XVortex or AdvancedTomato on EA6900 v1/v1.1 without 32k bug (renew)

Discussion in 'Other Firmware Projects' started by crashman, Mar 15, 2018.

  1. crashman

    crashman Network Newbie Member

    Hi to all, as I promised to renew guide here from @cybrnook. All credits go for @XVortex and @cybrnook and @RMerlin. I do respect authors, developers and everybody in projects like Asuswrt-Merlin, XVortex, Tomato and Advanced Tomato (GUI interface only). If somebody thinks I made a wrong thing post will be removed. That's now what I made it for.

    So here is a guide for replacing Linksys EA6900 v1/v1.1 stock firmware with XVortex or AdvancedTomato instead of missing original one.

    1. First of all you’ll need to download some files and tools like:
    Old stock Linksys firmware version
    XVortex firmware for EA6900 or directly from site
    dd-wrt firmware version of Brain Slayer
    PuTTY client
    EA6900 custom CFE
    CFE Edit tool
    AdvancedTomato or directly from site

    2. Connect router to computer by LAN cable in port 1 of router. Go into Network and Sharing Center in Control Panel. Click on the connection, mark TCP/IPv4 and choose Properties button. Then enter manual IP, mask and gateway in same order:, and Click OK to save settings.

    3. Open a browser and write in the address field after switching router, reset it by the button and wait for about 2 minutes to load. You should see:

    4. Standard user/password are admin/admin. Log into router and find manual upgrade field. Press Choose File, load Linksys old firmware - FW_EA6900_1.1.42.158863_prod.img and press Apply button:

    5. Wait for router to restart and load dd-wrt firmware - linksys-ea6900-webflash.bin by the same way. Should see that screen when done. Put admin/admin for user/password and login:

    6. Navigate to Services and enable SSHd and Telnet as pictured and press Apply button:

    7. Run PuTTY in Telnet with Host name (IP): and port: 23. Then click Open:

    8. In the next window use root/admin for user/pass to login:

    9. Then write those commands pressing Enter after each one:
    cd /tmp/root
    nvram show >> nvram_dump.txt
    dd if=/dev/mtd0 of=/tmp/root/stock-cfe.bin
    Last edited: May 6, 2018
  2. crashman

    crashman Network Newbie Member

    10. Run winSCP and enter for Host name an root/admin for user/password. Click Login afterwards:

    11. Navigate to /tmp/root in the right pane and you should see both earlier created files. Copy them in a desired folder in left pane by drag&drop:

    12. Open nvram_dump.txt file through winSCP and find: et0macaddr, 0:macaddr, 1:macaddr, uuid_key and secret_code. Those parameters must be transferred into new firmware. They should look like:
    et0macaddr=48:AB:xx:xx:xx:A9 (MAC address on the bottom of router)
    0:macaddr=48:AB:xx:xx:xx:AB (et0macadd+2)
    1:macaddr=48:AB:xx:xx:xx:AC (et0macadd+3)
    default_passphrase=xxxxxxxxxx (if any)
    default_ssid=Linksysxxxxx (if any)
    (WPS PIN on the bottom of router)

    13. Run CFEEdit.exe and load downloaded cfe_ea6900.bin file by File->Open CFE menu. Click on Advanced Mode and find same lines as earlier (from your router nvram_dump.txt file) and replace them with yours parameters. When done go to File->Save CFE As… with name new-cfe.bin:

    14. Open winSCP and find new-cfe.bin file in the left pane. Copy it to /tmp/root in the right pane by drag&drop:

    15. Open PuTTY in Telnet again and type command with pressing Enter afterwards:
    You should be able to see same three files in router’s memory (simple check).

    16. Write those commands by pressing Enter after each one:
    mtd unlock /dev/mtd0
    cd /tmp/root
    mtd write -f new-cfe.bin mtd0

    17. While router powered off, press and hold reset button on the back of router. Continuing to hold reset button, switch it on, powering up router. Hold reset button pressed for approx. 10 – 15 seconds. When done wait a little and navigate to again. You must see miniWeb Server page:

    18. Press Browse button to find XVortex or AdvancedTomato firmware and then Upload button to finish all that:

    P.S. More information can be found in the first thread - click here
    Last edited: Mar 15, 2018
    cjapeterborough and pomidor1 like this.
  3. cybrnook

    cybrnook Addicted to LI Member

    Seems no more builds for ea6900 anymore, so not sure you want to keep maintaining this. No FW updates, and a V2 of this unit being released which it not supported, may make for more questions than answers.
  4. crashman

    crashman Network Newbie Member

    Sure, but v1/v1.1 still can be found and if somebody wants to make it, why not. As I wrote if you or any of admins/moderators don't want it - delete it. Your guide was very helpful for me so all I want is to stay somewhere and have it stored for future if needed.
  5. kapollo

    kapollo Network Newbie Member

    I do agree with that, I don't understand in the first place why was it remove from the original thread.
    I know it reached end of the line, but then there is tomato that at least get's CVE fixes, sure late like hell but still better than not having any, especially that there seems to be no way back original SW.
  6. indslycon

    indslycon New Member Member

    I had some real trouble with this but have finally got it to work, I thought I'd post my method for anyone interested:

    (a) flash dd-wrt firmware as above (this is to get ssh/sftp access)
    (b) extract the info you need (UUID, mac-address, secret-code) to create custom CFE as above
    (c) write the custom CFE

    - at this point I diverge as the mini-webserver didn't work for me, upload did nothing.

    (d) power on holding down the WPS button until the Linksys light flashes rapidly
    (e) you should still have dd-wrt working
    (f) ssh back in and type: nvram show |more


    If it starts like this then you have the custom CFE in place so should have fixed the 32k bug, the original linksys firmware it starts with: olsrd_coverage=

    (g) exit ssh and power off router
    (h) on your PC start a terminal and ping (you should get no response as it's off) on windows I think you need -t to see the ttl response.
    (h) power on holding down reset (with a pen/pencil) until the Linksys light flashes on and off slowly
    (i) the ping should be giving a ttl response of 100 indicating the router is in rescue mode and can accept firmware
    (j) tftp
    (k) set mode to binary
    (l) put the firmware of your choice, I did the advanced tomato trx build
    (m) wait 3 minutes or so after it has completed as the flashing process takes some time but gives no feedback
    (n) when you're comfortable, power off then power back on and leave it for a few minutes
    (o) power off again, power on holding down WPS button to clear the nvram, wait for a few minutes and you should see the webserver come up on

    This was with a v1.1 EA6900 that I bought new a couple of weeks ago so they're still around.
  7. crashman

    crashman Network Newbie Member

    That's interesting solution and you never know. Thanks for that information, Simon!
    A made lots of tries to made my EA6500v2 back to live (same procedure like EA6900) from bad CFE change and made it but a bit different.
  8. KevinHod

    KevinHod Reformed Router Member

    I see xwrt-vortex has version 380.70 posted recently...I haven't had a chance to load up yet. Anyone else try it out?
  9. apvmtan

    apvmtan Serious Server Member

    Flashed to Kille72 Tomato. Thank you vortex and cybrnook for their hard work. Too bad it is end of the road for xwrt-vortex for the ea6900.
  10. crashman

    crashman Network Newbie Member

    I have two Tomato powered EA routers because of interface I used to. XVortex haven't tried since previous two releases so I can't say is there a loading problem. If I have time will try it.
  11. CHuckNasty

    CHuckNasty New Member Member

    I take it trying to roll back a new EA6900 from FW_EA6900_1.1.42.174776_prod.img to FW_EA6900_1.1.42.158863_prod.img is giving me the attached error, and most likely because the firmware is too new? Am i SOL at this moment or should i just invest in another router. My goal is to just use this one because i bought it about 3 years ago and it was just lying around. I just wanted to use it to run two AP for the other side of my house nothing major. Any suggestions at this point?

    Attached Files:

  12. cybrnook

    cybrnook Addicted to LI Member

  13. crashman

    crashman Network Newbie Member

    Did you try "Restore to previous FW version" or something similar?
    Sometimes that happens.
  14. CHuckNasty

    CHuckNasty New Member Member

    yeah that what i was trying to do was restore to FW_EA6900_1.1.42.158863_prod.img version from my current newer version of FW_EA6900_1.1.42.174776_prod.img, when I was getting that error.
  15. crashman

    crashman Network Newbie Member

    So try with manual upload of fw version as shown above.
  16. SatanTheDevil

    SatanTheDevil Network Newbie Member

    Thanks for your great work!
    May I ask how I can revert back to stock Linksys firmware while my EA6900 v1.1 is on XVortex's Asuswrt Merlin?
  17. crashman

    crashman Network Newbie Member

    Hi, same steps as above in reverse: reset to default, put dd-wrt, then put back original CFE, and afterwards original Linksys firmware. You may need do last step with Putty directly, not sure how exactly was. I did it when almost bricked my EA6500v2 many months ago and can't remember exact steps.

    But.. why you want to do that?!
  18. CHuckNasty

    CHuckNasty New Member Member

    I tried the manual upload of the firmware, but got a invalid or corrupt firmware, and told me the firmware was corrupted.

  19. crashman

    crashman Network Newbie Member

    Which fw version is your router and is it compatible for this version?

    Other possible way is with Putty.
  20. crashman

    crashman Network Newbie Member

    I made a bit improvement for passive cooling: more radiators, new thermal paste - K5-Pro on all places (backside also). CPU temperature now is around 70 deg.C almost constant and around 50 deg.C on WiFi chips.

    What are your temperatures?
  21. romper

    romper New Member Member

    Hello everyone!

    I need to turn my EA6900 v1.1 into Asus AC68U and flash it with Merlin firmware. Do I get it right that there is all the necessary info in this thread to do that please?

    Thank you
  22. crashman

    crashman Network Newbie Member

    Hi and yes, every single file you need is here. So just make it happen.
    Good luck and follow the steps!
    romper likes this.
  23. romper

    romper New Member Member

    Well, have read up to the middle of that manual and gave up:eek:
  24. CHuckNasty

    CHuckNasty New Member Member

    My Curretn Firmware Version is, I was trying to install the ddwrt to try and upgrade my router to tomato or ddwrt but TFTP and manual are not letting me update the firmware to flash it. I used the guide in this to try and downgrade to FW_EA6900_1.1.42.158863_prod.img flash the router but it give the that corrupt or invalid firmware file. any suggestions?
  25. crashman

    crashman Network Newbie Member

    Try update with TFTP2 to check. Can you make any connection with it? Try to downgrade one FW version earlier first (get it from Linksys site) to check.

    If not possible try to reset to default also. I don't know why not possible to put any other version except yours.
  26. CHuckNasty

    CHuckNasty New Member Member

    @crashman i tried the method for like 4 hours last night, and still it would not finish, it would start the upgrade, but then when i noticed the linksys light it would double flash at some point likes after it showed 'flashing upgrade' and the blue line would start and then I would see the double flash on the linksys light on the front of the router, light it was resetting it self because it was blocking it from allowing the firmware to be upgraded. I should have videoed the lights, it was very strange. I mean literally every time the blue line went across, the router would double blink like it reset it self on purpose before the firmware could be finished flashing, I was thinking this was some measure linksys put in to disallow custom firmware flashes. I tried the 99 retries for over four hours with TFTP2. Maybe i'm just SOL with this router. Does this router do management mode?
  27. crashman

    crashman Network Newbie Member

  28. cybrnook

    cybrnook Addicted to LI Member

  29. anggak

    anggak New Member Member


    If I just want to use DD-WRT, do I need to flash the custom CFE? thanks
  30. crashman

    crashman Network Newbie Member

    Hi, no you don't need to do that but you can't use more than 32 kB of NVRAM. Custom CFE solve 32k bug problem and all 64 kB can be used.
  31. anggak

    anggak New Member Member

    Does using custom CFE disable 5ghz wifi or other features? I read on another thread that using custom CFE will cause some features can't be used
    Or is there any downside of using custom CFE?
  32. crashman

    crashman Network Newbie Member

    Hi, I have no idea what and where you were reading all that things, but that's not real. Functions you have are mostly from firmware used. CFE makes things work and correct. I don't know how describe it correctly.
    5GHz signal disappears because of overflow of 32 KB NVRAM (32k bug) which that CFE resolves.

    Any disadvantages of custom CFE - none,
    any advantages of custom CFE - everything.
    That's for me!

    Linksys SmartWiFi GUI sucks a lot for me, so I don't want it at all. Hardware of that routers are still made by CISCO so that is the main reason to pay money for.

    anggak likes this.
  33. anggak

    anggak New Member Member

    one more thing about this part:
    0:macaddr=48:AB:xx:xx:xx:AB (et0macadd+2)
    1:macaddr=48:AB:xx:xx:xx:AC (et0macadd+3)

    on another thread, there are many version about this

    on another thread is:

    which one is correct to use?
  34. crashman

    crashman Network Newbie Member

    Hi. mine is correct - tested on 2 routers. I know written different things but this here is correct.
    eth0 - WAN
    LAN = +1 (auto)
    0:2.4 = +2
    1:5 = +3
    anggak likes this.
  35. anggak

    anggak New Member Member


    in the stock cfe_ea6900.bin you provided doesn't contain default_passphrase, default_ssid, and uuid_key

    If I add default_passphrase, default_ssid, and uuid_key to the cfe, I got the attached message
    It's okay when I didn't add default_passphrase, default_ssid, and uuid_key to the cfe
    should I add these manually according my router cfe?


    Attached Files:

    Last edited: May 17, 2018
  36. crashman

    crashman Network Newbie Member

    Hi, if you have them in the original CFE you should add them also. That's why I wrote "if any".
    Usually you don't need to add them but.. you never know. I personally have them written separately.
  37. anggak

    anggak New Member Member

    If I add them, I can't save edited cfe...
    It's running well now without adding them
  38. crashman

    crashman Network Newbie Member

    As I said - you will add them if there is any. As I don't have them and didn't need them - not been added. Just wrote original UID separate to have it. That's all.
  39. Hydr@!

    Hydr@! New Member Member

    Hi folks

    Hope someone can assist. I have EA6900 with DD-WRT v3.0-r33435M kongac (10/08/17). Problem is the USB 3.0 doesn't seem to work. Would there be an issue changing the firmware mentioned to XVortex's 380.70_0 firmware??
  40. crashman

    crashman Network Newbie Member

    Hi, if it's a hardware problem you won't solve it anyway. It doesn't mean "don't do it" of course but to put XVortex you must change CFE first. I would suggest you read all steps first to know what you must do before you start.

    Hydr@! likes this.
  41. Hydr@!

    Hydr@! New Member Member

    Don't believe it's a hardware problem. I think it was just a bug in the firmware.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice