Trying to Install Shibby Tomato on AC56U

Discussion in 'Tomato Firmware' started by brickbob2, Aug 12, 2014.

  1. brickbob2

    brickbob2 Network Newbie Member

    I tried installing shibby tomato (tomato-RT-AC56U-ARM--120-AIO-64K.trx) on my AC56U using this guide

    After putting the router into recovery mode (by using the buttons at start-up) and uploading the .trx with the ASUS Firmware Restoration utility, the installation began fine, judging by the lights. After some minutes though it got stuck with just the power light still shining. When I then reset the router, no lights other than the power light would light up and I couldn't put it into recovery mode either.

    I bought a serial cable and got into the CFE prompt using putty as instructed by an internet tutorial, but issuing "nvram erase" and "nvram commit" didn't change much. I still can't get the router into recovery mode using the buttons.

    I have serial access to the CFE, and I can also get into some sort of linux environment running on the router by pressing enter in putty after I let the router load up for some minutes.

    Should I perhaps try using the firmware update command available in the CFE and try to install the same .trx again through aftp or something?

    I have no experience with routers, so I could use some advice before I try anything just to avoid bricking the router even further.
    Last edited: Aug 12, 2014
  2. Siff

    Siff Serious Server Member

    If "erease" is not a typo, this might be part of the problem. Also, I think that you should type "nvram commit", not only "commit".

    Hope this helps and good luck!
  3. brickbob2

    brickbob2 Network Newbie Member

    Actually, I did those things. I've now edited my post with the proper CFE commands that I used.
  4. Siff

    Siff Serious Server Member

    Ok. Was worth asking... :)

    The video you looked at and followed is for RT-AC66U. I don't think that the RT-AC56U will behave much differently overall (LEDs, etc.), but there might be a significant difference in the times required for the flash to complete. The upload completes, but then the router has to flash the firmware, and, in some cases, this might take unexpectedly long time. For example, my RT-N66U takes more than 20 min. to flash Shibby AIO builds, while RT-AC66U in the video takes less than 5 min. to complete the flash. Please note that this is dependent on the speed of the flash chip, not on the architecture.

    Since the CFE is intact, you can try uploading the stock Asus firmware using the CFE's miniWeb GUI (if your CFE has it). Make sure you are connected with an Ethernet cable directly to one of the LAN ports of the router, that you have static IP set on your PC (e.g., mask, gateway, no firewall, no antivirus and that there are no other network connections (e.g. wireless). Then go to and if the miniWeb GUI appears, try uploading the stock firmware with it. If the upload is successful, start a ping /t and do not touch the router until at least 5 min. after it starts responding to the pings - this is to give the firmware time to build all the NVRAM variables.

    Also, please note that, on Asus routers, the 30-30-30 reset and NVRAM erase are performed using the WPS button, not the reset button.

    Hope this helps.
  5. brickbob2

    brickbob2 Network Newbie Member

    Interesting, I'd never have imagined that flashing could take so long. I believe I gave it 10-15 minutes after it went LED-inactive before I restarted it.

    I went ahead and tried connecting to, but the browser can't establish a connection. It seems like the router doesn't even initialize the eth ports. This is what it outputs when I'm connected to it with putty (but not in CFE prompt using ctrl-C):
    SHMOO VER 1.13
    RDLYW0 00000004
    RDENW0 00000054
     00 --------------+++++++++++++++++++++++++X++++++++++++++++++++++++
     01 ------------------+++++++++++++++++++++++X++++++++++++++++++++++
     02 ----------------++++++++++++++++++++++++X+++++++++++++++++++++++
     03 -----------++++++++++++++++++++++++++X++++++++++++++++++++++++++
     04 --------++++++++++++++++++++++++++++X+++++++++++++++++++++++++++
     05 -------------+++++++++++++++++++++++++X+++++++++++++++++++++++++
     06 ----------+++++++++++++++++++++++++++X++++++++++++++++++++++++++
     07 -------------+++++++++++++++++++++++++X+++++++++++++++++++++++++
     08 ---++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
     09 ------+++++++++++++++++++++++++++++X++++++++++++++++++++++++++++
     10 ----++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
     11 ----++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
     12 ---++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
     13 --+++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
     14 ---++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
     15 ----++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
     00 --------------+++++++++++++++++++++++++X++++++++++++++++++++++++
     01 -------------------++++++++++++++++++++++X++++++++++++++++++++++
     02 ----------------++++++++++++++++++++++++X+++++++++++++++++++++++
     03 ------------++++++++++++++++++++++++++X+++++++++++++++++++++++++
     04 --------++++++++++++++++++++++++++++X+++++++++++++++++++++++++++
     05 -------------+++++++++++++++++++++++++X+++++++++++++++++++++++++
     06 ----------+++++++++++++++++++++++++++X++++++++++++++++++++++++++
     07 -------------+++++++++++++++++++++++++X+++++++++++++++++++++++++
     08 --+++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
     09 ------+++++++++++++++++++++++++++++X++++++++++++++++++++++++++++
     10 ----++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
     11 ----++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
     12 ---++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
     13 --+++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
     14 ---++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
     15 ----++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
     00 -------------+++++++++++++++++++++++++X+++++++++++++++++++++++++
     01 ---------------++++++++++++++++++++++++X++++++++++++++++++++++++
     02 -------------+++++++++++++++++++++++++X+++++++++++++++++++++++++
     03 ---------+++++++++++++++++++++++++++X+++++++++++++++++++++++++++
     04 ------+++++++++++++++++++++++++++++X++++++++++++++++++++++++++++
     05 -------------+++++++++++++++++++++++++X+++++++++++++++++++++++++
     06 ----------+++++++++++++++++++++++++++X++++++++++++++++++++++++++
     07 ----------+++++++++++++++++++++++++++X++++++++++++++++++++++++++
     08 --+++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
     09 ----++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++
     10 ---++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
     11 --+++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
     12 --+++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
     13 ++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++
     14 --+++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
     15 --+++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++
     00 -+++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++-
     01 --++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++-
     02 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
     03 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
     04 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
     05 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
     06 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
     07 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
     08 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
     09 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
     10 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
     11 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
     12 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
     13 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
     14 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
     15 +++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++-
    WRDMW0 00000031
    WRDMW0 00000031
     00 +++++++++++++++++++++++++++++++XS+++++++++++++++++++++++++++++++
    Detect CPU turbo button...
    CFE version (r382208) based on BBP 1.0.37 for BCM947XX (32bit,SP,)
    Build Date: å 18 09:25:12 CST 2013 (yau@wireless-pub2)
    Copyright (C) 2000-2008 Broadcom Corporation.
    Init Arena
    Init Devs.
    Boot partition size = 262144(0x40000)
    DDR Clock: 533 MHz
    Info: DDR frequency set from clkfreq=800,*533*
    CPU type 0x0: 800MHz
    Tot mem: 262144 KBytes
    CFE mem:    0x00F00000 - 0x01192F4C (2699084)
    Data:       0x00F4B644 - 0x00F4BA8C (1096)
    BSS:        0x00F4BA98 - 0x00F90F4C (283828)
    Heap:       0x00F90F4C - 0x01190F4C (2097152)
    Stack:      0x01190F4C - 0x01192F4C (8192)
    Text:       0x00F00000 - 0x00F42394 (271252)
    Null Rescue Flag.
    boot the image...
    go load
    Loader:raw Filesys:tftp Dev:(null) File:: Options:(null)
    Loading: TFTP Server.
    Could not load :: Error
    Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
    Loading: .... 4185568 bytes read
    Entry at 0x00008000
    Starting program at 0x00008000
    console [ttyS0] enabled, bootconsole disabled
    serial8250.0: ttyS1 at MMIO 0x18000400 (irq = 117) is a 16550
    brd: module loaded
    loop: module loaded
    pflash: found no supported devices
    bcmsflash: found no supported devices
    Boot partition size = 524288(0x80000)
    lookup_nflash_rootfs_offset: offset = 0x200000
    nflash: squash filesystem with lzma found at block 29
    Creating 4 MTD partitions on "nflash":
    0x000000000000-0x000000080000 : "boot"
    0x000000080000-0x000000200000 : "nvram"
    0x000000200000-0x000002000000 : "linux"
    0x0000003ab644-0x000002000000 : "rootfs"
    PPP generic driver version 2.4.2
    PPP MPPE Compression module registered
    NET: Registered protocol family 24
    PPTP driver version 0.8.5
    === PPTP init ===
    u32 classifier
        Actions configured
    Netfilter messages via NETLINK v0.30.
    nf_conntrack version 0.5.0 (3990 buckets, 15960 max)
    xt_time: kernel timezone is -0000
    ip_tables: (C) 2000-2006 Netfilter Core Team
    TCP cubic registered
    NET: Registered protocol family 10
    ip6_tables: (C) 2000-2006 Netfilter Core Team
    NET: Registered protocol family 17
    L2TP core driver, V2.0
    PPPoL2TP kernel driver, V2.0
    802.1Q VLAN Support v1.8 Ben Greear <>
    All bugs added by David S. Miller <>
    Registering the dns_resolver key type
    Northstar brcmnand NAND Flash Controller driver, Version 0.1 (c) Broadcom Inc. 2012
    NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD NAND 128MiB 3,3V 8-bit)
    Spare area=64 eccbytes 56, ecc bytes located at:
     2 3 4 5 6 7 8 9 10 11 12 13 14 15 18 19 20 21 22 23 24 25 26 27 28 29 30 31 34 35 36 37 38 39 40 41 42 43 44 45 46 47 50 51 52 53 54 55 56 57 58 59 60 61 62 63
    Available 7 bytes at (off,len):
    (1,1) (16,2) (32,2) (48,2) (0,0) (0,0) (0,0) (0,0)
    Scanning device for bad blocks
    Creating 2 MTD partitions on "brcmnand":
    0x000002000000-0x000008000000 : "brcmnand"
    0x000004000000-0x000006000000 : "jffs2"
    VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
    devtmpfs: mounted
    Freeing init memory: 216K
    Hit ENTER for console...
    ctf: module license 'Proprietary' taints kernel.
    Disabling lock debugging due to kernel taint
    et_module_init: passivemode set to 0x0
    et_module_init: txworkq set to 0x1
    et_module_init: et_txq_thresh set to 0x400
    eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller (r456083)
    wl_module_init: passivemode set to 0x0
    wl_module_init: txworkq set to 0x1
    PCI: Enabling device 0001:01:00.0 (0140 -> 0142)
    wl driver (r456083) failed with code 21
    eth1: Broadcom BCM4360 802.11 Wireless Controller (r456083)
    / # vlan1: cmd=14: Operation not supported
    eth2: cmd=14: No such device
    eth2: No such device
    lo: File exists
    vlan1: cmd=14: Operation not supported
    eth2: cmd=14: No such device
    It takes it about 1 minute to go from "Freeing init memory: 216K" to "Hit ENTER for console..."

    I have the following commands in CFE though:
    CFE> help
    Available commands:
    nvram               NVRAM utility.
    reboot              Reboot.
    flash               Update a flash memory device
    batch               Load a batch file into memory and execute it
    go                  Verify and boot OS image.
    boot                Load an executable file into memory and execute it
    load                Load an executable file into memory without executing it
    save                Save a region of memory to a remote file via TFTP
    ping                Ping a remote IP host.
    arp                 Display or modify the ARP Table
    ifconfig            Configure the Ethernet interface
    show clocks         Show current values of the clocks.
    show devices        Display information about the installed devices.
    help                Obtain help for CFE commands
    For more information about a command, enter 'help command-name'
    *** command status = 0
    CFE> help flash
         Update a flash memory device
         flash [options] filename [flashdevice]
         Copies data from a source file name or device to a flash memory device.
         The source device can be a disk file (FAT filesystem), a remote file
         (TFTP) or a flash device.  The destination device may be a flash or eeprom.
         If the destination device is your boot flash (usually flash0), the flash
         command will restart the firmware after the flash update is complete
         -noerase     Don't erase flash before writing
         -norescue    Don't check anything
         -offset=*    Begin programming at this offset in the flash device
         -size=*      Size of source device when programming from flash to flash
         -noheader    Override header verification, flash binary without checking
         -ndump       dump nand flash
         -block=*     which block to dump
         -forceflash  Dangerous Command, Don't use if you don't know what you do
         -erase       Erase the partition, can set the  offset and length
         -cfe          write to flash and stay at cfe command mode
         -mem         Use memory as source instead of a device
    *** command status = 0
  6. Siff

    Siff Serious Server Member

    Since you mentioned "eth initialization" - you are not trying to flash/connect to the router through WiFi, are you?
    Although this might work in some cases (I was successful with an old Trendnet years ago), it is always recommended (and safer!) to connect directly to one of the LAN ports (with static IP set on your PC, no firewall, no antivirus and no other network connections, etc.) and then to try to flash or revive the router. BTW, I had to disable and the enable the Ethernet network adapter on my PC in order to make it work (no idea why it acted up, but ipconfig /release and /renew didn't work for some reason).

    I don't know how long it takes Asus RT-AC56U to flash, but if you reboot it before the flash is completed you'll most likely end up with a bricked router, so waiting until it starts to respond to pings is worth in my opinion.

    If direct connection to the router doesn't work - i.e. the Web interface doesn't come up and you cannot put it in restore mode, I guess that you can try flashing the original firmware on the router using the CFE. Please note that the instructions at that link are for Linksys routers and that there might be differences working with Asus routers.

    Good luck! :)
  7. brickbob2

    brickbob2 Network Newbie Member

    It seems like the network ports are just not working, so I wouldn't be able to CFE flash it either since that requires connecting over the LAN ports.

    CFE> nvram erase
    *** command status = 0
    CFE> nvram commit
    *** command status = 0
    CFE> ifconfig
    Network interface has not been configured
    *** command status = 0
    CFE> ifconfig eth0 -addr= -mask= -gw=
    Could not activate network interface 'eth0': Error
    *** command status = -1
  8. Siff

    Siff Serious Server Member

    I don't think that you can set an IP address on eth0 since it represents all LAN ports and the WAN port. And you don't have to - when you reset the router it will respond on and this is the address which you can try to ping, etc.

    My note above was to set a static IP configuration on your computer (I'm guessing that you are using a PC).

    What happens when you set a static IP configuration on your PC, connect the PC to one of the LAN ports of the router, turn the router on and run ping /t
  9. brickbob2

    brickbob2 Network Newbie Member

    I'm using a linux laptop connected to my router, but I did try the ping command on and actually got 100% responsiveness.

    Guess I'm gonna go back and try to CFE flash it after all then, cool.

    I went ahead and tried connecting to using my windows desktop and chrome instead, and got a grey page with the following text:

    Settings have been updated. Web page will now refresh.
    Changes have been made to the IP address or port number. You will now be disconnected from RT-AC56U.
    To access the settings of RT-AC56U, reconnect to the wireless network and use the updated IP address and port number.

    I think I got that page after the first time I tried flashing my router, perhaps it's just chrome-cache for
    Last edited: Aug 30, 2014
  10. Siff

    Siff Serious Server Member

    As far as I can recall, there were issues using chrome to flash routers, so you might be experiencing one of them. Try using IE or Firefox instead and make sure that you have the firewall and antivirus disabled - just in case.
  11. Image This

    Image This Reformed Router Member

    I too got a simliar behavior and feared for it to have failed (tomato-RT-AC56U-ARM--122-AIO-64K.trx). However I did flash it in Web-GUI with IE. It really takes long for the first boot, and only the Power LED works, however after ~15 minutes and after that several unplug/reboots (failed to get into the Restoration Mode as well) it booted up successfully into Tomato.

    I have to say - the AC56U regular performance over 5G with an N900 Router over the same distance gives me a worse (!!!) signal then an Asus USB-N66 N900-Adapter (with 3 internal Antennas).

    USB-N66 with High Power Mode -> 178 MBits ~54 dBI / 45-50% Signal-Level
    AC66U with Transmission-Power set to 200mW (not that it does anything) -> 144 Mbits ~63 dBi / 3x % Signal-Level

    5.8GHZ Channel-Width set to 20mHz (due to the router being N900 standard)

    I guess that "piece" is going back. However I'll wait until my AC66U receives and then test again if I get a better connection over the same route between them. Until then I'm highly unimpressed with it performing worse then an old USB-Wlan-Adapter ... one should never trust Routers with internal Antennas ... I really need to remember that.


    Bottomline of the story - It takes a while and at the moment (Build 122) no LEDs beside the Power-LED are working so take patience.
    Last edited: Sep 2, 2014
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice