T-Mobile router TM-AC1900 is a cheap alternative model of Asus RT-AC68U. But it is not supported by Asus officially, i.e, it is unable to upgrade to its latest firmware version. To use Asus?s latest fancy feature ?Asus AiMesh. To utilize Aimesh, it needs to flash its bootloader to Asus CFE 1.0.2.0 and then erase MTD5 partition. After doing that, it is identical with a genuine RT AC-68U.
To achieve this, First to download this file and extract it to a newly created folder. It contains a firmware to downgrade to, a firmware to upgrade to, and an executable file, mtd-write.
- The router is coming with the firmware version 3.0.0.4.376.3108 which has ssh option disabled and hidden, after trying to downgrade it to firmware version 3.0.0.4_376_1703 so that ssh can be enabled.
How to downgrade AC-1900 is really a headache.
1. Place router into Recovery/Restore modeHold reset button 10 secondsPower off router (keep holding reset)Wait 10 seconds, keep holding resetPower on router holding reset for 10 more seconds2. Go to 192.168.29.1 in a web browserIf Mini-CFE webpage won?t load use Asus Restore UtilityIf having trouble with this step perform NVRam Reset and try #2 again?not working in my case
Follow this instruction, it will work:
1). holding down three buttons- reset, WPS, and wifi on/off ? all at the same time2). powering on3). waiting a few seconds for fast blinking lights4). releasing the WPS and wifi buttons, but still holding down reset,5). as soon as 192.168.29.1 started answered pings, quickly visiting http://192.168.29.1/ to open the mini CFE uploader,6). submitting the 1703 firmware, and waiting for upload success message7). finally releasing the reset button. The rest of the how-to worked just fine.
T-Mobile has made it harder to modify the router, but it?s still possible.
2. Log in to router (admin:password), enable ssh in the administration page
Go to Administration > System > Enable SSH > Yes > Apply
3. using putty ssh to the router, copy bootloader cfe out:
cat /dev/mtd0 > original_cfe.bin
Then use scp to copy it out.
4. Copy original_cfe.bin to a local drive
5. Upload original_cfe.bin to https://cfeditor.pipeline.sh/ > Select 1.0.2.0 US AiMesh as Source CFE for Asus/Merlin builds, (1.0.2.5 recommended for DD-WRT or Tomato) > Download the new .bin > rename it to new_cfe.bin
6. Upload new_cfe.bin & mtd-write & FW_RT_AC68U_30043763626.trx to router through WinSCP
7. In Putty type:
chmod u+x mtd-write./mtd-write new_cfe.bin bootmtd-write2 FW_RT_AC68U_30043763626.trx linux
Note: If did not input the correct command format, mtd-write gives the wrong usage info, DON?T follow it, it is wrong.
admin@(none):/tmp/home/root# ./mtd-writeUsage: ./mtd-write -i file -d part <– wrong format
- Actually write the ASUS CFE version and overwrite the T-mobile one by typing:
admin@(none):./mtd-write new_cfe.bin boot <– correct cmd format
before flash:
admin@(none):/tmp/home/root# nvram get bl_version2.1.2.6
After flash ASUS CFE, the output looks like this:
admin@(none):/tmp/home/root# nvram get bl_version1.0.2.0admin@(none):/# nvram get HW_ver170admin@(none):/tmp/home/root# nvram get clkfreq800,666
8. Perform NVRAM Reset, wait for reboot <5 mins
a. Power off routerb. Wait 10 secondsc. Press and hold WPS buttond. Power up the router and continue to hold WPS button for 15?20 seconds until power LED starts blinking very quickly.
After flash asus firmware 376, the default gateway IP changes to 192.168.1.1username:password is now: admin:admin
9. ssh to the switch, remove mtd5 partition, otherwise, Asus will not let you upgrade to its 384 firmware since TM-AC1900 is not official supported by Asus and Asus added a firmware check.
cat /dev/mtd5 > /jffs/mtd5_backup.binmkdir /tmp/asus_jffsmount -t jffs2 /dev/mtdblock5 /tmp/asus_jffsrm -rf /tmp/asus_jffs/*sync && umount /tmp/asus_jffsrm -rf /jffs/.sys/RT-AC68Unvram unset fw_check && nvram commit && reboot
Next, you can download official Asus firmware from its website, and upgrade to latest version to enjoy AiMesh. After flash to 384.xx,
/tmp/home/root# ln -s /sbin/rc mtd-erase/tmp/home/root# ./mtd-erase -d asusErasing 0x0 – 0x1ffffErasing 0x20000 – 0x3ffffErasing 0x40000 – 0x5ffffErasing 0x60000 – 0x7ffffErasing 0x80000 – 0x9ffffErasing 0xa0000 – 0xbffffErasing 0xc0000 – 0xdffffErasing 0xeffff – 0xfffffErasing 0x100000 – 0x11ffffErasing 0x120000 – 0x13ffff”asus” successfully erased./tmp/home/root#
To check if your on CFE 1.0.2.0 or CFE 1.0.2.0 US AiMeshAs you will notice, doing this command(found from years ago):
nvram get bl_version
It just says 1.0.2.0 not anything about AiMesh.
To check Version verification, use Putty to telnet into router. Click the picture bottom of. this post
strings /dev/mtd0 | grep odmpid
?If it returns ?odmpid=RT-AC68U? odds are high you have installed the correct one(1.0.2.0 US AiMesh).If is says ?odmpid=ASUS?, that?s the non-AiMesh one.?
? ? -How do I double check the MTD5 signatureDo you think you didn?t do the MTD5 commands correctlyLazymocha?s Guide doesn?t explain to do the last two MTD5 commands on firmware 384.xxxxx (preferably 384.20308).If you didn?t read correctly about the MTD5 command step above, you might not have had the last 2 MTD5 commands effectively done.
To check this, once again, putty in and do the following command:
strings /dev/mtd5
A ?real? RT-AC68U has absolutely nothing in /dev/mtd5 except it is filled with 0xff. You should see no result for the command output.(seen in green)
admin@RT-AC68U:/tmp/home/root# strings /dev/mtd5admin@RT-AC68U:/tmp/home/root#
I did see weird things:
admin@RT-AC68U:/tmp/home/root# strings /dev/mtd5[tmo-14DDA9xxxxxx.tgz <- router mac addressgNp}ET8,0|Qtfx1(a+YZSlgEX`-fY qm^U=5:{“i=V#”skb8nJqf(o$4A?@8@ 9L1uHx)>(~#zAPdwTZWERs^/2sUY?g9S6’6P}e3jzM1s,Gl:cgeX(T{svzT#TA7k’_z] OW> Ma$:Y)(i&*z`q8y$^{?!Y 7neKJk;7#{# “‘F=/h)z>!?AZ ,!Y5”]mtetpX[tmo-14DDA9xxxxxx.tgz
If you do see some misc strings, there?s something in mtd5 and you should execute the commands to wipe it when on firmware Version 384.xxxxx
/tmp/home/root# ln -s /sbin/rc mtd-erase/tmp/home/root# ./mtd-erase -d asus
After this, everything works like a charm. You can sit at the back yard, enjoy a cup of cafe and web browsing at same time offered by Asus AiMesh now.
Reference:
