Skip to content

Instantly share code, notes, and snippets.

@jiayuzhou

jiayuzhou/TMAC1900_Merlin.md

Last active June 12, 2023 18:30
Show Gist options
  • Save jiayuzhou/6ef111e9e1767b6879bdc2d22465874a to your computer and use it in GitHub Desktop.
Save jiayuzhou/6ef111e9e1767b6879bdc2d22465874a to your computer and use it in GitHub Desktop.
Download ZIP
Flash Merlin to TM-AC1900
Raw
TMAC1900_Merlin.md

Flash Merlin (https://asuswrt.lostrealm.ca) experience

Bought TMobile Cellspot (TM-AC1900) and would like to flash Merlin firmware.

  1. Purchased router equipped with TMobile firmware version: 3.0.0.4.376_2827 Gateway address: 192.168.27.1

  2. Downgrade TMoble firmware to enable TELNET 1.1 Get into recovery mode (hold reset and power up, until ping TTL=100) 1.2 Downgrade to Tmobile firmware version: 3.0.0.4_376_1703 TRX use tftp binary transfer. 1.3 Reset NVRAM (hold the side WPS button and power up. Wait for 15 sec and release WPS) 1.4 Login to 192.168.27.1 and under administration enable TELNET access. (system => enable telnet => apply) Gateway address: 192.168.29.1. Access: admin:password

  3. Replace TMobile boot file (CFE) to ASUS boot file. 2.1. Mount USB drive in USB2.0 port. 2.2. Cat boot file (Old CFE) into flash drive. 2.3. Use a Hex editor and look for 3 MAC addresses in the old CFE 2.4. Obtain the ASUS boot (new CFE), use Hex to write in the recorded 3 MAC addresses. 2.5. Write the new CFE to the router using Telnet.

  4. Now with downgraded Tmobile flash and Asus CFE, I cannot no longer flash to any either Asus or Merlin, which is sad. Tftp will get "error ?????".

  5. Use tftp to flash tomato tomato-RT-AC68U-ARM--124-VPN-64K.trx Gateway Address: 192.168.1.1, Access: root:admin

  6. Use tomato to flash merlin. RT-AC68U_380.62_X7.1.trx Gateway Address: 192.168.1.1, Access: root:admin

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment