[SOLVED] RT-AC68U - Brick and can't take any firmware via recovery

[TheCoder]

I have cleared the NVRAM in web GUI and then tried to move from AsuswrtMerlin to FreshTomato using Asus Router Firmware Restoration Utility (couldn't do that in GUI because of the Asus restriction on flashing unofficial software...). Unfortunately, after a long wait, the router wasn't detected in DHCP settings.

Router: RT-AC68U rev. E1
Previous software: AsuswrtMerlin RT-AC68U_384.14_2.zip
Update that crashed the router: fresh tomato-RT-AC68U-ARM-2020.1-AIO-64K

Current State (what doesn't work):
- The router in DHCP mode doesn't work and doesn't respond to ping. Windows 10 assigns strange IP: 169.254.232.243 (no, the router doesn't respond on 169.254.232.1)
- wifi led is not lit. I am connecting via ethernet but it worked before
- clearing NVRAM seems not to work. When I do it via CFE mini web Server, the site timeouts. When I do it with WPS on boot it doesn't help (LEDs blink indicating the router should clear NVRAM)

What works:
In recovery mode, I can access router with Asus Restoration Tool and open CFE mini web server. Unfortunately flashing using these methods doesn't help.

Problem indication:
Asus Restoration Tool successfully passes the firmware to the router (first step) but stops the procedure at 1% or 2% in step of "System recovery is in progress". After reaching 2% of "recovery step", flashing stops and says that flashing was successful and a reboot is in progress. Of course, the router still doesn't launch soft.

What I have tried:
VooDoo and 30/30/30 reset
WPS button on launch reset
Waiting with power off and power on (2 nights and other breaks)
Flashing FreshTomato
Flashing Tomato VPN (10 Mb version)
Flashing Merlin RT-AC68U_378.55_0 (29 Mb)
Flashing latest DDWRT
Flashing Official Firmware:
- RT-AC68U_3.0.0.4_385_10000 (newest found on Asus site)
- RT-AC68U_3.0.0.4_384_32738-gc9a116a (oldest found on Asus site)

Do you have any tips on what I could do? Have I bricked the unbrickable device?

 

[ColinTaylor]

https://www.snbforums.com/threads/cant-leave-dd-wrt-really-want-merlin.42776/page-2#post-529610

 

[Ronald Schwerer]

Have you tried a different browser?

 

[TheCoder]

I have tried Merlin 380.57 and Hihn's RT-AC68U_374.43_27E5j9527 and still nothing.
Yes, I have tried different browsers, Asus Restoration Tool and also TFTP doesn't finish the process...

 

[KevTech]

Did you try reset to defaults in miniweb before uploading.

reset to defaults > reboot router > go back into miniweb > upload firmware.

Here are older versions of firmware to try: https://drivers.softpedia.com/get/R...AC68U-Router-Firmware-3-0-0-4-384-20308.shtml

Scroll down to "other versions" on the left of the page.

 

[TheCoder]

Thank you for your answers. Yes, I have tried to reset to defaults (before and after flashing). I've tried so many softs and also this one linked by @KevTech , unfortunately, does not work either.

I have gotten the serial cable and got communication with the router but I have completely no idea how to restore the software using serial. I would be glad for help in that matter. I have Windows 10. In connections I don't see Local Area Connection responsible for serial connection, this I cannot change IP of the USB connection.

I am not an expert but here's log from "nvram show" command. To me, it looks kinda broken or incomplete. On Merlin, I had diversion ad blocker which worked. I haven't uninstalled it before going to tomato. I have done nvram erase before reboot and before typing "nvram show"

CFE> nvram erase
*** command status = 0

CFE> nvram show
mwan_ckdst=google.com,microsoft.com
wan2_dns=
wan_ppp_mru=1500
wl_radius_port=1812
wl_mac_deny=
wl_itxbf=0
rrule0=0|1320|300|31|||word text
^begins-with.domain.
.ends-with.net$
^www.exact-domain.net$|0|example
wl1_wme=auto
wan_l2tp_server_ip=
qos_reset=1
https_crt=
pptp_client_mru=1400
wan_unit=0
ipv6_isp_gw=
qos_irates=5-100,2-20,5-100,10-90,20-90,5-90,5-70,5-100,5-30,1-1
log_in=0
jffs2_on=0
led_override=
sesx_led=12
ms_port=0
NC_Verbosity=2
0:rxgains2gtrisoa0=11
wan4_pptp_server_ip=
usb_3g=1
smbd_autoshare=2
tinc_hosts=
mysql_query_cache_size=16
0:rxgains2gtrisoa1=11
lan_desc=1
ipv6_dns=
wl_txstreams=0
vpn_server1_nm=255.255.255.0
vpn_server1_plan1=0
0:rxgains2gtrisoa2=11
wan2_ppp_service=
wan4_ppp_idletime=5
adblock_blacklist=1<http://winhelp2002.mvps.org/hosts.txt<>1<http://adaway.org/hosts.txt<>1<http://hosts-file.net/ad_servers.txt<>1<http://www.malwaredomainlist.com/hostslist/hosts.txt<>1<http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintext<>1<https://raw.githubusercontent.com/hoshsadiq/adblock-nocoin-list/master/hosts.txt<cryptomining>0<http://someonewhocares.org/hosts/zero/hosts<>0<https://raw.githubusercontent.com/WindowsLies/BlockWindows/master/hosts<Windows 10>0<http://sysctl.or▒

EDIT:
I have done nvram erase, nvram commit and then rebooot. Here's my nvram now. Still cannot flash soft with Asus Firmware Restoration but at least nvram looks quite normal to me.

CFE> show devices
Device Name          Description
-------------------  ---------------------------------------------------------
uart0                NS16550 UART at 0x18000300
uart1                NS16550 UART at 0x18000400
nflash0              AMD NAND flash size 131072KB
nflash0.boot         AMD NAND flash offset 0 size 512KB
nflash0.nvram        AMD NAND flash offset 80000 size 1536KB
nflash0.trx          AMD NAND flash offset 200000 size 1KB
nflash0.os           AMD NAND flash offset 20001C size 129024KB
nflash1.boot         AMD NAND flash offset 0 size 512KB
nflash1.nvram        AMD NAND flash offset 80000 size 1536KB
nflash1.trx          AMD NAND flash offset 200000 size 63488KB
nflash1.brcmnand     AMD NAND flash offset 4000000 size 65536KB
eth0                 Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller
*** command status = 0
CFE> nvram erase
*** command status = 0
CFE> nvram commit
*** command status = 0
CFE> nvram show
0:rxgains2gtrisoa0=11
0:rxgains2gtrisoa1=11
0:rxgains2gtrisoa2=11
0:pa2ga0=0xff4a,0x1c3c,0xfca8
1:sb20in80and160lr5ghpo=0
1:tssiposslope5g=1
0:pa2ga1=0xff49,0x1b5a,0xfcb9
boardrev=0x1103
0:pa2ga2=0xff4e,0x1c8d,0xfcaa
et0macaddr=60:45:CB:5A:04:98
1:antswitch=0
1:boardflags=0x30000000
1:mcsbw805glpo=0xECA86420
devpath0=pci/1/1
watchdog=2100
boot_wait=on
1:rxgains5ghelnagaina0=3
devpath1=pci/2/1
1:rxgains5ghelnagaina1=3
1:sb40and80lr5gmpo=0
1:rxgains5ghelnagaina2=3
et0mdcport=0
0:venid=0x14E4
0:aa2g=7
0:ledbh10=7
reset_gpio=11
pmon_ver=CFE 7.14.131.56 (r641653)
1:mcsbw805ghpo=0xECA86420
vlan2ports=0 5u
1:sb20in80and160hr5glpo=0
1:femctrl=3
0:mcsbw402gpo=0x88653320
0:epagain2g=0
ATEMODE=0
1:sb20in40lrpo=0
1:sb20in80and160hr5ghpo=0
gpio7=wps_button
gpio9=usbport1
1:rxgains5gmtrelnabypa0=1
1:rxgains5gmtrelnabypa1=1
1:rxgains5gmtrelnabypa2=1
0:mcsbw202gpo=0x88653320
1:mcsbw405glpo=0xECA86420
sromrev=8
boardtype=0x0646
1:sb40and80hr5gmpo=0
1:mcslr5glpo=0
1:mcsbw1605glpo=0
1:dot11agduplrpo=0
1:ccode=EU
1:macaddr=60:45:CB:5A:04:9C
1:rxgains5ghtrelnabypa0=1
lan_netmask=255.255.255.0
1:rxgains5ghtrelnabypa1=1
1:mcsbw405ghpo=0xECA86420
1:rxgains5ghtrelnabypa2=1
1:rpcal5gb0=0X6E43
1:rpcal5gb1=0X7C44
1:rpcal5gb2=0X7C3E
1:rpcal5gb3=0XFFFF
1:mcslr5ghpo=0
1:mcsbw1605ghpo=0
0:rxchain=7
0:cckbw20ul2gpo=0
1:devid=0x43A2
vlan2hwname=et0
odmpid=RT-AC68U_WHITE
1:sb40and80lr5glpo=0
0:sar2g=18
0:sb20in40lrpo=0
1:ledbh10=7
xtalfreq=25000
model=RT-AC68U
nvram_space=65536
0:gainctrlsph=0
boardflags2=0x00000000
1:sb40and80lr5ghpo=0
1:maxp5ga0=106,106,106,106
1:maxp5ga1=106,106,106,106
0:regrev=13
1:maxp5ga2=106,106,106,106
wait_time=1
1:sar5g=15
1:gainctrlsph=0
0:rxgains2gelnagaina0=6
0:pdgain2g=4
0:rxgains2gelnagaina1=6
0:rxgains2gelnagaina2=6
0:sromrev=11
secret_code=12588695
1:aga0=0
0:cckbw202gpo=0
1:subband5gver=4
1:aga1=0
1:aga2=0
1:sb40and80hr5glpo=0
1:sb20in40hrpo=0
0:rxgains2gtrelnabypa0=1
1:mcsbw205gmpo=0xECA86420
0:rxgains2gtrelnabypa1=1
0:ccode=EU
0:rpcal2g=0XED06
0:rxgains2gtrelnabypa2=1
1:sb40and80hr5ghpo=0
1:rxchain=7
0:dot11agduplrpo=0
1:dot11agduphrpo=0
1:papdcap5g=0
1:regrev=13
1:rxgains5gtrelnabypa0=1
0:ofdmlrbw202gpo=0
1:rxgains5gtrelnabypa1=1
1:rxgains5gtrelnabypa2=1
0:devid=0x43A1
lan_ipaddr=192.168.1.1
clkfreq=1000,666
vlan1hwname=et0
0:dot11agofdmhrbw202gpo=0x6533
0:maxp2ga0=106
0:maxp2ga1=106
sdram_config=0x0149
1:pdoffset80ma0=0x3343
0:maxp2ga2=106
1:pdoffset80ma1=0x3343
vlan1ports=1 2 3 4 5*
1:pdoffset80ma2=0x3343
cpurev=c0
0:boardflags=0x00001000
ctf_fa_cap=0
0:sb20in40hrpo=0
1:rxgains5gmtrisoa0=7
1:rxgains5gmtrisoa1=7
boardflags=0x00000110
sdram_refresh=0x0000
1:rxgains5gmtrisoa2=7
0:antswitch=0
wandevs=et0
1:rxgains5gelnagaina0=2
1:rxgains5gelnagaina1=2
0:txchain=7
sdram_ncdl=0x00000000
1:rxgains5gelnagaina2=2
1:sromrev=11
1:sb20in80and160lr5gmpo=0
0:boardflags2=0x00100002
0:boardflags3=0x00000003
1:pdoffset40ma0=0x7777
1:mcsbw205glpo=0xECA86420
1:pdoffset40ma1=0x7777
1:pdoffset40ma2=0x7777
territory_code=EU/01
et0phyaddr=30
bl_version=1.3.0.7
1:venid=0x14E4
0:agbg0=0
1:mcsbw805gmpo=0xECA86420
0:agbg1=0
1:pdgain5g=4
0:agbg2=0
1:boardflags2=0x00300002
1:mcsbw205ghpo=0xECA86420
1:boardflags3=0x0
0:papdcap2g=0
landevs=vlan1 wl0 wl1
1:rxgains5ghtrisoa0=8
1:rxgains5gtrisoa0=7
1:rxgains5ghtrisoa1=7
1:rxgains5gtrisoa1=9
1:rxgains5ghtrisoa2=8
1:rxgains5gtrisoa2=8
0:tworangetssi2g=0
0:dot11agduphrpo=0
1:sb20in80and160hr5gmpo=0
0:femctrl=3
sdram_init=0x0000
1:epagain5g=0
PA=5636
HW_ver=1.95
1:rxgains5gmelnagaina0=2
1:tworangetssi5g=0
1:rxgains5gmelnagaina1=2
1:rxgains5gmelnagaina2=2
0:xtalfreq=40000
1:aa5g=7
1:xtalfreq=40000
1:mcsbw405gmpo=0xECA86420
1:pa5ga0=0XFFB2,0X215D,0XFB51,0XFFBE,0X21E6,0XFB30,0XFFD0,0X22FA,0XFB1F,0XFFD7,0X2236,0XFB32
1:pa5ga1=0xffd0,0x23c2,0xfb32,0xffcb,0x2345,0xfb36,0xffe7,0x23a8,0xfb30,0xffe5,0x2228,0xfb4f
1:txchain=7
1:mcslr5gmpo=0
1:mcsbw1605gmpo=0
1:pa5ga2=0XFFCF,0X2483,0XFB24,0XFFD2,0X2386,0XFB1A,0XFFF9,0X2429,0XFB22,0XFFDD,0X21F1,0XFB3B
boardnum=00
0:tssiposslope2g=1
0:macaddr=60:45:CB:5A:04:98
bootflags=1
1:sb20in80and160lr5glpo=0
size: 4048 bytes (61488 left)
*** command status = 0

 

[Ronald Schwerer]

Maybe nothing, but since you stated that this was an RT-AC68U, I thought it odd that NVRAM has:
odmpid=RT-AC68U_WHITE
and
clkfreq=1000,666

If it is indeed an RT-AC68W, the odmpid should be RT-AC68W. IIRC, this name/value string gets searched for during firmware installation. Maybe it can't figure this out and gives-up?

The reason I mention clkfreq=1000,666 is I've never seen this combo. Normal 1GHz RAM clock is 800MHz. Probably not an issue. But these two discrepancies make me wonder if you've flashed a different CFE.

Both of the above are loaded into NVRAM from the CFE when NVRAM gets initialized (after a factory reset or NVRAM erase)

 

[ColinTaylor]

Do you think mvram is now correct in my case?

Your nvram looks normal now. I suggest you try using the normal recovery/restore process again.

 

[TheCoder]

I have indeed white version. I am sorry to not state it accordingly.

I have never flashed CFE (at least willingly). Anyway I believe it's possibly only using serial connection. I am doing serial connection for the first time and only did nvram erase and commit.

Unfortunately still I am getting bootloop when flashing software using CFE Web Browser/Asus Firmware Restoration tool. I will be trying to flash different softs now... Here's the log of the bootloop. When I try to nvram show, the log seems to be so long and thus incomplete at the top of the file.

Here's my booting log: https://pastebin.com/Fy4dH2CM
Here's current NVRAM log: https://pastebin.com/xcEfFXtu

 

[Tvlz]

You have two problems, the first caused the second.

#1
You flashed the wrong FreshTomato firmware for your RT-AC68U rev. E1 router.
The one you flashed does not support the chipset rev of the C1/E1 models.
You need to flash a Freshtomato ARM-NG firmware they have C1/E1 in the name.

#2
Not being able to flash back to stock or Merlin is because currently Freshtomato supports and sets a max firmware size partition of 32MB and all the stock and Merlin firmware requires more than 32MB, so there is not enough room to flash back.
The only fix is to get the Freshtomato devs to increase the partition size from 32MB to 64MB for the Asus routers.

 

[Grisu]

or search for very old small Merlin firmware.

 

[TheCoder]

I have tried soo many softs now including small FreshTomatos, Merlins, ddwrts (less than 32 mb), etc. none of the work. Most of them are bootlooping.

The problem is than when I am flashing with serial and tftp using command: flash -noheader : flash1.trx
I am getting this error when flashing reaches approximately 15th megabyte:

CFE> flash -noheader : flash1.trx
Reading ::
TFTP Server.
..tftp retry wait 0
break!! reach max retry!!
Failed.: I/O error
*** command status = -4

When I am flashing something smaller, the flashing process goes well. Unfortunately, FreshTomato VPN NG is bootlooping (flash successfull, 12mb sooft). The only soft that works is OpenWRT (6mb soft). Everything works well on OpenWRT except wifi (but I think it's commont for Asus routers).

By the way, here are my partitions:

CFE> show devices
Device Name          Description
-------------------  ---------------------------------------------------------
uart0                NS16550 UART at 0x18000300
uart1                NS16550 UART at 0x18000400
nflash0              AMD NAND flash size 131072KB
nflash0.boot         AMD NAND flash offset 0 size 512KB
nflash0.nvram        AMD NAND flash offset 80000 size 1536KB
nflash0.trx          AMD NAND flash offset 200000 size 1KB
nflash0.os           AMD NAND flash offset 20001C size 129024KB
nflash1.boot         AMD NAND flash offset 0 size 512KB
nflash1.nvram        AMD NAND flash offset 80000 size 1536KB
nflash1.trx          AMD NAND flash offset 200000 size 63488KB
nflash1.brcmnand     AMD NAND flash offset 4000000 size 65536KB
eth0                 Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller
*** command status = 0

Do you have any idea how can I sucessfully flash other firmware?

 

[Pierino]

Stop the cfe, then type: nvram erase then enter. Don’t do nvram commit.
After doing the nvram erase you should have a continuous ping of ttl=100
Then type: flash -noheader : nflash1.trx. Note it’s nflash.
Then I use tftpd32/64 by jourin to upload the firmware. After it uploads, wait till the cfe prompt says it is done, then type: go.

 

[TheCoder]

I have followed exactly your procedure but the router is stuck on bootloop or stuck on boot (depending on soft). I couldn't type "go" because after flashing the router is not responding.

CFE> flash -noheader : nflash1.trx
Reading ::
TFTP Server.
..tftp retry wait 0
- last blk -
Done. 28585984 bytes read
Download of 0x1b43000 bytes completed
Write kernel and filesystem binary to FLASH
Programming...copysize=28585984, amtcopy=28585984
done. 28585984 bytes written

Do you have ideas how to flash firmware on different offset of the memory? As I said, tftp2.exe is always crashing when flashing reaches approximately 15th megabyte. Other flashing methods report succesfull flash but maybe tftp2 is right on diagnosing the problem?

 

[Joshuajackson]

I have cleared the NVRAM in web GUI and then tried to move from AsuswrtMerlin to FreshTomato using Asus Router Firmware Restoration Utility (couldn't do that in GUI because of the Asus restriction on flashing unofficial software...). Unfortunately, after a long wait, the router wasn't detected in DHCP settings.

Router: RT-AC68U rev. E1
Previous software: AsuswrtMerlin RT-AC68U_384.14_2.zip
Update that crashed the router: fresh tomato-RT-AC68U-ARM-2020.1-AIO-64K

Current State (what doesn't work):
- The router in DHCP mode doesn't work and doesn't respond to ping. Windows 10 assigns strange IP: 169.254.232.243 (no, the router doesn't respond on 169.254.232.1)
- wifi led is not lit. I am connecting via ethernet but it worked before
- clearing NVRAM seems not to work. When I do it via CFE mini web Server, the site timeouts. When I do it with WPS on boot it doesn't help (LEDs blink indicating the router should clear NVRAM)

What works:
In recovery mode, I can access router with Asus Restoration Tool and open CFE mini web server. Unfortunately flashing using these methods doesn't help.

Problem indication:
Asus Restoration Tool successfully passes the firmware to the router (first step) but stops the procedure at 1% or 2% in step of "System recovery is in progress". After reaching 2% of "recovery step", flashing stops and says that flashing was successful and a reboot is in progress. Of course, the router still doesn't launch soft.

What I have tried:
VooDoo and 30/30/30 reset
WPS button on launch reset
Waiting with power off and power on (2 nights and other breaks)
Flashing FreshTomato
Flashing Tomato VPN (10 Mb version)
Flashing Merlin RT-AC68U_378.55_0 (29 Mb)
Flashing latest DDWRT
Flashing Official Firmware:
- RT-AC68U_3.0.0.4_385_10000 (newest found on Asus site)
- RT-AC68U_3.0.0.4_384_32738-gc9a116a (oldest found on Asus site)

Do you have any tips on what I could do? Have I bricked the unbrickable device?

Boot router in recovery, and assign yourself the IP in windows such as
IP address: 192.168.1.2
Subnet mask: 255.255.255.0
Gateway: 192.168.1.1

That should do the trick and restoration tool should work too then.

 

[TheCoder]

Stop the cfe, then type: nvram erase then enter. Don’t do nvram commit.
After doing the nvram erase you should have a continuous ping of ttl=100
Then type: flash -noheader : nflash1.trx. Note it’s nflash.
Then I use tftpd32/64 by jourin to upload the firmware. After it uploads, wait till the cfe prompt says it is done, then type: go.

I have done at least 60 reflashes with at least 10 different softwares with at lest 3 methods. I can't epxplain why but I tried few flashes with your method. After one day I tried to boot the router for the last time. Now it works like a charm!!!! Unbelievable! I have tried different block sizes in tftpd32/64 by jourin, maybe it did the trick.

Thank you all for the commitment in the thread. Hopefully it's solved Now I can install any software without problem

 

[gorkemulusoy]

Hello, I have bricked tenda ac18. I entered the console of router via putty. I can erase nvram but i couldn't do any thing after that. Can somebody please help me, what should I do next? Thank you

 

[BlueBlood]

Hello, I have bricked tenda ac18. I entered the console of router via putty. I can erase nvram but i couldn't do any thing after that. Can somebody please help me, what should I do next? Thank you

Hello, did you succeed in fixing your router?