[TM-AC1900 (RT-AC68U)] - Bricked while flashing from Tomato to Merlin

[slidermike]

Nice write up on the recovery tools as well as process. Pics are a big bonus.
+1

 

[Hien]

Hello, the serial cable just got in and I got the router opened up. plug in the pins ground, tx from cable to routers rx, rx from cable to router tx. installed the cable driver. my problem right now is that I can get putty to work. putty opens up fine but the screen stay black and I can't type anything. tried control c but no response.

here is what the router is showing...
power light in front is very dim.
usb2 light is on bright.

all this happened when I tried to flash the cfe and forgot to do the secret code.

thanks

 

[Pierino]

You can't fix a hosed cfe with a serial cable. Unless you know how and can reprogram the flash chip, but a new router.

 

[Hien]

You can't fix a hosed cfe with a serial cable. Unless you know how and can reprogram the flash chip, but a new router.

thanks for the info. so I am pretty much out of luck with this router?

 

[Roy2001]

thanks for the info. so I am pretty much out of luck with this router?

As he said, yes, unless you can rip the flash chip out and reprogram it.

 

[Song]

I have the exact same symptoms. It happend while I was resetting the router as I could not access the admin page. Maybe it's because I configured it so that only my smartphone's IP could access the admin page from outside of LAN, but I couldn't access it even in LAN and unfortunately the smartphone's IP got changed. No ARP response came from the router so I tried to statically update ARP table with 192.168.1.1 and MAC, which hopelessly failed. Then with the last hope I tried to find how to connect to UART and at last I found this.
I wish I could try this right now but I think it'll take quite a while. Thank you so much. I really hope it works.

 

[Song]

It took about 5 hrs disassemblying the router. I was able to get cfe console, and then nvram erase got my router going again. Thank you!!

 

[Sablaky]

I have recovered my router following the steps successfully. I had to use Tera Term (with Windows 10, putty did not work). I cleared the NVRAM and the Advanced Tomato is working. I have tried to flash Merlin but I could not. I have tried Restoration tool and CFE. Now I have configured the Tomato properly I think I will stick to Tomato. I am not planning to spend more time on the router. Thank you @that1geek for the detailed write up and response.

 

[thatguynow]

@that1geek - Just wanted to thank you a lot for this write up. I had to crack mine open after getting stuck with that constant flashing and with your pics I was able to to just punch a hole where the screws were to keep the backing mostly looking good.

I did wind up buying the USB to serial cable as trying to get an exact fit over loose cables wasn't easy. For the extraction of the cover though I used a putty knife to apply good pressure and that worked perfectly. Actually didn't loose any tabs.

That being said once I cracked everything open and got the com interface up I couldn't press Ctrl+C or find any way to get to the CFE screen. Every time it booted it kept getting stuck at a message that was something like: "Waiting for the WPS button to be released". I tried pushing the button and tried to lift it. The button itself clicked just fine but for some reason the unit kept thinking the button was being held down.

I was disappointed that I had come this far to have to trash it but then decided that it was worth taking the switch off and seeing what happens. I took a pair of needle noose pliers to the WPS button and carefully removed it from the board (while the unit was off obviously) and when I went to boot the unit back up it booted up perfectly and I was able to go in and start configuring. Thanks for all of your help! I'm excited that with that simple removal the unit is useful again.

 

[Marc Aronson]

@that1geek -- thank you so much for the details post -- I had the exact same symptoms you described and this un-bricked my router on the first attempt. Fantastic instructions and great photos!

For the record, I lost 2 tabs .

Marc

 

[fdm]

Managed to take off the faceplate without breaking tabs. Stick your pry tool in the seam, feel around for the tabs, and pull back on the pry tool towards the faceplate to pop them off. Start at the top center tab, use two or more pry tools(preferably metal) if you can.

Thanks for the guide BTW, only one I've found on the internet. Want to mount dual 60mm fans on the back for active cooling.

 

[Jim English]

Thanks for this information. I have a TM-AC1900 loaded the merlin firmware on it. After two weeks, it bricked with the USB 2.0 light only on. I ordered and got one of those USB Serial cables. I tried it with no luck. The terminal window in Putty or TeraTerm just sit there and display nothing. Note, that I DID plug the VCC to the board at first and tried it, then upon reading further saw that it should not be hooked up.
Is it possible this simple mistake destroyed the router?

Any help is appreciated.
Thanks!
Jim

 

[that1geek]

Seems Photobucket finally got to my account and broke the images I had posted in this guide. I'm working to fix this.

 

[that1geek]

Thanks for this information. I have a TM-AC1900 loaded the merlin firmware on it. After two weeks, it bricked with the USB 2.0 light only on. I ordered and got one of those USB Serial cables. I tried it with no luck. The terminal window in Putty or TeraTerm just sit there and display nothing. Note, that I DID plug the VCC to the board at first and tried it, then upon reading further saw that it should not be hooked up.
Is it possible this simple mistake destroyed the router?

Any help is appreciated.
Thanks!
Jim

I missed this question, sorry. The symptoms you describe are different than I had and I don't recognize them off-hand. In my case, only the power light was slowly flashing. I don't know what it means if only the USB light is on. I also don't know the exact reason why the red VCC cable shouldn't be connected - my guess would be that the board has a separate power connection via the AC adapter and the additional power provided by the red cable is either unnecessary or, perhaps, bad.

Also, photos are fixed. I can't tell you how gratifying it was to click "Delete this account" in Photobucket.

 

[JDub]

Hey man thanks for this guide. I had similar symptoms and bought the same cable as you but putty just makes a "ding" every time I hit the "open" button.

Yes I'm using the correct COM port for my computer etc. I guess that means putty doesnt detect a data stream?

 

[scaramonga]

Nice guide indeed

You can get one of these routers at the amazingly cheap price of $55 now: https://www.tanga.com/deals/6db2c7c...less-ac1900-dual-band-gigabit-router-open-box

 

[that1geek]

Hey man thanks for this guide. I had similar symptoms and bought the same cable as you but putty just makes a "ding" every time I hit the "open" button.

Yes I'm using the correct COM port for my computer etc. I guess that means putty doesnt detect a data stream?

Someone reported having the issues you describe with PuTTY on Windows 10 64-bit. They reported success with "Tera Term", though I've not used that program before.

 

[Bees23]

Thanks for this information.

I have an issue after all processes when I communicate with router, Putty doesn't show "CFE >", it shows something like "/ # " I can type nvram, it says back like "usage: nvram [get name] [set name=value] [unset name] [show] [commit] [save] [restore] [erase][fb_save file] ... "

It doesn't understand command "flash" as it says " bin sh no found" . Some information is below. Can you or anyone tell me what I should do next.????

Hit ENTER for console...

firmware version: 3.0.0.4.380_1842-g7414eb9
[1 preinit:init_nvram +17] init_nvram for model(40)
config_tcode(0x0013): tcode is []
config_tcode(0x0015): [tcode] no territory_code setting, using default region
num_of_mssid_support(0x0098): [mssid] support [3] mssid
cfe_commit: do nothing

FA off.
ctf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
et_module_init: passivemode set to 0x0
et_module_init: txworkq set to 0x1
et_module_init: et_txq_thresh set to 0xce4
eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.14.126 (r561982)
hotplug net INTERFACE=eth0 ACTION=add
set_wltxpower(0x0239): unit: 0, txpower: 100
set_wltxpower(0x0239): unit: 1, txpower: 100
^C^C^C^Ccwl_module_init: passivemode set to 0x0
wl_module_init: igs set to 0x0
wl_module_init: txworkq set to 0x1
wl driver 6.37.14.126 (r561982) failed with code 1
Unable to handle kernel paging request at virtual address d0ea4000
pgd = cec50000
[d0ea4000] *pgd=9ec48011, *pte=00000000, *ppte=00000000
Internal error: Oops: 7 [#1] PREEMPT SMP
last sysfs file: /sys/class/nvram/nvram/dev
module: wl bf031000 4169747
module: igs bf029000 11887
module: emf bf020000 15145
module: et bf00a000 61421
module: ctf bf000000 20243
Modules linked in: wl(P+) igs(P) emf(P) et(P) ctf(P)
CPU: 1 Tainted: P (2.6.36.4brcmarm #1)
PC is at get_erom_ent+0x20/0x5c
LR is at get_erom_ent+0x1c/0x5c
pc : [<c01c1bf4>] lr : [<c01c1bf0>] psr: 60000013
sp : cfb71a20 ip : 00200081 fp : 00000001
r10: cfb71a78 r9 : 00004360 r8 : cfb71a7c
r7 : 00000000 r6 : 0000000e r5 : cfb71a84 r4 : cec58000
r3 : d0ea4000 r2 : 00000000 r1 : cfb71a84 r0 : cfa35720
Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 10c53c7d Table: 9ec5004a DAC: 00000015
Process modprobe (pid: 322, stack limit = 0xcfb70270)
Stack: (0xcfb71a20 to 0xcfb72000)

 

[that1geek]

Thanks for this information.

I have an issue after all processes when I communicate with router, Putty doesn't show "CFE >", it shows something like "/ # " I can type nvram, it says back like "usage: nvram [get name] [set name=value] [unset name] [show] [commit] [save] [restore] [erase][fb_save file] ... "

It doesn't understand command "flash" as it says " bin sh no found" . Some information is below. Can you or anyone tell me what I should do next.????

Hit ENTER for console...

firmware version: 3.0.0.4.380_1842-g7414eb9
[1 preinit:init_nvram +17] init_nvram for model(40)
config_tcode(0x0013): tcode is []
config_tcode(0x0015): [tcode] no territory_code setting, using default region
num_of_mssid_support(0x0098): [mssid] support [3] mssid
cfe_commit: do nothing

FA off.
ctf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
et_module_init: passivemode set to 0x0
et_module_init: txworkq set to 0x1
et_module_init: et_txq_thresh set to 0xce4
eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.14.126 (r561982)
hotplug net INTERFACE=eth0 ACTION=add
set_wltxpower(0x0239): unit: 0, txpower: 100
set_wltxpower(0x0239): unit: 1, txpower: 100
^C^C^C^Ccwl_module_init: passivemode set to 0x0
wl_module_init: igs set to 0x0
wl_module_init: txworkq set to 0x1
wl driver 6.37.14.126 (r561982) failed with code 1
Unable to handle kernel paging request at virtual address d0ea4000
pgd = cec50000
[d0ea4000] *pgd=9ec48011, *pte=00000000, *ppte=00000000
Internal error: Oops: 7 [#1] PREEMPT SMP
last sysfs file: /sys/class/nvram/nvram/dev
module: wl bf031000 4169747
module: igs bf029000 11887
module: emf bf020000 15145
module: et bf00a000 61421
module: ctf bf000000 20243
Modules linked in: wl(P+) igs(P) emf(P) et(P) ctf(P)
CPU: 1 Tainted: P (2.6.36.4brcmarm #1)
PC is at get_erom_ent+0x20/0x5c
LR is at get_erom_ent+0x1c/0x5c
pc : [<c01c1bf4>] lr : [<c01c1bf0>] psr: 60000013
sp : cfb71a20 ip : 00200081 fp : 00000001
r10: cfb71a78 r9 : 00004360 r8 : cfb71a7c
r7 : 00000000 r6 : 0000000e r5 : cfb71a84 r4 : cec58000
r3 : d0ea4000 r2 : 00000000 r1 : cfb71a84 r0 : cfa35720
Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 10c53c7d Table: 9ec5004a DAC: 00000015
Process modprobe (pid: 322, stack limit = 0xcfb70270)
Stack: (0xcfb71a20 to 0xcfb72000)

Sorry, I don't check this thread as often anymore. If you don't see the CFE> prompt, you may have missed the timing - you have to mash CTRL+C during the very early boot sequence to get the prompt.
Perhaps for further assistance, you should elaborate on what symptoms you're having - if they're different than my OP, you may have better luck starting a separate thread or looking for a thread that matches your symptoms or what you're trying to accomplish.

 

[Devang Patel]

Sorry, I don't check this thread as often anymore. If you don't see the CFE> prompt, you may have missed the timing - you have to mash CTRL+C during the very early boot sequence to get the prompt.
Perhaps for further assistance, you should elaborate on what symptoms you're having - if they're different than my OP, you may have better luck starting a separate thread or looking for a thread that matches your symptoms or what you're trying to accomplish.

Job well done! I currently have the TM AC1900 running the latest firmware 3.0.0.4.376_3181-g247286a. I am having problems downgrading the firmware to 1703. I thought your putty method might work (by using the CFE prompt). I cannot get the break sequence to work. So I tried to use the CFE mine webpage. I got sent to 192.168.29.1/f2.html (The site can't be reached).

When I upload the 1703 via the CFE mini Putty shows this error:

Null Rescue Flag.
Startup canceled
CFE> tcb->tcb_rcvnext=e017b0dc seqnum=e017b2f4
tcb->tcb_rcvnext=e017b0dc seqnum=e017b32c
tcb->tcb_rcvnext=e017b2f4 seqnum=e017b0dc​

After all this router is still responding to pings (with a TTL of 100 which I think means rescue mode). I have spent several hours on this. Any guidance would be appreciated!