# TM 1900 to RT - AC68U - (Help)



## ice5192 (Feb 27, 2019)

I am at a impasse

When i upload said version of firmware TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx

I get this error in image below

"The file transferred is not a valid firmware image."

My current firmware version is 3.0.0.4.376_3199-ge62f8ab, I am trying to convert the TM 1900 to AC68U firmware.

How do i get around this?

Thanks,

I am follwing the steps on this post site https://lazymocha.com/blog/2018/04/16/flash-t-mobile-cellspot-tm-ac1900-to-asus-rt-ac68u-p/

Any Help would be greatly appreciated

I currently have a AC86U with Merlin on it.


----------



## jsfitz54 (Feb 28, 2019)

No idea what step your on.
Hex editor to down grade to CFE 1.0.2.0
Downgrade Firmware to increase nvram, so you can then upgrade firmware

Try putting the router in rescue mode to install firmware. also called recovery mode:  https://www.snbforums.com/search/942130/?q=rescue+mode+asus&o=date

https://www.snbforums.com/threads/faq-nvram-and-factory-default-reset.22822/

https://www.snbforums.com/threads/p...c68u-after-flashing-merlin.23394/#post-172940


----------



## ice5192 (Feb 28, 2019)

How to flash TM-AC1900 to AC68U:

Install WinSCP, Putty, and a file archiver. Install the Asus Restore Utility.
Create a folder on your desktop, name it “router”.
Download this file and extract it to the newly made router folder. It contains a firmware to downgrade to, a firmware to upgrade to, and mtd-write.
Set static IP for PC.
_start > run > ncpa.cpl > double click Ethernet > properties > IPV4 >_
_IP: 192.168.29.5_
_Subnet: Default (255.255.255.0)_
_Gateway: 192.168.29.1_
Place router into Recovery/Restore mode
_Hold reset button 10 seconds_
_Power off router (keep holding reset)_
_Wait 10 seconds, keep holding reset_
_Power on router holding reset for 10 more seconds_
Go to 192.168.29.1 in a web browser
_If Mini-CFE won’t load use Asus Restore Utility_
Flash TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx

I am on step 7 when i flash it i get that error?


----------



## jsfitz54 (Mar 1, 2019)

ice5192 said:


> How to flash TM-AC1900 to AC68U:
> Install WinSCP, Putty, and a file archiver. Install the Asus Restore Utility.
> Create a folder on your desktop, name it “router”.
> Download this file and extract it to the newly made router folder. It contains a firmware to downgrade to, a firmware to upgrade to, and mtd-write.
> ...



Compare your steps to these:  https://www.bayareatechpros.com/ac1900-to-ac68u/

You have to downgrade CFE.


----------



## ice5192 (Mar 1, 2019)

It wont let me downgrade from step 7 it shows the error in picture 44.png I uploaded.


----------



## jsfitz54 (Mar 1, 2019)

Is the router in rescue/recovery mode when you attempt this?
I did mine on an isolated laptop

This has to be done via Ethernet cable direct connection.
Static IP of PC has to be set at 192.168.29.(50)*  a range higher than the router login IP of 192.168.29.1
All other wireless needs to be turned off


----------



## ice5192 (Mar 1, 2019)

Yes see the image I uploaded I'm on step 7 and in the mini mode or rescue mode. 

It doesnt accept the firmware?


----------



## jsfitz54 (Mar 1, 2019)

ice5192 said:


> It doesnt accept the firmware?




If you can’t get Mini-CFE or Asus Restore utility to work try the method outlined in this comment: https://www.bayareatechpros.com/ac1900-to-ac68u/#comment-5679

someone's observation:
Then *DON'T* upgrade to the latest released 3.0.0.4.384_20624 firmware as the "upgrade" also overwrites CFE with a version that disables AiMesh on the converted TM-AC1900's. *To get it back currently you'll have to reflash both a valid CFE and previous 384.20308 firmware.*
It seems ASUS in their wisdom have moved to close down this excellent recycling path, partially for now (no AiMesh) but maybe they can disable more in the future?

*If you can't downgrade Firmware, try downgrading the CFE to 1.0.2.0 first.*


----------



## ice5192 (Mar 1, 2019)

I have no idea what you are talking about.

I cant turn on ssh or telnet I have to downgrade I cant do anything.

I put it in rescue mode upload said file get error message.

The restore utility doesn't fine the router.


----------



## jsfitz54 (Mar 1, 2019)

ice5192 said:


> I have no idea what you are talking about.



Read all the steps first,  not just follow from the top #1 and start.  The CFE is the bootloader for the router firmware.

Side tab Router "tools" "sysinfo" , 4th box down.


----------



## ice5192 (Mar 1, 2019)

I'm starting to feel your not reading nor hearing what I'm saying I CANNOT get past step 7!!!! I feel like I'm speaking with a wall right now.

Sorry it just feels that way. 

I cannot get past step seven I'm in rescue mode I upload 44.png the image I uploaded is the error message.

If you have another version you want me to upload I'll try it but the 1703 is not uploading on my tm1900


----------



## jsfitz54 (Mar 1, 2019)

ice5192 said:


> I cant turn on ssh or telnet I have to downgrade I cant do anything.



"Admin" side tab then "system" then scroll to near bottom.



ice5192 said:


> I'm starting to feel your not reading nor hearing what I'm saying I CANNOT get past step 7!!!! I feel like I'm speaking with a wall right now.
> 
> Sorry it just feels that way.
> 
> ...



I did mine over 3 years ago, you most likely cannot go forward due to a current CFE that does not permit a downgrade.
The only work around that I can see is to downgrade the CFE first.  Then flash the old Firmware build.  Then flash a current Merlin AC68U build.
If I was trying I would try the Merlin 384.8_2 build:  https://sourceforge.net/projects/asuswrt-merlin/files/RT-AC68U/Release/

You may be able to skip some steps but I can't guide you.  Rolling back the firmware was meant to aid in downgrading the CFE.
It may not wok that way now, as ASUS has tightened up on this action.

If you skip ahead to the CFE Instruction setting, you may be able to insert the current Merlin build in it's place.

There was a step in flashing to increase the NVRAM size. That was step 22 in this link: https://www.bayareatechpros.com/ac1900-to-ac68u/


----------



## ice5192 (Mar 1, 2019)

That's what I have been doing it's not letting me upload 1703 this is the version that has ssh and telnet access my current system tab doesnt have ssh or telnet.

How do I fix this?


----------



## jsfitz54 (Mar 1, 2019)

ice5192 said:


> That's what I have been doing it's not letting me upload 1703 this is the version that has ssh and telnet access my current system tab doesnt have ssh or telnet.
> 
> How do I fix this?



Have you tried rebooting the router after the failed flash via turn off button, unplug, turn on button to drain system(while unplugged), then turn off, then plug in and turn on.

And a factory default reset.

Try looking at this:  https://blog.silocitylabs.com/post/2018/01/01/flashing-merlin-to-tm-ac1900-or-ac68u/comment-page-1/

*I don't know how to downgrade the current Tmobile firmware other than rescue mode.*


----------



## ice5192 (Mar 1, 2019)

Yes, notta


----------



## jsfitz54 (Mar 1, 2019)

Try flashing to an official AC68U build or official 1900 build? (not a tmobile build)

https://www.asus.com/us/Networking/RTAC68U/HelpDesk_BIOS/

https://www.asus.com/us/Networking/RT-AC1900/HelpDesk_BIOS/


----------



## ice5192 (Mar 1, 2019)

Emergency mode aka rescue mode right?


----------



## jsfitz54 (Mar 1, 2019)

ice5192 said:


> Emergency mode aka rescue mode right?



Yes/correct


----------



## ice5192 (Mar 1, 2019)

Are you thinking this will work?


----------



## jsfitz54 (Mar 1, 2019)

ice5192 said:


> Are you thinking this will work?



If your current Firmware does not have a FIELD for allowing SSH then a straight router build would have that option.

How else to get an SSH field???  So I'm saying try it and keep your fingers crossed.


----------



## ice5192 (Mar 1, 2019)

trying both now will follow up.

1st one which was the AC68U 

Receive file size=44797998
The file transferred is not a valid firmware image.
Continue

uploading the second one...

TM 1900 

error 

Receive file size=44797998
The file transferred is not a valid firmware image.
Continue


----------



## Cybrnook2002 (Mar 1, 2019)

You can flash your image likely from Serial, not too bad once you get the hang of it. Use this to do your downgrade to get ssh access to then flash CFE etc... use something like tftp to flash your build.

https://www.snbforums.com/threads/t...d-while-flashing-from-tomato-to-merlin.29077/


----------



## ice5192 (Mar 1, 2019)

I have even just tried the ASUS upgrade utility

Its saying the router is not in rescue mode but it is i have access to the ASUSTek - CFE miniWeb Server 

See picture


----------



## Cybrnook2002 (Mar 1, 2019)

ice5192 said:


> I have even just tried the ASUS upgrade utility
> 
> Its saying the router is not in rescue mode but it is i have access to the ASUSTek - CFE miniWeb Server
> 
> See picture


It's likely not finding your router, you follow the steps properly?
https://www.asus.com/support/FAQ/1000814/


----------



## ice5192 (Mar 1, 2019)

Cybrnook2002 said:


> It's likely not finding your router, you follow the steps properly?
> https://www.asus.com/support/FAQ/1000814/



the 
ASUSTek - CFE miniWeb Server is up so this should mean the router is in rescue mode correct?


----------



## jsfitz54 (Mar 1, 2019)

*LINK:      http://dlcdnet.asus.com/pub/ASUS/wireless/RT-AC3100/Rescue_2000.zip*

*You need to find a copy of the Firmware restoration Utility. **It looks like it was pulled down off the ASUS website. So you need to locate another source.*

https://itunes.apple.com/us/app/asus-firmware-restoration/id1020519014?mt=12

https://www.snbforums.com/threads/download-asus-rt-ac68u-utility.20021/

https://drivers.softpedia.com/get/R...r-Firmware-Restoration-Tool-30043789168.shtml

https://www.techpowerup.com/forums/threads/asus-rt-ac66w-rt-ac66u-locked-firmware-resolution.223393/

Try a NVRAM clear:

"Most likely you need to run an NVRAM clear.  So, set up the router again, as it was, powered off.  Looking at the router from the back, press the (upper) WPS button on the left hand side for 30 seconds as you turn the power for the router back on.  This will clear the NVRAM, and unfortunately your previous settings, and it should reboot once done."

Clearing the NVRAM
1. After the router has completed booting up (stable led lights for wireless), power off the RT-AC68U.
2. While holding the WPS button, turn on the RT-AC68U.
3. Keep holding on to the WPS button for at least 30 seconds before releasing it. The router should reboot once you release the WPS button.


----------



## ice5192 (Mar 1, 2019)

even through this is a TM 1900? Cellspot? try what your stating?

what do i do after NVRAM?

how will i know its been reset?


----------



## jsfitz54 (Mar 1, 2019)

ice5192 said:


> even through this is a TM 1900? Cellspot? try what your stating?
> 
> what do i do after NVRAM?
> 
> how will i know its been reset?



Do the NVRAM reset to clear any bad flashes. When router reboots and settles (5min or so) turn off and reboot again.

Use the link at the top of post #26 to get* firmware restoration utility.*

Start over using that utility to downgrade.  Try the original one  you were using
TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx


----------



## ice5192 (Mar 1, 2019)

ok do i need to place the router in the rescue mode i think i am confused on the router modes i have seen emergency mode and rescue mode which one do i need to have it in for the ASUS firmware restoration utility>


----------



## jsfitz54 (Mar 1, 2019)

ice5192 said:


> ok do i need to place the router in the rescue mode i think i am confused on the router modes i have seen emergency mode and rescue mode which one do i need to have it in for the ASUS firmware restoration utility>



Rescue Mode


----------



## ice5192 (Mar 1, 2019)

what are the proper steps?

I want to ensure i am doing this by the book.


----------



## jsfitz54 (Mar 1, 2019)

ice5192 said:


> what are the proper steps?



NVRAM: end of post #26.

Firmware: use the utility to upload new downgrade version.


----------



## ice5192 (Mar 1, 2019)

Did that NVRAM what is next i am asking for the next steps i am following the directions you are given me. Please list the next steps for me to do on this router.


----------



## jsfitz54 (Mar 1, 2019)

Post #24 :  https://www.asus.com/support/FAQ/1000814/

Read all of it but you should be at about step #8 down


----------



## ice5192 (Mar 1, 2019)

The router is in rescue mode however i am not able to get the ASUS firmware restoration to pick up the router. it doesn't really do anything.

I am able to go to 192.168.29.1 and i do see the ASUSTek - CFE miniWeb Server but the ASUS firmware restoration is not working any ideas?


----------



## jsfitz54 (Mar 1, 2019)

Does it look like this:

At the *[Firmware Restoration]* window, click* [Browse]* and choose the latest firmware which you had downloaded.







Click *[Upload]*






Please wait for *60 seconds*






Click* [Close]* when the Status message shows *[Successfully recovered the system. Please wait for system to reboot].*


----------



## ice5192 (Mar 1, 2019)

Yes but it says this

...


----------



## jsfitz54 (Mar 1, 2019)

When you hit "upload"  what does it do?


----------



## ice5192 (Mar 1, 2019)

tries to connect to the hardline which i have shown skips it and goes to connecting wireless router...

says searching available IPS then skips to wireless


----------



## jsfitz54 (Mar 1, 2019)

Set your static IP to 192.168.29.50 and try again.
I want to see if your 192.168.29.2 is in a reserved range.


----------



## ice5192 (Mar 1, 2019)

changed the IP to 192.168.29.50 notta


----------



## jsfitz54 (Mar 1, 2019)

Was this a new buy, refurb, second hand?


----------



## ice5192 (Mar 1, 2019)

jsfitz54 said:


> Was this a new buy, refurb, second hand?


new buy from T-Mobile few years ago


----------



## jsfitz54 (Mar 1, 2019)

I read somewhere that new ones that connect and auto update out of the box have big trouble rolling back.  The advice was to never connect to the internet and do the conversion first.

If you have been updating the firmware all along you may be in the same boat.

As Cybrnook2002 pointed out in post #22 that may be your only way of going forward.


----------



## ice5192 (Mar 1, 2019)

this is the 1st time i have been doing this i do not know what to do next i have a AC86U which was very easy to upgrade im trying to get this one connected up so i can use it my office. So i can hardline it once everything is said and done.

I just want to either get this working or im just going to throw the dam thing away and go buy a new router.


----------



## jsfitz54 (Mar 1, 2019)

Try looking at this:  https://techtrickszone.com/2017/05/02/openwrt-firmware-upgradation-with-ssh-command-with-piture/

You may be able to upgrade via command line.  Not sure if you can do this because of your current inability to tick a SSH box in router.

https://www.google.com/search?q=ins...rome..69i57.9608j0j1&sourceid=chrome&ie=UTF-8

Your initial Lazy Mocha tutorial: read below line, *Wiping T-Mobile MTD5 Partition*


----------



## ice5192 (Mar 1, 2019)

WIN SCP is not working. It times out.

connection is refused when i have the router up and running.


----------



## jsfitz54 (Mar 1, 2019)

Use Putty. At black screen type login (enter) password (enter)  password is done blind

If that can't get you to a command line your stuck.

This is just to see if it is possible to login.

You could try telnet or serial but this has become more work.


----------



## ice5192 (Mar 1, 2019)

if i turn the routers firewall off i should be able to get in yes? in theory?

SSH connection is refused?

Firmware upgrade unsuccessfully. It may result from incorrect image or error transmission. Please check the version of firmware and try again.


----------



## jsfitz54 (Mar 2, 2019)

ice5192 said:


> if i turn the routers firewall off i should be able to get in yes? in theory?
> 
> SSH connection is refused?
> 
> Firmware upgrade unsuccessfully. It may result from incorrect image or error transmission. Please check the version of firmware and try again.



Firewall turn off and try. I really don't know at this point.  This is new territory since asus made it harder to convert.

The MTD5 partition holds the keys.

See this: https://mycyberuniverse.com/linux/full-controling-the-asus-router-via-command-line.html


----------



## ice5192 (Mar 2, 2019)

refused the connection

i need ideas ill test anything i need to to get this working before i go and buy a new router and trash this pos


----------



## jsfitz54 (Mar 2, 2019)

ice5192 said:


> refused the connection
> 
> i need ideas ill test anything i need to to get this working before i go and buy a new router and trash this pos



I'm out of ideas other than the already mentioned direct serial flash.
Make a deal with Cybrnook2002.

On a side note you can get a Windows 10 Pro Lic Key for cheap here:   https://www.bonanza.com/listings/Mi...-64-Bit-ESD/690394290?search_term_id=70546553


----------



## ice5192 (Mar 2, 2019)

jsfitz54 said:


> I'm out of ideas other than the already mentioned direct serial flash.
> Make a deal with Cybrnook2002.
> 
> On a side note you can get a Windows 10 Pro Lic Key for cheap here:   https://www.bonanza.com/listings/Mi...-64-Bit-ESD/690394290?search_term_id=70546553



Bought a pro key lol


----------



## jsfitz54 (Mar 2, 2019)

Still thinking.
Look at this subject NVRAM: https://www.snbforums.com/threads/faq-nvram-and-factory-default-reset.22822/


----------



## ice5192 (Mar 2, 2019)

hmmm trying

no go..

Receive file size=44797998
The file transferred is not a valid firmware image.


----------



## jsfitz54 (Mar 2, 2019)

*Big complaint is not getting into proper recovery mode.*


Some TM-AC1900 ship with a firmware version that allows SSH access. If you get one of these, you can skip steps 5-10 of the guide. To check if you have SSH available, go to Administration > System in the router configuration interface. If your firmware permits SSH, there will be a setting to Enable SSH. If so, choose Yes, then Apply. Move on to step 11.
*Try the instructions found here: *

Hi all, I've just solved the issue finally. The main problem I was having was the Asus Firmware Restoration Tool was not allowing me to return to an Asus Firmware. This is what I did it make it work.

Power off the router with the power button on the back.
Click and hold the WPS button located on the right sight side of the router.
Power on the router while continuing to hold the WPS button.
Watch the power LED light, it will begin to flash.
Release the WPS button.
Power off the router.
Press and hold the reset button on the back of the router.
Power on the router while continuing to hold the reset button.
This will enable emergency mode.
Open Asus Firmware Restoration Tool.
Upload Firmware and your done.
My problem was I was never able to successfully upload the firmware usuing the Restoration Tool. It would interrupt and never work. But Step 3 to Step 6 made it work!

*OR*

Boot into Recovery Mode.

Set you computer IP 192.168.1.2/255.255.255.0
When router is off, keep holding reset button down and turn on your device.
When power light slowly starts to blink try to connect via 192.168.1.1 (use wired connection).
First select option to Restore/Clean NVRAM, then select Reboot.
Let it fully boot up (could take couple of minutes) and then turn it off again.
Now boot into recovery mode _again_ using same method as before (hold down reset while powering on)
Download OEM firmware from Asus site: http://dlcdnet.asus.com/pub/ASUS/wireless/RT-AC68U/FW_RT_AC68U_90043802695.zip
On recovery page (192.168.1.1) select downloaded firmware file and click "Upload"
Patiently wait until upgrade process is complete and router fully reboots.

*OR*

*Community Wiki*
Last Edited by Ch1ngl1ng August 15, 2018 at 12:45 PM
From the other router posts at, like here

You can flash this router to an RT-AC68U: http://www.bayareatechpros.com/ac1900-to-ac68u/. There are few change/additions needed in the guide before the latest ASUS firmware can be flashed, though.

Avoid CFE 1.0.2.5 from the RT-AC68P, as the newest Asus firmwares (3.0.0.4.384.20624 and later) detect this on the TM-AC1900 and revert the mod. Instead, use *CFE 1.0.2.0 US AiMesh*; it was dumped from an _actual_ RT-AC68U by user goggles99 at SNB. The CFE generator [pipeline.sh] by danielfeng has this version available.
Some TM-AC1900 ship with a firmware version that allows SSH access. If you get one of these, you can skip steps 5-10 of the guide. To check if you have SSH available, go to Administration > System in the router configuration interface. If your firmware permits SSH, there will be a setting to Enable SSH. If so, choose Yes, then Apply. Move on to step 11.
The T-Mobile certificates have to be wiped from the mtd5 partition. This can be done after all of the steps in the guide have been completed, but must be done before any newer version of ASUS firmware is flashed. As of this writing, the firmware included in the bayareatechpros guide is 3.0.0.4.376.3626, so the steps below should be performed when this version is running on your router.
Wiping T-Mobile certificates from the mtd5 partition

These instructions originally existed on SNB before that forum thread was shut down [snbforums.com]. Credit to XVortex and rdallen. After you've performed these steps, you can flash 3.0.0.4.384.21045 (and possibly newer) using the GUI.

Code:
# Backup MTD5 (dd produces identical bin)
cat /dev/mtd5 > /jffs/mtd5_backup.bin

# Copy mtd5_backup.bin from router using scp
# From host: scp admin@192.168.1.1:/jffs/mtd5_backup.bin ./

# Mount MTD5
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs

# Copy mtd5 files from router using scp
# From host: scp admin@192.168.1.1:/tmp/asus_jffs/* ./

# Wipe mtd5 files and reboot
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot
-----

ASUS RT-AC68U firmware downloads [asus.com]

SNB now disallows discussion [snbforums.com] about converting TM-AC1900 to RT-AC68U with AiMesh. So, modding information may be a bit harder to come by going forward. Some discussion has moved to this thread [whirlpool.net.au] on whirlpool.

Other Tips:

If you are having problems accessing the mini-CFE webserver this works:

Power off the router using the power button
Set your PC's IP to 192.168.29.2 (assuming the recovery mode is gateway is 192.168.29.1)
Navigate to 192.168.29.1 using your browser -- the browser continue to try and access the page until it is available
Press and hold the reset button while powering-on the router
When the mini-CFE webpage appears on the browser, release the reset button
As long as the browser status is still spinning -- looking for a webpage -- the mini CFE web page will load
Link to this Wiki


----------



## ice5192 (Mar 2, 2019)

which one do you think i should try first?


----------



## ice5192 (Mar 7, 2019)

*jsfitz54 what do you think i should try?*


----------



## jsfitz54 (Mar 8, 2019)

ice5192 said:


> *jsfitz54 what do you think i should try?*



Start with the first one (example) and work through the list. Pay attention to the first bullet point... (are you sure about no SSH option?)


----------



## ice5192 (Mar 8, 2019)

SSH refused connection.


----------



## jsfitz54 (Mar 8, 2019)

ice5192 said:


> SSH refused connection.



What do mean refused connection.  You click on the SSH box and hit APPLY on the bottom of the screen.


----------



## ice5192 (Mar 12, 2019)

I don't have SSH access in settings

I just got over the FLU so give me a few days to test all this.


----------



## Arthurb (Mar 14, 2019)

Gosh, it almost hurt reading this.  Someone asking for help and someone just feeding information without reading, or understanding the replies.
What you are going to have to do is use the USB Instruction on this page;
https://docs.google.com/document/d/1NsZMONmJ70zMmoAKKQJXbTVKytaPJptWTpqih1TD5n8/edit

The new firmware works really hard to keep you from upgrading the router to the  RT-AC68U, even though it is the same hardware.

Make sure that after you upgrade, that you go back to this page;
https://www.bayareatechpros.com/ac1900-to-ac68u/
and follow the instructions at the bottom of the page to remove the lock stuff in the MTD5 partition.

I have worked  on mine for 8 hours today and there is no way to get the "Enable SSH" to happen in the newer firmware.

Good Luck

Oh, this page may also be helpful;
https://lazymocha.com/blog/2018/04/16/flash-t-mobile-cellspot-tm-ac1900-to-asus-rt-ac68u-p/


----------



## ice5192 (Mar 14, 2019)

It almost hurts reading this i feeel no one is listening to me..

Giving me a link doesn't help me.... I need to know what to do do do step by step. 

Thanks for replying.


----------



## CompleteThought (Mar 28, 2019)

Are you still stuck at step 7 as previously mentioned in your first post?


----------



## jeffifixit (Mar 30, 2019)

So I read through this entire post because I have 2 of these T mobile routers.
I hacked both of them in about 1 hour and i forgot to lock the MD5 check on the second one.
After being on the net for 50 mins the router rebooted and reverted to the T Mobile firmware, but this time to the new firmware that locks you out.

I tested flashing it several different ways from the recovery mode with zero success. Tried the Asus restore utility and that did nothing.


After doing more research I successful downgraded back to TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx - enabled SSH and reflashed

I stumbled across this document which outlines a few different methods to achieve this. 
Not too hard to follow but you have to read it carefully. This helped me so I hope it helps you. It is possible to fix a unit that is locked out.

https://docs.google.com/document/d/1NsZMONmJ70zMmoAKKQJXbTVKytaPJptWTpqih1TD5n8/edit#
* The exploit below does not work on the latest Firmware Version:3.0.0.4.384_45708 , which allows you to use the wget function and write the firmware.

I did test the current firmware to see if the following exploit would work: It failed

validForm = function(){document.form.SystemCmd.value = "ping\necho hello world";return true;}

Now press the Diagnose button, and you should see the output from the command "hello world".



For the record, the reason I have two of these so i could play with the Airmesh features. 
It's been running for 12 hours without issues.

Operation Mode:Access Point(AP) mode Firmware Version:3.0.0.4.384_45708 SSID:ASUS_OFFICEASUS_OFFICE


----------



## Leap (Apr 1, 2019)

Hey all,
Last night, I ran into the exact same scenario as "*ice5192.*"  I was on 376.3199 and received the "Not a valid firmware" error as well. 

I was successful with the following solution:

*********************
Just ignore everything else and follow the "NO CFE USB Instructions" from "https://docs.google.com/document/d/...aPJptWTpqih1TD5n8/edit#heading=h.9c99cywuzc0n"

One thing that got me was the keyword "Console."  It just means the Console TAB, within the inspect mode.

I am now on "Asus 3.0.0.4.384_45708"
*************************


----------



## jeffifixit (Apr 2, 2019)

Leap said:


> Hey all,
> Last night, I ran into the exact same scenario as "*ice5192.*"  I was on 376.3199 and received the "Not a valid firmware" error as well.
> 
> I was successful with the following solution:
> ...



Yeah not to extremely hard just have to use a different exploit to get it to work. Screenshot for what he means by "console" and where the text goes.







Leap said:


> Hey all,
> Last night, I ran into the exact same scenario as "*ice5192.*"  I was on 376.3199 and received the "Not a valid firmware" error as well.
> 
> I was successful with the following solution:
> ...



I haven't gotten great speeds when i do a speed test though with the AImesh. Not sure why .. both of my asus are hardwired for ethernet backhaul.


----------



## jsfitz54 (Apr 2, 2019)

Here is an additional reference guide: https://slickdeals.net/f/10958175-t...flashing-tips-general-help?page=2#commentsBox


----------



## Good3alz (Apr 10, 2019)

jeffifixit said:


> So I read through this entire post because I have 2 of these T mobile routers.
> I hacked both of them in about 1 hour and i forgot to lock the MD5 check on the second one.
> After being on the net for 50 mins the router rebooted and reverted to the T Mobile firmware, but this time to the new firmware that locks you out.
> 
> ...


I learned something today!!
*The exploit below does not work on the latest Firmware Version:3.0.0.4.384_45708 , which allows you to use the wget function and write the firmware.*



jsfitz54 said:


> Here is an additional reference guide: https://slickdeals.net/f/10958175-t...flashing-tips-general-help?page=2#commentsBox


THAT guy is GREAT !!
*User17347427 *
/grin.

-----------------------------------------

*The trick to getting 1703 installed is timing*!
Sometimes it doesn't work....

Post #36 here you see the firmware restoration tool UI window.

Following Lazymocha's Guide CLICK HERE
*Step: 6 & 7*
Mini-CFE webpage
If you are having problems accessing the mini-CFE webserver see if this works:

Power off the router using the power button
Set your PC's IP as explained in Step 4
Navigate to 192.168.29.1 using your browser -- the browser continue to try and access the page until it is available
Press and hold the reset button while powering-on the router
When the mini-CFE webpage appears on the browser, release the reset button
As long as the browser status is still spinning -- looking for a webpage. If it stops refresh the page -- the mini CFE web page will load.
Some have said to keep holding the reset button down for 10 seconds after you start to load the firmware.
So, browser searching status spinning for 192.168.29.1- holding reset, power on router - if browser spins, the mini-CFE opens and you click firmware - keep holding reset for 10 seconds while firmware uploads.. let go reset.
Don't waste any time finding that firmware to load to mini-CFE as that web browser must be searching trying to connect to 192.168.29.1. If browser gives up searching (stops spinning) you have to click refresh.. it can stop the process. That is why ping is mentioned on some guides.
It helps to tape on a 'zip tie end' on top of the reset button so it's easy to press, you have a few things to do at once during this one step.

If this doesn't work,
Try Google Chrome _incognito mode_.
Some mention to turn on _AP mode_ in the router, then try.



_*If accessing the mini-CFE webserver doesn't work at all for you*_...
You are experiencing the effects of a locked firmware...
You have to change Guides.

" Directions for rolling back to AC68 after AC1900 rollback: " Direct Google Docs Link. We call this the _Google Doc. Guide_. You can download it here

What is wrong with the T-Mobile 3199 firmware
The Cellspots are _USUALLY_ now shipped out with firmware 3199, that makes it harder for you to downgrade that firmware. Sometimes you get lucky with the above steps, sometimes you don't.
This is also caused if you have a converted a Cellspot -TM-AC1900 to RT-AC68U, that did _not_ do the MTD5 commands, and _attempted to do a firmware update past 3.0.0.4.384.20308_.

Why is my converted Cellspot rolled back to 3199??
Those that changed a Cellspot to RT-AC68U in the past might experience this because the ASUS Firmware 3.0.0.4.384.20624 and newer is a 'smart firmware' that identifies converted Cellspots and revert them back to a T-Mobile Cellspots with T-Mobile firmware- 3199. (You could say ASUS put in a virus/trojan to sniff out Cellspots)
Note: Merlin's is made off of ASUS firmware and will stop you updating firmware to 384.6 because it is triggering the 'cellspot rollback'... (or trying to)

To stop this from happening, you must complete the guide and _do the MTD5 commands to make your router immune_ to this 'ASUS type smart firmware'.
IF you don't do these MTD5 commands, the safest highest version of firmware you can use of ASUS's is 384.20308.
The first MTD5 commands erases T-Mobile certificates and solves this issue. These first commands should be done on (according to Lazymocha's Guide instructions) 376.3626.
The last 2 MTD5 commands fills in that missing area to the regular size of the normal RT-AC68U. (Ahh haaa! MUST be done on firmware 384.xxxxx. that is why 384.20308 is the last safest firmware.. and you should install this to do the last 2 MTD5 commands)

IF you need to use this _Google Doc. Guide_,I recommend using the (*No CFE USB Instructions*). IF you still have your old 'original_cfe.bin' from converting THIS router in the past (not one from another router), *then* you can *use* the (*USB Instructions*).


----------



## jeffifixit (Apr 15, 2019)

two things:

One is I used to connect my USB drive to the router and stream shows from it. However in firmware 3.0.0.4.384_45708 that feature is no longer working. Possible a USB issue but.. that is highly unlikely. Can someone else replicate?

Well i figured out part of the problem after reading some post: the AImesh router can not view the usb shared drive. It just doesn't work like that.* But it does work on the main router, so i was able to still use the usb on the main router which is in a different room. Testing our the USB application via torrent adders tonight.
*https://www.snbforums.com/threads/cant-access-usb-drive-on-aimesh-node.54722/ 


Secondly I am seeing that ASUS updated the firmware to a new version. 3.0.0.4.384_45713-g0f2983e which I have not tested or upgraded to.


----------



## Good3alz (Apr 15, 2019)

jeffifixit said:


> two things:
> 
> One is I used to connect my USB drive to the router and stream shows from it. However in firmware 3.0.0.4.384_45708 that feature is no longer working. Possible a USB issue but.. that is highly unlikely. Can someone else replicate?
> 
> Secondly I am seeing that ASUS updated the firmware to a new version. 3.0.0.4.384_45713-g0f2983e which I have not tested or upgraded to.


Question 1)
That sounds like a bug, you should ask over here *CLICK HERE* so they are aware of the bug .
Question 2) thanks for the heads up : )

You're right, there is an update! *CLICK HERE*

Version 3.0.0.4.384.45713
2019/04/11
39.76 MBytes
ASUS RT-AC68U Firmware version 3.0.0.4.384.45713
Bug Fix
- Fixed browser no response problem when enabled Traffic analyzer.
- Fixed VLAN bug for Movistar.
- Fixed the problem which causes lots of SQUASHFS error in system log.



Please unzip the firmware file first then check the MD5 code.
MD5: 1029c47675545caca1723b0a53ac6956
Maybe* - Fixed VLAN bug for Movistar.*  has to do with your first issue?
So before going to that site to talk about it, I would update your firmware since it has SOME fix for something to do with movistar?
With out the latest firmware installed, talking about bugs is somewhat pointless.

I will install the latest now and see if my router gets rolled back /grin! (since I have a spare in my drawer!)

BRB!

EDIT: I am not rolled back. 
on 45713.

By the way, you will still see logs of the router checking for firmware.. which was introduced 45708 (It is still 'calling home'). So ahh, make sure you have future proofed before these recent firmware updates.. doing the MTD5 commands!


----------



## Good3alz (Jul 4, 2019)

Anyone know where to get the T-mobile firmware 376.3199  ?


----------



## Gigaslackr (Jan 19, 2020)

Does anyone know if this process will work for an Sp-ac2015 as well? I would really like to restore the stock Asus firmware instead of using the sprint firmware


----------



## ice5192 (Jan 19, 2020)

I gave up on this months ago. I got tired of asking for help. I have the Wifi 6 AX6000 and the AC86U set on Merlin and working on mesh setup


----------



## sheldorparra (May 14, 2020)

ice5192 said:


> I am at a impasse
> 
> When i upload said version of firmware TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx
> 
> ...


use this guide as usb, for me works https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1168729 just follow the file in no CFE mode.


----------



## RUK_03 (Jul 19, 2020)

Hi, I would like to know whether it is possible to upgrade my TM-AC1900 to the latest ASUS firmware: RT-AC1900_3.0.0.4_385_20630-ged5e4c3. Currently, my router is on version 3.0.0.4.376_3199. I read this thread completely and not sure which set of instructions to follow. Any help is greatly appreciated. Thanks.


----------



## bullybear (Aug 6, 2020)

RUK_03 said:


> Hi, I would like to know whether it is possible to upgrade my TM-AC1900 to the latest ASUS firmware: RT-AC1900_3.0.0.4_385_20630-ged5e4c3. Currently, my router is on version 3.0.0.4.376_3199. I read this thread completely and not sure which set of instructions to follow. Any help is greatly appreciated. Thanks.


Same here.  I have read many of the posts including this one and I followed step by step the google doc instructions to downgrade the firmware from 3.0.4.376_3199. None worked:-( So...... o frustrating!


----------



## RUK_03 (Aug 6, 2020)

bullybear said:


> Same here.  I have read many of the posts including this one and I followed step by step the google doc instructions to downgrade the firmware from 3.0.4.376_3199. None worked:-( So...... o frustrating!


I followed this guide: 
https://docs.google.com/document/d/1NsZMONmJ70zMmoAKKQJXbTVKytaPJptWTpqih1TD5n8/edit?usp=sharing
Specifically, the NO CFE option - up to this step: validForm = function(){document.form.SystemCmd.value = "ping\nwget -A txt -r -nH -nd docbill.freeshell.org";return true;}
Then, followed appendix 6. Worked out good... now it is an ASUS RT-AC68U


----------



## Jezzabel (Sep 4, 2020)

Hi RUK-03,

I followed the NO CFE USB instructions from the google doc guide you suggested.
My problem is that the following command seems to work OK: validForm = function(){document.form.SystemCmd.value = "ping\nwget -A txt -r -nH -nd docbill.freeshell.org";return true;} 
But I do not get the *u.txt* file downloaded... leading to the next command (validForm = function(){document.form.SystemCmd.value = "ping\n u.txt " + encodeURIComponent("find /tmp/mnt  -name firmware1703.trx" ).replace(/%/g,"..");return true;} ) to fail.
Shall I just jump, like you, to the Appendix 6 to generate a replacement CFE and then download the FW TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx ?

Thank you


----------



## RUK_03 (Sep 4, 2020)

Jezzabel said:


> Hi RUK-03,
> 
> I followed the NO CFE USB instructions from the google doc guide you suggested.
> My problem is that the following command seems to work OK: validForm = function(){document.form.SystemCmd.value = "ping\nwget -A txt -r -nH -nd docbill.freeshell.org";return true;}
> ...


Hello Jezzabel, 
You do need to make sure that the u.txt is downloaded. Use this command to check: 

validForm = function(){document.form.SystemCmd.value = "ping\nfind u.txt";return true;} and click Diagnose button. If it doesn't show where u.txt is, you need to rerun this command:
 validForm = function(){document.form.SystemCmd.value = "ping\nwget -A txt -r -nH -nd docbill.freeshell.org";return true;}

Once you know that the u.txt is downloaded, then jump to Appendix 6. Hope this helps!


----------



## Jezzabel (Sep 5, 2020)

RUK_03 said:


> Hello Jezzabel,
> You do need to make sure that the u.txt is downloaded. Use this command to check:
> 
> validForm = function(){document.form.SystemCmd.value = "ping\nfind u.txt";return true;} and click Diagnose button. If it doesn't show where u.txt is, you need to rerun this command:
> ...


Thank you, will give a try


----------



## Jezzabel (Sep 9, 2020)

RUK_03 said:


> Hello Jezzabel,
> You do need to make sure that the u.txt is downloaded. Use this command to check:
> 
> validForm = function(){document.form.SystemCmd.value = "ping\nfind u.txt";return true;} and click Diagnose button. If it doesn't show where u.txt is, you need to rerun this command:
> ...


Hi RUK_03,

I managed to get u.txt loaded on the root of my router.  But it looks like I would need a little more of your help.

When I issue the command to extract /dev/mtd0 to original_cfe.bin on the USB, I do not get any response, which I assume is expected. 
But then the command to umount the USB says that the device cannot be umount because the device or resource is busy.
After few attempts I decided to disconnect the USB drive and read its content, but there was no trace of the original_cfe.bin file.

I attached my logs. I appreciate if you could have a look.

If my understanding is correct, I do not need to flash the firmware1703.trx. As soon as I successfully manage to replace the cfe by a new one, I shall get AC68U displayed in the webinterface of the router and then I would be able to load latest merlin FW. Then I could decide to remove the mtd5 partition.

Thank you for any help you can provide


----------



## RUK_03 (Sep 9, 2020)

Jezzabel said:


> Hi RUK_03,
> 
> I managed to get u.txt loaded on the root of my router.  But it looks like I would need a little more of your help.
> 
> ...


Hello Jezzabel, it looks like the cat command is not closing/completing the file transfer. Try this:
validForm = function(){document.form.SystemCmd.value = "ping\n. u.txt "+encodeURIComponent("cp /dev/mtd0  /tmp/mnt/USB/original_cfe.bin").replace(/%/g,"..");return true;}
Click Diagnose
validForm = function(){document.form.SystemCmd.value = "ping\nfind original_cfe.bin";return true;} and click Diagnose button. 
Should show that the original_cfe.bin is successfully created and placed in the USB. After this, issue the umount command. Don't forget to click the diagnose button after each command.


----------



## Hack7heGibson (Sep 11, 2020)

If anyone is wanting a new way to flash this thing, I just completed one this morning that would not go into recovery mode. (slow flashing power led and IP set to 192.168.1.1) not to be confused with the mini CFE loader page on 192.168.29.1.  I was able to get to the mini cfe by holding the reset button on powerup, but got "The file transferred is not a valid firmware image."  when uploading the TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx firmware.

This does require a tty USB serial adapter, which can be purchased for about $3.  Great news is that once you have the serial cable connected, it't easier than the original guide as you can completely SKIP steps 1-10 on the bayareatechpros page. Downgrading to the 1703 firmware is not needed. trying to feed commands into the ping interface is also not needed. You also need a usb drive.

1: once you have your serial cable, you can follow this guide to hook it up and get access:








						[TM-AC1900 (RT-AC68U)] - Bricked while flashing from Tomato to Merlin
					

Greetings SNB community!  Setup: T-Mobile TM-AC1900 successfully flashed (CFE) to RT-AC68U long ago  Background: Was on latest Asus stock firmware for a while. Decided to try out Tomato. Wasn't happy with WiFi performance, so decided to try flashing to Merlin last night.  Flashing steps:  Tried...




					www.snbforums.com
				




2: boot the router completely, have a usb stick (formatted as fat32) in the usb 2.0 port.

3: from commandline using terra term:

cat /dev/mtd0 > /mnt/USB/original_cfe.bin
reboot

4: wait until unit is booting back up and then power it off. (we want to make sure that the usb drive isn't active when we pull it out)

5:  plug the USB stick into your computer:

Upload original_cfe.bin to https://cfeditor.pipeline.sh/ > Select 1.0.2.0 US AiMesh as Source CFE > Download the new .bin > rename it to new_cfe.bin
6:  Download This_File

copy *new_cfe.bin* & *mtd-write* & *FW_RT_AC68U_30043763626.trx* to the usb drive
7:  plug the usb drive back into the router and boot it completely.

8:  in Terra Term type:

cd /mnt/USB
chmod u+x mtd-write
./mtd-write new_cfe.bin boot
./mtd-write FW_RT_AC68U_30043763626.trx linux
nvram_erase
reboot

9: Once the unit is booted back up, run the below commands before removing the serial cable and putting the router back together.

*Code for fixing MTD5 partition so you can update to latest firmware:*
You can enter this in Terra Term before you remove the serial cable and re-assemble the router

cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot

10: You can now flash Asus, Merlin, Advanced Tomato, Tomato, and DD-WRT firmwares.


----------



## ClockerXP (Nov 17, 2020)

Jezzabel said:


> Hi RUK-03,
> 
> I followed the NO CFE USB instructions from the google doc guide you suggested.
> My problem is that the following command seems to work OK: validForm = function(){document.form.SystemCmd.value = "ping\nwget -A txt -r -nH -nd docbill.freeshell.org";return true;}
> ...



I get a similar issue.  Althought, mine actually says it downloaded the u.txt file but then when I got to appendix 6 to execute the commands there, it says the u.txt is not found.


----------



## chromeking (Dec 20, 2020)

ice5192 said:


> I gave up on this months ago. I got tired of asking for help. I have the Wifi 6 AX6000 and the AC86U set on Merlin and working on mesh setup


Just saw this post today. Sorry to be a year late and that you didnt get the help...at all. I was just in the same position today and figured it out.  If you still have the router and want to mess with it , I can message you the two sites to help you.


----------



## ruggb (Jan 1, 2021)

Am I locked out?
I have 4 of these units.
#1 appears totally bricked. it has been a while since I looked at it, but I believe it wouldn't even boot up.
#2 & #3 are totally AC68Us
#4 went thru some mod attempts, but somehow ended up on TM1900 f/w 3.0.0.4.376.3221-gd4afd2e
Trying the previous procedure I used for 2 & 3 does not work
This f/w version appears to be much later than what I expect.
What I get when _upload the 1703 f/w with ASUSTek - CFE miniWeb Server is that it is not a valid f/w image._
The question is can it be recovered to AC68 or is it totally locked out?


----------



## chromeking (Jan 1, 2021)

ruggb said:


> Am I locked out?
> I have 4 of these units.
> #1 appears totally bricked. it has been a while since I looked at it, but I believe it wouldn't even boot up.
> #2 & #3 are totally AC68Us
> ...


The one where the CFE miniWeb Server gives you the issues where its not a valid f/w image is totally normal on the TM ones. Same thing happened to me. This is the site I used for the flash. https://docs.google.com/document/d/...taPJptWTpqih1TD5n8/edit#heading=h.fdrlq3l51p0 
Has to be the *No CFE USB Instructions*. 

Had to be flashed through admin tab in a loophole using a usb stick and console commands that were simple to follow. Also, if you didnt fix a string of code (MTD5 partition); after initially flashing the tm router to an asus firmware it would on the next firmware update revert to the latest TM firmware and lock you out of further firmware downgrades to older TM software to do a flash again. 

This is the site to follow after flashing with the USB you want to resume at the steps at step 10 at this site to finish the process. 
https://www.bayareatechpros.com/ac1900-to-ac68u/  
Then 100% make sure to do the code to fix the MTD5 partition. That is what causes a new firmware flash to revert to TM software if that partition is not patched and fixed.


----------



## ruggb (Jan 1, 2021)

chromeking said:


> The one where the CFE miniWeb Server gives you the issues where its not a valid f/w image is totally normal on the TM ones. Same thing happened to me. This is the site I used for the flash. https://docs.google.com/document/d/...taPJptWTpqih1TD5n8/edit#heading=h.fdrlq3l51p0
> Has to be the *No CFE USB Instructions*.
> 
> Had to be flashed through admin tab in a loophole using a usb stick and console commands that were simple to follow. Also, if you didnt fix a string of code (MTD5 partition); after initially flashing the tm router to an asus firmware it would on the next firmware update revert to the latest TM firmware and lock you out of further firmware downgrades to older TM software to do a flash again.
> ...


Thanks -- I ran thru the No CFE USB and it appeared that everything worked, HOWEVER, I am still at the same f/w 3221 and I am assuming it should be showing 1703. Therefore, I cannot proceed with LazyMocha. If that lockout is in effect because it is at 3221 then it looks like it is effective and there isn't anything to do at this point. Would that be correct?


----------



## chromeking (Jan 1, 2021)

ruggb said:


> Thanks -- I ran thru the No CFE USB and it appeared that everything worked, HOWEVER, I am still at the same f/w 3221 and I am assuming it should be showing 1703. Therefore, I cannot proceed with LazyMocha. If that lockout is in effect because it is at 3221 then it looks like it is effective and there isn't anything to do at this point. Would that be correct?


There is a comment on the google docs page stating that nothing happens at the end if the text of the usb file is too long. The page should update or text should appear after a short moment if done right. I had issues with that until I saw the person's comment. That might be the issue.


----------



## ruggb (Jan 2, 2021)

you are talking about the filename? I did change that. I guess I will run it again and copy all the responses. Maybe I missed something.
I don't know what this is in reference to? "The page should update or text should appear after a short moment if done right."

I ran it again and I get a console error on
validForm = function(){document.form.SystemCmd.value = "ping\nmount --move userRpm .";return true;}

Unchecked runtime.lasterror: The message port was closed before a response was received.

If I run that command again I get a Diagnose message
mount: mounting userRpm on . failed: Invalid argument

any ideas?

I think I am missing something about the SCRIPT file.
Step 5 says to download it, but I have no clue what that process is. Do you?


----------



## chromeking (Jan 2, 2021)

ruggb said:


> you are talking about the filename? I did change that. I guess I will run it again and copy all the responses. Maybe I missed something.
> I don't know what this is in reference to? "The page should update or text should appear after a short moment if done right."
> 
> I ran it again and I get a console error on
> ...


Yes, I was talking about the filename. I must have tried 4 or 5 different short ones until the text box at the last step had text appear after hitting diagnose. That is what I meant and was referring to. 

In reference to the message port error. I know that typically happens on console commands if it is run on chrome and or with chrome extensions. I would give it a try on a alternate browser or chrome with extensions disabled. 

Make sure to do the console test on step 4 then if that passes step 5 should just be copying and pasting commands into the console and hitting diagnose for each one. Make sure there is no spaces in front or behind the commands and that the last commands two have the firmware1703 name changed to whatever you chose. I believe what worked for me was firm17.


----------



## ruggb (Jan 2, 2021)

I tried FF & MS Edge. FF seemed to have problems. Edge appeared to be OK. However, again, the last command appears to do nothing.
I think it is suppose to install 1703 and reboot, but nothing happens. The previous response indicating it found the .trx file never gets erased. The router does nothing RE LEDs and never reboots.

What am I missing?


----------



## chromeking (Jan 2, 2021)

ruggb said:


> I tried FF & MS Edge. FF seemed to have problems. Edge appeared to be OK. However, again, the last command appears to do nothing.
> I think it is suppose to install 1703 and reboot, but nothing happens. The previous response indicating it found the .trx file never gets erased. The router does nothing RE LEDs and never reboots.
> 
> What am I missing?


I am almost positive that is just due to the name of the file. I would make sure your restarting the router every time you want to start over and then try a shorter name each time. It took a few trys for me and also two different flash drives until the code on the last command worked and shortly after hitting diagnose a string of text showed up in the text box which was it finishing the flash. I was trying to get that to show up for maybe an hour after many reboots and retrys it worked. Alot of my very small filenames would not come up when searching for the usb file on one of the final steps with a string of console code. If that happens just restart the router and rename the file again until it shows. Sometimes though it showed for me on the usb fine but the flash would not doing anything after the last command. That tells you the name is too long for the filename on the usb. The text box should update after a moment of typing the last command in and hitting diagnose.


----------



## ruggb (Jan 2, 2021)

Thanks
I went all the way to f3.trx
1703 is active.
now to see if I can finish the rest.

I am doing the telnet thing
I went all the way to trying to get the cfe file and it apparently can't find the usb
cat /dev/mtd0 > /tmp/mnt/sda1/original_cfe.bin
tried /mnt/sda1
/sda1
and  /tmp/mnt/usb/original_cfe.bin   which is the address used to get the f/w file from the drive.
keeps telling me the directory doesn't exist.
how do i get it to the usb?

I have an original from another 68 but the mac addresses and wps are different which is what appears to get changed in the download of the new one.


----------



## chromeking (Jan 2, 2021)

ruggb said:


> Thanks
> I went all the way to f3.trx
> 1703 is active.
> now to see if I can finish the rest.
> ...


No problem, and the sda1 is usually the name of the flash drive. Most likely USB from the earlier steps, but you shouldnt have to bother with that if your doing the mtd5 fix. I switched over after flashing and had used the second link I sent you; the bay area tech pros one. I resumed at step 10 and followed their steps and then their step 23 is fixing the mtd5 partition. Their mtd5 fix is listed after the bottom of the steps. 

*Make sure* to *disconnect from the internet* after flashing using the google docs steps and switching to step 10 on the bay area tech pros. Just a precaution and also do not check for updates on the router until finished with everything and the mtd5 partition is patched. Updating the firmware without the mtd5 partition patched and the router fully setup properly will cause the router to have the tmobile software reverted and locked out again from downgrade.


----------



## ruggb (Jan 3, 2021)

THANK YOU
It is done!!!!
beside the name issue, trying to read a 1 (one) vs and l (ell) was an issue.
needing to upgrade to an 384+ version b4 trying to erase the mtd since it wasn't quite explained in that order

and various other issues. I think I did this one b4 but forgot to erase the mtd so it got reverted.
I don't remember having an issue with the names b4, but I'm old.

Now I can replace my primary one that seems to have lost a 5G quest channel recently. Just playing router roulette.
Have a great year.......................


----------



## chromeking (Jan 3, 2021)

ruggb said:


> THANK YOU
> It is done!!!!
> beside the name issue, trying to read a 1 (one) vs and l (ell) was an issue.
> needing to upgrade to an 384+ version b4 trying to erase the mtd since it wasn't quite explained in that order
> ...


AWESOME! Glad to help. My router just went earlier last month. Had picked one up that was a Tmobile one that someone forgot to patch the mtd5 partition and updated it only to think it was bricked as well. Had a fun time searching for how to fix it. Very similar situation. Sorry about the first site directions being cloudy to where you had to basically improvise a name to get it to work then having to jump to the other website afterwards.

I saw a individual many pages before this on this post that had the same issue and no one could help them and figured I would post here. I believe that person just gave up because someone continued to try and help but wasnt listening at all to the individual and just was throwing out randomy sites pertaining to the router haha. Sad, but also a reason for me to post here to actually help people. 

Have a great new year as well!


----------



## ruggb (Jan 3, 2021)

yes I saw that. Hopefully he stumbles on this thread. The reason I decided to get to this is because my primary one started having troubles. One guest channel got flaky.
I have now replaced it and am trying to figure out its problem. It appears to be intermittent on that channel 5G Guest1. The others appear OK. I hate intermittents.


----------



## chromeking (Jan 3, 2021)

ruggb said:


> yes I saw that. Hopefully he stumbles on this thread. The reason I decided to get to this is because my primary one started having troubles. One guest channel got flaky.
> I have now replaced it and am trying to figure out its problem. It appears to be intermittent on that channel 5G Guest1. The others appear OK. I hate intermittents.


Did you try switching the control channel on the 5Ghz to something less congested? That's the only thing I can think off hand that could cause issues. I believe 161 is usually less congested than the standard control channel is for 5Ghz on these routers.


----------



## ruggb (Jan 3, 2021)

I had everything on - so 3x 5G radios. The only one with an issue was guest1. But it is intermittent. Sometimes it is fine.
I installed Merlin. Maybe that will help.


----------



## Wescotte (Feb 1, 2021)

Hello Got a problem with my downgrade using the NO CFE USB Instructions. everything seemed to have work fine. but once everything got boot up again web gui was broken. i was able to get to the Advanced_System_Content.asp page. i can select the ssh but i cannot apply the change. page are broken. i cannot use the diagnose button anymore.

is there a way to send the command to the web gui to apply the change ?
Anything please






Old tm-ac1900 build was 3.0.0.4.376_3221 Anyone know where i could get that file. i still have acces to asus mini-cfe page but always get that it's not a valid file. maybe i'll try putting it back in.
well at that point i'll try anything. the thing ping and seem to partialy work but i don,t know to which extend

Update :  i tryed to get to the firmware page looking to reflash it but i still have the same problem i can't it the button but at least i know a was succesful in a way to push a part of the firmware in


----------



## Wescotte (Feb 5, 2021)

Problem Solved time seem to did it


----------



## tisfreefl (Mar 29, 2021)

ice5192 said:


> I gave up on this months ago. I got tired of asking for help. I have the Wifi 6 AX6000 and the AC86U set on Merlin and working on mesh setup


I ran into the exact same issues you did. There is a way to do it through Chrome and the Network Tools screen. I had to use a FAT32 USB drive with the 1703 firmware, but mtd-write2 would not read it from USB. I had to do a cp /tmp/mnt/USB/firmware1703.trx /tmp

Click here if you would like to get that firmware and FW_RT_AC68U_30043763626.trx. You could also skip much of this and just go right to FW_RT_AC68U_30043763626.trx, enable SSH and replace the CFE and delete mtdblock5 but I am putting all the steps here I followed. You will also need ASUS Firmware 384.20308 CLICK HERE FOR IT ( it is the last safest ASUS Firmware before it started hunting for Cellspots). Let me know what shortcuts worked and maybe we can reduce this to fewer steps (as has been previously mentioned).

I was then able to do mtd-write2 /tmp/firmware1703.trx linux then rebooted and reset nvram. I was then able to enable ssh and then do the rest.

See step 4 here for details how to do this with chrome and the inspect / console and using the diagnostics command for each step.

When I ran the last command to do the write from the file on USB to flash it just circled for a second with no error. Upon reboot, I still had the 1399 firmware. Did it many times, so this is what I did to get around it.

This did not succeed in the process that I posted above but will also repost right here.

validForm = function(){document.form.SystemCmd.value = "ping\n. u.txt " + encodeURIComponent("/sbin/mtd-write2 /tmp/mnt/USB/firmware1703.trx linux").replace(/%/g,"..");return true;}

This is what ultimately succeeded with the 1399 FW version and doing this from end-to-end. In Chrome, go to the network tools screen, right click and choose inspect, then go to the console. Paste in each command, hit enter, then click the diagnostics button. Make sure you inserted a FAT32 USB into the USB 2.0 slot with the 1706 firmware trx file on it, call it firmware1706.trx and label the USB just USB so that you just have to copy the commands below as-is and not edit - they should just run.

validForm = function(){document.form.SystemCmd.value = "ping\nmount -t tmpfs tmpfs userRpm";return true;}
validForm = function(){document.form.SystemCmd.value = "ping\ncp -a . userRpm";return true;}

If you see the message cp: recursion detected, omitting directory "./userRpm" you are on the right track.

validForm = function(){document.form.SystemCmd.value = "ping\nmount --move userRpm .";return true;}
validForm = function(){document.form.SystemCmd.value = "ping\nmount";return true;}
validForm = function(){document.form.SystemCmd.value = "ping\nservice restart_httpd";return true;}

You will see some connection errors and that is ok because it is restarting.

validForm = function(){document.form.SystemCmd.value = "ping\nwget -A txt -r -nH -nd docbill.freeshell.org";return true;}
validForm = function(){document.form.SystemCmd.value = "ping\nfind u.txt";return true;}

If the file is there, then proceed.

validForm = function(){document.form.SystemCmd.value = "ping\n. u.txt " + encodeURIComponent("find /tmp/mnt  -name firmware1703.trx" ).replace(/%/g,"..");return true;}

Change firmware1703.trx to whatever the filename is on your FAT32 formatted USB drive labeled "USB" and recheck.

Now this is where it differs. You want to write this to /tmp and do the mtd-write2 from there.

validForm = function(){document.form.SystemCmd.value = "ping\n. u.txt " + encodeURIComponent("cp /tmp/mnt/USB/firmware1703.trx /tmp").replace(/%/g,"..");return true;}
validForm = function(){document.form.SystemCmd.value = "ping\n. u.txt " + encodeURIComponent("ls -l /tmp/firmware1703.trx" ).replace(/%/g,"..");return true;}

If the file is there, proceed to flash.

validForm = function(){document.form.SystemCmd.value = "ping\n. u.txt " + encodeURIComponent("/sbin/mtd-write2 /tmp/firmware1703.trx linux").replace(/%/g,"..");return true;}

If it took more than a second or two, then it most likely flashed.

Rebooted and hold down WPS for 20 seconds to ensure nvram reset. After a few minutes, you should be able to connect to 192.168.29.1 and verify it's a 1703 firmware. You can enable ssh and proceed to get the CFE onto the USB or pull with scp so you can update it to the 1.0.2.0 AIMesh through the pipeline tool. You can then follow all the other instructions as you normally would and you should be ready to rock n' roll.

Adding the steps here from a previous post so it is all in one place.

SSH in or from the console over serial

cp /dev/mtd0 /tmp/mnt/USB/original_cfe.bin

# I've also seen - cat /dev/mtd0 > /tmp/mnt/USB/original_cfe.bin
# or if you are ssh'ing in, you can do cat or cp to /tmp/original_cfe.bin and then scp it from the router. 

Then take that and upload

Upload original_cfe.bin to https://cfeditor.pipeline.sh/ 

Select 1.0.2.0 US 1.0.2.5 US for AC68P or 1.0.2.0 US AiMesh for AC68U with AiMesh as Source CFE > Download the new .bin > rename it to new_cfe.bin

Download This_File and extract with p7zip or 7zip

Copy *new_cfe.bin* & *mtd-write* & *FW_RT_AC68U_30043763626.trx* to the FAT32 usb drive we used previously (or you can scp it over the network)

Plug the usb drive back into the router and boot it completely.

In SSH terminal like putty or terminal through serial:

cd /mnt/USB
chmod u+x mtd-write
./mtd-write new_cfe.bin boot
./mtd-write FW_RT_AC68U_30043763626.trx linux
nvram_erase
reboot

Once the unit is booted back up, run the below commands before removing the serial cable and putting the router back together.

*Code for fixing MTD5 partition:*
You can enter this in Terra Term before you remove the serial cable and re-assemble the router

cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot

We still have 2 more commands to execute but we need to update firmware to 384.xxxxx or higher. We will use 3.0.0.4.384.20308 (preferred because it is just before the change in firmware to hunt Cellspots) or the command will not be effective.

Now wait for the reboot. Go to 192.168.1.1 and manually update firmware to 3.0.0.4.384.20308 that we downloaded.

Reset NVRAM again. Very important!

Power off the router
Wait 10 seconds
Press and hold WPS button on the side
Power up router and keep holding WPS button for 15-20 seconds until you see the power light starts to flash

Now turn on SSH in router system, and log in PuTTY, and do 2 more commands.

Make sure you are in /tmp/home/root directory.

Writing all FFs to the MTD5 (This will resize CFE it to normal)
Here are the commands:

ln -s /sbin/rc mtd-erase
./mtd-erase -d asus

It will look like this *The “Erasing…” is given when you never did the 2 commands before… if you have you probably won’t see them again? Don’t be alarmed:

admin@RT-AC68U:/tmp/home/root# ln -s /sbin/rc mtd-erase
admin@RT-AC68U:/tmp/home/root# ./mtd-erase -d asus
Erasing 0x0 - 0x1ffff
Erasing 0x20000 - 0x3ffff
Erasing 0x40000 - 0x5ffff
Erasing 0x60000 - 0x7ffff
Erasing 0x80000 - 0x9ffff
Erasing 0xa0000 - 0xbffff
Erasing 0xc0000 - 0xdffff
Erasing 0xeffff - 0xfffff
Erasing 0x100000 - 0x11ffff
Erasing 0x120000 - 0x13ffff
"asus" successfully erased.
/tmp/home/root#

You can now flash Asus, Merlin, Advanced Tomato, Tomato, and DD-WRT firmwares.



Hack7heGibson said:


> If anyone is wanting a new way to flash this thing, I just completed one this morning that would not go into recovery mode. (slow flashing power led and IP set to 192.168.1.1) not to be confused with the mini CFE loader page on 192.168.29.1.  I was able to get to the mini cfe by holding the reset button on powerup, but got "The file transferred is not a valid firmware image."  when uploading the TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx firmware.
> 
> This does require a tty USB serial adapter, which can be purchased for about $3.  Great news is that once you have the serial cable connected, it't easier than the original guide as you can completely SKIP steps 1-10 on the bayareatechpros page. Downgrading to the 1703 firmware is not needed. trying to feed commands into the ping interface is also not needed. You also need a usb drive.
> 
> ...


I used a Raspberry Pi running stock Raspbian to get to the terminal on this just to see what was happening. With the stock 1399 firmware and CFE 2.1.2.6, it was not allowing me to get to the CFE prompt and do anything including running nvram reset but I could see by holding down the WPS button, it was causing the nvram to reset. I kept getting a "command status = -1" error not a 0 when running anything on the CFE> menu. 1399 and later seems super locked down and restricted - which is probably because the CFE version is 2.1.2.6. Once I forced the 1703 firmware on it, everything opened up so I could ssh in and extract the CFE, modify with the pipeline, and overwrite the CFE on the device with the correct modified version. If they had closed the loop on the diagnostics screen, I would have had to resort to connecting my Raspberry Pi to the flash chip and using flashrom commands to get the CFE off so I can reflash the right version after running it through the pipeline process. (something I was really happy to avoid).

To connect your raspberry pi to it, do the following, connect Pin 6 on the Rpi to GND on the router. Connect pin 8 on the Rpi to the RX pin on the router, and finally connect pin 10 to the TX pin on the router.





You may have to go into raspi-config and enable the serial interface under interfaces and restart your pi. Once it reboots, you can ssh into it and do the following:

sudo apt install minicom

Once that installs, you can get access to the terminal by running the following.

minicom -b 115200 -o -D /dev/serial0

You can then see the whole boot process and you can hit enter to get access to the console to run any linux command you want.

On your Rpi, you do need to be a member of the tty group or else you can try with sudo. For reference, the default pi user is automatically a member of tty group - type "id" at a shell prompt to verify group membership.


----------



## Adam12 (Apr 24, 2021)

tisfreefl, do you have instruction on  Raspberry Pi to the flash chip and using flashrom commands to get the CFE off?  My current firmware is 3.0.0.4.376_3221.  Any command issues at the CFE> always return "Command Status = -1".  I believe Asus closed the loop on this latest firmware.  I get no response on console with Network Tools screen hack.


----------



## tisfreefl (Apr 24, 2021)

Adam12 said:


> tisfreefl, do you have instruction on  Raspberry Pi to the flash chip and using flashrom commands to get the CFE off?  My current firmware is 3.0.0.4.376_3221.  Any command issues at the CFE> always return "Command Status = -1".  I believe Asus closed the loop on this latest firmware.  I get no response on console with Network Tools screen hack.


I got the EXACT same issue but I was able to get to the console on the network tools screen.

What is your router SW version currently?


----------



## Adam12 (Apr 25, 2021)

My current router SW version is 3.0.0.4.376_3221-gd4afd2e.


----------



## tisfreefl (Apr 26, 2021)

Adam12 said:


> My current router SW version is 3.0.0.4.376_3221-gd4afd2e.


A couple of things. 

Are you able to enable ssh from the Admin screen? 

And what happens when you go to the console? Do you get any responses with any of the commands?


----------



## Adam12 (Apr 26, 2021)

No ssh.  No console response with any commands on FF, Chrome, Edge and IE.  Not only that the command field now is limited to 100 characters.


----------



## tisfreefl (Apr 26, 2021)

Adam12 said:


> No ssh.  No console response with any commands on FF, Chrome, Edge and IE.  Not only that the command field now is limited to 100 characters.


Can you try downgrading to 1703 FW and see what happens? Will it let you downgrade at all?

There would potentially be one final option if everything is locked down and that might be to get into restoration mode and try and downgrade the FW to the 1703 version?


----------



## Adam12 (Apr 26, 2021)

tisfreefl said:


> Can you try downgrading to 1703 FW and see what happens? Will it let you downgrade at all?
> 
> There would potentially be one final option if everything is locked down and that might be to get into restoration mode and try and downgrade the FW to the 1703 version?


No luck.  Try CFE mini web with not valid firmware.  While router is in recovery mode try Asus recovery with error wifi router is not in recovery mode.   I am out of idea.  Any other suggestion?


----------



## tisfreefl (Apr 27, 2021)

Ping me privately. Maybe we can set a time to jump on a hangout and have a look.

If it’s completely fubar’d then you maybe have to use jtag and flashrom to backup the cfe, run it through the pipeline, then write it back, get into recovery mode, and put 1703 on it and then go through the rest of the process, but let’s verify before you go through all of that.


----------

