Nat Taylor — Blog, AI, Product Management & Tinkering

Below is a summary of how I flashed a TM-AC1900 to a RT-AC68U, which is based on the instructions at https://www.bayareatechpros.com/ac1900-to-ac68u/

I started on firmware version 3.0.0.4.376_3108

You will need the router, a computer, a flash drive and an ethernet cable.

I thought it was useful to know:

• CFE is the bootloader for Broadcom (Common Firmware Environment)
• Firmware is the router software
• mtd-write is a utility for writing to flash memory (Memory Technology Device)
• T-Mobile has locked the firmware to T-Mobile signed firmwares, has disabled telnet in recent firmwares and has disabled downgrading, which is why all of this is necessary.

Instructions

1. Setup Computer Download TM-AC1900toRT-AC68U .7z (currently available here) and extract to a USB drive. Install telnet if you don’t have it (brew install telnet). Connect to the router over ethernet and Configure IPv4 to manual with (IP: 192.168.29.5, Subnet: 255.255.255.0, Gateway: 192.168.29.1). Turn off WiFi
2. Start the router in “Rescue Mode”: 1) power of the router 2) hold down all three of the Reset, WPS, and Wifi On/Off buttons down 3) power on the router and wait till the power LED on the front starts blinking rapidly 4) release the WPS and Wifi On/Off buttons but continue holding the Reset button down, the Power LED should now start blinking slowly and you will be in Rescue mode.
3. Downgrade to Firmware 1703 by going to 192.168.29.1 and flashing the file you downloaded TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx and wait for reboot
4. Enable telnet Login into the router in your browser at http://192.168.29.1 (admin:password), go to Administration > System > Enable telnet > Yes > Apply
5. Copy the original cfe Insert the flash drive into the router, login via telnet (telnet -l admin 192.168.1.1 password: password) and do cat /dev/mtd0 > /tmp/mnt/sda1/original_cfe.bin then remove the flash drive
6. Modify the original cfe Insert the flash drive into the computer, go to https://cfeditor.pipeline.sh/, upload original_cfe.bin select “Select 1.0.2.0 US AiMesh” then download to the flash drive
7. Install the modified CFE and Firmware Insert the flash drive into the router: then
   1. login via telnet
   2. cd /tmp/mnt/sda1/
   3. chmod u+x mtd-write
   4. ./mtd-write new_cfe.bin boot
   5. mtd-write2 FW_RT_AC68U_30043763626.trx linux
   6. Perform NVRAM Reset, wait for reboot <5 mins:
      1. Power off router
      2. Wait 10 seconds
      3. Press and hold WPS button
      4. Power up the router and continue to hold WPS button for 15-20 seconds until power LED starts blinking very quickly.
8. Restore Computer Configuration Reset PC IP back to default and turn on WiFi

You now have an AC68u!