How to change country (regulation domain) in E3000

Post new topic   Reply to topic    DD-WRT Forum Index -> Contributions Upload
Author Message
Kuzya
DD-WRT Novice


Joined: 11 Mar 2012
Posts: 1

PostPosted: Sun Mar 11, 2012 11:05    Post subject: How to change country (regulation domain) in E3000 Reply with quote
The router locked by firmware to channels, allowed in country where it was originally sold. The regulation (region code) is stored in NVRAM. Country code is located in CFE at offset 0x3FE2C, 2.4GHz code is at offset 0x3FE24, and 5GHz at offset 0x3FE28. I discovered few codes: EU, US. Empty fields (0xFF) works as US. Here are simple steps for changing region code in NVRAM.

1. Flash Linksys E3000 with DD-WRT as described http://www.dd-wrt.com/wiki/index.php/Linksys_E3000#Flashing_instructions_for_the_E3000 steps 1 - 10.
2. Enable telnet access and login to router:
telnet <router IP>,
user: root,
password: <admin pass>
3. Read your original boot and NVRAM http://www.dd-wrt.com/wiki/index.php/CFE_backup
dd if=/dev/mtd/0 of=/tmp/cfe_backup.bin
4. Read first part of CFE (upto region codes)
dd if=/dev/mtd/0 of=/tmp/cfe_1.bin bs=1 count=261668
5. Fill desired country codes in HEX format. EU = 0x45, 0x55.
echo -e "\x45\x55\xff\xff\x45\x55\xff\xff\x45\x55\xff\xff" -n >/tmp/cfe_2.bin
6. Copy thrird part of CFE:
tail -c 464 /tmp/cfe_backup.bin >/tmp/cfe_3.bin
7. Create new CFE file with updated region:
cat /tmp/cfe_1.bin /tmp/cfe_2.bin /tmp/cfe_3.bin >/tmp/cfe_new.bin
8. Check that new file has correct size:
ls -l /tmp
9. Check that only region was changed in new file:
cmp -b /tmp/cfe_backup.bin /tmp/cfe_new.bin
10. Write new file to flash:
mtd unlock cfe
mtd write -f /tmp/cfe_new.bin cfe
11. Restore stock firmware as described here:
http://www.dd-wrt.com/wiki/index.php/Linksys_E3000#Reverting_back_to_stock_firmware

Now you can select Wi-Fi channels 12,13.
Sponsor
slobodan
DD-WRT Guru


Joined: 03 Nov 2011
Posts: 1555
Location: Zwolle

PostPosted: Tue Apr 17, 2012 15:31    Post subject: Reply with quote
It is good that you said check file size, because following your instructions (through copying/pasting the information) the cfe_new.bin file resulted 4 bytes longer than it should.

I did apply this trick and I can confirm that it works, but I used HxD from Total Commander Ultima Prime instead of command line instructions. After I have edited the file with EUÿÿEUÿÿEU instead of Q2/3Q2/3US (ÿ is FF in hexadecimal), I did a binary content comparison and this was the one and only difference between the two files.

Another difference is that I did not flash back to stock firmware, I remained using DD-WRT firmware. I guess that this new cfe makes for me no real difference, but in any case my two WRT610N-EU routers, which had become E3000 (US region) through flashing the advised cfe and the custom firmware for conversion, are now E3000 (EU region).

_________________
2 times APU2 Opnsense 21.1 with Sensei

2 times RT-AC56U running DD-WRT 45493 (one as Gateway, the other as AP, both bridged with LAN cable)

3 times Asus RT-N16 shelved

E4200 V1 running freshtomato 2020.8 (bridged with LAN cable)

3 times Linksys WRT610N V2 converted to E3000 and 1 original E3000 running freshtomato 2020.8 (bridged with LAN cable)


slobodan
DD-WRT Guru


Joined: 03 Nov 2011
Posts: 1555
Location: Zwolle

PostPosted: Tue Apr 17, 2012 20:39    Post subject: Reply with quote
Debugged it. This script works ok on my E3000 with Kong 18730M firmware and OTRW:

Code:
dd if=/dev/mtd/0 of=/tmp/cfe_backup.bin
dd if=/dev/mtd/0 of=/tmp/cfe_1.bin bs=1 count=261668
echo -e "\x45\x55\xff\xff\x45\x55\xff\xff\x45\x55\xff\xff" >/tmp/cfe_2a.bin
dd if=/tmp/cfe_2a.bin of=/tmp/cfe_2.bin bs=1 count=12
tail -c 464 /tmp/cfe_backup.bin >/tmp/cfe_3.bin
cat /tmp/cfe_1.bin /tmp/cfe_2.bin /tmp/cfe_3.bin >/tmp/cfe_new.bin
ls -l /tmp/cfe*
cmp /tmp/cfe_backup.bin /tmp/cfe_new.bin
# Manually execute the commands below if you agree with flashing CFE:
# mtd unlock cfe
# mtd write -f /tmp/cfe_new.bin cfe

_________________
2 times APU2 Opnsense 21.1 with Sensei

2 times RT-AC56U running DD-WRT 45493 (one as Gateway, the other as AP, both bridged with LAN cable)

3 times Asus RT-N16 shelved

E4200 V1 running freshtomato 2020.8 (bridged with LAN cable)

3 times Linksys WRT610N V2 converted to E3000 and 1 original E3000 running freshtomato 2020.8 (bridged with LAN cable)


petew
DD-WRT Novice


Joined: 19 Apr 2013
Posts: 1

PostPosted: Fri Apr 19, 2013 16:41    Post subject: Reply with quote
Quote:

11. Restore stock firmware as described here:
http://www.dd-wrt.com/wiki/index.php/Linksys_E3000#Reverting_back_to_stock_firmware
Use this link for your dream interpretations! Start your dream analysis now.
Debugged it. This script works ok on my E3000 with Kong 18730M firmware and OTRW:

Code:
dd if=/dev/mtd/0 of=/tmp/cfe_backup.bin
dd if=/dev/mtd/0 of=/tmp/cfe_1.bin bs=1 count=261668
echo -e "\x45\x55\xff\xff\x45\x55\xff\xff\x45\x55\xff\xff" >/tmp/cfe_2a.bin
dd if=/tmp/cfe_2a.bin of=/tmp/cfe_2.bin bs=1 count=12
tail -c 464 /tmp/cfe_backup.bin >/tmp/cfe_3.bin
cat /tmp/cfe_1.bin /tmp/cfe_2.bin /tmp/cfe_3.bin >/tmp/cfe_new.bin
ls -l /tmp/cfe*
cmp /tmp/cfe_backup.bin /tmp/cfe_new.bin
# Manually execute the commands below if you agree with flashing CFE:
# mtd unlock cfe
# mtd write -f /tmp/cfe_new.bin cfe


Hey slobodan, thanks for debugging this and getting it working, I'm going to give it a go and hopefully it works on my firmware as it's slightly different to yours. I'll let you know how I get on.
aplacebo
DD-WRT Novice


Joined: 16 Sep 2014
Posts: 1

PostPosted: Tue Sep 16, 2014 10:46    Post subject: cfe write problem Reply with quote
I am trying to do the same thing, i.e trying to enable all available channels for the UK. I have followed the steps above but when it comes to "mtd write -f cfe_new.bin cfe" i get the error

Unlocking cfe ...
Writing from cfe_new.bin to cfe ... [e]Erasing mtd failed: cfe

Does anyone know why this might happen?
regae
DD-WRT Novice


Joined: 15 Jan 2015
Posts: 2

PostPosted: Sat Feb 07, 2015 10:50    Post subject: Reply with quote
hi, i have a real big nasty problem,
i have no idea why i did that,
i have followed this instructuion on my linksys e1200 v2, everything went good with the command, but after the latest command, i can not connect to my router, all leds switched on, no blinking or flashing, just dimmed, i tried 30/30/30 and nothing happened, nothing works, the wireless connection, ethernet connection, all dead, everything went south,

1 question in my mind, just take aside my stupidity for following this instruction,
what am i supposed to do right now?
with jtag or serial recovery, will it work?
or its just the end of my router?

anybody?
perieanuo
DD-WRT Novice


Joined: 07 Dec 2016
Posts: 2

PostPosted: Thu Dec 08, 2016 17:21    Post subject: Reply with quote
slobodan wrote:
Debugged it. This script works ok on my E3000 with Kong 18730M firmware and OTRW:

Code:
dd if=/dev/mtd/0 of=/tmp/cfe_backup.bin
dd if=/dev/mtd/0 of=/tmp/cfe_1.bin bs=1 count=261668
echo -e "\x45\x55\xff\xff\x45\x55\xff\xff\x45\x55\xff\xff" >/tmp/cfe_2a.bin
dd if=/tmp/cfe_2a.bin of=/tmp/cfe_2.bin bs=1 count=12
tail -c 464 /tmp/cfe_backup.bin >/tmp/cfe_3.bin
cat /tmp/cfe_1.bin /tmp/cfe_2.bin /tmp/cfe_3.bin >/tmp/cfe_new.bin
ls -l /tmp/cfe*
cmp /tmp/cfe_backup.bin /tmp/cfe_new.bin
# Manually execute the commands below if you agree with flashing CFE:
# mtd unlock cfe
# mtd write -f /tmp/cfe_new.bin cfe


hello sir,
after writind dowd your new cfe,you did reflashed with ddwrt or just rebooted the router or restored factory defaults on your existing ddwrt?
best regards,
pierre
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Contributions Upload All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum