Flash T-Mobile Cellspot TM-AC1900 to Asus RT-AC68U/P

Posted on by Lazy Mocha

Lately, there are some issues with Asus rolling back of the stock firmware of TM-AC1900 router. Look at Amazon, there are lots of these on sale for as low as $48 (they are great price), and many are modifying these to AC68U to obtain Ai-Mesh functionality. Once Asus detected these modified routers via an online upgrade, the rollback would lock the CFE and firmware from further modifications.

UPDATE 04/23: If Asus reverted your TM-AC1900 router, here is the solution

UPDATE 07/25: Before any Asus firmware can be flashed, the following must be done

  • Avoid CFE 1.0.2.5 from the RT-AC68P, as the newest Asus firmwares (3.0.0.4.384.20624 and later) detect this on the TM-AC1900 and revert the mod. Instead, use CFE 1.0.2.0 US AiMesh; it was dumped from an actual RT-AC68U by user goggles99 at SNB. The CFE generator [pipeline.sh] by danielfeng has this version available.
  • Some TM-AC1900 ship with a firmware version that allows SSH access. If you get one of these, you can skip steps 5-10 of the guide. To check if you have SSH available, go to Administration > System in the router configuration interface. If your firmware permits SSH, there will be a setting to Enable SSH. If so, choose Yes, then Apply. Move on to step 11.
  • The T-Mobile certificates have to be wiped from the mtd5 partition. This can be done after all of the steps in the guide have been completed, but must be done before any newer version of ASUS firmware is flashed. As of this writing, the firmware included in the guide is 3.0.0.4.376.3626, steps below “Wiping T-Mobile MTD5 Partition” should be performed when this version is running on your router.

UPDATE 07/26: There is known issue upgrading with Merlin’s firmware for TM-AC1900. Wiping the MTD5 could be the solution.

UPDATE 10/26: RM-Merlin firmware no longer support TM-AC1900, use RT-AC68U instead. DO NOT UPDATE CFE to anything other than 1.0.2.0 for AiMesh

UPDATE 01/02: As per RM-Merlin firmware for RT-AC68U are not meant for TM-AC1900, even after the conversion. Please do not update to the latest merlin without understand the risk of bricking or requiring a rollback

Cross-Flashing TM-AC1900 to RT-AC68U

WARNING: DISCONNECT WAN BEFORE PERFORMING STOCK ASUS RT-AC68 FIRMWARE UPGRADE

I’ve included the instruction to modify and format the T-Mobile partition to prevent Asus of detecting these routers (for now).

Steps to convert TM-AC1900 to RT-AC68U/

  1. Install WinSCP, Putty, and a file archiver. Install the Asus Restore Utility.
  2. Create a folder on your desktop, name it “router”.
  3. Download this file and extract it to the newly made router folder. It contains a firmware to downgrade to, a firmware to upgrade to, and mtd-write.
  4. Set static IP for PC.
    start > run > ncpa.cpl > double click Ethernet > properties > IPV4 >
    IP: 192.168.29.5
    Subnet: Default (255.255.255.0)
    Gateway: 192.168.29.1
  5. Place router into Recovery/Restore mode
    Hold reset button 10 seconds
    Power off router (keep holding reset)
    Wait 10 seconds, keep holding reset
    Power on router holding reset for 10 more seconds
  6. Go to 192.168.29.1 in a web browser
    If Mini-CFE won’t load use Asus Restore Utility
  7. Flash TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx
  8. Wait for reboot <5 mins – WiFi lights will turn on when boot is complete
  9. Log in to router (admin:admin or admin:password)
  10. Go to Administration > System > Enable SSH > Yes > Apply
  11. Open Putty and WinSCP and connect them to 192.168.29.1 using a admin:admin or admin:password
    Tip: In WinSCP select SCP as file protocol, in Putty SSH
  12. In putty type:
    cat /dev/mtd0 > original_cfe.bin
  13. In WinSCP refresh the window on the right side and note that original_cfe.bin is present
  14. Copy original_cfe.bin to a local drive
  15. Upload original_cfe.bin to https://cfeditor.pipeline.sh/ > Select 1.0.2.0 US 1.0.2.5 US for AC68P or 1.0.2.0 US AiMesh for AC68U with AiMesh as Source CFE > Download the new .bin > rename it to new_cfe.bin
  16. Upload new_cfe.bin & mtd-write & FW_RT_AC68U_30043763626.trx to router through WinSCP
  17. In Putty type:
    chmod u+x mtd-write
  18. In Putty type:
    ./mtd-write new_cfe.bin boot
  19. In Putty type:
    mtd-write2 FW_RT_AC68U_30043763626.trx linux
  20. Perform NVRAM Reset, wait for reboot <5 mins
    a. Power off router
    b. Wait 10 seconds
    c. Press and hold WPS button
    d. Power up the router and continue to hold WPS button for 15-20 seconds
  21. Reset PC IP back to default
  22. Log in to router using 192.168.1.1 and the router is now an AC68U with 64MB jffs
  23. Feel free to flash AC68U builds from Asus or Merlin

Wiping T-Mobile MTD5 Partition

To format the T-Mobile partition (MTD5) to prevent Asus from ID the router and force a rollback, these are obtained from Small Network Builders before the thread got removed:

#WARNING! WARNING! WARNING! WARNING! WARNING! WARNING! WARNING! WARNING! WARNING! WARNING! WARNING!
#IF YOU PERFORM THESE COMMANDS ON YOUR T-MOBILE AC-1900 ROUTER, YOU DO SO AT YOUR OWN RISK!
#THERE'S A GOOD CHANCE YOU WON'T BE ABLE TO GO BACK TO THE ORIGINAL T-MOBILE FIRMWARE AFTER PERFORMING THESE COMMANDS
#IF YOU MESS SOMETHING UP AND BRICK THE ROUTER, THEN THAT IS ON YOU!!!

#Before you begin, make sure you installed CFE 1.0.2.0 AiMesh.  Follow the instructions provided by Bay Tech Area Pros in the link above.
#Backup your mdt5 partition
admin@RT-AC68U:/tmp/home/root# cat /dev/mtd5 > /jffs/mtd5_backup.bin

#Use WinSCP in Windows to copy the mtd5_backup.bin off the router to a safe place.

#View the mounted file systems. One of them should be TMO for T-Mobile.
admin@RT-AC68U:/tmp/home/root# df -h

#Remove the TMO mdt5 partition
admin@RT-AC68U:/tmp/home/root# mkdir /tmp/asus_jffs
admin@RT-AC68U:/tmp/home/root# mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
admin@RT-AC68U:/tmp/home/root# rm -rf /tmp/asus_jffs/*
admin@RT-AC68U:/tmp/home/root# sync && umount /tmp/asus_jffs
admin@RT-AC68U:/tmp/home/root# rm -rf /jffs/.sys/RT-AC68U
admin@RT-AC68U:/tmp/home/root# nvram unset fw_check && nvram commit && reboot

#Write all FFs to the mdt5 (in case that didn't happen when you removed the TMO partition in the previous steps)
admin@RT-AC68U:/tmp/home/root# ln -s /sbin/rc mtd-erase
admin@RT-AC68U:/tmp/home/root# ./mtd-erase -d asus

#Now you can flash firmware version 3.0.0.4.384.20648
#To be on the safe side, download the firmware from the Asus site, disconnect the router from the internet, and then perform the upgrade
#If you are paranoid, you can SSH to the router after you finish the upgrade and re-flash CFE 1.0.2.0 AiMesh

Good luck and have fun with this router.

AC68 ai-mesh aimesh Asus cellspot flash hack jffs lockdown merlin mtd5 revert roll back router RT-AC68P RT-AC68U T-mobile TM-AC1900 wireless