Using TFTP at boot (getting TTL=100 pings), I could not get linksys_ea6900_ddwrt.bin to complete successfully. (erroring out at 75-90%). After many attempts, I managed to successfully flash linksys-ea6900-webflash.bin, so I went with that.
I don't recall the exact steps, but basically I created a new CFE bin file following the guide, copied it over via SSH, and then attempted to install it with:
mtd unlock /dev/mtd0
cd /tmp/root
mtd write -f new-cfe.bin mtd0
mtd unlock gave an error, so after researching, it was mentioned that dd does the same thing, so I ran:
dd if=new-cfe.bin of=/dev/mtd0
This is where things went south. From then on, I no longer got TTL=100 pings. The bootup went straight to TTL=64, and the web page no longer loaded.
Without the ability to try another TFTP flash, I decided to try through a serial connection, which I was able to establish. I can see the boot sequence over the serial connection (running Putty), and I can stop the boot sequence with CTRL+C to get to a CFE prompt. At this point, I get TTL=100 pings again. However, I still cannot flash linksys_ea6900_ddwrt.bin, but I was able to flash
FW_EA6900_1.1.42.158863_prod.img. Unfortunately, the web UI does not load.
If I let the router boot without stopping at the CFE prompt, I can login to BusyBox with root/admin (but there are a lot of error messages such as "wl: wl driver adapter not found").
I tried to copy over my new-cfe.bin file and a mtd-write file using TeraTerm send command, but mtd-write needs a library file, which probably won't work in BuysBox I guess. Trying with dd again gives an error saying permission denied on /proc/mtd0.
I'm trying to basically write a new CFE, but it seems the BusyBox environment won't work.
Does anyone have any ideas on how to flash a new CFE to this EA6900?
Last edited by joncl on Sat Aug 13, 2022 21:59; edited 1 time in total
Flashing FW_EA6900_1.1.42.158863_prod.img (14,421 Kb) with TFTP2, it flashes successfully:
Code:
Reading ::
TFTP Server.
..tftp retry wait 0
- last blk -
- Last block -
Done. 14766336 bytes read
Download of 0xe15100 bytes completed
Write kernel and filesystem binary to FLASH
Programming...copysize=14766336, amtcopy=14766336
done. 14766336 bytes written
I then hold the WPA until LED flashes quickly. I still get a this kind of stuff in the serial console, and also blank web page:
Code:
wl: wl driver adapter not found
wl: wl driver adapter not found
wifi, user vap eth2 is up
wifi, guest_enabled is set to 0, do not enable 2.4GHz guest
wifi, guest_enabled is set to 0, do not enable 5GHz guest
wl: wl driver adapter not found
wl: wl driver adapter not found
wl: wl driver adapter not found
wl: wl driver adapter not found
eth1: cmd=14: No such device
eth1: WLC_SET_VAR(pref_chanspec): No such device
eth1: WLC_GET_VAR(obss_coex): No such device
eth1: WLC_SET_VAR(chanim_sample_period): No such device
eth1: WLC_SET_VAR(noise_metric): No such device
eth1: WLC_GET_VAR(scb_assoced): No such device
eth1: WLC_GET_VAR(scb_assoced): No such device
eth1: WLC_GET_VAR(scb_assoced): No such device
wl: wl driver adapter not found
wl: wl driver adapter not found
wl: wl driver adapter not found
wl: wl driver adapter not found
eth1: WLC_GET_VAR(scb_assoced): No such device
eth1: WLC_GET_VAR(chanspec): No such device
eth1: WLC_GET_VAR(scb_assoced): No such device
Attached is entire output after successful flash of FW_EA6900_1.1.42.158863_prod.img.
Reading in another thread, someone mentioned their MACs are all the same. Well, mine are too! Below is output from "ifconfig" after letting the router boot to BusyBox. What is it supposed to look like? How to fix?
Ok, got it unbricked. This one was a real head-banger. What fixed it for me was the ASUS Firmware Restoration tool. Documenting here in case it helps someone.
Followed that guide, made a new CFE with updated MAC addresses, and no other changes. I was not able to flash linksys_ea6900_ddwrt.bin for some reason (TFTP2 kept erroring out at 75%). If I recall, the router was still on FW_EA6900_1.1.42.158863_prod.img, so enabled SSH from the webui, copied over new-cfe.bin, but mtd unlock did not work. So skipping any backup step (not smart), I ran:
Code:
dd if=new-cfe.bin of=/dev/mtd0
After that, nothing would flash successfully, except for the smallest firmwares (FW_EA6900_1.1.42.158863_prod.img and FW_EA6900_1.1.42.161129_prod.img).
I grabbed ASUS FW_RT_AC68U_300438643129, and the Firmware Restoration 2102.
Hold RESET, power on until you get the LED steady flash. It helps to have a serial console running so you can see the TFTP server running on the router. You also get TTL=100 pings.
Run the Firmware Restoration. At first, it could not find the router, I figured maybe because the model info in the Vortex CFE was for the EA6900?
So went back to the CFE prompt in the serial console (smash CTRL+C at power on). Then set ASUS AC68U values from step 5 in the guide above:
Code:
nvram set odmpid=RT-AC66U_B1
nvram set model=RT-AC68U
nvram set ATEMODE=0
nvram commit
Note that in that guide, he is running CFE version 1.3.0.7, but mine is 1.0.37 which I guess does not matter.
Then do the reset-power-on thing again, until TTL=100 shows up (TFTP server is running in the serial console). Now the Firmware Restoration tool was able to find the router and flash FW_RT_AC68U_300438643129 successfully!!
Unfortunately, https://192.168.1.1 still did not load, but the missing device errors I had before in the serial output were gone, and there was also a new mtd5 "asus" partition that was not there before.
Next, to revert those nvram commands above, I cleared nvram with the WPS button (power-on with WPS button held until the LED flashed rapidly, and you get a message in the serial console saying waiting for WPS button release).
I repeated reset-power-on to get the TFTP server running again with the TTL=100 pings, loaded the mini flash page at http://192.168.1.1, and was able to successfully flash Xvortex EA6900_380.57_0.trx, and after a reboot, the ASUS UI showed up at https://192.168.1.1 !!
Finally, I used the ASUS UI to flash freshtomato-EA6900-ARM_NG-2022.5-AIO-64K.trx, and I now have the latest Fresh Tomato running on my previously bricked EA6900.