Turning a Linksys EA6900 to Asus RT-AC68U

I dug up an old project from way back then, a converted Linksys EA6900 with Vortex’s modified Asus firmware. I looked at the date of the firmware, it was done 3 years ago. Since it has been a while and I decided to flash to stock again and start over, here’s what I’ve learned.

This is not a beginner’s guide, I am only listing the commands I used. For more hands-on material, scroll to the bottom and check out the links in the source section.

  1. Download all the following:
  2. Setup your environment on your local computer:
    • Set static IP of 192.168.1.2
    • Set Gateway IP of 192.168.1.1
    • Set Subnet of 255.255.255.0
  3. Boot to miniWeb Server and flash EA6900 stock firmware:
    • Router power off, press and hold reset button, power it up. Keep holding reset button pressed for approx. 10 – 15 seconds. Wait about 30 sec and navigate to 192.168.1.1. You must see miniWeb Server
    • Click Browser and upload the EA6900 stock firmware file
    • Wait until done and perform NV RAM reset by powering down, hold WPS button and power up, wait about 30 sec and let the router boot
  4. Boot to miniWeb Server and flash Tomato firmware
    • Same process as all step 3, replace EA6900 stock firmware with Tomato firmware file
    • Stock Linksys firmware will stuck as “Waiting” at http://192.168.1.1, don’t bother to even try loading or flashing on web UI
  5. Enable SSH in Tomato
    • Login to Tomato at http://192.168.1.1, login/pass: admin/admin
    • Tomato -> Administration -> Admin Access -> SSH Daemon
    • Check “Enable at Startup”, Port “22”
    • Use SSH to login 192.168.1.1
  6. Backup CFE
    • In SSH console, run:
      • cd /tmp/root
      • nvram show >> nvram_dump.txt
      • dd if=/dev/mtd0 of=/tmp/root/stock-cfe.bin
  7. Use SCP client to login 192.168.1.1 and copy out nvram_dump.txt and stock-cfe.bin ; keep them safe
  8. Extract ea6900-cfe-1307 and open CFEEdit.exe
    • In CFEEdit, File – Open CFE -> cfe_ea6900.bin
    • Click Advanced tab, copy and paste following, deleting everything else:
      sromrev=8
      boardnum=00
      boardtype=0x0646
      boardrev=0x1103
      boardflags=0x00000110
      boardflags2=0x00000000
      xtalfreq=25000
      clkfreq=800,666
      reset_gpio=11
      gpio9=usbport1
      gpio10=usbport2
      sdram_config=0x0149
      et0mdcport=0
      et0phyaddr=30
      et0macaddr=74:D0:2B:00:00:00
      vlan1ports=1 2 3 4 5*
      vlan1hwname=et0
      vlan2ports=0 5u
      vlan2hwname=et0
      landevs=vlan1 wl0 wl1
      wandevs=et0
      lan_ipaddr=192.168.1.1
      lan_netmask=255.255.255.0
      gpio7=wps_button
      boot_wait=on
      wait_time=1
      watchdog=2100
      devpath0=pci/1/1
      0:venid=0x14E4
      0:sromrev=11
      0:boardflags=0x00001000
      0:boardflags2=0x00100002
      0:boardflags3=0x00000003
      0:xtalfreq=40000
      0:devid=0x43A1
      0:macaddr=74:D0:2B:00:00:00
      0:aa2g=7
      0:agbg0=0
      0:agbg1=0
      0:agbg2=0
      0:txchain=7
      0:rxchain=7
      0:antswitch=0
      0:femctrl=3
      0:gainctrlsph=0
      0:papdcap2g=0
      0:tworangetssi2g=0
      0:pdgain2g=4
      0:epagain2g=0
      0:tssiposslope2g=1
      0:rxgains2gelnagaina0=6
      0:rxgains2gelnagaina1=6
      0:rxgains2gelnagaina2=6
      0:rxgains2gtrelnabypa0=1
      0:rxgains2gtrelnabypa1=1
      0:rxgains2gtrelnabypa2=1
      0:rxgains2gtrisoa0=13
      0:rxgains2gtrisoa1=13
      0:rxgains2gtrisoa2=13
      0:maxp2ga0=106
      0:maxp2ga1=106
      0:maxp2ga2=106
      0:pa2ga0=0xff34,0x19cd,0xfccc
      0:pa2ga1=0xFF38,0x1A8A,0xFCCB
      0:pa2ga2=0xFF38,0x1A1B,0xFCD0
      0:cckbw202gpo=0
      0:cckbw20ul2gpo=0
      0:mcsbw202gpo=0x75310000
      0:mcsbw402gpo=0x75310000
      0:dot11agofdmhrbw202gpo=0x0000
      0:ofdmlrbw202gpo=0
      0:sb20in40hrpo=0
      0:sb20in40lrpo=0
      0:dot11agduphrpo=0
      0:dot11agduplrpo=0
      0:pdoffset2g40ma0=0x8
      0:pdoffset2g40ma1=0x8
      0:pdoffset2g40ma2=0x8
      0:rpcal2g=0xf606
      0:ccode=#a
      0:regrev=0
      0:sar2g=24
      0:ledbh10=7
      devpath1=pci/2/1
      1:venid=0x14E4
      1:sromrev=11
      1:boardflags=0x30000000
      1:boardflags2=0x00300002
      1:boardflags3=0x0
      1:xtalfreq=40000
      1:devid=0x43A2
      1:macaddr=74:D0:2B:00:00:04
      1:aa5g=7
      1:aga0=0
      1:aga1=0
      1:aga2=0
      1:txchain=7
      1:rxchain=7
      1:antswitch=0
      1:femctrl=3
      1:subband5gver=4
      1:gainctrlsph=0
      1:papdcap5g=0
      1:tworangetssi5g=0
      1:pdgain5g=4
      1:epagain5g=0
      1:tssiposslope5g=1
      1:rxgains5gelnagaina0=2
      1:rxgains5gtrelnabypa0=1
      1:rxgains5gtrisoa0=7
      1:rxgains5gmelnagaina0=2
      1:rxgains5gmtrelnabypa0=1
      1:rxgains5gmtrisoa0=7
      1:rxgains5ghelnagaina0=3
      1:rxgains5ghtrelnabypa0=1
      1:rxgains5ghtrisoa0=8
      1:rxgains5gelnagaina1=2
      1:rxgains5gtrelnabypa1=1
      1:rxgains5gtrisoa1=9
      1:rxgains5gmelnagaina1=2
      1:rxgains5gmtrelnabypa1=1
      1:rxgains5gmtrisoa1=7
      1:rxgains5ghelnagaina1=3
      1:rxgains5ghtrelnabypa1=1
      1:rxgains5ghtrisoa1=7
      1:rxgains5gelnagaina2=2
      1:rxgains5gtrelnabypa2=1
      1:rxgains5gtrisoa2=8
      1:rxgains5gmelnagaina2=2
      1:rxgains5gmtrelnabypa2=1
      1:rxgains5gmtrisoa2=7
      1:rxgains5ghelnagaina2=3
      1:rxgains5ghtrelnabypa2=1
      1:rxgains5ghtrisoa2=8
      1:maxp5ga0=106,106,106,106
      1:pa5ga0=0xFF15,0x1BEC,0xFC8C,0xFF14,0x1BC7,0xFC8E,0xFF1A,0x1CDB,0xFC72,0xFF1B,0x1CD7,0xFC74
      1:maxp5ga1=106,106,106,106
      1:pa5ga1=0xFF13,0x1BF5,0xFC8A,0xFF14,0x1C45,0xFC81,0xFF17,0x1C7D,0xFC7C,0xFF19,0x1C8D,0xFC7C
      1:maxp5ga2=106,106,106,106
      1:pa5ga2=0xFF12,0x1B8F,0xFC96,0xFF12,0x1B2B,0xFCA1,0xFF16,0x1C62,0xFC81,0xFF15,0x1B80,0xFC98
      1:pdoffset40ma0=0x0
      1:pdoffset40ma1=0x0
      1:pdoffset40ma2=0x0
      1:pdoffset80ma0=0x0000
      1:pdoffset80ma1=0x0000
      1:pdoffset80ma2=0x0000
      1:mcsbw205glpo=0xCA864200
      1:mcsbw405glpo=0xCA864200
      1:mcsbw805glpo=0xCA864200
      1:mcsbw1605glpo=0
      1:mcsbw205gmpo=0xCA864200
      1:mcsbw405gmpo=0xCA864200
      1:mcsbw805gmpo=0xCA864200
      1:mcsbw1605gmpo=0
      1:mcsbw205ghpo=0xCA864200
      1:mcsbw405ghpo=0xCA864200
      1:mcsbw805ghpo=0xCA864200
      1:mcsbw1605ghpo=0
      1:mcslr5glpo=0
      1:mcslr5gmpo=0
      1:mcslr5ghpo=0
      1:sb20in40hrpo=0
      1:sb20in80and160hr5glpo=0
      1:sb40and80hr5glpo=0
      1:sb20in80and160hr5gmpo=0
      1:sb40and80hr5gmpo=0
      1:sb20in80and160hr5ghpo=0
      1:sb40and80hr5ghpo=0
      1:sb20in40lrpo=0
      1:sb20in80and160lr5glpo=0
      1:sb40and80lr5glpo=0
      1:sb20in80and160lr5gmpo=0
      1:sb40and80lr5gmpo=0
      1:sb20in80and160lr5ghpo=0
      1:sb40and80lr5ghpo=0
      1:dot11agduphrpo=0
      1:dot11agduplrpo=0
      1:rpcal5gb0=0xa757
      1:rpcal5gb1=0xb75a
      1:rpcal5gb2=0xb361
      1:rpcal5gb3=0xc171
      1:ccode=#a
      1:regrev=0
      1:sar5g=20
      1:ledbh10=7
      bl_version=1.1.2.2
      bootflags=1
      secret_code=12345678
      odmpid=RT-AC66U_B1
      model=RT-AC68U
      ATEMODE=0
      HW_ver=2.10
      PA=5003
      nospare=0
      cpurev=c0
      ctf_fa_cap=0

  9. Change the following parameters: (open nvram_dump.txt to find the values)
    et0macaddr=48:AB:xx:xx:xx:A9 (MAC address on the bottom of router)
    0:macaddr=48:AB:xx:xx:xx:A9 (et0macadd+0)
    1:macaddr=48:AB:xx:xx:xx:B0 (et0macadd+4)
    default_passphrase=xxxxxxxxxx (if any)
    default_ssid=Linksysxxxxx (if any)
    secret_code=xxxxxxxx (WPS PIN on the bottom of router)

  10. Save the file. File – Save CFE As (mod-cfe.bin)
  11. Use SCP client and drop mod-cfe.bin to 192.168.1.1. Ensure the path is still /tmp/root/
  12. Flash the modded CFE
    • Use SSH client and send the following commands
      mtd unlock /dev/mtd0
      cd /tmp/root
      mtd write -f mod-cfe.bin mtd0

  13. Reboot to MiniWeb Server, Upload and Flash Asus RT-AC68U firmware and reset NVRAM (see Step 3)
  14. Login to http://192.168.1.1 and it will say “RT-AC66U_B1” on the top left. If it is showing EA6900, try reset NVRAM again.






Source: https://www.linksysinfo.org/index.php?threads/asuswrt-merlin-build-384-5-or-later-on-linksys-ea6900-or-ea6700.74209/, https://www.linksysinfo.org/index.php?threads/xvortex-or-advancedtomato-on-ea6900-v1-v1-1-without-32k-bug-renew.74084/