t
o
n
y
a
n
g
'
s
 
w
e
b
l
o
g


i never left the house today. the weather this morning was still raw, remnants of hurricane michael passing through southern new england. it was far enough offshore that we didn't get drenched, but it still rained a little bit, and at one point the sky got very dark. by the afternoon the clouds dissipated somewhat and there was even some sun, but it was too little too late. everything was still drying so i couldn't do any paint work and with my parents leaving this weekend there was no need to take a trip to haymarket. sunset was at 6:05pm.

my sister sent me photos of wild mushrooms she was encountering while hiking in the woods. with the rain we got yesterday, the forest floor was full of fungi. she sent me a bunch that looked like hen of the woods, which i also learned are known as maitake mushrooms. as such, they're definitely edible and have medical beneficially uses like increasing immunity and anticancer and hypoglycemic agents. hen of woods can be confused with turkey tail mushrooms, but those are thinner and leathery, not at all edible looking. there's also chicken of the woods, but those are unmistakably yellow to fluorescent orange. hen of the woods like growing at the base of oak trees, and that's where my sister found them, and they're found in late fall and early autumn. she didn't bring a bag so she wrapped up the mushrooms in her jacket and brought them home.

i spent 2 hours flashing the t-mobile TM-AC1900 to an asus RT-AC68U router. the $40 TM-AC1900 is essentially the same as the $140 RT-AC68U, except it's rebranded as a t-mobile router with some special t-mobile wifi calling features and a proprietary firmware. i don't think t-mobile supports this router anymore (meaning no more firmware updates), that's why it's been showing up online selling at a discount. fortunately the TM-AC1900 can be hacked and converted to a normal asus RT-AC68U router.

i studied the steps late last night before bed and then continued reading up on the steps so i was familiar with everything. most of the online instructions are for the PC (including the primary source), but all the steps either involves web browser work or linux commands, of which the mac is more than capable. there were two mac instructions, a written and a video. the former was way more technical than required, while the latter was helpful but the narrator was a bit meandering and some of his steps required additional commands he either glossed over or simply didn't mention. i ended up following the primary instructions but using the video as a secondary source. from a different website i also picked up a few additional tips (like use CFE 1.0.2.0 US AiMesh instead of CFE 1.0.2.5).

the steps for flashing the TM-AC1900 to RT-AC68U isn't all that crazy. a total of 3 different firmwares needed to be flashed along with a modified common firmware environment file (CFE).

the first firmware to be flashed is actually an older version (3.0.0.4_376_1703-g0ffdbba) of the existing firmware on the TM-AC1900 router (3.0.0.4.376_2827-g566ef60). the reason why an older firmware needs to be flashed is the older version supports SSH, which is a remote protocol that allows us to log into the router remotely and issue some special linux commands which can't be done through the router's admin page. newer versions of the firmware removed SSH support probably for security reasons since it's not something most normal users would need to use and having it accidentally on might allow hackers to gain access to the router.

the instructions said to put assign a static IP for my computer, but since the DHCP server was still functioning on the router, i could simply just connect to the router directly and would automatically be assigned an IP on the same subnet mask and gain access to the router. fortunately my thunderbolt to ethernet adapter arrived a few weeks ago so i could take advantage of it (flashing a router via wifi is too dangerous). i don't know if the TM-AC1900 admin page would allow me to flash an older firmware, but the directions said to place the router in recovery/restore mode. how that's done is by doing a 10-10-10 reset: hold the reset button for 10 seconds, power off and hold the reset for 10 seconds, power on and continue to hold the reset for 10 more seconds. then by going to 192.168.29.1 (the router's address) it should bring me to the mini-CFE webpage, but it didn't.

instead i had to do a NVRam reset, which means powering off the router, waiting 10 seconds, then power back up the router while holding down the WPS button until the power button starts flashing quickly. when the router rebooted, i went to the router's address from chrome and found myself at the router's admin setup page, not what i wanted. so i did another 10-10-10 reset which finally did bring me to the mini-CFE webpage. using chrome, i choose the old firmware file saved on my computer and hit the upload button. after a few minutes the browser went to a blank page, which meant the router had rebooted. but when i went to the router's address, i got the admin page but the firmware was still the new version, not the old. i also know this because there was no SSH option. so i 10-10-10 reset back into the mini-CFE webpage once again, this time using the safari browser. i did the same thing as before, waited several minutes, but this time instead of advancing to a blank page, it told me that the upload was completed and told me the system was rebooting. once the router was back online, i went to the admin page and saw that the firmware had been downgraded. it gave me the option to enable SSH which i did.

when i tried to SSH into the router, it gave me an error. i had to find a fix on my own and came up with this command to run on my OSX terminal:

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@192.168.29.1

that seemed to do the trick and let me gain access into the temp directory of the TM-AC1900. i issued this command:

cat /dev/mtd0 > original_cfe.bin

to make a copy of the CFE file. i copied original_cfe.bin using a modified scp command issued from the local terminal instead of within the router:

# copied director (-r recursive) - creates a "root" directory with original_cfe.bin and authorized_keys
scp -r -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@192.168.29.1:/tmp/home/root .

scp -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@192.168.29.1:/tmp/home/root/original_cfe.bin original_cfe.bin

the first command i used essentially just copied the root folder. later i discovered a more exact command, but i already got the copy of original_cfe.bin. the CFE file had to be modified from a t-mobile to an asus. it can be done manually using a hex editor, but fortunately there are online resources that will modify the CFE file for me.

i put the 3 files i needed to copy (new_cfe.bin, mtd-write, FW_RT_AC68U_30043763626.trx) into a folder and then cd into that folder before issuing a scp command to copy the files onto the router:

# within the /upload directory (3 files to be uploaded)
scp -oKexAlgorithms=+diffie-hellman-group1-sha1 * admin@192.168.29.1:/tmp/home/root

i then SSH'ed into the router and issued 3 commands:

chmod u+x mtd-write
./mtd-write new_cfe.bin boot
mtd-write2 FW_RT_AC68U_30043763626.trx linux

that last command flashed the 2nd firmware onto the router, an asus firmware. that only worked because we also flashed the new CFE file onto the boot directory of the router. the asus firmware isn't the latest version, but supposedly one that doesn't have new security checks that looks to see if the router is a TM-AC1900 and will revert back to the t-mobile firmware if discovered.

when the router booted up, from my network panel i could see that the default router address had changed from 192.168.29.1 (t-mobile) to 192.168.1.1 (asus). when i entered the address (192.168.1.1), it took me to the admin page, which now said asus RT-AC68U. success! but i want to update the firmware to the latest version, and to do that i needed to format the MTD5 partition to remove all traces of t-mobile, otherwise when new asus firmwares get installed, it won't revert to the t-mobile firmware because it detected a t-mobile router. so i SSH'ed into the router, this time at the new default address:

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@192.168.1.1

and then issued the following commands:

cat /dev/mtd5 > /jffs/mtd5_backup.bin
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot

once that was done, i went back to the admin page, to Administration/Firmware Upgrade, and uploaded the latest firmware file (our 3rd firmware update) which i downloaded earlier, 3.0.0.4.384_32799. and with that i finally have a brand new working asus RT-AC68U router!

it actually wasn't that difficult, and only took as long as it did because i double and triple checked every single step to make sure i didn't make a mistake and accidentally brick the router. having done it once, i think if i were to do it again, i could probably hack another TM-AC1900 in under 20 minutes. it makes me want to upgrade my current router, which i just upgraded from an old DD-WRT flashed tp-link to an asus RT-ACRH13. the RT-ACRH13 is okay (better than the old tp-link anyway) but it's nowhere as robust as the RT-AC68U. what makes it worse is i paid $45 for that router, when i can get another TM-AC1900/RT-AC68U for just $40, so i'm seriously thinking about if i should make another upgrade, and pass down my current RT-ACRH13 to the cafe, where it's currently running a DD-WRT tp-link.

my sister called me, said there was a car flipped upside down behind the cafe, and to see if i could see it with the webcam. i thought she meant in the parking lot, but it was actually out on the street. sure enough, there was a car that had somehow landed on its roof, and a crane was in the process of tipping it over. the whole street was blocked so my sister couldn't get back into the parking lot. not sure what happened but in hindsight i should've turned on the police radio so i could hear the conversation.

my sister dropped off the mushrooms at the cafe and my parents were busy cleaning them up. at one point my mother sent me a photo of a red-striped salamander that'd been hiding in the mushrooms (my father released it outside in the garlic chive box). later my father sauteed some of the mushrooms while freezing up the rest of it. my sister said she must've carried 20 lbs. worth of hen of the woods, and said there was even more but she couldn't carry them all.

for dinner i cooked up some ramen, but added some scallions, eggs, and tomato slices to make it a little healthier. for dessert i crunched on a honeycrisp apple. nothing good on television tonight, but this weekend will feature plenty of sports, including a red sox astros game happening at the same time with a chiefs patriots game sunday night.