T-Mobile TM-AC1900 WiFi CellSpot Router (Certified Pre-Owned) Expired

EDIT: My old notes show this guide was typed by User17347427. (MANY people here have taken part of this guide)
I am just showing that names should not be taken out when editing this guide.

After johnny2x4's post below, the origional User17347427 name seem's to have disappeared. It looks like all this work is work off of johnny2x4.
My notes show different.
So I am editing to make things more clear who did what.
I am not saying johnny2x4 edited out any users.

lets try to keep user names still in when editing.

-------
Posted by User17347427

The following information and steps were done by many great people here and on other websites. Many here can edit this information.

For example, johnny2x4 Wrote a "new guide" in the below link, that also simply updates/minor fixes for those that like the style of the guide at bayareatechpros

johnny2x4 link:
https://slickdeals.net/f/12685621-t-mobile-wi-fi-cellspot-router-tm-ac1900-certified-pre-owned-39-99-plus-free-shipping?p=124882258#post124882258



johnny2x4 (or whatever name he goes by now) also commented:

Quote : I made a pile of powershell scripts that anyone with a pretty recently-updated Windows computer should be able to use without need to deal with other software. Since you could re-badge your tmo fw to stock asus firmware, I called the project The Badger... it's basically just a "user friendly" menu script wrapped around a bunch of separate operations......Check out the video and see if it's your kinda thing Video demo: https://www.youtube.com/watch?v=J7SYNOZQ504 Project page: https://github.com/jasonbuechler/asus-rebadger Testing thread: https://slickdeals.net/f/13056622 --jasonbuechler

---------------------------- Back to the guide ----------------------------
Posted by User17347427 from information gathered by many contributors!

Ordering experience:
(Check Spam/Junk/Inbox) for any communications from T-Mobile.
If you didn't hear anything from your order within a few hours, chances are your order didn't take.
You can call call 800-672-5390, say you don't have an order number.. and you get a CSR to talk to. Find out what happened.
----
Download PDF manual for original T-mobile TM-AC1900:
https://us.v-cdn.net/6025034/uplo...glgrwe.pdf
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------


You can flash this router to an RT-AC68U: There are few change/additions needed in the guide before the latest ASUS firmware can be flashed. You MUST read this Community Wiki below, on steps of Lazymocha's Guide [lazymocha.com].

Advice:

• Avoid CFE 1.0.2.5 from the RT-AC68P, as the newest Asus firmwares (3.0.0.4.384.20624 and later) have performance issues using it when running on a converted TM-AC1900. Instead, use the most current CFE 1.0.2.0 US AiMesh as it is not only for AiMesh.; it was dumped from an actual RT-AC68U by user goggles99 at SNB. The CFE generator [pipeline.sh] by danielfeng has this version available.
  IF need, link to ASUS RT-AC68U Router Firmware 3.0.0.4.384.20308 [softpedia.com] (which is MD5 0eebcaebee656d3d882f6fcb40bf2697, if you are curious for its authenticity) ASUS removed this firmware as it is the last safest firmware for the converted cellspots without doing the MTD5 commands discussed below.
• Some TM-AC1900 ship with a firmware version that allows SSH access. If you get one of these, you can skip steps 5-10 of the guide. To check if you have SSH available, go to Administration > System in the router configuration interface. If your firmware permits SSH, there will be a setting to Enable SSH. If so, choose Yes, then Apply. Move on to step 11.
• The T-Mobile certificates have to be wiped from the mtd5 partition. This can be done after all of the steps in the guide have been completed, but must be done before any newer version of ASUS firmware is flashed. As of this writing, the firmware included in the Lazymocha's Guide [lazymocha.com] is 3.0.0.4.376.3626, so the steps below should be performed when this version is running on your router.

PC Instructions: Lazymoca's Guide [lazymocha.com]
(I removed the Bayarea guide link, you will get it from Lazymocha's Guide. But the site is wrong about the MTD5 commands. The comments repeat. I found it best to keep Lazymocha's up)
Mac Instructions - Here [youtu.be] (remember, 1.0.2.0 US AiMesh, he chooses the wrong one in the video).

A brief explanation of what you are achieving in the Guide to change your T-Mobile RT-AC1900 to RT-AC68U.

The Cellspots usually come with firmware 3199 that hides features (SSH and Telnet) in the settings of the router.
SSH feature needs to be turned on to do steps of the guide.
If it is not available to turn on, in order to turn them on, a different older T-Mobile firmware needs to be installed.

The achievements for the entire Guide are as follows:
1. Install firmware 376.1703 to enable SSH
2. Replace CFE (taking out old, updating, installing new)
3. Install firmware 376.3626 to expand jffs (mtd4) to 64MB
4. Clean-up mtd5
*As a bonus there is an extra 2 mtd5 commands to run when on firmware 384.20308.
That is it! 4 achievements to accomplish, then you can install updated Firmware.

Between these achievements are preparations to be done. That is why the guide has 24+ steps in it.
Above is Advice with some links for downloads, below are Guide Tips and notes for tough Steps of the guide.
In this "Community Wiki" is talk about the 'Steps' of the Guide(s) to help you do these achievements.

It is important you follow the guide and the steps correctly. The first achievement is the toughest part of the entire guide. Pay attention closely. If you are stuck on a Step, read the Community Wiki.
If things get bad for you, just walk away don't skip any 'Steps', don't decide to go out of the steps. Just ask your questions and people will help you.

----

The Lazymocha Guide steps discussed below.

Guide Tips:

Step 1, 2, 3
Download files from Step 1, and Step 3, but also download firmware 3.0.0.4.384.20308 [softpedia.com].


NOTE: If you already converted to an RT-AC68U in the past, and you want the new version of RT-AC68U with AiMesh (you want to update it), you don't have to use your origional_cfe.bin.
Just skip Steps 4+ and go to Step 11, continue from there. (You will need Step 1,2,3 and 384.20308 firmware from above)

*Disconnect from the internet now*

Step 4
Set static IP for PC. See photo on the left, bottom of this page HERE
Make sure your PC/Laptop WiFi is off. You should be disconnected from the internet.
Connect this NEW router to the PC. (1 of the 4 yellow ports) Do not connect into the blue port.
Work offline until Step 15. Remember there are preparations steps for each achievement, so pay attention.

Lets now try to manually install firmware 376.1703 from logging into the router.. in your browser, type in 192.168.29.1
Username: Admin
Password: Password
Find the firmware version top of the page and click on it.. Find the downloaded firmware from Step 3 above, (make sure it is unzipped).. and manually install it to the router.
You might get lucky and it installs.. it depends on what version firmware your router came with. IF it does, move to Step 8.. if not, continue below

Step 6 & 7
Mini-CFE webpage
If you are having problems accessing the mini-CFE webserver see if this works:

1. Power off the router using the power button
2. Set your PC's IP as explained in Step 4
3. Navigate to 192.168.29.1 using your browser -- the browser continue to try and access the page until it is available
4. Press and hold the reset button while powering-on the router
5. When the mini-CFE webpage appears on the browser, release the reset button
6. As long as the browser status is still spinning -- looking for a webpage. If it stops refresh the page -- the mini CFE web page will load.

Some have said to keep holding the reset button down for 10 seconds after you start to load the firmware.
So, browser searching status spinning for 192.168.29.1- holding reset, power on router - if browser spins, the mini-CFE opens and you click firmware - keep holding reset for 10 seconds while firmware uploads.. let go reset.
Don't waste any time finding that firmware to load to mini-CFE as that web browser must be searching trying to connect to 192.168.29.1. If browser gives up searching (stops spinning) you have to click refresh.. it can stop the process. That is why ping is mentioned on some guides.
It helps to tape on a 'zip tie end' on top of the reset button so it's easy to press, you have a few things to do at once during this one step.

If this doesn't work,
Try Google Chrome incognito mode.
Some mention to turn on AP mode in the router then try.



If accessing the mini-CFE webserver doesn't work at all for you...
You are experiencing the effects of a locked firmware...
You have to change Guides.

[/I] " Directions for rolling back to AC68 after AC1900 rollback: " Direct Google Docs Link [google.com]. We call this the Google Doc. Guide. You can download it here [mega.nz]

What is wrong with the T-Mobile 3199 firmware
The Cellspots are USUALLY now shipped out with firmware 3199, that makes it harder for you to downgrade that firmware. Sometimes you get lucky with the above steps, sometimes you don't.
This is also caused if you have a converted a Cellspot -TM-AC1900 to RT-AC68U, that did not do the MTD5 commands, and attempted to do a firmware update past 3.0.0.4.384.20308.

Why is my converted Cellspot rolled back to 3199
Those that changed a Cellspot to RT-AC68U in the past might experience this because the ASUS Firmware 3.0.0.4.384.20624 and newer is a 'smart firmware' that identifies converted Cellspots and revert them back to a T-Mobile Cellspots with T-Mobile firmware- 3199. (You could say ASUS put in a virus/trojan to sniff out Cellspots)

To stop this from happening, you must complete the guide and do the MTD5 commands to make your router immune to this 'ASUS type smart firmware'.
IF you don't do these MTD5 commands, the safest highest version of firmware you can use of ASUS's is 384.20308 [softpedia.com].
The first MTD5 commands erases T-Mobile certificates and solves this issue.
The last 2 MTD5 commands fills in that missing area to the regular size of the normal RT-AC68U.

IF you need to use this Google Doc. Guide,I recommend using the (No CFE USB Instructions). IF you still have your old 'original_cfe.bin' from converting THIS router in the past (not one from another router), then you can use the (USB Instructions).

IF you had success on Step 7 above, continue with the Lazymocha's Guide under the Google Doc Guide chat - Steps 1 - 5 below.

-----
- For those that could not get past Step 7 above, we now talk about The Google Doc. Guide. [google.com] Download here [mega.nz]

Changing Guides to The Google Doc. Guide, (NO CFE USB Instructions)

Google Doc. Guide discussion now:
The router must be connected to the internet for this to work

• Step 1 You need a formatted (completely empty) USB thumbdrive. You need to right click - rename it to: USB
• Step 2 When doing step 2, you need to get the firmware file: TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx and rename it to: firmware1703.trx
  Copy the firmware file to your thumbdrive called: USB
  The file you need can be found in Step 3 on the Lazymocha Guide [lazymocha.com] (Which you should already have)
• Step 3 This explains how to use the Google Doc. Guide.. the commands.To help you, there are some photos I found to show you how and where you put the commands when using this Direct Google Docs Link. (Thank you Sploit).
  The photos can be seen at the bottom of this post.
• Step 4 Plug in the thumbdrive to the routers USB 2.0 port and look in the Router page for USB thumbdrive.. check it is showing 'USB' for a name.
• Step 5 Run the commands as shown in the pictures. When it says 'wait before doing the next command'. Wait.

- Google Doc. Guide is complete. Make sure you did your 'reset NVRAM' which is Step 20 of Lazymocha Guide.
Start at Step 9 over on there guide.

END of Google Doc. Guide discussion
----

........Lazymocha's Guide [lazymocha.com] discussion and Steps continued below.

Step 8
After flashing "TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx" and rebooting, the NVRAM *must* be reset (Step 20).
NOTE: IF holding WPS seems to not work, try holding WPS for 20 seconds instead of waiting for the power led to flash.

Another way is the command: nvram erase

Step 11
Open Putty and WinSCP. In WinSCP select SCP as file protocol, in Putty select SSH - See Putty SSH photo, bottom of this page HERE
After you connect to the router in Putty, another window opens (if asked, click yes yes yes). It will ask for the user name and password of the router. Username will be visible, password wont. Hit enter after each.

Step 12

In putty type:
cat /dev/mtd0 > original_cfe.bin

Step 13
In WinSCP refresh the window on the right side and note that original_cfe.bin is present

Step 14
Copy original_cfe.bin to a local drive (to keep for future use-always keep this)

Step 15
You must go on the internet now to upload your original_cfe.bin HERE [pipeline.sh]
Chose 1.0.2.0 US AiMesh
When getting the CFE downloaded from the website, don't forget to rename the downloaded CFE to:
new_cfe.bin
Get back off the internet when you are finished doing Step 15.

Steps 16
"Upload" Copy and paste the new_cfe.bin and mtd-write and FW_RT_AC68U_30043763626.trx into WinSCP, next to your original_cfe.bin. All 4 files should be in there.

Steps 17-19:
Install new_cfe.bin and mtd-write and FW_RT_AC68U_30043763626.trx from WinSCP using commands:

The green text should appear in Putty after issuing the three commands.
Step 20 clear NVRAM: After the CRC OK green text, clear NVRAM

• Perform NVRAM Reset.
  a. Power off router
  b. Wait 10 seconds
  c. Press and hold WPS button
  d. Power up the router and continue to hold WPS button for 20 seconds - power LED starts blinking very quickly - keep holding for that 20 seconds.
  e. Release WPS button and wait for router to fully boot ~ 5 mins
  

If the Model number remains TM-AC1900: After doing Step 20, and you still don't see "RT-AC68U", this was due to a mistake in Steps 16 -19.
Check the spelling of the code and re-naming of the CFE:
origional_cfe.bin to the CFE generator [pipeline.sh] (choosing 1.0.2.0 US AiMesh), correctly re-naming the received CFE "new_1.0.2.0_am.bin"
to
new_cfe.bin
Make sure all those 3 files new_cfe.bin and mtd-write and FW_RT_AC68U_30043763626.trx are in WinSCP next to original_cfe.bin.
(If doing Steps 17-19 again, make sure you then do Step 20) You should now see "RT-AC68U"
IF it still isn't clearing NVRAM, in Putty type this command:

Step 23 Wiping T-Mobile certificates from the MTD5 partition
(this is entered in Putty after enabling SSH on the router)

These instructions originally existed on SNB before that forum thread was shut down [snbforums.com]. Credit to XVortex and rdallen. After you've performed these steps, you can flash above Firmware version 3.0.0.4.384.20308 and newer using the GUI.

Those 7 MTD5 commands look like this:
If following the Lazymocha's Guide, you will be on Firmware version 3004.376.3626 during this step Step 23.

The last 2 MTD5 commands:
In order to do the last 2 MTD5 commands you must be on Firmware 384.xxxxx or higher. 3.0.0.4.384.20308 [softpedia.com] (preferred because it is just before the virus) or the command will not be effective.
Remember, every time you update firmware, reset NVRAM Step 20. Enable SSH, then do the last 2 commands below.

Writing all FFs to the mtd5, the green text should appear in Putty after issuing the two commands.
You may now upgrade to the latest ASUS firmware (I suggest every firmware install be manually uploaded, and off the internet.)
ASUS RT-AC68U firmware downloads [asus.com]
Merlin found HERE [lostrealm.ca]
Don't forget to reset NVRAM after firmware installs.
Put the new_cfe.bin and original_cfe.bin and firmwares in the folder 'router' and save for future work in case you need them.


-------------------------------------Well, a big congratulations are in order!! You now have an RT-AC68U [asus.com]------------------------------------------------
(guide updated 1/31/19)

-----
A guide on the Internet connectivity during the process of the Lazymocha's Guide.
This tells you when to connect/disconnect the PC from the Internet and old router to new router.

Assuming you are using a single PC to do the flashing:

• You are connected to the Internet via your old router in Steps 1-3.
• Then you disconnect from old router, "Set static IP for PC" (as in Step 4) connect to the new router in Steps 4-14 (no Internet).
• Now you disconnect from new router, "Reset PC IP back to default" (as in Step 21), reconnect to your old router to get on the Internet, and do Step 15.
• Then you disconnect from old router, "Set static IP for PC" (as in Step 4) connect to the new router for Steps 16-20 (no Internet). From now on, your PC can stay connected to the new router.
• Step 21 "Reset PC IP back to default" Continue with Step 22-23 (no Internet).
• In Step 24, you can connect the new router to your Internet modem. After a normal configuration, your PC should connect to the Internet now via the new router.
• Flash your desired/updated/newest firmware to the router via a manual upload on the router's Firmware Update screen. Then do Step 20 again.

Assuming you are using 2 PC's to do the flashing, and the above is complicated:

• If you are using 2 PC's follow Lazymocha's Guide [lazymocha.com]. Use the separate PC to get step 1 and 3 downloads onto a thumbdrive, and transfer it to the (off Internet PC working on the new router).
  On step 14, thumbdrive the origional_cfe.bin from the offline PC - to the online PC, do Step 15, rename the CFE and transfer the new_cfe.bin to the (offline PC) again via thumbdrive.
  Finish the work. Once you are past Step 23, you can go on the internet with the new router.

-----
Having Trouble Getting a AiMesh Node to connect to your main AiMesh router? (confirmed working on firmware 3.0.0.4.384.32799) then follow this tutorial from vboyz103 (Click me to go to his original post or read below)

Having issue with intermittent wireless connection running latest firmware (3.0.0.4.384_45149)?

Try this.
In Wifi Professional for 2.4Ghz & 5Ghz:
Disable Roaming Assistance; Airtime fairness; and both types of Beamforming (click Apply for each band).
If you see improvement, enable Roaming Assistance but lower the threshold to about -75. This needs to be fine tuned for each environment and band.
You might also play with Bluetooth coexistence. BTW, do you have USB3 devices connected? If so, set USB3 to USB2 mode. It can interfere with 2.4GHz.
If anything makes an improvement, you might try enabling other settings to narrow-down exactly which is the problem.
~ST1NGY

Please note:
Before commenting below in the comment section... make sure your line signal is good with the Modem.
Make sure you don't have drop outs, signal loss, T3 or T4 timeouts. Look in your Modem logs and check signal strength. Call your ISP for any issues.
Please, trouble shoot this first, and make sure you did all the steps on this Guide...before commenting below.
-----
If you feel the need to change clock speeds
(Not necessary for conversion from cellspot to RT-AC68U)

After completing the above steps to convert your router to RT-AC68U using CFE 1.0.2.0 US AiMesh, you may notice the CFE defaults to clkfreq=800,666 and will revert to default after reboot if overclocked.
To make the overclock stick, follow these steps from the whirlpool forum:

To manually set the clkfreq the following SSH commands can be used which allow the clkfreq to survive a device reboot:

nvram set asuscfeclkfreq=1000,800 && nvram set asuscfecommit=1
nvram set clkfreq=1000,800
nvram commit && reboot

People have reported using the following clock speeds: 800,666, 1000/666, 1000/800, 1200/800, or 1400/800

-----
If you want to check temps

Enable Telnet in router.
Putty telnet. Click the picture bottom of. this post
CPU temperature, (Code from 'RMerlin'):
For the radio temperature, it's more complicated.
The result of the radio temperature must be divided by two, then add 20 to the result.

-----
To check if your on CFE 1.0.2.0 or CFE 1.0.2.0 US AiMesh
As you notice, doing this Code (found from years ago):
It just says 1.0.2.0 not anything about AiMesh.

To check Version verification, Putty Telnet into Router. Click the picture bottom of. this post
(Code and quote from 'st1ngy')
"If it returns "odmpid=RT-AC68U" odds are high you have installed the correct one(1.0.2.0 US AiMesh).
If is says "odmpid=ASUS", that's the non-AiMesh one."

-----
How do I double check the MTD5 signature
Do you think you didn't do the MTD5 commands correctly
Lazymocha's Guide doesn't explain to do the last two MTD5 commands on firmware 384.xxxxx (preferably 384.20308).
If you didn't read correctly about the MTD5 command step above, you might not have had the last 2 MTD5 commands effectively done.

To check this, once again, putty in and do the following command:
A "real" RT-AC68U has absolutely nothing in /dev/mtd5 except it is filled with 0xff. You should see no result for the command output.(seen in green)
If you do see some misc strings, there's something in mtd5 and you should execute the commands to wipe it when on firmware Version 384.xxxxx
-----

SNB now disallows discussion [snbforums.com] about converting TM-AC1900 to RT-AC68U with AiMesh. So, modding information may be a bit harder to come by going forward. Some discussion has moved to this thread [whirlpool.net.au] on whirlpool.

Link to this Wiki