Member Appreciation Event Get Extra 10% off Check It Out
Forum Thread

TM-AC1900 / Asus RT-AC68U router -- bootloader & firmware flashing tips & general help

480 1,303 November 28, 2017 at 03:33 PM
I'm creating this thread here in the Tech Support forum hoping to create something of a master reference, or at least reduce the amount of cruft that quickly fills each HotDeals thread, when one of these puppies hit the front page. Although much of the information in this post will be relevant for those who purchase stock ac68u routers, I'm going to pretend everyone here is here for the much cheaper TM-AC1900 rebrand of the ac68u.

Before we get into this, there's a couple things that would just be good for everyone to know
  • There's been several hardware versions/revisions of this router -- should you happen to have acquired an older revision, the newest instructions might still work for you, but I can't guarantee that.
  • The procedure for flashing these things has evolved over time, due to both software updates within the firmware (e.g. options disappearing in the web GUI console) and the hardware/bootloader/low-level instructions that support the firmware.
  • Terminology is kind of important to make sure we're all communicating what we think we're communicating:
    • These routers have a "bootloader" on them, which is kind of** separate from the operational "firmware" (**often, lay-people will say "firmware" when referring to both as a set, in the context of "flashing the firmware of XYZ")
    • The bootloader is officially titled "CFE" -- often also referred to as "miniCFE", "CFE miniWeb", "rescue mode", and "recovery mode"
    • There are many "operational firmware" replacements: the stock Asus firmware that comes on OEM Asus RT-AC68U's, the T-Mobile-modified Asus firmware that comes on the TM-ac1900, Asuswrt-Merlin, DD-WRT, Tomato, and several more. You are free to choose whichever you'd like and can re-flash to another one at-will if you feel like it.
    • .trx files are the format for firmware flashing images; .bin files are for bootloader flashing
  • The T-Mobile-modified bootloader forbids any non-Tmo firmware from being flashed (I think?)
  • Part of the reason this whole procedure is so onerous is because the bootloader code is embedded with your unit's unique hardware address -- it's crucial to understand that any replacement CFE you flash will need to be modified to contain the same info... AKA: you CANNOT just flash an unmodified generic bootloader you found online!
  • Downloads (including firmware images and software tools) will be listed below this OP, in _this post_
  • Tips for newbs, on how to use command-line interfaces will be listed below this OP, in _this post_
  • If you're interested in AiMesh or WDS methods for tying together multiple routers in a network, visit _this post_

Here is an outline of the whole procedure:
  1. Download/prepare all the files you'll need for later
  2. Flash the "functional" firmware with an older T-Mobile firmware
    1. Boot the unit into "rescue mode"
    2. Upload the firmware .trx file via the "CFE miniWeb" browser interface, via the Asus Firmware Restoration tool, or via TFTP (not recommended!)
  3. Flash the CFE bootloader with one from Asus (without Tmo's mods)
    1. enable SSH within the router's web-admin console
    2. login to the router via SSH (login to its "hidden" command-line-powered linux system, to be exact)
    3. dump your current bootloader to a "backup" copy file on the router
    4. copy that file from the router to your computer
    5. modify that file via the very cool CFEditor website, or via a text-editor (manually making changes yourself -- not recommended!)
    6. copy the modified bootloader from your computer to the router
    7. write/flash that bootloader .bin file into the router's permanent memory
  4. Flash the firmware with a "proven", older, oem-Asus ac68u firmware (without Tmo's mods)
    1. Boot the unit into "rescue mode" again
    2. Upload the new firmware via the "CFE miniWeb" browser interface, via the Asus Firmware Restoration tool, or via TFTP (again not recommended)
  5. Optionally replace (flash) the firmware with one from another project, like DD-WRT

Onward with the instructions!

Step 1 - Download/prepare all the files you'll need for later

...
Step 2 - Flash the "functional" firmware with an older T-Mobile firmware
  1. Boot the unit into "rescue mode"
    • Power-off the unit.
    • Even though it's off, start continuously pinging the router (windows command prompt: "ping -t 192.168.29.1" ... mac terminal: "ping 192.168.29.1") because we'll need to know the instant it's available.
    • Arrange your windows so you can see when the pings start succeeding.
    • Then open a browser tab and type in "http://192.168.29.1" BUT don't yet hit enter.
    • Find, hold down, and KEEP HOLDING DOWN the reset button on the back of the router
    • Power-on the unit
  2. Upload ("flash") the firmware .trx file via the "CFE miniWeb" browser interface
    • Continue firmly holding in the reset button.
    • Power-on the router
    • Start watching the ping activity.
    • As soon as the pings start returning successfully, hit enter on your browser tab to bring up the miniCFE webpage.
    • Immediately select your v1703 firmware file and click send. If you're using Chrome, the bottom-left corner of the window should show an upload status percentage. Watch it like a hawk.
    • When it hits 10%, release the reset button
    • When it hits 100% you should see the success-page I have attached to this post: the URL has been redirected to "192.168.29.1/f2.htm" and the content of the page reads: "Receive file size=16949294 / Upload completed. System is going to reboot. Please wait a few moments."
    • Give it several minutes to reboot and come back up.

As an alternative to the miniWeb interface, you could perform the upload/flash via the Asus Firmware Restoration tool, or via TFTP (not recommended!)
Step 3 - Flash the CFE bootloader with one from Asus
  1. enable SSH within the router's web-admin console
  2. login to the router via SSH (login to its "hidden" command-line-powered linux system, to be exact)
  3. dump your current bootloader to a "backup" copy file on the router
  4. copy that file from the router to your computer
  5. modify that file via the very cool CFEditor website, or via a text-editor (manually making changes yourself -- not recommended!)
  6. copy the modified bootloader from your computer to the router
  7. write/flash that bootloader .bin file into the router's permanent memory
Step 4 - Flash the firmware with a "proven", older, oem-Asus ac68u firmware
  1. Boot the unit into "rescue mode" again (see step #2a, above)
  2. Upload the new firmware via the "CFE miniWeb" browser interface, via the Asus Firmware Restoration tool, or via TFTP (again not recommended)
Step 5 - Optionally replace (flash) the firmware with one from another project

...
I'll be filling these above steps in ASAP, copying from my previous tutorials on this:

9 Comments

1

Sign up for a Slickdeals account to remove this ad.

This comment has been rated as unhelpful by Slickdeals users
Joined Sep 2007
Deductive Reasoner, Sr.
480 Posts
1,303 Reputation
Original Poster
Pro
#2
Reserved for downloads/tools
Reply Helpful Comment? 1 0
This comment has been rated as unhelpful by Slickdeals users
Joined Sep 2007
Deductive Reasoner, Sr.
480 Posts
1,303 Reputation
Original Poster
Pro
#3
Reserved for command-line usage tips for newbs
Reply Helpful Comment? 0 0
This comment has been rated as unhelpful by Slickdeals users
Joined Sep 2007
Deductive Reasoner, Sr.
480 Posts
1,303 Reputation
Original Poster
Pro
#4
Reserved for mesh-network/multi-router info
Reply Helpful Comment? 0 0
This comment has been rated as unhelpful by Slickdeals users
Joined Mar 2018
New User
1 Posts
10 Reputation
#5
Quote from jasonbuechler
:
Reserved for mesh-network/multi-router info
Jason, do you have the detailed instruction on Step 3 onwards please? I managed to downgrade the firmware to 1703. I am using a Mac BTW. TIA.
Reply Helpful Comment? 0 0
This comment has been rated as unhelpful by Slickdeals users
Joined Mar 2006
L3: Novice
331 Posts
50 Reputation
#6
After step2, once the older 1703[TM-AC1900_3.0.0.4_376_1703-g0ffdbba] firmware got uploaded, I am unable to login with admin/admin or admin/password.
Reply Helpful Comment? 0 0
This comment has been rated as unhelpful by Slickdeals users
Joined Nov 2004
L6: Expert
1,683 Posts
209 Reputation
#7
thinking of picking one of these up - anyone have latest instructions to permanently covert this over to the AC68U? I believe some files have to be deleted off the router that identify it as the t-mobile variant so the "cripple" code never gets triggered in the future and all future AC68U firmwares will be automatically compatible...
Reply Helpful Comment? 0 0
This comment has been rated as unhelpful by Slickdeals users
Joined Nov 2009
L1: Learner
8 Posts
10 Reputation
#8
I've tried all the recommended approaches on two TM-AC1900s and I've given up for now. They are both on the 3199 firmware. I set them up as APs with the same SSIDs as my primary router and honestly, it may work slightly better than my AiMesh setup. But that doesn't make me any less pissed at Asus. I know they're trying to make their money but if these routers can sell at $50, you know that the Asus branded ones are ridiculously overpriced. Why they would waste their engineering time on preventing a relative handful of TM users from getting the full benefit of their purchase (and in the meantime fostering ill will among this group) is beyond me. I'm in the market for a new laptop and so far my only requirement is that it NOT be an Asus.
Reply Helpful Comment? 0 0

Sign up for a Slickdeals account to remove this ad.

This comment has been rated as unhelpful by Slickdeals users
Joined May 2010
L4: Apprentice
377 Posts
41 Reputation
#9
Anyone have any experience with fixing this router when it's completely bricked? My router was working fine after installing dd-wrt but I needed to clear the settings but I made the mistake of powering off too soon after telling it to clear the nvram.

Now it will not go into recovery mode so I'm unable to apply firmware updates. I cannot get a ping to the router at all, even after setting a static IP to be in the subdomains of 192.168.29.1 and 192.168.1.1
Reply Helpful Comment? 0 0
This comment has been rated as unhelpful by Slickdeals users
Joined Jul 2005
Ye wacky olde frogge
8,605 Posts
1,368 Reputation
#10
Quote from scohad
:
Anyone have any experience with fixing this router when it's completely bricked? My router was working fine after installing dd-wrt but I needed to clear the settings but I made the mistake of powering off too soon after telling it to clear the nvram.

Now it will not go into recovery mode so I'm unable to apply firmware updates. I cannot get a ping to the router at all, even after setting a static IP to be in the subdomains of 192.168.29.1 and 192.168.1.1
Typically, you'd need a USB cable that breaks out to four pins (RX, TX, GND, 3.3V) and use the serial console on the router's printed circuit board to interrupt the CFE/BIOS and work from there.
Reply Helpful Comment? 0 0
Quote from Frogstar
:
Fo dreezy up on the wizzle dim dang.
Quote from chevvy
:
I'm gonna get little baby sneakers for my chickens so that they know what it's like to step in chicken shit.
Quote from slickdeals
:
How did I end up here...
Page 1 of 1
1
Join the Conversation
Add a Comment
 
Copyright 1999 - 2018. Slickdeals, LLC. All Rights Reserved. Copyright / Infringement Policy  •  Privacy Policy  •  Terms of Service  •  Acceptable Use Policy (Rules)  •  Interest-Based Ads
Link Copied to Clipboard