ASUS RT-AC66U CFE and DD-WRT on H/W version B0

When you try to flash DD-WRT on Asus AC66U you will stuck on ASUS Recovery Page. DD-WRT won’t work because ASUS will close their hardware to third party software.

If your router is in recovery page just flash original TRX firmware file.

ASUS MIPS Broadcom routers have something like bootloader called CFE. It contains built-in configuration like MAC addresses, interfaces configs etc.

DD-WRT won’t boot on new CFE: 1.0.2.0 (EU) so I downgrade CFE to 1.0.1.6 (EU). Be carefull, you can brick your router.

Resources

  • HEX editor, on windows you can use HxD: https://mh-nexus.de/en/hxd/
  • Pendrive (FAT32 file system)
  • PuTTY for telnet connection: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
  • CFE collection for AC66U: http://www.mediafire.com/download/h3v61arkqaqg6zg/CFE-AC66U.zip
  • CFE collection for other ASUS routers: http://www.mediafire.com/download/yoxw8f2xt9j87ca/CFE_AIO.zip
  • MTD-WRITE ARM: http://www.mediafire.com/download/q2dbo6ngwpdn87q/mtd-write-arm.zip

CFE source: http://www.snbforums.com/threads/asus-routers-cfe-dumps-collection.17793/

Before you start you have to read this warning and check which version do you have:
cfe ac66u warning hw version

Check information and prepare

You have to check current H/W version, bl version (CFE) and memory manufacturer.

  • Activate Telnet access in webpanel: [Advanced Settings] -> [Administration] -> [System] -> Enable Telnet – check Yes -> Click [Apply]
  • Run putty and set telnet to 192.168.1.1, click Open: telnet asus
  • Run command to check bl version:
    nvram get bl_version
  • Run command and read part output to check memory chip vendor (work only on ASUS WRT):
    dmesg | grep -e "flash" -e "nand" -e "amd" /tmp/syslog.log
    output:

    Found a Zentel NAND flash with 2048B pages or 128KB blocks; total size 128MB

  • Connect pendrive and make current CFE backup. Check the correct path to pendrive:
    ls /tmp/mnt/
    cd /tmp/mnt/sda/
  • Make a backup:
    cat /dev/mtd0 > /tmp/mnt/sda/original_cfe.bin
    dd if=/dev/mtd0 of=/tmp/mnt/sda/original_cfe1.bin
  • Umount pendrive in webpanel (USB icon right-top corner).
  • Connect pendrive to computer, copy files (original_cfe.bin and original_cfe1.bin) to safe place. Open one file in HxD – hex editor and search hw_version
  • Read and copy three MAC addresses in hex editor, these variables:
    et0macaddr=
    pci/1/1/macaddr=
    pci/2/1/macaddr=
  • Read H/W version from the box of router

Information about my router.

ASUS RT-AC66U:
H/W Version: B0 hw_version=1.5
CFE: 1.0.2.0 bl_version=1.0.2.0
EU version

I decided to downgrade to 1.0.1.6 (EU).

Prepare CFE and flash it

  • Copy MTD-WRITE v3 to penrive
  • Open chosen CFE version [1.0.1.6 (EU)] in hex editor:
    asus cfe
  • Replace three mac addresses with correct which was red before.

    et0macaddr=XX:XX:XX:XX:XX:XX
    pci/1/1/macaddr=XX:XX:XX:XX:XX:XX
    pci/2/1/macaddr=XX:XX:XX:XX:XX:XX

    asus cfe mac address
    Be careful at the beginning and at the end there is 00 (null) in visible part is a dot, do not remove or replace it.

  • Save modified file as new_cfe.bin on pendrive.
  • Make sure you want do this.
  • Connect pendrive to router and flash CFE with putty:
    cd /tmp/mnt/sdb/
    chmod +x mtd-write
  • Flash CFE
    mtd-write -i new_cfe.bin -d pmon
    mtd-erase -d nvram
    reboot
  • Skip wizard, activate telnet and check with putty CFE version:
    nvram get bl_version
  • Done. You can flash any DD-WRT Version.

Rescue from Marshall London HS-USB Diagnostics 9006 mode

After flashing Lenovo S60 from 4.4.4 to 5.0.2 (or 5.0.1) i ove got weird mode: Marshall London HS-USB Diagnostics 9006 and a lot of removable media.

In this mode you can access directly eMMC memory in phone. Use EMMC RAW TOOL to backup (read) all partitions!!!

Easy way: flash with MiFlash

Download and install: MiPhone 2.11.6 (MiFlash). (yes, just use miflash to flash lenovo)
http://www.mediafire.com/download/x3feqw4lmsk5s3a/MiFlash-MiPhone-2.11.6.zip
Run MiFlash choose Advanced:
miflash flash
and browse for all correct files:
miphone miflash flash
Then click ok and in the main windows flash and wait.

qualcomm-mmc-storage-usb-device

Another way: eMMC memory

http://www.mediafire.com/download/9e3lsu3hq83a5iy/EMMCRAW_1.4.0.0.zip
You can just read and write eMMC memory in this mode. I will use eMMC RAW Tool 1.4.0.0 (source: http://4pda.ru/forum/index.php?showtopic=655617 ).

Backup IMEI

In this mode you can backup all partition. You should do that first! Click Read Selected Partitions.

Write partitions images:

  1. Load GPT partition table. In write column Browse > Select gpt_main0.bin file > Click Load partition structure > Make sure in presets is MBR-GPT-OTHER > Click Write selected partitions:
    emmc raw tool partition structure
  2. Do the same with partitions image what you have. Choose preset, browse for correct file and click write selected partitions. Do not make a mistake (wrong preset with wrong image file).

    You can check correct files in rawprogram0.xml:
    filename="NON-HLOS.bin" label="modem"

    1. MBR-GPT-OTHER – gpt_main0.bin
    2. MODEM – NON-HLOS.bin
    3. SBL1 and SBL1BAK – sbl1.mbn and sbl1.mbn_sbl1bak

    Do not flash these, only do a BACKUP (read):
    There is a IMEI and other important settings!

    • fsc
    • ssd
    • DDR
    • sec
    • mrd
    • pad
    • modemst1
    • modemst2
    • fsg
    • persist
    • misc
    • config
    • keystore
    • oem
  3. After correctly writing images you can reset phone by pressing Power button for 10-30 seconds.
  4. Do the factory reset in recovery menu. (without it phone will stuck in boot, just press Vol+ and Vol- and pwr buutton, choose english and fuse wipe data, cache or choose power off and press vol- and connect usb cable, choose factory default)
  5. Flash again the same ROM which cause trouble, it should work now!

USBASP V2.0 – warning: cannot set sck period

Cheap USBASP programmer which you china buy on ebay, ali and others. Official project WebPage: http://www.fischl.de/usbasp/

usbasp-v2.0-board-pinout

  • JP1 – Supply Target – Choose between 5V and 3.3V.
  • JP2 – Self Program – jumper on for self program, normally free
  • JP3 – Slow SCK – Jumper on only if the target clock is lower than 1.5 MHz.
  • LED R – Programmer communicating with target device
  • LED G – Power on
  • IDC pinout:
    usbasp-v2.0-idc-pinout

I will write how to solve:

avrdude: warning: cannot set sck period. please check for usbasp firmware update

You have to flash a new firmware version: usbasp.2011-05-28. Precompiled bin to flash is in \bin\firmware\ directory.

I’ve got USBASP with Atmega8 so I will use usbasp.atmega8.2011-05-28.hex and Arduino UNO R3 as ISP to flash it.

  1. First open ArduinoISP example in Arduino IDE 1.6.8 and upload the sketch (CTRL+U). Disconnect Arduino.
  2. Connect arduino to usb asp directly (without any adapter only cables) as follows:
    Arduino<->USBASP
    10<------>5 (RESET)
    11<------>1 (MOSI)
    12<------>9 (MISO)
    13<------>7 (SCK)
    5V<------>2 (VCC +5V)
    GND<----->10 (GROUND)
  3. Set jumper on JP2 (you can solder goldpins).
  4. Set power jumper for 5V (JP1)
  5. Connect only Arduino to USB and check which port com it use. You must not connect usbasp to usb!
  6. Download AVRDUDE avrdude-6.3-mingw32.zip: http://download.savannah.gnu.org/releases/avrdude/
  7. Copy correct hex file to avrdude.exe file directory.
  8. Check the connection with command:
    avrdude -c avrisp -P COMX -b 19200 -p ATmega8 -v

    avrdude: Version 6.3, compiled on Feb 17 2016 at 09:25:53
    Copyright (c) 2000-2005 Brian Dean, http://www.bdmicro.com/
    Copyright (c) 2007-2014 Joerg Wunsch

    System wide configuration file is „C:\WinAVR-20100110\bin\avrdude.conf”

    Using Port : COM4
    Using Programmer : avrisp
    Overriding Baud Rate : 19200
    AVR Part : ATmega8
    Chip Erase delay : 10000 us
    PAGEL : PD7
    BS2 : PC2
    RESET disposition : dedicated
    RETRY pulse : SCK
    serial program mode : yes
    parallel program mode : yes
    Timeout : 200
    StabDelay : 100
    CmdexeDelay : 25
    SyncLoops : 32
    ByteDelay : 0
    PollIndex : 3
    PollValue : 0x53
    Memory Detail :

    Block Poll Page Polled
    Memory Type Mode Delay Size Indx Paged Size Size #Pages MinW MaxW ReadBack
    ———– —- —– —– —- —— —— —- —— —– —– ———
    eeprom 4 20 128 0 no 512 4 0 9000 9000 0xff 0xff
    flash 33 10 64 0 yes 8192 64 128 4500 4500 0xff 0x00
    lfuse 0 0 0 0 no 1 0 0 2000 2000 0x00 0x00
    hfuse 0 0 0 0 no 1 0 0 2000 2000 0x00 0x00
    lock 0 0 0 0 no 1 0 0 2000 2000 0x00 0x00
    calibration 0 0 0 0 no 4 0 0 0 0 0x00 0x00
    signature 0 0 0 0 no 3 0 0 0 0 0x00 0x00

    Programmer Type : STK500
    Description : Atmel AVR ISP
    Hardware Version: 2
    Firmware Version: 1.18
    Topcard : Unknown
    Vtarget : 0.0 V
    Varef : 0.0 V
    Oscillator : Off
    SCK period : 0.1 us

    avrdude: AVR device initialized and ready to accept instructions

    Reading | ################################################## | 100% 0.04s

    avrdude: Device signature = 0x1e9307 (probably m8)
    avrdude: safemode: hfuse reads as D9

    avrdude: safemode: hfuse reads as D9
    avrdude: safemode: Fuses OK (E:FF, H:D9, L:9F)

    avrdude done. Thank you.

    replace COMX with correct com port for arduino.

  9. Set the fuses like on Readme file:

    # TARGET=atmega8 HFUSE=0xc9 LFUSE=0xef
    # TARGET=atmega48 HFUSE=0xdd LFUSE=0xff
    # TARGET=atmega88 HFUSE=0xdd LFUSE=0xff

    with command:

    avrdude -c avrisp -P COM3 -b 19200 -p ATmega8 -v -e -u -U hfuse:w:0xC9:m -U lfuse:w:0xEF:m
  10. If it recognize the M8 you can flash it:
    avrdude -c avrisp -P COMx -b 19200 -p ATmega8 -v -U flash:w:usbasp.atmega8.2011-05-28.hex

    avrdude: Version 6.3, compiled on Feb 17 2016 at 09:25:53
    Copyright (c) 2000-2005 Brian Dean, http://www.bdmicro.com/
    Copyright (c) 2007-2014 Joerg Wunsch

    System wide configuration file is „C:\WinAVR-20100110\bin\avrdude.conf”

    Using Port : COM4
    Using Programmer : avrisp
    Overriding Baud Rate : 19200
    AVR Part : ATmega8
    Chip Erase delay : 10000 us
    PAGEL : PD7
    BS2 : PC2
    RESET disposition : dedicated
    RETRY pulse : SCK
    serial program mode : yes
    parallel program mode : yes
    Timeout : 200
    StabDelay : 100
    CmdexeDelay : 25
    SyncLoops : 32
    ByteDelay : 0
    PollIndex : 3
    PollValue : 0x53
    Memory Detail :

    Block Poll Page Polled
    Memory Type Mode Delay Size Indx Paged Size Size #Pages MinW MaxW ReadBack
    ———– —- —– —– —- —— —— —- —— —– —– ———
    eeprom 4 20 128 0 no 512 4 0 9000 9000 0xff 0xff
    flash 33 10 64 0 yes 8192 64 128 4500 4500 0xff 0x00
    lfuse 0 0 0 0 no 1 0 0 2000 2000 0x00 0x00
    hfuse 0 0 0 0 no 1 0 0 2000 2000 0x00 0x00
    lock 0 0 0 0 no 1 0 0 2000 2000 0x00 0x00
    calibration 0 0 0 0 no 4 0 0 0 0 0x00 0x00
    signature 0 0 0 0 no 3 0 0 0 0 0x00 0x00

    Programmer Type : STK500
    Description : Atmel AVR ISP
    Hardware Version: 2
    Firmware Version: 1.18
    Topcard : Unknown
    Vtarget : 0.0 V
    Varef : 0.0 V
    Oscillator : Off
    SCK period : 0.1 us

    avrdude: AVR device initialized and ready to accept instructions

    Reading | ################################################## | 100% 0.04s

    avrdude: Device signature = 0x1e9307 (probably m8)
    avrdude: safemode: hfuse reads as D9
    avrdude: NOTE: „flash” memory has been specified, an erase cycle will be performed
    To disable this feature, specify the -D option.
    avrdude: erasing chip
    avrdude: reading input file „usbasp.atmega8.2011-05-28.hex”
    avrdude: input file usbasp.atmega8.2011-05-28.hex auto detected as Intel Hex
    avrdude: writing flash (4700 bytes):

    Writing | ################################################## | 100% 7.34s

    avrdude: 4700 bytes of flash written
    avrdude: verifying flash memory against usbasp.atmega8.2011-05-28.hex:
    avrdude: load data flash data from input file usbasp.atmega8.2011-05-28.hex:
    avrdude: input file usbasp.atmega8.2011-05-28.hex auto detected as Intel Hex
    avrdude: input file usbasp.atmega8.2011-05-28.hex contains 4700 bytes
    avrdude: reading on-chip flash data:

    Reading | ################################################## | 100% 3.89s

    avrdude: verifying …
    avrdude: 4700 bytes of flash verified

    avrdude: safemode: hfuse reads as D9
    avrdude: safemode: Fuses OK (E:FF, H:D9, L:9F)

    avrdude done. Thank you.

  11. Done. Disconnect Arduino.

USBASP Drivers on Windows 8, 8.1 and Windows 10
You have to first disable check signed drivers on windows 8, 8.1 and 10!
(pull Shift and click to restart > Troubleshoot > Advanced options > Startup Settings > Restart button again > On the Startup Settings screen press 7 or F7 to disable driver signature enforcement.)
Download: usbasp-windriver.2011-05-28

Then install it manually in device manager.

CH341 EEPROM and SPI Flash Programmer

There is a links to tested working software and drivers with this programmer.

All drivers should work on all Windows versions: Xp, Vista, 7, 8, 8.1, 10 on both 64 bit and 32bit versions (x86).
Main page drivers download from winchiphead: http://www.winchiphead.com/download/

CH341PAR Programmer mode Driver

Jumper on Pin 1 and 2. To install via setup.exe you have to first connect the programmer.
You have to first disable check signed drivers on windows 8, 8.1 and 10!
(pull Shift and click to restart > Troubleshoot > Advanced options > Startup Settings > Restart again > On the Startup Settings screen press 7 or F7 to disable driver signature enforcement.)
Tested drivers on Windows 10 64 bit:
; CH341WDM.INF
; Driver for CH341 (USB=>EPP/I2C/SPI... chip) V2.2
; WDM for Windows 98/Me/2000/XP/Server2003/Vista/64bit Vista/Server2008/Win7/64bit Win7
; Copyright (C) W.ch 2001-2009
[...]
DriverVer = 06/05/2009, 2.2.2009.06
[...]
USB\VID_1A86&PID_5512&REV_0304
USB\VID_1A86&PID_5512

Link:
http://www.mediafire.com/download/4lndgg9owaugysp/CH341PAR-2.2.ZIP
with preinstallation option:
http://www.mediafire.com/download/ac16rptr36eo33p/CH341PAR-drivers%282%29.zip

Other Drivers and libraries for Android, Linux and MacOS:
http://www.mediafire.com/download/j2qv4jr7neqi2r7/CH341PAR-ANDROID.zip
http://www.mediafire.com/download/35lnjtuaulybuqs/CH341PAR-LINUX.zip

CH341SER Serial mode Driver

Jumper on Pin 2 and 3. Disable force signed drivers like described above.
USB-SERIAL CH340 driver included too. Install manually or run setup.exe from CH341SER directory (not from install).

; CH341SER.INF
; Driver for CH341 (USB=>SERIAL chip) V3.4
; WDM&VXD for Windows 98/Me/2000/XP/Server2003/Vista/64bit Vista/Server2008/Win7/64bit Win7
; Copyright (C) W.ch 2001-2014
;
[...]
DriverVer = 08/08/2014, 3.4.2014.08
[...]
USB\VID_1A86&PID_5523&REV_0304
USB\VID_1A86&PID_5523

Link:
http://www.mediafire.com/download/8tr22eu65qt62pw/CH341SER-3.4.ZIP

Other Serial Drivers and libraries (Linux, MacOS, Android):
http://www.mediafire.com/download/atldfbvvb1a5bl6/CH341SER-MAC.zip
http://www.mediafire.com/download/em654fj2h9j1m14/CH341SER-LINUX.zip
http://www.mediafire.com/download/hzwoyhwpxwm51ic/CH341SER-ANDROID.zip

Other downloads:
CH341DP version 1.3 (serial mode)
SPI, I2C downloader, TTL, RS232 for AT89S5X, AVR-MEGA microcontroller
http://www.mediafire.com/download/137pu9fhee80d0o/CH341DP.ZIP

CH341EVT – evaluation board and example uses
Speed testing software. eeprom writer demo and other source codes and libs.
http://www.mediafire.com/download/rj2l97lvzml7ydz/CH341EVT-1.1.ZIP

Printer driver?
http://www.mediafire.com/download/sum76rgcaet7p9z/CH341PRT-1.2.ZIP

Working programmer software

ch341 programmer software 1.18
on Windows 10 work versions 1.29, 1.26, 1.16 and 1.13:

CH341A Programmer 1.29
http://www.mediafire.com/download/v7yp367795dz877/CH341A-programmer-software-1.29.zip

CH341A Programmer 1.26 (working only CH341AFree.exe)
http://www.mediafire.com/download/k63gfj3z4b9jj7g/CH341A-programmer-software-1.26.zip

CH341A Programmer 1.16
http://www.mediafire.com/download/a4u604m99ud7l66/CH341A-programmer-software-1.16.zip

CH341A Programmer 1.13
http://www.mediafire.com/download/d2sejhdgwvtrqdq/CH341A-programmer-software-1.13.zip

Other Versions ( working on Windows 7, Vista, XP):
CH341A Programmer 1.18
http://www.mediafire.com/download/jrqjn3r5yxrtkqx/CH341A-programmer-software-1.18.zip

CH341A Programmer 1.17
http://www.mediafire.com/download/ec9d9oh7tgw3fa4/CH341A-programmer-software-1.17.zip

Other software

There is 2 programs in Chinese language.
English labels for buttons (both apps are the same):
English buttons labels CH341 programmer
First is only for EEPROM (USB24):
USB 24Cxxx.exe V3.0
http://www.mediafire.com/download/eqy2wo49v25lo73/USB-24CXX-CH341-programmer-software.zip

The second one:
CH341A-1.15.exe – USB24-25 2011.05
USB24C and USB25 SPI Flash
http://www.mediafire.com/download/7ah3e1ao74q6hin/CH341-software-1.15.zip

Acer Aspire E5 (E15 E5-511) won’t sleep and running slowly

If you Acer Aspire E5 works very slow and system won’t go to sleep / suspend mode and it is restart when you try, you should update the bios.

There is one problem that deny to solve these problems. You can’t install new bios if you can’t run properly device called: Intel(R) Trusted Execution Engine Interface. This is like hardware DRM to check RSA signatures or something that disallow you to use your own device or set any advanced options in bios (for example turn on supported virtualization, wtf). That’s sick, acer shit.

I’ve tried to install all versions of driver for this device (from 1.1.0.1050, 1.1.0.1064 to 2.x) but nothing work. I’ve tried to reinstall system and other systems it still not working. Acer won’t sleep (it restarts when waking up) and run slowly.

VID and PID of this device:
PCI\VEN_8086&DEV_0F18&SUBSYS_09051025&REV_0E
PCI\VEN_8086&DEV_0F18&SUBSYS_09051025
PCI\VEN_8086&DEV_0F18&CC_108000
PCI\VEN_8086&DEV_0F18&CC_1080

U can try to update bios form official site but you probably get error caused by malfunction of intel TXE:
insydeh2o secure flash error

InsydeH2O – Secure Flash

Error : Decompress failed!!!

Please press any key to reset system……

Solution: Update BIOS in Acer E5 Critical Mode

  1. Download BIOS from Acer site:
    http://us.acer.com/ac/en/US/content/drivers
    for example verison 1.08
    BIOS Acer Update legacy VBIOS for UMA 1.08 9.8 MB 2015/06/10 Download
  2. Extract file called: Z5AL108W.exe with 7zip (right click on it &zip -> open as archive)
  3. There should be file with .fd extension: Z5WAL.fd or .bin isflash.bin
  4. Prepare the empty USB pendrive. Format it in FAT32 filesystem.
  5. Copy fd or bin file with changed names:
    BIOS.fd
    isflash.bin
    Z5WAL.fd
    Z5WALX64.fd
    (i do not know which one works, you should copy them in one time like on screen below (this is the same file with different names):
    acer-critical-mode-bios-file-name
    )
  6. Turn off your Acer Laptop, remove battery and unplug AC.
  7. Put prepared pendrive in one of USB ports.
  8. Hold: Fn + ESC keys, plug in AC Adapter and press PowerButton
  9. System fan speed will be 100%, this is CRISIS Mode.Screen will be black, power led will blinking. Do not disconnect AC adapter!!! Be carefully. U can try run crisis mode with battery for safety.
  10. Wait about 10-20 minutes that critical mode will find bios file. (why so long? probably it is looking for bios file in hard drive then on usb)
  11. Laptop will update bios and turn off. Done.

fd file has a rsa key and signed bios binary.

CRISIS Mode

Info about Insyde BIOS recovery, Critical Mode, CRISIS Mode:
http://community.acer.com/t5/Acer-Ideas/Documenting-the-in-built-CRISIS-Mode-for-BIOS-recovery/idi-p/282468

Updating BIOS to 1.08 solve all my errors: (original was 1.03 version)

  • Intel(R) Trusted Execution Engine Interface works properly on the same driver!!! (without any error code 10 or 37)
  • Sleep mode working OK
  • Acer is father then before, i did not change anything except bios
  • TXE is working so you can update bios form Official EXE’s installers

Reinstall Brother drivers on Windows 10

When you will try to install brother drivers on Windows 10 after upgrade you should se this error:

The Brother printing device software has already been installed.
There are no additional items to install.

You have uninstall drivers manually. Uninstall Tool won’t help you!

For example for HL1110 series
You have to run command line as admin (CMD) an then run setup with this parameters:

„C:\Program Files (x86)\InstallShield Installation Information\{4F2442B7-A89E-42A4-8F0E-6937499855CA}\Setup.exe” -runfromtemp UNINSTALL Reg=DSL-PRT -removeonly

Restart computer and try to install dirvers. If it can’t recognize system version just run as admin and in Windows 8 mode.

How to check installation id of my drivers and uninstall them

  1. First u have to download official drivers for your printer:
    http://support.brother.com/g/b/countrytop.aspx?c=eu_ot&lang=en
  2. If there is no drivers for 10 just download form 8/8.1 or 7
  3. Unpack drivers exe file with 7-zip
  4. Go to: /unpacked-drivers/install\data\Disk1
  5. Open setup.ini and read the id:
    ProductGUID=4F2442B7-A89E-42A4-8F0E-6937499855CA
  6. U can run setup.exe from unpacked drivers to uninstall previous drivers installation:
    \install\data\Disk1\setup.exe -runfromtemp UNINSTALL Reg=DSL-PRT -removeonly
    just change the path

Sterownik drukarki Brother został już zainstalowany.
Brak dodatkowych elementów do instalacji.