[RT-AC56U] Reboot cycle after update to original firmware 374.291

[RMerlin]

The disk labeling seems normal, one is WD Ultra 2TB and the other is WinUx2. However, now that I checked the labels, at the time I plugged in the WinUx2 USB drive, I didn't realize it was named similar to the the hostname which was winux2 (all lower case). Perhaps that caused the javascript error?

The 1st time I pressed the Factory default reset, both drives were attached, along with the wan and lan connections, and the router failed to fully reboot, only the power led came on (steady, not flashing).

The 2nd+ times, I removed all devices from the router and the Factory default reset fails to work. The router is in an endless reboot state and will not go into recovery mode, even after pressing WPS button at power up.

The WPS button is for doing a factory default reset at boot time. The reset button is what you must use to enter recovery mode.

 

[Winux2]

The WPS button is for doing a factory default reset at boot time. The reset button is what you must use to enter recovery mode.

Okay, thanks for clarifying the button use. The RT-AC56U Manual only refers to the reset button in the back for preforming both Factory Defaults Reset & for entering rescue/recovery mode to re-flash the firmware.

I've been trying to get the router into rescue mode without success, following your instructions below. Do you have an updated method that will help restore function to the router?

Try the following procedure to see if you can revive it.

1) Turn the router off. Unplug all network cables from it.
2) Press the WPS button, and keep it pressed while turning the router on
3) Wait 10 secs, then press the reset button. Now, release the WPS button.
4) Wait 5 secs, then release the reset button

See if the power led starts flashing. If not, repeat the same procedure, but swap the button order (I'm sorry, I can't remember which order was the correct one).

If you can get it to a stage where the power led starts flashing, then plug a LAN computer, and try running the Asus Firmware Recovery tool.

 

[RMerlin]

I've been trying to get the router into rescue mode without success, following your instructions below. Do you have an updated method that will help restore function to the router?

No. If that procedure still fails, then you will probably need a serial cable to recover the router.

 

[Winux2]

No. If that procedure still fails, then you will probably need a serial cable to recover the router.

I purchased the router in the USA & I live overseas, and...
"ASUS does not perform warranty service outside of the country where you bought the wireless & networking product." something I didn't know at time of purchase. However, Amazon is willing to work with me to have this router fixed or refunded.

Is the RT-AC56U router worth the hassle of having it repaired? "NO!"
What's to prevent the same bricking issue from happening again? "Nothing!"

I really liked this router, but if this issue is not preventable from such recurrences, than it's better for me to return it. "Returning it would be wiser!"

Update: Sent the RT-AC56U back to retailer. Now looking for a reliable router that won't brick itself so easy.

 

[rentey]

I just had to recover my own AC56U from badly corrupted nvram, where neither buttons would work, and the router would also be unable to configure its own network interfaces (so no web interface to recover it). The corrupted nvram even prevented the kernel from loading, so no serial console either.

After a lot of tinkering, I finally managed to access the CFE over serial. The trick (using a serial cable) isn't to repeatedly mash Ctrl-C like I usually do, but to keep Ctrl-C constantly pressed as you turn the router on. Looks like the opportunity window is *very* small. It will abort the boot process and land you in CFE, where you can do an "nvram erase" over serial, followed by "reboot". Next reboot, you should now be able to access Recovery Mode as usual, through the Reset button.

So if anyone has an apparently bricked RT-AC56U, you can almost certainly recover it using a TTL serial cable.

As for the pinout, now that I have it open in front of me...

+-+
|1| VCC (do not connect)
|2| TX
|3| RX
|4| Ground
+-+

This is with the Ethernet ports closest to you. Pin 1 of the serial port has a white stripe on the pcboard by that pin. You have to connect Tx, Rx and Gnd.

Remember that you need a TTL adapter. You cannot directly connect it to a serial port. Those adapters are about 5-7$ on eBay if I remember. And since Asus is even providing pins on the router's pcboard, you won't have to do any soldering at all.

Hi all, I want to say a big thank Merlin for a way to restore them described. My router ac56u back to work)

I decided to add the description of the pictures, I hope they will be able to clarify and remove some of the questions ..

(1) first, we need Serial to TTL adapter or USB to TTL adapter.
The one I have is one of those with a CP2102 interface.
four-pin cable
(2) download and install the driver for CP210x USB to UART Bridge VCP Drivers http://www.silabs.com/products/mcu/pages/usbtouartbridgevcpdrivers.aspx


1. Should remove the metal bracket
2. Unscrew the two screws for the label


Open the router was the most difficult in the process ((I must try not to break the fastener, a total of 12.
I started with a flat screwdriver from the top corner and moved down. It was the right decision so the bottom they are smaller and fixing them is not as strong as you progress and increase the gap further opening will be easier.


further connect interface module as shown.
(1)Ground (2)TX (3)RX

 

[rentey]

continued ..)

- (1) Required in the Device Manager windows have USB CP2102 set settings
- (2) Download the PuTTY (the Telnet and SSH client itself)
http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
and configure the serial connection for

COM port: Should match the one assigned by OS
Baud: 115200
Data Bits: 8
Stop Bits: 1
Parity: None
Flow Control: None

4) Click 'Open' in PuTTy to begin session
5) Turn on router. If initsializaiyu see all connected correctly. hold CTRL-C to prevent normal boot mode. I press and hold for 5-10 seconds until the appearance of the command line.
6) If you are succesful you will see "CFE>" in your PuTTy console
7) Type in the command 'nvram erase' and execute
8) FIXED


Considering how difficult it is to parse.. not began to collect. Expect to get the ipx ufl antenna. I want to try to upgrade my ac56u at the expense of aerials and to increase the radius))

 

[MickeyRooney]

Thanks everyone for the instructions on how to open the router and connect it to putty.

I've managed to successfully execute the nvram erase command, but I still can't get the AC56U into recovery mode by holding any of the two buttons for 10 seconds while starting it up.

I originally bricked it by trying to install tomato on it using the asus firmware tool while in recovery mode. The power light is the only one that ever lights up no matter what I do.

Since recovery mode doesn't seem to work, can I somehow install the tomato .trx onto the router using the serial command terminal, or what alternatives are there?

 

[RMerlin]

Thanks everyone for the instructions on how to open the router and connect it to putty.

I've managed to successfully execute the nvram erase command, but I still can't get the AC56U into recovery mode by holding any of the two buttons for 10 seconds while starting it up.

I originally bricked it by trying to install tomato on it using the asus firmware tool while in recovery mode. The power light is the only one that ever lights up no matter what I do.

Since recovery mode doesn't seem to work, can I somehow install the tomato .trx onto the router using the serial command terminal, or what alternatives are there?

After you do an nvram erase over serial, reboot it again and re-enter the bootloader. Once at the bootloader, make sure it displays that eth0 has been configured with 192.168.1.1, otherwise it means the erase didn't work or wasn't committed back to flash.

Once you do see the IP address and are at the CFE> prompt, configure a wired client to use 192.168.1.100. Then you will be able to access the mini WEB interface over 192.168.1.1 to reflash it.

 

[MickeyRooney]

When I reboot it and let it start up without entering ctrl-C, all I get is the following. It doesn't seem to mention eth0 anywhere

Decompressing...done

SHMOO VER 1.13

PKID07DC06011801080000000000001A103F01000000

S300402B3
000021C0


RDLYW0 00000004

RDENW0 00000056

RDQSW0

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 ---------------++++++++++++++++++++++++X++++++++++++++++++++++++
 01 -------------------++++++++++++++++++++++X++++++++++++++++++++++
 02 ----------------++++++++++++++++++++++++X+++++++++++++++++++++++
 03 ------------++++++++++++++++++++++++++X+++++++++++++++++++++++++
 04 --------++++++++++++++++++++++++++++X+++++++++++++++++++++++++++
 05 --------------+++++++++++++++++++++++++X++++++++++++++++++++++++
 06 -----------++++++++++++++++++++++++++X++++++++++++++++++++++++++
 07 --------------+++++++++++++++++++++++++X++++++++++++++++++++++++
 08 ---++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
 09 -----+++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
 10 -----+++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
 11 ----++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
 12 ----++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
 13 --+++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
 14 ---++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
 15 ----++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++


PW0

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 --------------+++++++++++++++++++++++++X++++++++++++++++++++++++
 01 -------------------++++++++++++++++++++++X++++++++++++++++++++++
 02 ----------------++++++++++++++++++++++++X+++++++++++++++++++++++
 03 ------------++++++++++++++++++++++++++X+++++++++++++++++++++++++
 04 --------++++++++++++++++++++++++++++X+++++++++++++++++++++++++++
 05 -------------+++++++++++++++++++++++++X+++++++++++++++++++++++++
 06 -----------++++++++++++++++++++++++++X++++++++++++++++++++++++++
 07 -------------+++++++++++++++++++++++++X+++++++++++++++++++++++++
 08 ---++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
 09 -----+++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
 10 -----+++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
 11 ----++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
 12 ---++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
 13 --+-++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
 14 ----++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
 15 -----+++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++


NW0

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 -------------+++++++++++++++++++++++++X+++++++++++++++++++++++++
 01 ----------------++++++++++++++++++++++++X+++++++++++++++++++++++
 02 -------------+++++++++++++++++++++++++X+++++++++++++++++++++++++
 03 ---------+++++++++++++++++++++++++++X+++++++++++++++++++++++++++
 04 -------++++++++++++++++++++++++++++X++++++++++++++++++++++++++++
 05 ------------++++++++++++++++++++++++++X+++++++++++++++++++++++++
 06 -----------++++++++++++++++++++++++++X++++++++++++++++++++++++++
 07 ----------+++++++++++++++++++++++++++X++++++++++++++++++++++++++
 08 ---++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
 09 -----+++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
 10 ----++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
 11 --+++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
 12 ----++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
 13 --+++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
 14 --+++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
 15 ---++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++


WRDQW0

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
 01 -+++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++-
 02 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
 03 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
 04 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
 05 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
 06 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
 07 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
 08 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
 09 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
 10 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
 11 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
 12 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
 13 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
 14 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
 15 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-


WRDMW0 00000031
WRDMW0 00000031


ADDR

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 +++++++++++++++++++++++++++++++X+S++++++++++++++++++++++++++++++

Decompressing...done
Detect CPU turbo button...

CFE version 6.30.163.2002 (r382208) based on BBP 1.0.37 for BCM947XX (32bit,SP,)
Build Date: å 18 09:25:12 CST 2013 (yau@wireless-pub2)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
DDR Clock: 533 MHz
Info: DDR frequency set from clkfreq=800,*533*
CPU type 0x0: 800MHz
Tot mem: 262144 KBytes

CFE mem:    0x00F00000 - 0x01192F4C (2699084)
Data:       0x00F4B644 - 0x00F4BA8C (1096)
BSS:        0x00F4BA98 - 0x00F90F4C (283828)
Heap:       0x00F90F4C - 0x01190F4C (2097152)
Stack:      0x01190F4C - 0x01192F4C (8192)
Text:       0x00F00000 - 0x00F42394 (271252)

Null Rescue Flag.
boot the image...
go load
Loader:raw Filesys:tftp Dev:(null) File:: Options:(null)
Loading: TFTP Server.
Failed.
Could not load :: Error
Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
Loading: .... 4185568 bytes read
Entry at 0x00008000
Starting program at 0x00008000
console [ttyS0] enabled, bootconsole disabled
serial8250.0: ttyS1 at MMIO 0x18000400 (irq = 117) is a 16550
brd: module loaded
loop: module loaded
pflash: found no supported devices
bcmsflash: found no supported devices
Boot partition size = 524288(0x80000)
lookup_nflash_rootfs_offset: offset = 0x200000
nflash: squash filesystem with lzma found at block 29
Creating 4 MTD partitions on "nflash":
0x000000000000-0x000000080000 : "boot"
0x000000080000-0x000000200000 : "nvram"
0x000000200000-0x000002000000 : "linux"
0x0000003ab644-0x000002000000 : "rootfs"
PPP generic driver version 2.4.2
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
=== PPTP init ===
u32 classifier
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (3990 buckets, 15960 max)
xt_time: kernel timezone is -0000
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Registering the dns_resolver key type
Northstar brcmnand NAND Flash Controller driver, Version 0.1 (c) Broadcom Inc. 2012
NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD NAND 128MiB 3,3V 8-bit)
Spare area=64 eccbytes 56, ecc bytes located at:
 2 3 4 5 6 7 8 9 10 11 12 13 14 15 18 19 20 21 22 23 24 25 26 27 28 29 30 31 34 35 36 37 38 39 40 41 42 43 44 45 46 47 50 51 52 53 54 55 56 57 58 59 60 61 62 63
Available 7 bytes at (off,len):
(1,1) (16,2) (32,2) (48,2) (0,0) (0,0) (0,0) (0,0)
Scanning device for bad blocks
Options: NO_AUTOINCR,NO_READRDY,BBT_SCAN2NDPAGE,
Creating 2 MTD partitions on "brcmnand":
0x000002000000-0x000008000000 : "brcmnand"
0x000004000000-0x000006000000 : "jffs2"
VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
devtmpfs: mounted
Freeing init memory: 216K

Then after a couple of minutes it gives this:

Hit ENTER for console...

ctf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
et_module_init: passivemode set to 0x0
et_module_init: txworkq set to 0x1
et_module_init: et_txq_thresh set to 0x400
eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.14.86 (r456083)
wl_module_init: passivemode set to 0x0
wl_module_init: txworkq set to 0x1
PCI: Enabling device 0001:01:00.0 (0140 -> 0142)
eth1: Broadcom BCMa8db 802.11 Wireless Controller 6.37.14.86 (r456083)
eth2: Broadcom BCM4360 802.11 Wireless Controller 6.37.14.86 (r456083)
/ # xhci_hcd 0000:00:0b.0: Failed to enable MSI-X
xhci_hcd 0000:00:0b.0: failed to allocate MSI entry
usb usb1: No SuperSpeed endpoint companion for config 1  interface 0 altsetting 0 ep 129: using minimum values
vlan1: cmd=14: Operation not supported
COEX: downgraded chanspec 0x1804 to 0x1002: channel 1 used by exiting BSSs
lo: File exists
vlan1: cmd=14: Operation not supported

If I hit enter it puts me into a linux environment.

192.168.1.1 does not respond when i connect to it from 192.168.1.100

 

[RMerlin]

When I reboot it and let it start up without entering ctrl-C, all I get is the following. It doesn't seem to mention eth0 anywhere

Which is precisely the bug of the RT-AC56U bootloader that's been mentioned numerous times here, where it will fail to initialize the Ethernet switch as well as both hardware buttons unless you wipe out nvram.

 

[MickeyRooney]

I've tried nvram erase several times. Should I just keep erasing and restarting it, or is there some other way to erase it properly? Maybe I need to commit the erasing somehow?

 

[Adamm]

I've tried nvram erase several times. Should I just keep erasing and restarting it, or is there some other way to erase it properly? Maybe I need to commit the erasing somehow?

Did you issue an "nvram commit" after clearing the nvram?

 

[MickeyRooney]

I tried doing nvram erase and then nvram commit and rebooting, but it didn't seem to work since I still can't get into recovery mode using WPS and reset buttons. Neither is eth0 configuration mentioned anywhere during startup.

The last chunk of startup output, which takes a little while before showing up, changed to this though:

Hit ENTER for console...

ctf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
et_module_init: passivemode set to 0x0
et_module_init: txworkq set to 0x1
et_module_init: et_txq_thresh set to 0x400
eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.14.86 (r456083)
wl_module_init: passivemode set to 0x0
wl_module_init: txworkq set to 0x1
PCI: Enabling device 0001:01:00.0 (0140 -> 0142)
wl driver 6.37.14.86 (r456083) failed with code 21
eth1: Broadcom BCM4360 802.11 Wireless Controller 6.37.14.86 (r456083)
/ # vlan1: cmd=14: Operation not supported
eth2: cmd=14: No such device
eth2: No such device
lo: File exists
vlan1: cmd=14: Operation not supported
eth2: cmd=14: No such device

 

[oneuser]

Oops, I'm facing the same problem: only power LED is on, the LED lights at the back for the ports will all light up every 30 seconds.

I tried the WPS & reset buttons combination, but have no luck. Any solution?

Thank you~

 

[RMerlin]

Oops, I'm facing the same problem: only power LED is on, the LED lights at the back for the ports will all light up every 30 seconds.

I tried the WPS & reset buttons combination, but have no luck. Any solution?

Thank you~

Same as everyone else: need a serial cable to fix this. Sorry.

 

[hashish]

I was wondering if anyone could help me ... i flashed my ac56u with tomato from ddwrt and it seems to be stucked now ... it works with an ip onf 192.168.2.1 but I am unable to access it ... the default passwords do not work. I can ssh in but face the same password issue - I've tried to sent the router to recovery mode but have been unable to do so after all the steps here ... what are my options besides a serial cable?

Any help to resolve this is much appreciated

 

[john9527]

If you set to defaults on ddwrt before flashing try the following.....

login= root , Password= bJz7PcC1rCRJQ

Or try the following (from Shibby the tomato developer)

turn off power, press and hold WPS button and then turn power on. Hold pressed button until power led will blink very fast. After that release button. Router should restart automatically and run with default settings.

or second way: when router will run, press and hold WPS button for 25 seconds. After that you should be able to connect to router via telnet on port 233 without password. After that run command:
mtd-erase2 nvram
reboot

 

[MickeyRooney]

CFE> nvram erase
*** command status = 0
CFE> nvram commit
*** command status = 0
CFE> ifconfig
Network interface has not been configured
*** command status = 0
CFE> ifconfig eth0 -addr=192.168.1.140 -mask=255.255.255.0 -gw=192.168.1.100
Could not activate network interface 'eth0': Error
*** command status = -1

With neither the buttons or the LAN ports on my router working, there doesn't seem to be a lot I can do. I'd at least need to get the LAN ports back to flash it using the CFE flash command or something.

I read that deleting the linux partition could force it into recovery mode, does anyone know anything about that?

 

[hashish]

Ordered a USB TTL cable. I would appreciate if someone can help with the instructions for the next steps. Thanks!

 

[hashish]

Ordered a USB TTL cable. I would appreciate if someone can help with the instructions for the next steps. Thanks!

Sorry. Missed the steps in the previous page!