## How to remove the 32K NVRAM limit ## How to flash Linksys EA6300v1, EA6400, EA6500v2, EA6700, EA6900v1.0/1.1 with Tomato. The EA6300v1 uses the same firmware as EA6400 since the routers are exactly the same. WARNING: If anything goes wrong this can brick your router and I will not be held responsible if that happens. You're doing this at your own risk. For these router a different CFE needs to be flashed otherwise only 32k of NVRAM can be used and that is not enough but for the most basic setup. This means that you will not be able to revert back to Linksys stock firmware after the CFE flash. Other 3rd party firmwares can however be flashed. Since the CFE has to be changed for this router there are some Pros and cons when this is done. Pros: Can install 3rd party firmwares (without the 32k NVRAM limit) Can enter recovery mode (Hold the red "reset" button on the back of the router and power up the router, release it after about 15-20 seconds) Navigate to 192.168.1.1 and the ”recovery web interface” should come up. Cons: Can no longer flash back to Linksys stock firmware (not really sure if this is a con since the stock Linksys firmware is nearly useless) Download for EA6300v1 & EA6400: https://my.pcloud.com/publink/show?code=kZNb807Z04GYcuqwyxY10A7Ypsd8YHj35b57/ Mirred: https://blog.adriel.co.nz/firmware/EA6700/Flash%20Linksys%20EA6300v1%20&%20EA6400%20with%203rd%20Party%20Firmware.7z The archive contains: linksys_ea6400_ddwrt.bin linksys_ea6400_cfe.bin WinSCP-5.9.6-Portable CFEEdit.exe putty.exe Tftp2.exe Download for EA6500v2: https://my.pcloud.com/publink/show?code=kZUbB87Zm3YFpS5jm17pxlLl49R2b5lXvYQV Mirred: https://blog.adriel.co.nz/firmware/EA6700/Flash%20Linksys%20EA6500v2%20with%203rd%20Party%20Firmware.7z The archive contains: linksys_ea6500_ddwrt.bin linksys_ea6500_cfe.bin WinSCP-5.9.6-Portable CFEEdit.exe putty.exe Tftp2.exe Download for EA6700: https://my.pcloud.com/publink/show?code=kZ8beL7Zh4Wmg5YsaGfhw7Lb5Qn2kuR4sA87/ Mirred: https://blog.adriel.co.nz/firmware/EA6700/Flash%20Linksys%20EA6700%20with%203rd%20Party%20Firmware.7z The archive contains: linksys_ea6700_ddwrt.bin linksys_ea6700_cfe.bin WinSCP-5.9.6-Portable CFEEdit.exe putty.exe Tftp2.exe Download for EA6900v1.0 & EA6900v1.1: https://my.pcloud.com/publink/show?code=kZ5Erm7ZffTAthNzl1Hnv31K35kW7uw3aK4V Mirred: https://blog.adriel.co.nz/firmware/EA6700/Flash%20Linksys%20EA6900v1.0%20&%20%20EA6900v1.1%20with%203rd%20Party%20Firmware.7z The archive contains: linksys_ea6900_ddwrt.bin linksys_ea6900_cfe.bin WinSCP-5.9.6-Portable CFEEdit.exe putty.exe Tftp2.exe Also remember to download Tomato firmware of your choice. 1. Reset the router (press and hold the red reset button until the power indicator flashes) 2. Connect the PC to LAN port1 on the router. Give the PC a static IP: IP address: 192.168.1.20 Subnet mask: 255.255.255.0 Default gateway: 192.168.1.1 DNS: 192.168.1.1 Reconnect to make the settings take effect. Ping the router "ping -t 192.168.1.1" (ttl=64 usually means that the router is ready) 3. Open a web browser and navigate to 192.168.1.1. Skip the basic setup (check the "skip" box) and proceed to log in using "admin" as password. Navigate to Connectivity → Basic and flash "linksys_ea6xxx_ddwrt.bin". If there’s an error saying the file is invalid this means the stock Linksys firmware is too new and can only flash firmwares signed by Linksys. In this case do the following: Go to Troubleshooting → Diagnostics and click on "restore previous firmware", if it asks for a file then flash "linksys_ea6xxx_ddwrt.bin". If it doesn’t ask for a file the flash will have to be done with tftp: (For Windows) Disconnect router Run tftp2.exe Server: 192.168.1.1 Password: blank (nothing) File: browse to the dd-wrt file Retry: 99 times Connect the router Immediately when ttl=100 appears in the ping window, press Upgrade to upload the firmware. This has to be excecuted quite fast so that the firmware have time to be uploaded to the router before ttl=64 appears. If ping times out or host unreachable before firmware is flashed, ttl=100 doesn't show up, only ttl=64 or something else, just reconnect power to the router and let tftp keep trying. Also try a few resets once in a while. Whatever you do, do not reconnect power or reset the router if the firmware has started uploading. Most times it works on the first go, but this can take a bunch of retries (It appears the number of ttl=100 responses is not the same on every powercycle and sometimes there are no ttl=100 response at all, very strange) Give the router a few minutes untill ttl=64 appears in the Ping window. If ttl=64 does not appear, make sure that atleast five minutes has passed since the upload and reconnect the power to the router Go to 192.168.1.1 again and DD-WRT should be there. If not: Navigate to Troubleshooting → Diagnostics and restore previous firmware. DD-WRT should now boot. (For the Linuxes) The procedure is the same as for Windows but instead of the tftp2 application, command line is used. Install tftp from the distro repo if not already installed. Run tftp from the folder where "linksys_ea6xxx_ddwrt.bin" is located. $ tftp tftp> connect (to) 192.168.1.1 tftp> binary tftp> rexmt 1 tftp> timeout 180 Reconnect the power to the router. When ttl=100 appears in the ping window: tftp> put linksys_ea6xxx_ddwrt.bin Sent 22765568 bytes in 76.5 seconds tftp> quit 4. Once the flash has completed (this takes a couple of minutes) navigate to 192.168.1.1. Set username/password to admin/admin. Navigate to the services tab and enable SSHd. Click Save at the bottom, then Apply Settings. 5. Open "linksys_ea6xxx_cfe.bin" with "CFEEdit.exe" and fill in: MAC Address (found on the bottom of the router) WPS Password (found on the bottom of the router) Go over to the Advanced Mode tab and change 0:macaddr and 1:macaddr to the following: 0:macaddr (same as MAC Address +2) 1:macaddr (same as MAC Address +4) The HEX sequence from 00H to FFH: 00,01,02,03,04,05,06,07,08,09,0A,0B,0C,0D,0E,0F 10,11,12,13,14,15,16,17,18,19,1A,1B,1C,1D,1E,1F 20,21,22,23,24,25,26,27,28,29,2A,2B,2C,2D,2E,2F 30,31,32,33,34,35,36,37,38,39,3A,3B,3C,3D,3E,3F 40,41,42,43,44,45,46,47,48,49,4A,4B,4C,4D,4E,4F 50,51,52,53,54,55,56,57,58,59,5A,5B,5C,5D,5E,5F 60,61,62,63,64,65,66,67,68,69,6A,6B,6C,6D,6E,6F 70,71,72,73,74,75,76,77,78,79,7A,7B,7C,7D,7E,7F 80,81,82,83,84,85,86,87,88,89,8A,8B,8C,8D,8E,8F 90,91,92,93,94,95,96,97,98,99,9A,9B,9C,9D,9E,9F A0,A1,A2,A3,A4,A5,A6,A7,A8,A9,AA,AB,AC,AD,AE,AF B0,B1,B2,B3,B4,B5,B6,B7,B8,B9,BA,BB,BC,BD,BE,BF C0,C1,C2,C3,C4,C5,C6,C7,C8,C9,CA,CB,CC,CD,CE,CF D0,D1,D2,D3,D4,D5,D6,D7,D8,D9,DA,DB,DC,DD,DE,DF E0,E1,E2,E3,E4,E5,E6,E7,E8,E9,EA,EB,EC,ED,EE,EF F0,F1,F2,F3,F4,F5,F6,F7,F8,F9,FA,FB,FC,FD,FE,FF So if the MAC Address (found on the bottom of the router) is: 3B:00:8F:39:F9:56 then 0:macaddr (same as MAC Address +2) would be: 3B:00:8F:39:F9:58 If the MAC Address (found on the bottom of the router) is: 3B:00:8F:39:F9:CF then 0:macaddr (same as MAC Address +2) would be: 3B:00:8F:39:F9.D1 For EA6300v1 and EA6400 also change clkfreq to: clkfreq=800,533 Save as "new6xxxcfe.bin" 6. Run WinSCP.exe File protocol: SFTP Host name: 192.168.1.1 Port number: 22 Username/Password: root/admin and Login Upload the newly created CFE file "new6xxxcfe.bin" to the router. This is done by dragging the file from the left side to the right (make sure the right side is in the /tmp/root directory) Close WinSCP 7. Run Putty.exe Host name: 192.168.1.1 Port: 22 Connection type: SSH and Open login as: root password: admin To flash the CFE use the following commands: mtd unlock /dev/mtd0 mtd write –f /tmp/root/new6xxxcfe.bin /dev/mtd0 If that doesn't work try: mtd unlock /dev/mtd0 mtd –f write /tmp/root/new6xxxcfe.bin /dev/mtd0 Close Putty 8. Now that the new CFE is flashed the "recovery web interface" can be used to flash new firmwares. Hold the red "reset" button on the back of the router and power up the router, release it after about 15-20 seconds. Navigate to 192.168.1.1 and the "recovery web interface" should come up. Flash Tomato Firmware (this can take up to five minutes, check the ping for ttl=64 to see if it’s done.) When the flash is done it's time to reset NVRAM (hold the WPS button while powering on the router, hold it until the Linksys logo starts to flash or 15-20 seconds) Go to 192.168.1.1 and do a reset from within Tomato. Administration → Configuration → Erase all data in NVRAM memory (thorough). Reboot router.