[SOLVED] RT-AC1900 w/kongac 31800M - serial port Linux shell

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message

Joined: 22 Jun 2008
Posts: 489

PostPosted: Mon Jun 24, 2019 3:47    Post subject: [SOLVED] RT-AC1900 w/kongac 31800M - serial port Linux shell Reply with quote
How to load and flash a firmware file from a USB device? This unit has been balky and frustrating, and I'm desperately trying to insure a good, reliable firmware load. Tried TFTPD on boot, tried Asus Restore, neither worked. Sad

Are there commands available from the command line to load a firmware file? Any and all help greatly appreciated. Thanks!

Update: I have been able to use TFTP to upload the firmware.trx file from my laptop to the /tmp directory on the router. Now all I need is how to get it loaded.

2x Asus RT-AC68U

Last edited by KeithB on Wed Jun 26, 2019 23:38; edited 1 time in total

Joined: 18 Sep 2010
Posts: 8034

PostPosted: Mon Jun 24, 2019 4:21    Post subject: Reply with quote
AFAIK, all ASUS routers can be updated via tftp (at the command line) by putting the router into restore mode (no need for the ASUS Restoration Utility, which would probably reject third-party firmware anyway). You can usually trigger restore mode by holding the restore button while simultaneously applying power, until the power LED begins to flash very slowly. Finally, w/ your PC/laptop configured w/, you can put the firmware file to the router @

Over the years, ASUS has made it more difficult to do this, presumably to prevent third-party firmware. Sometimes you need to hold more than just the restore button. In the case of my RT-AC68U, I have to hold the restore, WPS, wifi, buttons, all at the same time, while applying power, and making sure to let go as soon as the LAN LED begins to flash. A major pain. Sometimes takes me 20-30 mins to get the firmware installed.

Once the firmware is installed, you need to wait at least 5 mins (sometimes it takes considerably longer) w/ the power ON, then power cycle, and do a hardware reset, using a combination of the restore and WPS buttons.

DD-WRT: DNS Leak Detection w/ VPNs (updated 6/5/19)
NEW SCRIPT!: ddwrt-mount-usb-drives.sh
NEW SCRIPT!: ddwrt-blacklist-domains.sh
NEW SCRIPT!: ddwrt-ovpn-remote-access.sh
NEW SCRIPT!: ddwrt-pptp-policy-based-routing.sh

Joined: 22 Jun 2008
Posts: 489

PostPosted: Mon Jun 24, 2019 11:06    Post subject: Reply with quote
Thank you, eibgrad. Unfortunately, rescue/restore mode is where this router just won't go. Sad No combination of 30/30/30 reset, reset, WDS, or that other button seem to get it into TFTP rescue mode. That's precisely why I've opened it up and connected a serial console.

I just NVRAM SET WAIT_TIME=5, NVRAM WRITE, and REBOOT and it did NOT wait. This is CFE 1.0.20 from way back in the day, even before AImesh was available. I'm surprised it won't even boot wait. Sad

It appears one of the TFTP wait NVRAM settings is not defined. Sad


Detect CPU turbo button...

CFE version (r456083) based on BBP 1.0.37 for BCM947XX (32bit,SP,)
Build Date: Sun Aug  3 03:15:27 WEST 2014 (root@backbone)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
DDR Clock: 666 MHz
Info: DDR frequency set from clkfreq=800,*666*
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller (r456083)
CPU type 0x0: 800MHz
Tot mem: 262144 KBytes

CFE mem:    0x00F00000 - 0x01795680 (9000576)
Data:       0x00F4DCDC - 0x00F4E1A8 (1228)
BSS:        0x00F4E1B8 - 0x00F93680 (283848)
Heap:       0x00F93680 - 0x01793680 (8388608)
Stack:      0x01793680 - 0x01795680 (8192)
Text:       0x00F00000 - 0x00F44390 (279440)

Device eth0:  hwaddr 14-DD-A9-88-B5-70, ipaddr, mask
        gateway not set, nameserver not set
Null Rescue Flag.
boot the image...
go load
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: TFTP Server.
..tftp retry wait 0
Could not load :: Timeout occured
Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
Loading: ... 1636032 bytes read
Entry at 0x00008000
Closing network.
Starting program at 0x00008000
Uncompressing Linux... done, booting the kernel.

2x Asus RT-AC68U

Joined: 22 Jun 2008
Posts: 489

PostPosted: Mon Jun 24, 2019 11:29    Post subject: Reply with quote
Okay, it seems the mtd command is supplied by the rc binary:

root@DD-WRT:/usr/sbin# cd /sbin
root@DD-WRT:/sbin# ls -la mtd*
lrwxrwxrwx    1 root     root             2 Mar 31  2017 mtd -> rc

root@DD-WRT:/bin# mtd -help
mtd: unrecognized option: h
Usage: mtd [<options> ...] <command> [<arguments> ...] <device>

The device is in the format of mtdX (eg: mtd4) or its label.
mtd recognizes these commands:
        unlock                  unlock the device
        resetbc                 reset bootcounter for WRT1900AC/WRT1200AC/WRT1900ACv2
        erase                   erase all data on device
        write <imagefile>|-     write <imagefile> (use - for stdin) to device
Following options are available:
        -q                      quiet mode (once: no [w] on writing,
                                           twice: no status messages)
        -r                      reboot after successful command
        -f                      force write without trx checks
        -e <device>             erase <device> before executing the command

Example: To write linux.trx to mtd4 labeled as linux and reboot afterwards
         mtd -r write linux.trx linux

and the MTD block devices are:


brw-r--r--    1 root     root       31,   0 Jan  1 01:00 /dev/mtdblock0
brw-r--r--    1 root     root       31,   1 Jan  1 01:00 /dev/mtdblock1
brw-r--r--    1 root     root       31,   2 Jan  1 01:00 /dev/mtdblock2
brw-r--r--    1 root     root       31,   3 Jan  1 01:00 /dev/mtdblock3
brw-r--r--    1 root     root       31,   4 Jan  1 01:00 /dev/mtdblock4

So now I need to determine which of these mtdblock devices is the Linux kernel and which is the userland/application. Sure would be nice if a CFE wizard would help out with a little guidance. Wink

2x Asus RT-AC68U

Joined: 18 Mar 2014
Posts: 4693
Location: Netherlands

PostPosted: Mon Jun 24, 2019 13:21    Post subject: Reply with quote
I use the following:
cat /proc/mtd

When I flash my EA6900 (you might need another file!) via CLI:
cd /tmp

wget http://www.desipro.de/ddwrt/K3-AC-Arm/dd-wrt.v24-K3_AC_ARM_STD.bin

mtd write dd-wrt.v24-K3_AC_ARM_STD.bin linux


After reboot reset with the WPS button (press WPS button, power down, while holding WPS button, power up and hold for approx 25 seconds till the lights start flashing).
My EA6900 has a CFE derived from Asus Smile

Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
OpenVPN Policy Based Routing guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard Setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135

Joined: 22 Jun 2008
Posts: 489

PostPosted: Mon Jun 24, 2019 17:28    Post subject: Reply with quote
@egc: Thank you for confirming what I thought might be the proper mtd write command. Early this morning, I was actually able to use the DD-WRT GUI from the kongac firmware to load the firmware file I could not load, earlier. I strongly suspect it had to do with the flash partition sizes, so I went back to whichever version of the AsusWRT firmware would re-size the partitions. Once that succeeded, I had to scoot out the house and get to work, but I think I'm finally in the clear. Smile
2x Asus RT-AC68U

Joined: 22 Jun 2008
Posts: 489

PostPosted: Wed Jun 26, 2019 23:41    Post subject: Reply with quote
FYI, the Asus mtd5 partition was still present, and still had the gzipped archive of T-Mobile certificates.

dd bs=1024 if=/dev/zero of=/dev/mtdblock5

took care of that quite rapidly. No more issues after that.

2x Asus RT-AC68U
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT


Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum