Updated How-To? TM-AC1900 (T-Mobile Cell Spot) to Merlin Firmware Guide?

[zgroten]

Just recently got the T-Mobile Asus Cell Spot Router - TM-AC1900 (Ac68u)

There are no current guides that clearly show how to install Merlin Firmware from the current T-Mobile firmware. I will make an updated YouTube video on How-To after I find the cleanest and most correct method.

Out of the box TM-AC1900 with firmware "3.0.0.4.376_3108-g23b5852"

From what I understand:

Factory reset the router for default settings.
Put it into AP mode
Connect directly to my computer
Put into restore mode: Hold down reset while plugging in power cable
Set my computer's LAN IP to static: i.e: 192.168.1.2
Set Subnet Mask to: 255.255.255.0
Set Gateway to: 192.168.1.1
Launch Asus Firmware Rescue tool
Select Merlin's ASUSWRT Firmware: In this case build 378.55
Flash and wait...

Done?

No USB stick, etc, required?

Thanks in advance!

 

[john9527]

Much more involved than that. Latest guide from @Engineer here....

http://slickdeals.net/forums/showpost.php?p=73690012&postcount=3895

 

[zgroten]

Much more involved than that. Latest guide from @Engineer here....

http://slickdeals.net/forums/showpost.php?p=73690012&postcount=3895

Yes but JoeGreat stated that "Merlin has integrated the CFE update into his actual firmware"

So this means that downgrading the firmware in unnecessary.

Edit: That guide was meant for ANY CFE to be installed. So it covers more steps that are not needed to go directly to Merlin.

 

[john9527]

Yes but JoeGreat stated that "Merlin has integrated the CFE update into his actual firmware"

So this means that downgrading the firmware in unnecessary.

Edit: That guide was meant for ANY CFE to be installed. So it covers more steps that are not needed to go directly to Merlin.

The CFE update in the firmware will only update within the 'family' of CFE that's currently on the router. That is, if you have a TM-1900 CFE it will update to a later TM-1900 CFE......an AC68 CFE will update to a later AC68 CFE. If you are going to do the conversion from a TM-1900 to an AC68, you have change 'families' manually. (T-Mobile really doesn't want you to do this )

EDIT: Note that the last edit date on the link I gave you was 11-27-2015. Still applicable....

 

[zgroten]

I'm getting conflicting information from this thread:

http://www.snbforums.com/threads/asus-tm-ac1900-question.27912/#post-222017

and this YouTube guide:

T-Mobile Router (Asus RT68U AC1900) Changing Firmware

 

[Engineer]

Yes but JoeGreat stated that "Merlin has integrated the CFE update into his actual firmware"

So this means that downgrading the firmware in unnecessary.

Edit: That guide was meant for ANY CFE to be installed. So it covers more steps that are not needed to go directly to Merlin.

If you are on the latest TMobile firmware/CFE, you will not be able to install anything other than a TMobile firmware. You can try but you'll discover that the firmware flash will result in failure. Even if you do downgrade to 1703 (TMobile) and try to go directly to Merlin or Asus with built in CFE updates, they will update your TMobile CFE to a newer (if available) TMobile CFE and not an Asus CFE. This will further lock you from alternative firmware. I've been with this thing for nearly 1.25 years and haven't seen shortcuts around what is currently being done. If anything, it's harder now to update with the new 2.1.2.5/2.1.2.6 CFE than it was before as TMobile/Asus has changed restoration mode to make it more difficult to run (or even detect).

Video has become outdated as TMobile / Asus have changed CFE/firmware to block features and flashing. I've kept my guide closer up to date to cover current CFE flashing. The thread at SD is also about the best source of information on this router, even if a little long.

 

[ASAT]

I think it is possible to re-flash the CFE with JTAG of the RT-AC68U. Or, it is possible to use pogo pins with point tips to reprogram the flash directly without desoldering it from the board.

 

[Engineer]

I think it is possible to re-flash the CFE with JTAG of the RT-AC68U. Or, it is possible to use pogo pins with point tips to reprogram the flash directly without desoldering it from the board.

That may be possible but why would you want to (unless you already have a JTAG unit to flash with)? I guess if the unit was bricked from the CFE flashing, that would be an option (assuming there is a JTAG unit that can flash the CFE on this unit).

 

[cuekay]

If you are on the latest TMobile firmware/CFE, you will not be able to install anything other than a TMobile firmware. You can try but you'll discover that the firmware flash will result in failure. Even if you do downgrade to 1703 (TMobile) and try to go directly to Merlin or Asus with built in CFE updates, they will update your TMobile CFE to a newer (if available) TMobile CFE and not an Asus CFE. This will further lock you from alternative firmware. I've been with this thing for nearly 1.25 years and haven't seen shortcuts around what is currently being done. If anything, it's harder now to update with the new 2.1.2.5/2.1.2.6 CFE than it was before as TMobile/Asus has changed restoration mode to make it more difficult to run (or even detect).

Video has become outdated as TMobile / Asus have changed CFE/firmware to block features and flashing. I've kept my guide closer up to date to cover current CFE flashing. The thread at SD is also about the best source of information on this router, even if a little long.

I'm currently on firmware v. 380.58 and CFE 2.1.2.6. I got this router two years ago and flashed Merlin right upon receipt, and it's my understanding that I had an older version of CFE at that time. So when I was having issues with flashing the latest Merlin, I discovered that it was having issues flashing directly from the Merlin setup page. No problem, I thought. I tried booting into CFE and tried it there. But I couldn't flash it there either. I then tried to flash an older version as well as John's fork. No luck. This prompted me to check my CFE version on a lark and led me to the discovery that it's currently on 2.1.2.6. My question is, am I out of luck with any future flashing as this is the only thread I found regarding CFE 2.1.2.6 on a cell spot? I'm more than fine with the firmware as is but when I get the itch to upgrade for a security patch or some feature, I'm wondering if this is the end of the road for me.

 

[Engineer]

I'm currently on firmware v. 380.58 and CFE 2.1.2.6. I got this router two years ago and flashed Merlin right upon receipt, and it's my understanding that I had an older version of CFE at that time. So when I was having issues with flashing the latest Merlin, I discovered that it was having issues flashing directly from the Merlin setup page. No problem, I thought. I tried booting into CFE and tried it there. But I couldn't flash it there either. I then tried to flash an older version as well as John's fork. No luck. This prompted me to check my CFE version on a lark and led me to the discovery that it's currently on 2.1.2.6. My question is, am I out of luck with any future flashing as this is the only thread I found regarding CFE 2.1.2.6 on a cell spot? I'm more than fine with the firmware as is but when I get the itch to upgrade for a security patch or some feature, I'm wondering if this is the end of the road for me.

No, you're not stuck but you'll have to change your CFE from TMobile 2.1.2.6 to Asus 1.0.2.0 (or 1.0.2.1). If you have Telnet ability, you won't have to do anything except follow the guide to slide into an Asus CFE. If you don't have Telnet, you'll have to downgrade to an older TMobile firmware (.1703 for example) to do it. The 2.1.2.6 CFE currently has you locked to loading only TMobile firmware. That's why you can't change to other firmware than TMobile right now.

 

[cuekay]

No, you're not stuck but you'll have to change your CFE from TMobile 2.1.2.6 to Asus 1.0.2.0 (or 1.0.2.1). If you have Telnet ability, you won't have to do anything except follow the guide to slide into an Asus CFE. If you don't have Telnet, you'll have to downgrade to an older TMobile firmware (.1703 for example) to do it. The 2.1.2.6 CFE currently has you locked to loading only TMobile firmware. That's why you can't change to other firmware than TMobile right now.

Thanks for your response and for the thorough guide above on how to do it. From what I've read, it sounds like most of the risk in the modding process falls on downgrading the CFE from T-Mobile's to Asus's. The part that I'm mostly squeamish about is the use of a hex editor and how there's no risk in actually bricking the router EXCEPT when playing with the CFE. I'm hoping I misread it and my particular use case falls outside the general scenario this guide describes because I did manage to upgrade the firmware to Merlin and between the number of times that I had flashed Merlin, Tomato and DD-WRT without letting T-Mobile forcing their upgrade prior to my flashing.

Thanks again!

 

[howarddavidp@gmail.com]

I am curious if I bricked my Router, and what do I need if I have to go the JTAG route?

I purchased cheap a TMOBILE AC68U, and I wanted to get rid of the TMOBILE firmware and go with DD-WRT for my home mesh network.

I tried the HOLD RESET and power on, but I could never get the device to go into "recovery mode" so I could send the firmweare file with the ASUS "Firmware Restoration" utility. I downloaded this from ASUS for the N66, but posts saw it is the same version. I did find on another site the Resto utility for the AC68U, and the EXE files were the same, just different filenames.

So, I have the resto utility, and I have the DDWRT BIN/TRX file, and I am struggling to get the device into the blinking power light mode. So I search around and I find the article that talks about replacing the CFE in this router. I tried to 30/30/30 reset, but that does not get rid of TMOBILE. So, I followed this article to the Tee:

GUIDE to CFE flashing 2.0:
https://slickdeals.net/forums/showpost.php?p=73690012&postcount=3895

I work in IT, so I am great with Linux and HEX editors, have used both many times. And I get the gish of this article, you dump the CFE code to a USB disk, the use the HEX editor to find the MAC addresses of the RADIO's and the network/WAN port, then you take the CFE you want (the OEM ASUS) and use their ARM architecture executable to flash the CFE you modified so the MAC addresses match. This all worked well, I dumped the stock T-Mobile CFE, edited the file and copied over the MAC's to the ASUS CFE, then went back to the router and used their ARM FLASH EXE to flash the new CFE file onto the router, and bye-bye T-MOBILE. I even did the GREP command to verify I got everything correct, which I did. I did it by hand, I did not use the scripted tool that is untested.

The flash worked, everything went as expected, but now I am worried I bricked the router.

I am able to get the router in Firmware Resto mode, so when I hold down RESET and PWR-ON, the blue power will slowly blink. However, the RESTO utility will not find the device after 30 secs and times out. I tried both the T-MOBILE 192.168.29.0/24 subnet, as well as the new one I hoped for, 192.168.1.0/24. Neither subnet is findable by the Firmware Resto utility

What are my option at this point? If I turn it on normally, it tried to boot for about 45 secs, then the device reboots and tried again. I can tell this from watching the lights, and watching what my cable and laptop does when it is trying to boot.

I can crack it open and connect a RS-232 port if needed, I am just not sure if that is my next step?

Thanks and sorry to NECRO.

David

 

[LegitPC]

I am curious if I bricked my Router, and what do I need if I have to go the JTAG route?
...
What are my option at this point? If I turn it on normally, it tried to boot for about 45 secs, then the device reboots and tried again. I can tell this from watching the lights, and watching what my cable and laptop does when it is trying to boot.

When you do the restore utility or try to load the Mini-CFE webpage you should have set a static IP for your PC. After setting a static IP you can interface with your router while it is in recovery mode.

 

[mobileman88]

I am curious if I bricked my Router, and what do I need if I have to go the JTAG route?

I purchased cheap a TMOBILE AC68U, and I wanted to get rid of the TMOBILE firmware and go with DD-WRT for my home mesh network.

I tried the HOLD RESET and power on, but I could never get the device to go into "recovery mode" so I could send the firmweare file with the ASUS "Firmware Restoration" utility. I downloaded this from ASUS for the N66, but posts saw it is the same version. I did find on another site the Resto utility for the AC68U, and the EXE files were the same, just different filenames.

So, I have the resto utility, and I have the DDWRT BIN/TRX file, and I am struggling to get the device into the blinking power light mode. So I search around and I find the article that talks about replacing the CFE in this router. I tried to 30/30/30 reset, but that does not get rid of TMOBILE. So, I followed this article to the Tee:

GUIDE to CFE flashing 2.0:
https://slickdeals.net/forums/showpost.php?p=73690012&postcount=3895

I work in IT, so I am great with Linux and HEX editors, have used both many times. And I get the gish of this article, you dump the CFE code to a USB disk, the use the HEX editor to find the MAC addresses of the RADIO's and the network/WAN port, then you take the CFE you want (the OEM ASUS) and use their ARM architecture executable to flash the CFE you modified so the MAC addresses match. This all worked well, I dumped the stock T-Mobile CFE, edited the file and copied over the MAC's to the ASUS CFE, then went back to the router and used their ARM FLASH EXE to flash the new CFE file onto the router, and bye-bye T-MOBILE. I even did the GREP command to verify I got everything correct, which I did. I did it by hand, I did not use the scripted tool that is untested.

The flash worked, everything went as expected, but now I am worried I bricked the router.

I am able to get the router in Firmware Resto mode, so when I hold down RESET and PWR-ON, the blue power will slowly blink. However, the RESTO utility will not find the device after 30 secs and times out. I tried both the T-MOBILE 192.168.29.0/24 subnet, as well as the new one I hoped for, 192.168.1.0/24. Neither subnet is findable by the Firmware Resto utility

What are my option at this point? If I turn it on normally, it tried to boot for about 45 secs, then the device reboots and tried again. I can tell this from watching the lights, and watching what my cable and laptop does when it is trying to boot.

I can crack it open and connect a RS-232 port if needed, I am just not sure if that is my next step?

Thanks and sorry to NECRO.

David

Without the telnet open, by enabling the SSH functionality, I am not sure if it's safe to use "ssh" terminal to flash the old CFE into the router or must I flash it with the telnet terminal? I am on the same 2.1.2.6 bootloader too. Any luck so far?

 

[XeoNoX]

wow, got router with the latest firmware with CFE 2.1.2.6 .
it was a little harder than the previous once, but finally got it to take the custom firmware and custom CFE.

Pretty much did the following:

downgraded to firmware to TM-AC1900_3.0.0.4_376_1703
reboot router
enabled telnet
downgraded CFE by flashing modified ASUS CFE (rt-ac68u_1.0.2.0_us) using mtdwrite v3
reboot router
(dont bother checking bootloader or anyting just flash tomato)
immediately flash tomoato firmware tomato-RT-AC68U-ARM--124-AIO-64K.trx
reset NVRAM and checked bootloader and it was my custom 1.0.2.0
from here i can flash whatever firmware i want or stay on tomato

reference: Just follow PROCESS1 PROCESS2 PROCESS3

https://slickdeals.net/f/7193262-t-mobile-personal-cellspot-ac-router-by-asus-free-for-postpaid-25-deposit

good luck

 

[aiguofer]

@howarddavidp@gmail.com were you able to sort it out?

I was able to downgrade the firmware to the first TM version, but I'm stuck after loading the Asus CFE. I tried 1.0.2.0 and 1.0.2.1 with a couple different mtd-write versions, but I could never get it to load the mini-CFE and the Recovery tool could never find the router (yes, I set a static IP, tried using both 192.168.1.* and 192.168.29.*). My last attempt, I followed some forum post I found saying I should first set it to AP mode then try to go into recovery mode. I did this after flashing 1.0.2.1 with mtd-write v3; now I think I may have bricked it..

It still seems like it responds to the button presses; if I turn it on holding reset and leave it pressed for like 30 seconds, the power button will start to blink. I can also do the WPS button nvram reset, and I can see the lights responding. But after doing either of these, I still cannot connect or talk to the router. Before that, every time I did the WPS nvram reset, it would go back into normal running mode and I could enable SSH or configure the router like normal.

I've also tried doing 30/30/30 reset and just leaving it unplugged for a while, but I can't get it back to normal working mode. Any thoughts?

Thanks!

 

[paredown]

Just wanted to thank Engineer and the anonymous coder who automated the process of grabbing the MAC and Secret and patching the new *.bin.

I had a T-Mobile/Asus TM-AC1900 fall into my lap, found this and various other threads and had at it. I was lucky--the modem was NIB, with older (v/. 3.0.0.4.376.1520) firmware, so I was able to enable Telnet on the router, download the CFE, use the files linked in Engineer's post on Slickdeals, run the automated version to update the Asus version of the CFE, upload the modified version, and run an update with the latest ASUS firmware (that does not have Facebook doodads).

A bit complicated, but all the details are there if you read carefully!

Been a while for me, although I used to do this stuff for a living, but the process was pretty painless because it did not involve trying to down version the CFE before proceeding.

So a big thanks to all who figured this shirt out--as a matter of principle, I don't like locked and/or crippled devices.

Dean