I dug up an old project from way back then, a converted Linksys EA6900 with Vortex’s modified Asus firmware. I looked at the date of the firmware, it was done 3 years ago. Since it has been a while and I decided to flash to stock again and start over, here’s what I’ve learned.
This is not a beginner’s guide, I am only listing the commands I used. For more hands-on material, scroll to the bottom and check out the links in the source section.
- Download all the following:
- EA6900 stock firmware
- Tomato firmware
- Asus firmware
- Vortex EA6900 CFE 1307
- SSH, SCP clients (Putty, WinSCP etc)
- Setup your environment on your local computer:
- Set static IP of 192.168.1.2
- Set Gateway IP of 192.168.1.1
- Set Subnet of 255.255.255.0
- Boot to miniWeb Server and flash EA6900 stock firmware:
- Router power off, press and hold reset button, power it up. Keep holding reset button pressed for approx. 10 – 15 seconds. Wait about 30 sec and navigate to 192.168.1.1. You must see miniWeb Server
- Click Browser and upload the EA6900 stock firmware file
- Wait until done and perform NV RAM reset by powering down, hold WPS button and power up, wait about 30 sec and let the router boot
- Boot to miniWeb Server and flash Tomato firmware
- Same process as all step 3, replace EA6900 stock firmware with Tomato firmware file
- Stock Linksys firmware will stuck as “Waiting” at http://192.168.1.1, don’t bother to even try loading or flashing on web UI
- Enable SSH in Tomato
- Login to Tomato at http://192.168.1.1, login/pass: admin/admin
- Tomato -> Administration -> Admin Access -> SSH Daemon
- Check “Enable at Startup”, Port “22”
- Use SSH to login 192.168.1.1
- Backup CFE
- In SSH console, run:
cd /tmp/rootnvram show >> nvram_dump.txtdd if=/dev/mtd0 of=/tmp/root/stock-cfe.bin
- In SSH console, run:
- Use SCP client to login 192.168.1.1 and copy out nvram_dump.txt and stock-cfe.bin ; keep them safe
- Extract ea6900-cfe-1307 and open CFEEdit.exe
- In CFEEdit, File – Open CFE -> cfe_ea6900.bin
- Click Advanced tab, copy and paste following, deleting everything else:
sromrev=8
boardnum=00
boardtype=0x0646
boardrev=0x1103
boardflags=0x00000110
boardflags2=0x00000000
xtalfreq=25000
clkfreq=800,666
reset_gpio=11
gpio9=usbport1
gpio10=usbport2
sdram_config=0x0149
et0mdcport=0
et0phyaddr=30
et0macaddr=74:D0:2B:00:00:00
vlan1ports=1 2 3 4 5*
vlan1hwname=et0
vlan2ports=0 5u
vlan2hwname=et0
landevs=vlan1 wl0 wl1
wandevs=et0
lan_ipaddr=192.168.1.1
lan_netmask=255.255.255.0
gpio7=wps_button
boot_wait=on
wait_time=1
watchdog=2100
devpath0=pci/1/1
0:venid=0x14E4
0:sromrev=11
0:boardflags=0x00001000
0:boardflags2=0x00100002
0:boardflags3=0x00000003
0:xtalfreq=40000
0:devid=0x43A1
0:macaddr=74:D0:2B:00:00:00
0:aa2g=7
0:agbg0=0
0:agbg1=0
0:agbg2=0
0:txchain=7
0:rxchain=7
0:antswitch=0
0:femctrl=3
0:gainctrlsph=0
0:papdcap2g=0
0:tworangetssi2g=0
0:pdgain2g=4
0:epagain2g=0
0:tssiposslope2g=1
0:rxgains2gelnagaina0=6
0:rxgains2gelnagaina1=6
0:rxgains2gelnagaina2=6
0:rxgains2gtrelnabypa0=1
0:rxgains2gtrelnabypa1=1
0:rxgains2gtrelnabypa2=1
0:rxgains2gtrisoa0=13
0:rxgains2gtrisoa1=13
0:rxgains2gtrisoa2=13
0:maxp2ga0=106
0:maxp2ga1=106
0:maxp2ga2=106
0:pa2ga0=0xff34,0x19cd,0xfccc
0:pa2ga1=0xFF38,0x1A8A,0xFCCB
0:pa2ga2=0xFF38,0x1A1B,0xFCD0
0:cckbw202gpo=0
0:cckbw20ul2gpo=0
0:mcsbw202gpo=0x75310000
0:mcsbw402gpo=0x75310000
0:dot11agofdmhrbw202gpo=0x0000
0:ofdmlrbw202gpo=0
0:sb20in40hrpo=0
0:sb20in40lrpo=0
0:dot11agduphrpo=0
0:dot11agduplrpo=0
0:pdoffset2g40ma0=0x8
0:pdoffset2g40ma1=0x8
0:pdoffset2g40ma2=0x8
0:rpcal2g=0xf606
0:ccode=#a
0:regrev=0
0:sar2g=24
0:ledbh10=7
devpath1=pci/2/1
1:venid=0x14E4
1:sromrev=11
1:boardflags=0x30000000
1:boardflags2=0x00300002
1:boardflags3=0x0
1:xtalfreq=40000
1:devid=0x43A2
1:macaddr=74:D0:2B:00:00:04
1:aa5g=7
1:aga0=0
1:aga1=0
1:aga2=0
1:txchain=7
1:rxchain=7
1:antswitch=0
1:femctrl=3
1:subband5gver=4
1:gainctrlsph=0
1:papdcap5g=0
1:tworangetssi5g=0
1:pdgain5g=4
1:epagain5g=0
1:tssiposslope5g=1
1:rxgains5gelnagaina0=2
1:rxgains5gtrelnabypa0=1
1:rxgains5gtrisoa0=7
1:rxgains5gmelnagaina0=2
1:rxgains5gmtrelnabypa0=1
1:rxgains5gmtrisoa0=7
1:rxgains5ghelnagaina0=3
1:rxgains5ghtrelnabypa0=1
1:rxgains5ghtrisoa0=8
1:rxgains5gelnagaina1=2
1:rxgains5gtrelnabypa1=1
1:rxgains5gtrisoa1=9
1:rxgains5gmelnagaina1=2
1:rxgains5gmtrelnabypa1=1
1:rxgains5gmtrisoa1=7
1:rxgains5ghelnagaina1=3
1:rxgains5ghtrelnabypa1=1
1:rxgains5ghtrisoa1=7
1:rxgains5gelnagaina2=2
1:rxgains5gtrelnabypa2=1
1:rxgains5gtrisoa2=8
1:rxgains5gmelnagaina2=2
1:rxgains5gmtrelnabypa2=1
1:rxgains5gmtrisoa2=7
1:rxgains5ghelnagaina2=3
1:rxgains5ghtrelnabypa2=1
1:rxgains5ghtrisoa2=8
1:maxp5ga0=106,106,106,106
1:pa5ga0=0xFF15,0x1BEC,0xFC8C,0xFF14,0x1BC7,0xFC8E,0xFF1A,0x1CDB,0xFC72,0xFF1B,0x1CD7,0xFC74
1:maxp5ga1=106,106,106,106
1:pa5ga1=0xFF13,0x1BF5,0xFC8A,0xFF14,0x1C45,0xFC81,0xFF17,0x1C7D,0xFC7C,0xFF19,0x1C8D,0xFC7C
1:maxp5ga2=106,106,106,106
1:pa5ga2=0xFF12,0x1B8F,0xFC96,0xFF12,0x1B2B,0xFCA1,0xFF16,0x1C62,0xFC81,0xFF15,0x1B80,0xFC98
1:pdoffset40ma0=0x0
1:pdoffset40ma1=0x0
1:pdoffset40ma2=0x0
1:pdoffset80ma0=0x0000
1:pdoffset80ma1=0x0000
1:pdoffset80ma2=0x0000
1:mcsbw205glpo=0xCA864200
1:mcsbw405glpo=0xCA864200
1:mcsbw805glpo=0xCA864200
1:mcsbw1605glpo=0
1:mcsbw205gmpo=0xCA864200
1:mcsbw405gmpo=0xCA864200
1:mcsbw805gmpo=0xCA864200
1:mcsbw1605gmpo=0
1:mcsbw205ghpo=0xCA864200
1:mcsbw405ghpo=0xCA864200
1:mcsbw805ghpo=0xCA864200
1:mcsbw1605ghpo=0
1:mcslr5glpo=0
1:mcslr5gmpo=0
1:mcslr5ghpo=0
1:sb20in40hrpo=0
1:sb20in80and160hr5glpo=0
1:sb40and80hr5glpo=0
1:sb20in80and160hr5gmpo=0
1:sb40and80hr5gmpo=0
1:sb20in80and160hr5ghpo=0
1:sb40and80hr5ghpo=0
1:sb20in40lrpo=0
1:sb20in80and160lr5glpo=0
1:sb40and80lr5glpo=0
1:sb20in80and160lr5gmpo=0
1:sb40and80lr5gmpo=0
1:sb20in80and160lr5ghpo=0
1:sb40and80lr5ghpo=0
1:dot11agduphrpo=0
1:dot11agduplrpo=0
1:rpcal5gb0=0xa757
1:rpcal5gb1=0xb75a
1:rpcal5gb2=0xb361
1:rpcal5gb3=0xc171
1:ccode=#a
1:regrev=0
1:sar5g=20
1:ledbh10=7
bl_version=1.1.2.2
bootflags=1
secret_code=12345678
odmpid=RT-AC66U_B1
model=RT-AC68U
ATEMODE=0
HW_ver=2.10
PA=5003
nospare=0
cpurev=c0
ctf_fa_cap=0
- Change the following parameters: (open nvram_dump.txt to find the values)
et0macaddr=48:AB:xx:xx:xx:A9 (MAC address on the bottom of router)
0:macaddr=48:AB:xx:xx:xx:A9 (et0macadd+0)
1:macaddr=48:AB:xx:xx:xx:B0 (et0macadd+4)
default_passphrase=xxxxxxxxxx (if any)
default_ssid=Linksysxxxxx (if any)
secret_code=xxxxxxxx (WPS PIN on the bottom of router) - Save the file. File – Save CFE As (mod-cfe.bin)
- Use SCP client and drop mod-cfe.bin to 192.168.1.1. Ensure the path is still /tmp/root/
- Flash the modded CFE
- Use SSH client and send the following commands
mtd unlock /dev/mtd0
cd /tmp/root
mtd write -f mod-cfe.bin mtd0
- Use SSH client and send the following commands
- Reboot to MiniWeb Server, Upload and Flash Asus RT-AC68U firmware and reset NVRAM (see Step 3)
- Login to http://192.168.1.1 and it will say “RT-AC66U_B1” on the top left. If it is showing EA6900, try reset NVRAM again.
Source: https://www.linksysinfo.org/index.php?threads/asuswrt-merlin-build-384-5-or-later-on-linksys-ea6900-or-ea6700.74209/, https://www.linksysinfo.org/index.php?threads/xvortex-or-advancedtomato-on-ea6900-v1-v1-1-without-32k-bug-renew.74084/