Flashing TM-AC1900 to RT-AC68U
Below is a summary of how I flashed a TM-AC1900 to a RT-AC68U, which is based on the instructions at https://www.bayareatechpros.com/ac1900-to-ac68u/
I started on firmware version 220.127.116.11.376_3108
You will need the router, a computer, a flash drive and an ethernet cable.
The process involves first downgrading the firmware, then installing a modified CFE and firmware.
I thought it was useful to know:
- CFE is the bootloader for Broadcom (Common Firmware Environment)
- Firmware is the router software
mtd-writeis a utility for writing to flash memory (Memory Technology Device)
- T-Mobile has locked the firmware to T-Mobile signed firmwares, has disabled telnet in recent firmwares and has disabled downgrading, which is why all of this is necessary.
- Setup Computer Download TM-AC1900toRT-AC68U .7z (currently available here) and extract to a USB drive. Install telnet if you don’t have it (
brew install telnet). Connect to the router over ethernet and Configure IPv4 to manual with (IP: 192.168.29.5, Subnet: 255.255.255.0, Gateway: 192.168.29.1). Turn off WiFi
- Start the router in “Rescue Mode”: 1) power of the router 2) hold down all three of the Reset, WPS, and Wifi On/Off buttons down 3) power on the router and wait till the power LED on the front starts blinking rapidly 4) release the WPS and Wifi On/Off buttons but continue holding the Reset button down, the Power LED should now start blinking slowly and you will be in Rescue mode.
- Downgrade to Firmware 1703 by going to 192.168.29.1 and flashing the file you downloaded TM-AC1900_18.104.22.168_376_1703-g0ffdbba.trx and wait for reboot
- Enable telnet Login into the router in your browser at http://192.168.29.1 (admin:password), go to Administration > System > Enable telnet > Yes > Apply
- Copy the original cfe Insert the flash drive into the router, login via telnet (
telnet -l admin 192.168.1.1password: password) and do
cat /dev/mtd0 > /tmp/mnt/sda1/original_cfe.binthen remove the flash drive
- Modify the original cfe Insert the flash drive into the computer, go to https://cfeditor.pipeline.sh/, upload
original_cfe.binselect “Select 22.214.171.124 US AiMesh” then download to the flash drive
- Install the modified CFE and Firmware Insert the flash drive into the router: then
- login via telnet
chmod u+x mtd-write
./mtd-write new_cfe.bin boot
mtd-write2 FW_RT_AC68U_30043763626.trx linux
Perform NVRAM Reset, wait for reboot <5 mins:
- Power off router
- Wait 10 seconds
- Press and hold WPS button
- Power up the router and continue to hold WPS button for 15-20 seconds until power LED starts blinking very quickly.
- login via telnet
- Restore Computer Configuration Reset PC IP back to default and turn on WiFi
You now have an AC68u!