSH > Yes > Apply
mac sudo nano /etc/ssh/ssh_config (to enable legacy algo)
mac Offending DSA key in /Users/[your username]/.ssh/known_hosts:3
mac sudo nano /Users/[your username]/.ssh/known_hosts (delete line:3)
mac ssh 192.168.29.1 -l admin (pass: password)
router cat /dev/mtd0 > original_cfe.bin
mac scp admin@192.168.29.1:/tmp/home/root/original_cfe.bin .
Upload original_cfe.bin to https://cfeditor.pipeline.sh/
mac scp new_cfe.bin admin@192.168.29.1:/tmp/home/root/
mac scp mtd-write admin@192.168.29.1:/tmp/home/root/
mac scp FW_RT_AC68U_30043763626.trx admin@192.168.29.1:/tmp/home/root/
router chmod u+x mtd-write
router ./mtd-write new_cfe.bin boot
router mtd-write2 FW_RT_AC68U_30043763626.trx linux
Perform NVRAM Reset, wait for reboot /jffs/mtd5_backup.bin
router mkdir /tmp/asus_jffs
router mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
router rm -rf /tmp/asus_jffs/*
router sync && umount /tmp/asus_jffs
router rm -rf /jffs/.sys/RT-AC68U
router nvram unset fw_check && nvram commit && reboot
wait after reboot and upload firmware RT-AC68U_3.0.0.4_384_20308-gead790e.trx
mac ssh 192.168.1.1 -l admin (pass: admin)
router cat /dev/mtd5 > /jffs/mtd5_backup.bin
router mkdir /tmp/asus_jffs
router mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
router rm -rf /tmp/asus_jffs/*
router sync && umount /tmp/asus_jffs
router rm -rf /jffs/.sys/RT-AC68U
router nvram unset fw_check && nvram commit && reboot
wait after reboot and upload firmware RT-AC68U_3.0.0.4_384_20648-g21e3702.trx
http://dlcdnet.asus.com/pub/ASUS/wireless/RT-AC68U/FW_RT_AC68U_300438420308.ZIP
http://dlcdnet.asus.com/pub/ASUS/wireless/RT-AC68U/FW_RT_AC68U_300438420648.ZIP
I followed the guide on this page without a hitch. But I only ran that final procedure beginning with cat /dev/mtd5 > /jffs/mtd5_backup.bin, once not twice. Then I upgraded to the latest Asus firmware. Did I make a mistake? I see the AIMesh in the firmware settings page.
Also a victim of the rollback but the USB instructions saved my @$$. I did save my CFE so it made things easier. Step 15 only worked with Firefox & Chrome. For some reason IE11 didn’t make the download part available. Drove me nuts for a while when I couldn’t enable SSH due to my inability to edit the timezone for Pacific. Had to use Greenwich & was smooth sailing after that. The erase MTD steps were spot on, no problems. Running 20648 on both TM routers & AIMESH has been pretty solid so far. Much better than when I had 1 router as media bridge.
Anyone know how to set a static IP for the AIMESH Node?
Thanks again for the wealth of info!!!
[quote] Feel free to flash AC68U builds from Asus, Merlin, Tomato, DD-WRT, etc or to “overclock” it using instruction below.[/quote]
Beware that Merlin 384.4 also content TMO cfe, it might also revert back to tm-ac1900 if flash to any further updates version!
To expand a bit more on the Merlin issue. While Merlin may run without issue on these TMO routers, the authors of the Merlin firmware have repeatedly stated that they do not officially support Merlin on these TMO routers. See this link: https://www.snbforums.com/threads/preview-384-ng-asuswrt-merlin-384-5-early-test-builds.45769/page-3#post-395449 and this link: https://www.snbforums.com/threads/announcement-running-asuswrt-merlin-and-forks-on-non-asus-devices-is-illegal.44636/
Because the Merlin firmware is based on the Asus firmware it is possible the Merlin firmware could contain the auto rollback to TMO code. Currently there do not appear to be any confirmed reports of Merlin firmware auto rolling back a TMO router like the Asus firmware has done, but it is something users should be aware of.
Hey guys,
So I did all this and went with the 1.0.2.0 US AiMesh CFE. Completed the whole thing, did the md5 thing and then flashed Merlin. I now realised that with 1.0.2.0 US AiMesh CFE the CPU is 800mhz instead of 1ghz.
I heard that changing the CFE to 1.0.2.5 will get the 1ghz back. Does anyone know how can I do this? Do I have to re-do step 16-20 and flash back the old Asus firmware etc? Also, I kept my original CFE for backup, do I use that or should I extract the CFE again? Considering that I changed that to 1.0.2.0 US AiMesh.
One can manually change the clkfreq rather than use the 1.0.2.5 CFE. See my post earlier up page:
https://www.bayareatechpros.com/ac1900-to-ac68u/#comment-1812
Read through the various comments above that give warnings on using 1.0.2.5 when coupled with later versions of the official Asus firmware.
I was pointing to the boot when it should have been the linux part. I should of have known this.
Bought it on Amazon for 39.00 refurbished.
Thanks Bud, works great first try.
Now back to the R7000 (brick)
PEACE
Someone please tell me what this ‘USB Method’ is.
Look for the Google docs link here posted by SmithB:
https://www.bayareatechpros.com/ac1900-to-ac68u/#comment-1665
Select which USB method works best for your situation.
I have already updated my routed to Asus firmware about 6 months. I was going to update 648 but it I am glad I looked at this site again.
What I don’t understand is how to prevent the rollback.
Do I just manually update to 648 or do I need to do something before to prevent rollback?
Can someone please tell me if its possible to downgrade from 3.0.0.4.376_3199 to 3.0.0.4_376_1703 so that I can enable ssh and proceed?
If it is then please list the detail steps. I tried the tricks mentioned above but none has worked till now for me.
Thanks in advance!!
See my post above with a link to a doc that has several methods to try and roll off the TMO 3199 firmware when one cannot enable SSH.
https://www.bayareatechpros.com/ac1900-to-ac68u/#comment-1665
Had the same issue, even tried a full search in WinSCP and the ‘original’ file could not be found.
Closed the session and reopened the connection and there it was!
Hi, I did flash TM-AC1900 to a RT-AC68U. It has the latest firmware version 3.0.0.4.376_3626. Can any one please tell me what will the latest build that I can update?
It looks like if I use the latest ASUS official firmware, it will reflash the router back to AC1900. Thanks in advance for your help
I can confirm installing RT-AC68U_3.0.0.4_384_20648-g21e3702.trx will reflash the router back to TM-AC1900. Previously was using RT-AC68U_3.0.0.4_384_20308-gead790e.trx and had no problems.
My router reflashed to TM 3199. Now, I am trying to revert back to Asus AC68U. I can get to the CFE miniWeb Server and upload TM 1703. Once the upload is finished I get this error message “The file transferred is not a valid firmware image”. Some are talking about flashing 1708 but there is no reference to where to download this firmware or any comment on why 1708 would be preferred over 1703.
I would appreciate any help on this matter.
Just purchase another TM-AC1900 and for some strange reason this one name never changed from TM-AC1900. I reloaded different CFEs such 1.0.2.0 US and 1.0.2.0 US AiMesh but no success. Additionally this Router is currently on Asus RT-AC68U_3.0.0.4_384_20308 firmware and has not icon for AiMesh. Any help on these two issues would be greatly appreciated.
I had done this previously with a TM1900 and decided to try it again. Bought a refurb on Amazon (April 2018) and had no problems. Easier this time, didn’t have to hexedit files. If you have a Mac with a newer OS, you will have to do this:
In Terminal:
sudo nano /etc/ssh/ssh_config
Remove the hashtags from the lines that say:
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
and
# MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
And paste this at the end of the file:
HostkeyAlgorithms ssh-dss,ssh-rsa
KexAlgorithms +diffie-hellman-group1-sha1
If you install the Tomato firmware, be advised you may get a “bad tax header” error if you try to go back to Merlin or a stock firmware. The solution is to use the ASUS Firmware Restoration app. Running the latest from Merlin- I like his version better, personally. I haven’t tried the AiMesh option yet.
I did all the steps and it’s configured BUT not seeing AiMesh option. How do I get that?
I was able to reflash back to Asus, but from TM 3199 could not downgrade. Had to use an exploit explained here https://docs.google.com/document/d/1NsZMONmJ70zMmoAKKQJXbTVKytaPJptWTpqih1TD5n8/edit#
The one that worked for me was the USB method. There are some typos on the step numbering and also at some point before inserting the USB, the zip file needs to be copied to it. During the process there was some buffer error when running the command to write the FW_RT_AC68U_30043763626.trx firmware, but after NVRAM reset is showed the firmware had been installed successfully.
I have used the CFE 1.0.2.0 US AiMesh but still have no icon to configure AiMesh. If someone has a solution to AiMesh, please share.
I had problems with web server method. The USB method was successful. Note that there are errors in the step numbering and before inserting USB in the router, the files12345.zip needs to be copied to it.
Alright I am looking for clarification on how to get AIMesh back. Currently when I log into either router it shows as RT-AC68u in the upper corner of the web interface. I auto updated to the latest firmware before realizing they killed AiMesh.
Do I need to repeat steps 15 on to get AIMesh back or can I just run the code to remove the TMobile certs and get it back? Again my router doesn’t say or indicate that it is a T-MOBILE ac1900 it still shows as a 68u so I am confused as to if I am in the same boat as everyone else.
Terrific – my “refurb” AC-1900 came with Firmware version 3181. Followed steps above EXCEPT used Resonce’s suggestion for reset and got to Mini-CFE page on the first attempt. Did get the buffer error, but as noted by others, it did not interfere with the flashing.
I SOOOOO appreciate not having to resort to using a hex editor to modify the binary. This process was a pleasure. Thanks for your attention to detail.
I do not have ai mesh option. I verified that my CFE version changed from 2.1.2.6 to 1.0.2.0 and I am running 30043763626.
Flashed merlin 380.7 and still no aimesh. CPU model ARMv7 Processor REV0 (v7l) 800 mhz. Rechecked cfeditor and made sure I selected aimesh option.