TM 1900 to RT - AC68U - (Help)

[sheldorparra]

I am at a impasse

When i upload said version of firmware TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx

I get this error in image below

"The file transferred is not a valid firmware image."

My current firmware version is 3.0.0.4.376_3199-ge62f8ab, I am trying to convert the TM 1900 to AC68U firmware.

How do i get around this?

Thanks,

I am follwing the steps on this post site https://lazymocha.com/blog/2018/04/16/flash-t-mobile-cellspot-tm-ac1900-to-asus-rt-ac68u-p/

Any Help would be greatly appreciated

I currently have a AC86U with Merlin on it.

use this guide as usb, for me works https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1168729 just follow the file in no CFE mode.

 

[RUK_03]

Hi, I would like to know whether it is possible to upgrade my TM-AC1900 to the latest ASUS firmware: RT-AC1900_3.0.0.4_385_20630-ged5e4c3. Currently, my router is on version 3.0.0.4.376_3199. I read this thread completely and not sure which set of instructions to follow. Any help is greatly appreciated. Thanks.

 

[bullybear]

Hi, I would like to know whether it is possible to upgrade my TM-AC1900 to the latest ASUS firmware: RT-AC1900_3.0.0.4_385_20630-ged5e4c3. Currently, my router is on version 3.0.0.4.376_3199. I read this thread completely and not sure which set of instructions to follow. Any help is greatly appreciated. Thanks.

Same here. I have read many of the posts including this one and I followed step by step the google doc instructions to downgrade the firmware from 3.0.4.376_3199. None worked:-( So...... o frustrating!

 

[RUK_03]

Same here. I have read many of the posts including this one and I followed step by step the google doc instructions to downgrade the firmware from 3.0.4.376_3199. None worked:-( So...... o frustrating!

I followed this guide:
https://docs.google.com/document/d/1NsZMONmJ70zMmoAKKQJXbTVKytaPJptWTpqih1TD5n8/edit?usp=sharing
Specifically, the NO CFE option - up to this step: validForm = function(){document.form.SystemCmd.value = "ping\nwget -A txt -r -nH -nd docbill.freeshell.org";return true;}
Then, followed appendix 6. Worked out good... now it is an ASUS RT-AC68U

 

[Jezzabel]

Hi RUK-03,

I followed the NO CFE USB instructions from the google doc guide you suggested.
My problem is that the following command seems to work OK: validForm = function(){document.form.SystemCmd.value = "ping\nwget -A txt -r -nH -nd docbill.freeshell.org";return true;}
But I do not get the u.txt file downloaded... leading to the next command (validForm = function(){document.form.SystemCmd.value = "ping\n u.txt " + encodeURIComponent("find /tmp/mnt -name firmware1703.trx" ).replace(/%/g,"..");return true;} ) to fail.
Shall I just jump, like you, to the Appendix 6 to generate a replacement CFE and then download the FW TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx ?

Thank you

 

[RUK_03]

Hi RUK-03,

I followed the NO CFE USB instructions from the google doc guide you suggested.
My problem is that the following command seems to work OK: validForm = function(){document.form.SystemCmd.value = "ping\nwget -A txt -r -nH -nd docbill.freeshell.org";return true;}
But I do not get the u.txt file downloaded... leading to the next command (validForm = function(){document.form.SystemCmd.value = "ping\n u.txt " + encodeURIComponent("find /tmp/mnt -name firmware1703.trx" ).replace(/%/g,"..");return true;} ) to fail.
Shall I just jump, like you, to the Appendix 6 to generate a replacement CFE and then download the FW TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx ?

Thank you

Hello Jezzabel,
You do need to make sure that the u.txt is downloaded. Use this command to check:

validForm = function(){document.form.SystemCmd.value = "ping\nfind u.txt";return true;} and click Diagnose button. If it doesn't show where u.txt is, you need to rerun this command:
validForm = function(){document.form.SystemCmd.value = "ping\nwget -A txt -r -nH -nd docbill.freeshell.org";return true;}

Once you know that the u.txt is downloaded, then jump to Appendix 6. Hope this helps!

 

[Jezzabel]

Hello Jezzabel,
You do need to make sure that the u.txt is downloaded. Use this command to check:

validForm = function(){document.form.SystemCmd.value = "ping\nfind u.txt";return true;} and click Diagnose button. If it doesn't show where u.txt is, you need to rerun this command:
validForm = function(){document.form.SystemCmd.value = "ping\nwget -A txt -r -nH -nd docbill.freeshell.org";return true;}

Once you know that the u.txt is downloaded, then jump to Appendix 6. Hope this helps!

Thank you, will give a try

 

[Jezzabel]

Hello Jezzabel,
You do need to make sure that the u.txt is downloaded. Use this command to check:

validForm = function(){document.form.SystemCmd.value = "ping\nfind u.txt";return true;} and click Diagnose button. If it doesn't show where u.txt is, you need to rerun this command:
validForm = function(){document.form.SystemCmd.value = "ping\nwget -A txt -r -nH -nd docbill.freeshell.org";return true;}

Once you know that the u.txt is downloaded, then jump to Appendix 6. Hope this helps!

Hi RUK_03,

I managed to get u.txt loaded on the root of my router. But it looks like I would need a little more of your help.

When I issue the command to extract /dev/mtd0 to original_cfe.bin on the USB, I do not get any response, which I assume is expected.
But then the command to umount the USB says that the device cannot be umount because the device or resource is busy.
After few attempts I decided to disconnect the USB drive and read its content, but there was no trace of the original_cfe.bin file.

I attached my logs. I appreciate if you could have a look.

If my understanding is correct, I do not need to flash the firmware1703.trx. As soon as I successfully manage to replace the cfe by a new one, I shall get AC68U displayed in the webinterface of the router and then I would be able to load latest merlin FW. Then I could decide to remove the mtd5 partition.

Thank you for any help you can provide

 

[RUK_03]

Hi RUK_03,

I managed to get u.txt loaded on the root of my router. But it looks like I would need a little more of your help.

When I issue the command to extract /dev/mtd0 to original_cfe.bin on the USB, I do not get any response, which I assume is expected.
But then the command to umount the USB says that the device cannot be umount because the device or resource is busy.
After few attempts I decided to disconnect the USB drive and read its content, but there was no trace of the original_cfe.bin file.

I attached my logs. I appreciate if you could have a look.

If my understanding is correct, I do not need to flash the firmware1703.trx. As soon as I successfully manage to replace the cfe by a new one, I shall get AC68U displayed in the webinterface of the router and then I would be able to load latest merlin FW. Then I could decide to remove the mtd5 partition.

Thank you for any help you can provide

Hello Jezzabel, it looks like the cat command is not closing/completing the file transfer. Try this:
validForm = function(){document.form.SystemCmd.value = "ping\n. u.txt "+encodeURIComponent("cp /dev/mtd0 /tmp/mnt/USB/original_cfe.bin").replace(/%/g,"..");return true;}
Click Diagnose
validForm = function(){document.form.SystemCmd.value = "ping\nfind original_cfe.bin";return true;} and click Diagnose button.
Should show that the original_cfe.bin is successfully created and placed in the USB. After this, issue the umount command. Don't forget to click the diagnose button after each command.

 

[Hack7heGibson]

If anyone is wanting a new way to flash this thing, I just completed one this morning that would not go into recovery mode. (slow flashing power led and IP set to 192.168.1.1) not to be confused with the mini CFE loader page on 192.168.29.1. I was able to get to the mini cfe by holding the reset button on powerup, but got "The file transferred is not a valid firmware image." when uploading the TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx firmware.

This does require a tty USB serial adapter, which can be purchased for about $3. Great news is that once you have the serial cable connected, it't easier than the original guide as you can completely SKIP steps 1-10 on the bayareatechpros page. Downgrading to the 1703 firmware is not needed. trying to feed commands into the ping interface is also not needed. You also need a usb drive.

1: once you have your serial cable, you can follow this guide to hook it up and get access:

[TM-AC1900 (RT-AC68U)] - Bricked while flashing from Tomato to Merlin

Greetings SNB community! Setup: T-Mobile TM-AC1900 successfully flashed (CFE) to RT-AC68U long ago Background: Was on latest Asus stock firmware for a while. Decided to try out Tomato. Wasn't happy with WiFi performance, so decided to try flashing to Merlin last night. Flashing steps: Tried...

www.snbforums.com

2: boot the router completely, have a usb stick (formatted as fat32) in the usb 2.0 port.

3: from commandline using terra term:

cat /dev/mtd0 > /mnt/USB/original_cfe.bin
reboot

4: wait until unit is booting back up and then power it off. (we want to make sure that the usb drive isn't active when we pull it out)

5: plug the USB stick into your computer:

• Upload original_cfe.bin to https://cfeditor.pipeline.sh/ > Select 1.0.2.0 US AiMesh as Source CFE > Download the new .bin > rename it to new_cfe.bin

6: Download This_File

• copy new_cfe.bin & mtd-write & FW_RT_AC68U_30043763626.trx to the usb drive

7: plug the usb drive back into the router and boot it completely.

8: in Terra Term type:

cd /mnt/USB
chmod u+x mtd-write
./mtd-write new_cfe.bin boot
./mtd-write FW_RT_AC68U_30043763626.trx linux
nvram_erase
reboot

9: Once the unit is booted back up, run the below commands before removing the serial cable and putting the router back together.

Code for fixing MTD5 partition so you can update to latest firmware:
You can enter this in Terra Term before you remove the serial cable and re-assemble the router

cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot

10: You can now flash Asus, Merlin, Advanced Tomato, Tomato, and DD-WRT firmwares.

 

[ClockerXP]

Hi RUK-03,

I followed the NO CFE USB instructions from the google doc guide you suggested.
My problem is that the following command seems to work OK: validForm = function(){document.form.SystemCmd.value = "ping\nwget -A txt -r -nH -nd docbill.freeshell.org";return true;}
But I do not get the u.txt file downloaded... leading to the next command (validForm = function(){document.form.SystemCmd.value = "ping\n u.txt " + encodeURIComponent("find /tmp/mnt -name firmware1703.trx" ).replace(/%/g,"..");return true;} ) to fail.
Shall I just jump, like you, to the Appendix 6 to generate a replacement CFE and then download the FW TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx ?

Thank you

I get a similar issue. Althought, mine actually says it downloaded the u.txt file but then when I got to appendix 6 to execute the commands there, it says the u.txt is not found.

 

[chromeking]

I gave up on this months ago. I got tired of asking for help. I have the Wifi 6 AX6000 and the AC86U set on Merlin and working on mesh setup

Just saw this post today. Sorry to be a year late and that you didnt get the help...at all. I was just in the same position today and figured it out. If you still have the router and want to mess with it , I can message you the two sites to help you.

 

[ruggb]

Am I locked out?
I have 4 of these units.
#1 appears totally bricked. it has been a while since I looked at it, but I believe it wouldn't even boot up.
#2 & #3 are totally AC68Us
#4 went thru some mod attempts, but somehow ended up on TM1900 f/w 3.0.0.4.376.3221-gd4afd2e
Trying the previous procedure I used for 2 & 3 does not work
This f/w version appears to be much later than what I expect.
What I get when upload the 1703 f/w with ASUSTek - CFE miniWeb Server is that it is not a valid f/w image.
The question is can it be recovered to AC68 or is it totally locked out?

 

[chromeking]

Am I locked out?
I have 4 of these units.
#1 appears totally bricked. it has been a while since I looked at it, but I believe it wouldn't even boot up.
#2 & #3 are totally AC68Us
#4 went thru some mod attempts, but somehow ended up on TM1900 f/w 3.0.0.4.376.3221-gd4afd2e
Trying the previous procedure I used for 2 & 3 does not work
This f/w version appears to be much later than what I expect.
What I get when upload the 1703 f/w with ASUSTek - CFE miniWeb Server is that it is not a valid f/w image.
The question is can it be recovered to AC68 or is it totally locked out?

The one where the CFE miniWeb Server gives you the issues where its not a valid f/w image is totally normal on the TM ones. Same thing happened to me. This is the site I used for the flash. https://docs.google.com/document/d/...taPJptWTpqih1TD5n8/edit#heading=h.fdrlq3l51p0
Has to be the No CFE USB Instructions.

Had to be flashed through admin tab in a loophole using a usb stick and console commands that were simple to follow. Also, if you didnt fix a string of code (MTD5 partition); after initially flashing the tm router to an asus firmware it would on the next firmware update revert to the latest TM firmware and lock you out of further firmware downgrades to older TM software to do a flash again.

This is the site to follow after flashing with the USB you want to resume at the steps at step 10 at this site to finish the process.
https://www.bayareatechpros.com/ac1900-to-ac68u/
Then 100% make sure to do the code to fix the MTD5 partition. That is what causes a new firmware flash to revert to TM software if that partition is not patched and fixed.

 

[ruggb]

The one where the CFE miniWeb Server gives you the issues where its not a valid f/w image is totally normal on the TM ones. Same thing happened to me. This is the site I used for the flash. https://docs.google.com/document/d/...taPJptWTpqih1TD5n8/edit#heading=h.fdrlq3l51p0
Has to be the No CFE USB Instructions.

Had to be flashed through admin tab in a loophole using a usb stick and console commands that were simple to follow. Also, if you didnt fix a string of code (MTD5 partition); after initially flashing the tm router to an asus firmware it would on the next firmware update revert to the latest TM firmware and lock you out of further firmware downgrades to older TM software to do a flash again.

This is the site to follow after flashing with the USB you want to resume at the steps at step 10 at this site to finish the process.
https://www.bayareatechpros.com/ac1900-to-ac68u/
Then 100% make sure to do the code to fix the MTD5 partition. That is what causes a new firmware flash to revert to TM software if that partition is not patched and fixed.

Thanks -- I ran thru the No CFE USB and it appeared that everything worked, HOWEVER, I am still at the same f/w 3221 and I am assuming it should be showing 1703. Therefore, I cannot proceed with LazyMocha. If that lockout is in effect because it is at 3221 then it looks like it is effective and there isn't anything to do at this point. Would that be correct?

 

[chromeking]

Thanks -- I ran thru the No CFE USB and it appeared that everything worked, HOWEVER, I am still at the same f/w 3221 and I am assuming it should be showing 1703. Therefore, I cannot proceed with LazyMocha. If that lockout is in effect because it is at 3221 then it looks like it is effective and there isn't anything to do at this point. Would that be correct?

There is a comment on the google docs page stating that nothing happens at the end if the text of the usb file is too long. The page should update or text should appear after a short moment if done right. I had issues with that until I saw the person's comment. That might be the issue.

 

[ruggb]

you are talking about the filename? I did change that. I guess I will run it again and copy all the responses. Maybe I missed something.
I don't know what this is in reference to? "The page should update or text should appear after a short moment if done right."

I ran it again and I get a console error on
validForm = function(){document.form.SystemCmd.value = "ping\nmount --move userRpm .";return true;}

Unchecked runtime.lasterror: The message port was closed before a response was received.

If I run that command again I get a Diagnose message
mount: mounting userRpm on . failed: Invalid argument

any ideas?

I think I am missing something about the SCRIPT file.
Step 5 says to download it, but I have no clue what that process is. Do you?

 

[chromeking]

you are talking about the filename? I did change that. I guess I will run it again and copy all the responses. Maybe I missed something.
I don't know what this is in reference to? "The page should update or text should appear after a short moment if done right."

I ran it again and I get a console error on
validForm = function(){document.form.SystemCmd.value = "ping\nmount --move userRpm .";return true;}

Unchecked runtime.lasterror: The message port was closed before a response was received.

If I run that command again I get a Diagnose message
mount: mounting userRpm on . failed: Invalid argument

any ideas?

I think I am missing something about the SCRIPT file.
Step 5 says to download it, but I have no clue what that process is. Do you?

Yes, I was talking about the filename. I must have tried 4 or 5 different short ones until the text box at the last step had text appear after hitting diagnose. That is what I meant and was referring to.

In reference to the message port error. I know that typically happens on console commands if it is run on chrome and or with chrome extensions. I would give it a try on a alternate browser or chrome with extensions disabled.

Make sure to do the console test on step 4 then if that passes step 5 should just be copying and pasting commands into the console and hitting diagnose for each one. Make sure there is no spaces in front or behind the commands and that the last commands two have the firmware1703 name changed to whatever you chose. I believe what worked for me was firm17.

 

[ruggb]

I tried FF & MS Edge. FF seemed to have problems. Edge appeared to be OK. However, again, the last command appears to do nothing.
I think it is suppose to install 1703 and reboot, but nothing happens. The previous response indicating it found the .trx file never gets erased. The router does nothing RE LEDs and never reboots.

What am I missing?

 

[chromeking]

I tried FF & MS Edge. FF seemed to have problems. Edge appeared to be OK. However, again, the last command appears to do nothing.
I think it is suppose to install 1703 and reboot, but nothing happens. The previous response indicating it found the .trx file never gets erased. The router does nothing RE LEDs and never reboots.

What am I missing?

I am almost positive that is just due to the name of the file. I would make sure your restarting the router every time you want to start over and then try a shorter name each time. It took a few trys for me and also two different flash drives until the code on the last command worked and shortly after hitting diagnose a string of text showed up in the text box which was it finishing the flash. I was trying to get that to show up for maybe an hour after many reboots and retrys it worked. Alot of my very small filenames would not come up when searching for the usb file on one of the final steps with a string of console code. If that happens just restart the router and rename the file again until it shows. Sometimes though it showed for me on the usb fine but the flash would not doing anything after the last command. That tells you the name is too long for the filename on the usb. The text box should update after a moment of typing the last command in and hitting diagnose.

 

[ruggb]

Thanks
I went all the way to f3.trx
1703 is active.
now to see if I can finish the rest.

I am doing the telnet thing
I went all the way to trying to get the cfe file and it apparently can't find the usb
cat /dev/mtd0 > /tmp/mnt/sda1/original_cfe.bin
tried /mnt/sda1
/sda1
and /tmp/mnt/usb/original_cfe.bin which is the address used to get the f/w file from the drive.
keeps telling me the directory doesn't exist.
how do i get it to the usb?

I have an original from another 68 but the mac addresses and wps are different which is what appears to get changed in the download of the new one.

 

[chromeking]

Thanks
I went all the way to f3.trx
1703 is active.
now to see if I can finish the rest.

I am doing the telnet thing
I went all the way to trying to get the cfe file and it apparently can't find the usb
cat /dev/mtd0 > /tmp/mnt/sda1/original_cfe.bin
tried /mnt/sda1
/sda1
and /tmp/mnt/usb/original_cfe.bin which is the address used to get the f/w file from the drive.
keeps telling me the directory doesn't exist.
how do i get it to the usb?

I have an original from another 68 but the mac addresses and wps are different which is what appears to get changed in the download of the new one.

No problem, and the sda1 is usually the name of the flash drive. Most likely USB from the earlier steps, but you shouldnt have to bother with that if your doing the mtd5 fix. I switched over after flashing and had used the second link I sent you; the bay area tech pros one. I resumed at step 10 and followed their steps and then their step 23 is fixing the mtd5 partition. Their mtd5 fix is listed after the bottom of the steps.

Make sure to disconnect from the internet after flashing using the google docs steps and switching to step 10 on the bay area tech pros. Just a precaution and also do not check for updates on the router until finished with everything and the mtd5 partition is patched. Updating the firmware without the mtd5 partition patched and the router fully setup properly will cause the router to have the tmobile software reverted and locked out again from downgrade.

 

[ruggb]

THANK YOU
It is done!!!!
beside the name issue, trying to read a 1 (one) vs and l (ell) was an issue.
needing to upgrade to an 384+ version b4 trying to erase the mtd since it wasn't quite explained in that order

and various other issues. I think I did this one b4 but forgot to erase the mtd so it got reverted.
I don't remember having an issue with the names b4, but I'm old.

Now I can replace my primary one that seems to have lost a 5G quest channel recently. Just playing router roulette.
Have a great year.......................

 

[chromeking]

THANK YOU
It is done!!!!
beside the name issue, trying to read a 1 (one) vs and l (ell) was an issue.
needing to upgrade to an 384+ version b4 trying to erase the mtd since it wasn't quite explained in that order

and various other issues. I think I did this one b4 but forgot to erase the mtd so it got reverted.
I don't remember having an issue with the names b4, but I'm old.

Now I can replace my primary one that seems to have lost a 5G quest channel recently. Just playing router roulette.
Have a great year.......................

AWESOME! Glad to help. My router just went earlier last month. Had picked one up that was a Tmobile one that someone forgot to patch the mtd5 partition and updated it only to think it was bricked as well. Had a fun time searching for how to fix it. Very similar situation. Sorry about the first site directions being cloudy to where you had to basically improvise a name to get it to work then having to jump to the other website afterwards.

I saw a individual many pages before this on this post that had the same issue and no one could help them and figured I would post here. I believe that person just gave up because someone continued to try and help but wasnt listening at all to the individual and just was throwing out randomy sites pertaining to the router haha. Sad, but also a reason for me to post here to actually help people.

Have a great new year as well!

 

[ruggb]

yes I saw that. Hopefully he stumbles on this thread. The reason I decided to get to this is because my primary one started having troubles. One guest channel got flaky.
I have now replaced it and am trying to figure out its problem. It appears to be intermittent on that channel 5G Guest1. The others appear OK. I hate intermittents.