ASUS RT-AC66U CFE and DD-WRT on H/W version B0

When you try to flash DD-WRT on Asus AC66U you will stuck on ASUS Recovery Page. DD-WRT won’t work because ASUS will close their hardware to third party software.

If your router is in recovery page just flash original TRX firmware file.

ASUS MIPS Broadcom routers have something like bootloader called CFE. It contains built-in configuration like MAC addresses, interfaces configs etc.

DD-WRT won’t boot on new CFE: (EU) so I downgrade CFE to (EU). Be carefull, you can brick your router.


  • HEX editor, on windows you can use HxD:
  • Pendrive (FAT32 file system)
  • PuTTY for telnet connection:
  • CFE collection for AC66U:
  • CFE collection for other ASUS routers:

CFE source:

Before you start you have to read this warning and check which version do you have:
cfe ac66u warning hw version

Check information and prepare

You have to check current H/W version, bl version (CFE) and memory manufacturer.

  • Activate Telnet access in webpanel: [Advanced Settings] -> [Administration] -> [System] -> Enable Telnet – check Yes -> Click [Apply]
  • Run putty and set telnet to, click Open: telnet asus
  • Run command to check bl version:
    nvram get bl_version
  • Run command and read part output to check memory chip vendor (work only on ASUS WRT):
    dmesg | grep -e "flash" -e "nand" -e "amd" /tmp/syslog.log

    Found a Zentel NAND flash with 2048B pages or 128KB blocks; total size 128MB

  • Connect pendrive and make current CFE backup. Check the correct path to pendrive:
    ls /tmp/mnt/
    cd /tmp/mnt/sda/
  • Make a backup:
    cat /dev/mtd0 > /tmp/mnt/sda/original_cfe.bin
    dd if=/dev/mtd0 of=/tmp/mnt/sda/original_cfe1.bin
  • Umount pendrive in webpanel (USB icon right-top corner).
  • Connect pendrive to computer, copy files (original_cfe.bin and original_cfe1.bin) to safe place. Open one file in HxD – hex editor and search hw_version
  • Read and copy three MAC addresses in hex editor, these variables:
  • Read H/W version from the box of router

Information about my router.

H/W Version: B0 hw_version=1.5
CFE: bl_version=
EU version

I decided to downgrade to (EU).

Prepare CFE and flash it

  • Copy MTD-WRITE v3 to penrive
  • Open chosen CFE version [ (EU)] in hex editor:
    asus cfe
  • Replace three mac addresses with correct which was red before.


    asus cfe mac address
    Be careful at the beginning and at the end there is 00 (null) in visible part is a dot, do not remove or replace it.

  • Save modified file as new_cfe.bin on pendrive.
  • Make sure you want do this.
  • Connect pendrive to router and flash CFE with putty:
    cd /tmp/mnt/sdb/
    chmod +x mtd-write
  • Flash CFE
    mtd-write -i new_cfe.bin -d pmon
    mtd-erase -d nvram
  • Skip wizard, activate telnet and check with putty CFE version:
    nvram get bl_version
  • Done. You can flash any DD-WRT Version.


  1. Thank you!!!

  2. Thank you so much! I have exactly the same model as you and this worked perfectly.

  3. First downgrade using ASUS tool to official FW which allowed on to upload dd-wrt image from web, it would however still not boot dd-wrt. Same when using ASUS tool to flash dd-wrt.
    This solution worked perfect! Had same HW_version also from EU. Downgrade to (EU).

    • Ellis Johns

      19.02.2017 at 06:46

      Worked for me too. I’m using hw_version=1.5
      bl_version= in the regulation_domain=US

      I ended up using using cfe version

      Thanks so much for the help.

  4. bricked… it never restarted. it just stays stuck with three lights on where there were ethernet cables

  5. Hello! Do you have any information about Tomato by Shibby firmware for Asus RT-AC66U B1 or AC68U C1/E1 rev.? thx

Leave a Reply

Witryna wykorzystuje Akismet, aby ograniczyć spam. Dowiedz się więcej jak przetwarzane są dane komentarzy.