CFE bootloader update

[pirx73]

Thanks @joegreat !
It explains why "nvram get clkfreq" gives me original clock frequencies, but it is confusing still - BogoMIPS show overclocked value - 330.95, because for non-overclocked RT-N66U BogoMIPS is 299.82

 

[netware5]

I am with CFE bootloader 1.0.1.4 and the router is overclocked. What are the goals to upgrade to 1.0.1.9? Where I can read the change log (release notes) for different CFEs? Thanks in advance!

 

[pirx73]

@netware5 Nobody knows for sure. It is known that 1.0.1.4 and above gives router overclocking capabilities, what else versions above 1.0.1.4 do - we do not know, and ASUS are not telling because they do not endorse upgrading CFE at all - it is risky and could cause a lot of RMAs, thus - loss of money for ASUS. I went to 1.0.1.9 because my router originally had 1.0.1.3 which does not have overclocking, thus i just went for latest available. If you already have overclocking there is no real initiative to go beyond 1.0.1.4 i believe.

 

[netware5]

@netware5 Nobody knows for sure. It is known that 1.0.1.4 gives overclocking capabilities, what versions above 1.0.1.4 do - we do not know, and ASUS are not telling because they do not endorse upgrading CFE at all - it is risky and could cause a lot of RMAs, thus - loss of money for ASUS. I went to 1.0.1.9 because my router originally had 1.0.1.3 which does not have overclocking, thus i just went for latest available. If you already have overclocking there is no real initiative to go beyond 1.0.1.4 i believe.

Thanks! I upgraded to 1.0.1.4 some years ago (at that time this was the latest version) and then overclocked. Since I never made any new bootloader upgrades. So, if there are no any additional goals I will stay with 1.0.1.4.

 

[bird333]

Can you use this script to create a new CFE with your personal values without actually flashing it to the router right away?

 

[Pir8pete]

Has anyone tried ripping the CFE from a RT-AC86U or is it encrypted?

 

[Pierino]

Has anyone tried ripped the CFE from a RT-AC86U or is it encrypted?

I did. It's encrypted or compressed. Not sure which.

 

[DDz1818]

This procedure "actually bricked" my AC66R.
The script does not check or is not able to tell the hardware version difference.

ONLY HW versions 1.5 or higher supports this CFE update v.1.0.1.9. edit : I confused N66 with AC66 to begin with.

I was able up un-brick my bricked HW v.1.3 AC66R using a rom writer using backed up original CFE.


even though my original CFE says I have a HW version v.1.5, on PCB board it says v.1.3
so.... Don't do it if you are not sure.


If you already bricked your router and you don't have a rom writer and you don't know how to teardown your router... you are screwed for good.

Check this post before you do anything.
https://www.snbforums.com/threads/asus-routers-cfe-dumps-collection.17793/

 

[ColinTaylor]

This procedure "actually bricked" my AC66R.

To be fair these instructions are for the N66U not the AC66R. The other thread you linked to doesn't show 1.0.1.9 as a valid ROM for the AC66R.

 

[DDz1818]

To be fair these instructions are for the N66U not the AC66R. The other thread you linked to doesn't show 1.0.1.9 as a valid ROM for the AC66R.

So true... I misread N66 as AC66 and just went with it.
Not getting much sleep lately... And I also have a N66 as well.

Anyway, I was able to brick my AC66R with this script without noticing anything was wrong.

Maybe a model check routine is in order for someone like me.

 

[kenpet]

Is there a way to extract the information from CFE (*.bin) in the format shown in several posts in various threads. An example is shown below. That way I can compare 2002 and 2003 CFE to see what are the differences. Thank you.

Code:
boardtype=0xF5B2
boardnum=00
boardrev=0x1100
boardflags=0x00000110
boardflags2=0x00000000
sromrev=8
clkfreq=600,300,150
xtalfreq=25000
et0phyaddr=30
et0mdcport=0
et0macaddr=XX:XX:XX:XX:XX:XX
vlan1ports=1 2 3 4 8*
vlan1hwname=et0
vlan2ports=0 8u
vlan2hwname=et0
landevs=vlan1 wl0 wl1
wandevs=et0
lan_ipaddr=192.168.27.1
lan_netmask=255.255.255.0
gpio4=wps_button
boot_wait=on
gpio7=robo_reset
watchdog=3000
pci/1/1/venid=0x14E4
pci/1/1/boardvendor=0x14E4
pci/1/1/sromrev=9
pci/1/1/boardflags=0x00003200
pci/1/1/boardflags2=0x00100000
pci/1/1/devid=0x4332
pci/1/1/macaddr=XX:XX:XX:XX:XX:XX
pci/1/1/aa2g=7
pci/1/1/ag0=0
pci/1/1/ag1=0
pci/1/1/ag2=0
pci/1/1/txchain=7
pci/1/1/rxchain=7
pci/1/1/antswitch=0
pci/1/1/tssipos2g=1
pci/1/1/extpagain2g=3
pci/1/1/pdetrange2g=0
pci/1/1/triso2g=3
pci/1/1/antswctl2g=0
pci/1/1/elna2g=0
pci/1/1/maxp2ga0=0x64
pci/1/1/pa2gw0a0=0xFE74
pci/1/1/pa2gw1a0=0x1A2D
pci/1/1/pa2gw2a0=0xF999
pci/1/1/maxp2ga1=0x64
pci/1/1/pa2gw0a1=0xFE85
pci/1/1/pa2gw1a1=0x1C2D
pci/1/1/pa2gw2a1=0xF924
pci/1/1/maxp2ga2=0x64
pci/1/1/pa2gw0a2=0xFE75
pci/1/1/pa2gw1a2=0x1971
pci/1/1/pa2gw2a2=0xF9C8
pci/1/1/cckbw202gpo=0x1111
pci/1/1/cckbw20ul2gpo=0x1111
pci/1/1/legofdmbw202gpo=0x74111111
pci/1/1/legofdmbw20ul2gpo=0x74111111
pci/1/1/mcsbw202gpo=0xDA741111
pci/1/1/mcsbw20ul2gpo=0xDA741111
pci/1/1/mcsbw402gpo=0xFC963333
pci/1/1/mcs32po=0x9999
pci/1/1/legofdm40duppo=0x4444
pci/1/1/parefldovoltage=35
pci/1/1/ccode=US
pci/1/1/regrev=0
pci/1/1/ledbh12=7
pci/1/1/leddc=0xFFFF
pci/1/1/temps_period=5
pci/1/1/tempthresh=120
pci/1/1/temps_hysteresis=5
pci/1/1/phycal_tempdelta=0
pci/1/1/tempoffset=0
pci/1/1/rxgainerr2ga0=60
pci/2/1/boardrev=0x1305
pci/2/1/boardflags=0x10000000
pci/2/1/boardflags2=0x00300002
pci/2/1/boardflags3=0x0
pci/2/1/boardnum=21059
pci/2/1/boardtype=0x621
pci/2/1/boardvendor=0x14e4
pci/2/1/devid=0x43a2
pci/2/1/venid=0x14e4
pci/2/1/macaddr=XX:XX:XX:XX:XX:XX
pci/2/1/ccode=US
pci/2/1/rxgains5gtrelnabypa0=1
pci/2/1/rxgains5gtrelnabypa1=1
pci/2/1/rxgains5gtrelnabypa2=1
pci/2/1/rxgains5gtrisoa0=7
pci/2/1/rxgains5gtrisoa1=6
pci/2/1/rxgains5gtrisoa2=5
pci/2/1/rxgains5gelnagaina0=1
pci/2/1/rxgains5gelnagaina2=1
pci/2/1/rxgains5gelnagaina1=1
pci/2/1/pa5ga0=0xff39,0x1a55,0xfcc7,0xff38,0x1a7f,0xfcc3,0xff33,0x1a66,0xfcc4,0xff36,0x1a7b,0xfcc2
pci/2/1/pa5ga1=0xff3a,0x1b0b,0xfcba,0xff38,0x1b37,0xfcb4,0xff37,0x1aa1,0xfcc0,0xff37,0x1aef,0xfcb7
pci/2/1/pa5ga2=0xff3a,0x1b28,0xfcb4,0xff38,0x1aaa,0xfcc2,0xff35,0x1a93,0xfcc1,0xff38,0x1aab,0xfcbe
pci/2/1/maxp5ga0=100,100,100,100
pci/2/1/maxp5ga1=100,100,100,100
pci/2/1/maxp5ga2=100,100,100,100
pci/2/1/mcsbw205glpo=0x99753333
pci/2/1/mcsbw405glpo=0x99975333
pci/2/1/mcsbw805glpo=0x99975333
pci/2/1/mcsbw1605glpo=0
pci/2/1/mcsbw205gmpo=0x99753333
pci/2/1/mcsbw405gmpo=0x99975333
pci/2/1/mcsbw805gmpo=0x99975333
pci/2/1/mcsbw1605gmpo=0
pci/2/1/mcsbw205ghpo=0x99753333
pci/2/1/mcsbw405ghpo=0x99975333
pci/2/1/mcsbw805ghpo=0x99975333
pci/2/1/mcsbw1605ghpo=0
pci/2/1/mcslr5glpo=0
pci/2/1/mcslr5gmpo=0
pci/2/1/mcslr5ghpo=0
pci/2/1/sb20in40hrrpo=0
pci/2/1/sb20in80and160lr5glpo=0
pci/2/1/sb40and80hr5glpo=0
pci/2/1/sb20in80and160hr5gmpo=0
pci/2/1/sb40and80hr5gmpo=0
pci/2/1/sb20in80and160hr5ghpo=0
pci/2/1/sb40and80hr5ghpo=0
pci/2/1/sb20in40lrpo=0
pci/2/1/sb20in80and160hr5glpo=0
pci/2/1/sb40and80lr5glpo=0
pci/2/1/sb20in80and160lr5gmpo=0
pci/2/1/sb40and80lr5gmpo=0
pci/2/1/sb20in80and160lr5ghpo=0
pci/2/1/sb40and80lr5ghpo=0
pci/2/1/dot11agduphrpo=0
pci/2/1/dot11agduplrpo=0
pci/2/1/rxgainerr5ga1=27,31,31,31
pci/2/1/rxgainerr5ga2=25,31,31,29
secret_code=XXXXXXXX
hw_version=1.5
bl_version=2.0.0.2
bootflags=1
nflash_swecc=1
serial_no=CAIAA2000001
odmpid=SP-AC2015
model=RT-AC66U
ATEMODE=0
pci/1/1/rxgainerr2ga1=1
pci/1/1/rxgainerr2ga2=1
pci/2/1/rxgainerr5ga0=61,63,63,1
wait_time=3
regulation_domain=US
regulation_domain_5G=Q2
pci/2/1/regrev=33

 

[kenpet]

This is the difference I have noticed between SP-AC2015 2002 and 2003 CFEs. Is the delta significant?

Zentel CFE 1016 (EU)

pci/1/1/pa2gw0a0=0xFE74
pci/1/1/pa2gw1a0=0x1A2D
pci/1/1/pa2gw2a0=0xF999
pci/1/1/pa2gw0a1=0xFE85
pci/1/1/pa2gw1a1=0x1C2D
pci/1/1/pa2gw2a1=0xF924
pci/1/1/pa2gw0a2=0xFE75
pci/1/1/pa2gw1a2=0x1971
pci/1/1/pa2gw2a2=0xF9C8

SP-AC2015 CFE 2002

pci/1/1/pa2gw0a0=0xFE74
pci/1/1/pa2gw1a0=0x1A2D
pci/1/1/pa2gw2a0=0xF999
pci/1/1/pa2gw0a1=0xFE85
pci/1/1/pa2gw1a1=0x1C2D
pci/1/1/pa2gw2a1=0xF924
pci/1/1/pa2gw0a2=0xFE75
pci/1/1/pa2gw1a2=0x1971
pci/1/1/pa2gw2a2=0xF9C8


SP-AC2015 CFE 2003

pci/1/1/pa2gw0a0=0xFEA9
pci/1/1/pa2gw1a0=0x1B95
pci/1/1/pa2gw2a0=0xF9EC
pci/1/1/pa2gw0a1=0xFEA5
pci/1/1/pa2gw1a1=0x1B34
pci/1/1/pa2gw2a1=0xFA18
pci/1/1/pa2gw0a2=0xFE8C
pci/1/1/pa2gw1a2=0x1B28
pci/1/1/pa2gw2a2=0xF9E7


Does the above delta matter? Or SP-AC2015 with 2003 can still be flashed with CFE 1016 (EU) as is? Or it should be flashed with modified CFE 1016 (EU) with the above changes in red corrected?

 

[thiggins]

Closing thread. CFEs are now locked down so these instructions are not helpful.