How to Convert T-Mobile AC 1900 Into Asus RT AC68U on Mac OSX

How to Convert T-Mobile AC 1900 Into Asus RT AC68U on Mac OSX: Did you just get your hands on a T-Mobile AC-1900 personal cell spot and want to hack and convert it into the Asus RT AC68U router, you googled and all the guides were for Windows? We got you covered peeps, in this guide, we will tell you how to convert T-Mobile AC 1900 into Asus RT AC68U on Mac OSX.

**WARNING: We are not responsible for any bricked devices. Use at your own risk. This procedure could brick your router. There currently is no known working JTAG hardware procedure to unbrick it. Unsoldering the NAND chip and flashing in a dedicated flasher is the only currently known way to flash the CFE (bootloader) back in!!! ***

Please, read completely through this guide. If the guide isn’t clear or you run into trouble, please post a question via a comment.

If you have just received your T-Mobile TM AC1900 router and want to hack it into Asus RT AC68U, it is recommended to not connect the router to the Internet. The router will automatically update both the firmware and bootloader if connected to the Internet. Although the router ‘could’ already have the latest firmware and/or CFE, there are fewer steps to complete the process if the router is on older firmware and/or CFE.

How to Avoid Nintendo 3DS Ban Wave 002-0102

How to Convert T-Mobile AC 1900 Into Asus RT AC68U on Mac OSX

Pre-Requisites

Set Static IP on OS X

The connecting Mac must have a static IP address to complete the CFE flashing process and Telnet must be enabled to enter the commands to the router. Hit the link below on how to set static IP o OS X.

http://www.macinstruct.com/node/550

The recommended IP addresses are as follows (this guide assumes the router has the default IP address setting of the respective firmware type)

Set OS X to 192.168.29.2, Router will be 192.168.29.1 by default.

A USB Drive

Obtain a USB flash drive (minimum 2GB) and connect to your Mac OSx. Take note of the name of the USB flash drive noting the CASE of each letter in the spelling of the name. Keep the name handy, we will be using the name later.

How to NVRAM reset. Perform NVRAM reset when the tutorial asks you to do so.

This can be done by the following two methods:

Method 1: Using Telnet

Open Terminal on Mac and Telnet into the router.

Enter the following command to reset NVRAM: MTD-erase2 NVRAM <Enter>.

Enter the following command to reboot: reboot <Enter>.

Method 2: Using the WPS button

Power router off.

Wait for 10 seconds.

Press and hold the WPS button.

Power the router back on while continuing to hold the WPS button for 15-20 seconds.

Step 1 – Enable Telnet.

Make sure the router is turned on, and connect your router (yellow LAN port labeled 1 on the back of the router) to the LAN port on the Mac using the cable provided.

Login to the router using the web browser (http://192.168.29.1) and navigate to the ADMINISTRATION > SYSTEM> ENABLE TELNET> YES (then apply and save settings). If you are asked for a username and password, type the username as admin and password as the password.

In case you do not see the option to enable Telnet, means you are on updated firmware. Follow the below steps to make sure the option is visible.

Open your Administration > System page (probably http://192.168.29.1/Advanced_System_Content.asp)

Then, while on that page, press F12 to bring up your browser’s developer tools

Search the HTML for ‘telnet’ and you should see a block like this:

[code]

<th>Enable Telnet</th>

<td>

<input type=”radio” name=”telnetd_enable” class=”input” value=”1″ disabled=””>Yes

<input type=”radio” name=”telnetd_enable” class=”input” value=”0″ checked=”” disabled=””>No

</td>

</tr>

[/code]

Edit it (double click, or right-click and ‘edit as HTML or similar) and then delete the style value ‘display: none‘ and remove the word ‘disabled‘ from the input type tags (the checkboxes). It should look something like this after you have changed it:

[code]

<th>Enable Telnet</th>

<td>

<input type=”radio” name=”telnetd_enable” class=”input” value=”1″ >Yes

<input type=”radio” name=”telnetd_enable” class=”input” value=”0″ checked>No

</td>

</tr>

[/code]

Press ESC (or click somewhere else in the editor) to apply your changes and the Telnet checkboxes are now available. Select yes for telnet, then click apply. Telnet is enabled, no downgrade is required.

Check Telnet working on OS X

On you Mac, open Applications -> Utilities -> Terminal.

In the terminal window, type the following command

Telnet 192.168.29.1.

It will ask for a username followed by a password. In our case username is admin and the password is password.

Next type in the below commands.

get current CFE version: nvram get bl_version

Note down the number displayed on the screen. This also ensures that telnet is working.

Step 2 – Backup Existing CFE (bootloader)

Reset NVRAM of the router (see NVRAM reset section at the end of the post, using Method 2)

Plug the USB flash drive into a USB port on the back of the router (Note: black USB 2.0 port recommended)

Connect Mac Ethernet port to one of the router’s LAN ports using a CAT 5e/6 cable (the yellow cable that came in the box).

Open a browser and navigate to the router’s GUI (http://192.168.29.1). Login to router(userid-admin,password-password)

Make sure Telnet is enabled.

On your Mac Open Applications -> Utilities -> Terminal.

Type the following commands:-

Telnet 192.168.29.1

Enter userid and password, in our case admin and password.

Issue command mentioned below. This will save existing CFE aka bootoader onto USB stick:

cat /dev/mtd0 > /tmp/mnt/USB_NAME/original_cfe.bin <Enter aka press Enter/return key on Mac>

Replace USB_NAME with USB flash drive name noted from pre-requisites section.

Verify original_cfe.bin is stored on USB, by issuing the below command.

ls /tmp/mnt/USB_NAME/ <Enter>

.original_cfe.bin should be listed

Exit Telnet by issuing the below command in the terminal.

close

Wait for 10 seconds, then remove the USB flash drive from the router

Step 3 – Edit and Flash New CFE

Download Required files/software

Download New CFE version 1.0.2.0 from the below link (will need to unrar/unzip the file).

https://mega.nz/#!IxZTAbDZ!Rardt8pN-ULyYk9ak_O2X-g-YhPWauuH-tByYIvWYgY

Download/Install Hex Editor for Mac OS X

https://itunes.apple.com/us/app/ihex-hex-editor/id909566003?mt=12

Download mtd-write v2 from here (will need to unrar/unzip the file).

https://mega.nz/#!R4AWkJSQ!pGw1Vl0j6qS9kYhbOtpvsgbKf-VIRfWRw61HhmIqRDM

Perform below steps

Uncompress the downloaded files
Copy the uncompressed mtd-write file to the USB flash drive
Copy the downloaded uncompressed CFE to the USB flash drive
Navigate to the USB flash drive and rename the file downloaded CFE.bin to new_cfe.bin

Edit new_cfe.bin to have mac address and wps from your router

This section gives details on how to copy the three (3) MAC address values and the WPS code from the original CFE file to the new CFE file.

There are three (3) MAC addresses in the original CFE that must be copied to the new CFE. Search for ‘mac’ in the original and new CFE files. Each ‘mac’ search will respond with XX:XX:XX:XX:XX:XX. The original XX:XX:XX:XX:XX:XX will be copied and pasted over the new CFE’s XX:XX:XX:XX:XX:XX at the same point. This will be done three times to copy all entries of the MAC address. The WPS code can be found by searching for ‘secret’. Once found in both original and new CFE, the secret code numbers can be copied and pasted over the new CFE file’s secret code numbers. Note: The first two of the MAC addresses may be the same with the third one being different. This is normal.

Plug the USB flash drive into a USB port on the Mac
Navigate to the USB flash drive. At this point, you should have both original_cfe.bin and new_cfe.bin on your USB flash drive.
Open up iHex Editing Software downloaded above
Open up the original_cfe.bin file from the USB flash drive using the iHex software
Open up the new_cfe.bin file from the USB flash drive using the iHex software. You should have two tabs listed on the HxD software, one labeled new_cfe.bin and the other labeled original_cfe.bin

First MAC search and replace.

From the original_cfe.bin tab, search (<CTRL><F>) for ‘mac’ (no quotes). It should find something like this: et0macaddr=XX:XX:XX:XX:XX:XX (XX will be replaced by your mac address)
Highlight the XX:XX:XX:XX:XX:XX just found and copy (<CTRL><C>)
From the new_cfe.bin tab, search (<CTRL><F>) for ‘mac’ (no quotes). It should find something like this: et0macaddr=XX:XX:XX:XX:XX:XX (XX will be replaced by your mac address)
Highlight the XX:XX:XX:XX:XX:XX just found and now paste the value copied above over it (<CTRL><V>). The XX:XX:XX:XX:XX:XX value from copied from the original_cfe.bin tab should overwrite the value just found and highlighted in the new_cfe.bin tab

Second MAC search and replace.

From the original_cfe.bin tab, search again (F3>) for ‘mac’ (no quotes). It should find something like this: macaddr=XX:XX:XX:XX:XX:XX (XX will be replaced by your mac address)
Highlight the XX:XX:XX:XX:XX:XX just found and copy (<CTRL><C>)
From the new_cfe.bin tab, search again (<F3>) for ‘mac’ (no quotes). It should find something like this: macaddr=XX:XX:XX:XX:XX:XX (XX will be replaced by your mac address)
Highlight the XX:XX:XX:XX:XX:XX just found and now paste the value copied above over it (<CTRL><V>). The XX:XX:XX:XX:XX:XX value from copied from the original_cfe.bin tab should overwrite the value just found and highlighted in the new_cfe.bin tab

Third MAC search and replace.

From the original_cfe.bin tab, search again (F3>) for ‘mac’ (no quotes). It should find something like this: macaddr=XX:XX:XX:XX:XX:XX (XX will be replaced by your mac address)
Highlight the XX:XX:XX:XX:XX:XX just found and copy (<CTRL><C>)
From the new_cfe.bin tab, search again (<F3>) for ‘mac’ (no quotes). It should find something like this: macaddr=XX:XX:XX:XX:XX:XX (XX will be replaced by your mac address)
Highlight the XX:XX:XX:XX:XX:XX just found and now paste the value copied above over it (<CTRL><V>). The XX:XX:XX:XX:XX:XX value from copied from the original_cfe.bin tab should overwrite the value just found and highlighted in the new_cfe.bin tab

Now, a double-check for accuracy.

From each tab, press <F3> (Search again) one more time and verify that iHex displays the window “Can’t find mac”. This ensures that you have copied all three (3) instances of the MAC address from your original CFE to your new CFE. It is recommended to go back to the top of each file and search and compare the three (3) ‘mac-address values again for accuracy.

WPS code (secret code) copy.

From the original_cfe.bin tab, search (<CTRL><F>) for ‘secret’ (no quotes). It should find something like this: secret_code=XXXXXXXX (XXXXXXXX will be replaced by your WPS eight (8) digit code)
Highlight the XXXXXXXX just found and copy (<CTRL><C>)
From the new_cfe.bin tab, search (<CTRL><F>) for ‘secret’ (no quotes). It should find something like this: secret_code=XXXXXXXX (XXXXXXXX will be replaced by your WPS eight (8) digit code)
Highlight the XXXXXXXX just found and now paste the value copied above over it (<CTRL><V>). The XXXXXXXX value from copied from the original_cfe.bin tab should overwrite the value just found and highlighted in the new_cfe.bin tab
Verify that the secret_code value from the original CFE tab was copied properly to the new CFE tab

Save the final results.

From the new_cfe.bin tab, save the file (File – Save). Your edited new_cfe.bin file should now be saved to the USB flash drive
Close iHex
After a 10 second wait, remove the USB flash drive from Mac

Flash New CFE

Plug the USB flash drive into a USB port on the back of router (Note: black USB 2.0 port recommended)
Reset NVRAM of router using Method 2.
Open Terminal and Telnet into router
Navigate to the USB flash drive using the following command: cd /tmp/mnt/USB_NAME/ <Enter>
Verify that your new_cfe.bin, original _cfe.bin and mtd-write files are on the USB flash drive by typing: ls <Enter>
Verify that your MAC Address edits worked with the following command: ./grep mac ./original_cfe.bin ./new_cfe.bin. If the results don’t match, STOP and recheck your work (Hex editor)
Verify that the WPS Secret Code edits worked with the following command: ./grep secret ./original_cfe.bin ./new_cfe.bin. If the results don’t match, STOP and recheck your work (Hex editor)
Flash the new CFE file with one of the commands depending on version of mtd-write downloaded in Section #2:
mtd-write version 2: ./mtd-write -i new_cfe.bin -d boot <Enter>
Wait for the 5 to 10 second pause to complete and come back to the Telnet command prompt
Reboot the router by typing the following command: reboot <Enter>. The router may also be rebooted by turning Off and then back On (about 5 seconds).
Reset NVRAM of router using any method.

Verification of CFE (after reboot).

Open Terminal on Mac and Telnet into router
Enter the following command to verify CFE version: nvram get bl_version <Enter>. The revision should now match the version that you downloaded 1.0.2.0

Step 4 – Flash Official Asus Firmware (will expand rootfs partition from 32M to 64M)

Download Asus Official Firmware from the below link and Unzip

http://dlcdnet.asus.com/pub/ASUS/wireless/RT-AC68U/FW_RT_AC68U_30043763626.zip?_ga=1.98421983.1346884498.1473784618

Make sure you have static IP address as mentioned in pre-requisite.
Perform NVRAM RESET using any method (Wait for 5 minutess for router to fully boot)
Place router into Restore / Recovery mode
1. Turn power off to the router by disconnecting the power cable
2. Wait 10 seconds
3. Press and hold the Reset button
4. Restore power to router while continuing to hold Reset button
5. Continue to hold Reset button for 20 seconds then let go or until the power led starts flashing. (When putting it into recovery mode (newer firmware/CFE), the rear asus logo will be off for about 5 to 10 seconds before turning on. On the front panel, only the power and the ethernet LED will be solidly lit up). wait 180 seconds for router to enter recovery
Connect a cable between the LAN port 1 (NOT the WAN port) on the router and your Mac.
Open Terminal
CD into the older where you extracted the trx file
Upload the firmware using tftp in terminal:
1. tftp -e 192.168.29.1
2. In the tftp shell execute these commands (enter the part after tftp> )
  1. tftp> timeout 90
  2. tftp> verbose
  3. tftp> status
The output of the status command should be something like:
1. Connected to 192.168.29.1. Mode: octet Verbose: on Tracing: off Rexmt-interval: 5 seconds, Max-timeout: 90 seconds
2. The main thing to watch out for in the output is that the mode is binary (octet) and that the timeout is high enough for the upload to complete.
Still using the tftp shell, upload the trx file to the router:
1. tftp> put FW_RT_AC68U_30043763626.trx
2. The output should be:
  1. putting FW_RT_AC68U_30043763626.trx to 192.168.29.1 FW_RT_AC68U_30043763626.trx [octet]
  2. The upload should finish in about 10 seconds:
    1. Sent xxxxxxxxx bytes in 9.5 seconds [xxxxxxx bits/sec]
Wait for 5-10 minutes
1. After the upload is complete is that the router will restart and then install the firmware.
2. After the power light should stops flashing wait for 5-10 minutes, this is currently the only know indicator.
Perform NVRAM RESET using any method. At this point routers address should be 192.168.1.1.

At this point, you have converted your T-Mobile AC 1900 Into Asus RT AC68U. If you want to install custom firmware proceed to step 5 else you can stop here also.

Step 5 – Flashing Custom Firmware Asus RT-AC68U

Follow steps in Step 4 after downloading custom firmware using the links below. Please note routers’ IP address may now be 192.168.1.1 and userid and password may also have changed (user: root, password: admin).

Merlin – https://www.mediafire.com/folder/bkfq2a6aebq68/Asuswrt-Merlin#qc4e5xc252czd

Advanced Tomato – https://advancedtomato.com/downloads/router/rt-ac68u

Please make sure to leave us a comment below on our How to Convert T-Mobile AC 1900 Into Asus RT AC68U on Mac OSX article.