router_flash.md

Flash Asus TM-AC1900 to Asus RT-AC68U

Asus TM-AC1900 is a T-Mobile rebranded router but exactly the same hardware as a RT-AC68U. It is touted as one of the best available routers in the market and is highly rated. However, TM-AC1900 contains a T-Mobile firmware which runs several years behind the official Asus firmware available for the hardware. Thus, it is of interest to "flash" the offical firmware with a newer one.

NOTE: The router works smoothly even without flashing. Don't flash if you don't need to.

Steps

Depending on the pre-installed firmware on the CellSpot router, many instructions below may or may not work for everyone. Howevery, they worked for mine.

Files needed

TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx
mtd-write
FW_RT_AC68U_30043763626.trx

Transfer these files to a thumb drive and connect to router. Alternatively, these files can also be transferred by scp once it is enabled (in step 1).

Step 0 (Connect router)

Disconnect the router from an internet connect.
Connect your laptop to the router through one of the ethernet ports, so that it is on the same WAN.
Set your PC's IP to 192.168.29.2 and Gateway to 192.168.29.1; leave Subnet as is.
Laptop should now to show a "wired" connection.
Open 192.168.29.1 in browser to check if router login page opens.

Step 1 (Downgrade firmware)

Boot the router in rescue/recovery mode

Keep holding the reset button for a few seconds and turn off the router
Turn on the router while button is pressed
Continue holding till the ASUS LED at the back starts flashing

At this stage (while the reset button is still pressed), navigate to 192.168.29.1 (the default router URL). It should load a ASUS miniCFE webpage. Upload the downgrading firmware (TM-AC1900-*) to it. It will flash your router.

After flashing, your router should restart and you can reopen the login webpage. Navigate to Administration --> System --> Enable SSH, and set it to "Yes".

Step 2 (Flash)

Replace stock bootloader with Asus bootloader

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 192.168.1.1 -l admin
cat /dev/mtd0 > /mnt/sd*/original_cfe.bin

Exit the shell. Retrieve this file from the thumb drive and upload it to cfeditor. Download the modified 1.0.2.0 (US) version. This is your new bootloader to be flashed on to the router. Place this file back on the thumb drive.
Login to router again with thumb drive connected to router

mtd-write /mnt/sd*/new_cfe.bin boot
mtd-write2 /mnt/sd*/FW_RT_AC68U_30043763626.trx linux

Step 3 (NVRAM reset)

Hold down the WPS button on the side of the router, unplug the power for 5 seconds, then plug it back in while continuing to hold the WPS button for 20 seconds.
Release the WPS button. This clears your nvram, effectively a factory reset.

Conclude

Congrats, your router is now flashed!

Your router URL or admin/password combination may have changed: Try 192.168.1.1. Further, you can also login again via SSH and run df -h to confirms that the jffs partition (/dev/mtdblock) has been expanded to 64M.

admin@RT-AC68U-3730:/tmp/home/root# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                33.6M     33.6M         0 100% /
devtmpfs                124.8M         0    124.8M   0% /dev
tmpfs                   124.9M    704.0K    124.2M   1% /tmp
/dev/mtdblock4           62.8M      1.7M     61.1M   3% /jffs

Now you can flash any other firmware from the ASUS Web GUI. For example, download Asuswrt-Merlin and upload it to the firmware upgrade webpage in the router.

raivivek/router_flash.md