Linksys E1000 v1

Default SSID: CiscoXXXXX (6 addl. devices)
Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1326 additional devices
of which 155 are Linksys devices
Default login user: blank
Default login password: admin
blank:admin credentials used by 280 additional devices
of which 135 are Linksys devices

Manuf/OEM/ODM

CyberTAN

3rd Party Firmware Support

DD-WRT • (List)
, OpenWrt (Was)
, TomatoUSB • (List | DLs)

Retail

Availability

End of Life

FCC approval date

29 December 2009

Country of manuf

China

Physical

Dimensions

7.95" x 1.34" x 6.3" (202 x 34 x 160 mm)

Radio 1

Chip1

Broadcom BCM4716B0

Wireless interface OUI

68:7F:74, C0:C1:C0

Antenna Connector Type

Internal

MIMO status

2x2:2

Wireless Standard

IEEE 802.11b/g/n

802.11n

up to 300 Mbps

802.11g

up to 54 Mbps

802.11b

up to 11 Mbps

WiFi Operating Frequency

2.4 GHz

Radio cor_rev

Radio Capabilities

ap, sta wet led wme pio 802.11d 802.11h rm cqa mbss16 afterburner, ampdu, amsdurx, amsdutx, acktiming

	FCC ID
Cisco Valet M10 v1	Q87-M10 Q87-E1000

	CPU1 brand	Radio1 chip1 brand
Linksys E1000 v1	Broadcom	Broadcom
Linksys E1000 v2.0	Broadcom	Broadcom
Linksys E1000 v2.1	Broadcom	Broadcom

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.

For a list of all currently documented Linksys device with specifications, see Linksys.

• 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = N300 class

Overview

"3763-01010105R" is silkscreened on the board of some / all production model units.
E1000 v1 serial numbers appear to start with CVN0.

The default SSID is CiscoXXXXX where XXXXX is the last 5 digits of the serial number. If the device has been configured with Cisco Connect the device will probably have a randomly generated SSID. A sample serial number is CVN01K6E1346.

Links of Interest

Linksys E1000 On the DD-WRT Wiki
On the OpenWrt Wiki
On the DD-WRT forums w/ OUI mention
On the DD-WRT Wiki w/ serial pinout
Linksys E1000 now supported (V.1 ONLY!) On the DD-WRT forums
jtag 160v3 & e1000 resistor values On the DD-WRT forums

Flashing

NOTE: During configuration or flashing a device, the only things that should be hooked to the device is the computer and power.

Flashing dd-wrt

WARNING: Do not flash micro this unit!

WARNING: Requires K2.6 for DD-WRT, Do not flash anything else!

WARNING: This is only for version 1 hardware. For version 2: Linksys E1000 v2.0

Support started version: dd-wrt.v24-15279_NEWD-2_K2.6
Current supported version: ?
Comment:
Exactly the same hardware as M10 and WRT160N v3.0

Install Procedure

Read the Peacock Announcement.
Download a trailed mini build (named mini_e1000v1.bin) from the broadcom_K26 folder.
- Old builds are named mini_e1000.bin, before the v2 hardware was supported
- If you wish to experiment with a newer build, read it's build thread before flashing!
Set a static IP on your computer e.g. 192.168.1.7 and subnet mask 255.255.255.0
Connect an ethernet cable from your computer to a router LAN port. Do NOT use wireless!
- Recommended to disconnect other cables.
Perform a hard reset.
Navigate to http://192.168.1.1/ for the Linksys web GUI
Go to the Linksys Administration->Firmware Upgrade page. Do not give the reboot command. You will use this page to upgrade your firmware.
Browse to the downloaded firmware and click Upload.
Do not touch anything. The page will tell you that the upgrade was successful and the router is now rebooting. Your router may take upwards of a couple minutes to reboot. Watch the lights... once the wireless and power indicators are on steadily for several seconds, your router is fully rebooted and you can click "Continue" in your browser window.
If the DD-WRT password change page displays, your upgrade has been successful, and you must now perform another hard reset. This time, when you navigate to http://192.168.1.1/, click "Reboot" and wait for the router to come online again so you can configure it.

Make sure all builds you flash are less than 8 000 000 bytes in size or you will brick the router.

If the DD-WRT password change page does not display, your page request times out, or you can't ping 192.168.1.1, make sure both wireless and power lights are on steadily first, then do a hard power cycle (unplug the power from the router—do not do a 30/30/30 reset). Wait a few seconds and plug the power back into the router. Wait until both wireless and power lights are on steadily, then navigate to http://192.168.1.1/ in your browser of choice again. If the DD-WRT password change page displays, your upgrade has been successful, and you must now perform another hard 30/30/30. This time, when you navigate to 192.168.1.1, click "Reboot" and wait for the router to come online again so you can configure it.

You can also flash the same firmware of TomatoUSB as described for WRT160N_v3.0

Firmware version 33555 dated 10/20/17 runs on this router, but doesn't have the final Broadcom fix for the KRACK vulnerability in WPA2. KRACK fixes for Broadcom were completed in SVN 33678, but build 33679 is missing many files, so it is recommended to use 33772 or newer, after reviewing New Build threads.

See Where do I download firmware? for build links.

Performing a Hard Reset

Procedure for an E1000v1:

Perform a normal 30/30/30 reset.
Login to http://192.168.1.1/ and you will see the Linksys - Management Mode page.
Click "Reboot" then after a moment, you will see "Command reboot completed." and reboot again.
When the lights return to their normal state, click "Continue" to the router GUI main page.

Flashing OpenWrt

This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram. DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date and secure OpenWrt version onto it! See 4/32 warning for details.

This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation. This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices what you can do now.

OpenWrt support for this device has ended in 2022.
19.07.10 was the last official build for 4/32 devices.

Devices with Broadcom WiFi chipsets have limited OpenWrt supportability (due to limited FLOSS driver availability for Broadcom chips). Consider this when choosing a device to buy, or when deciding to flash OpenWrt on your device because it is listed as supported. See Broadcom WiFi for details.

On the OpenWrt ToH (techdata entry)
On the OpenWrt Wiki
On the OpenWrt Forum
On the OpenWrt Forum
OpenWrt Target: bcm47xx
OpenWrt Subtarget: mips74k
OpenWrt Package architecture: mipsel_74kc
Support started version: 14.07
Current supported version: 18.06.0
Unsupported Functions:
WiFi 2.4GHz partly

Please insert instructions here

Flashing Tomato

Preparation

Use a wired connection only. (disable wireless to be in the safe side)
Make sure you disable firewall in Windows.
Disable the virus guard.

Let's Begin!

Download and extract the K26-MIPSR2 Tomato USB Firmware. Mini, STD or VPN version is up to you. With this router you can only use certain builds. It's flash size is only 4MB. (Get them Here)
Connect your computer's using network cable to one of the LAN ports of the Asus router. Manually set your computer IP address (in the TCP/IP properties of the LAN connection) to 192.168.1.2, network mask 255.255.255.0.
Upgrade to dd-wrt first.
After upgrade, go to the router by typing 192.168.1.1, after setting the username and password go to administration then firmware upgrade. Click browse and find the TomatoUSB firmware file. Click upgrade.
After upgrading is complete open your browser, go to the router by typing 192.168.1.1, when prompted for a username and password enter "root" and "admin". Go to Administration > Configuration > Restore Default Configuration, select "Erase all data in NVRAM memory (thorough)" and click OK. To insure that the processor has time to complete addressing all NVRAM variables it's best to wait about 5 minutes before making any changes.

You are now ready to start using your Asus router with Tomato.

Upgrading

Updating DD-WRT

If dd-wrt is already on the router follow these instructions. If stock firmware is on the router follow the flashing instructions.

Check for recommended builds here first.
Set your computer to a static IP of 192.168.1.7. (or to whatever subnet the router is on) Disable all firewalls and security. Disable wireless on your computer and only have the router connected to the flashing computer by the ethernet cable between the two.
Hard reset or 30/30/30 (If the router supports it, if not, reset to defults in the GUI) prior to flashing. Wait. Check for password page on re-login and change password.
Flash firmware. You can use the webgui except if you have a belkin router. (For belkin use tftp.exe to flash)
Wait...at least three minutes. Lights should return to normal. See important2, below. Failing to wait is how most people brick their routers.
Do a power cycle of the router. (Unplug the cord, count to 30 and plug it back in.)
Wait for the lights to return to normal usually about 2 minutes.
Hard reset or 30/30/30 again (If the router supports it, if not, reset to defults in the GUI). Wait. Check for the password page and re-login to change the password. Then you can reconfigure your settings manually.
Once configured set your computer back to autoIP and autoDNS.

Important1: This Hard reset or 30/30/30 works fine for Asus router, but you do have to power cycle after the reset.

Important2: After you flash the firmware, and before you do the hard reset, the router will be building some nvram settings. YOU MUST WAIT FOR THIS TO FINISH PRIOR TO DOING ANYTHING WITH THE ROUTER INCLUDING A HARD RESET. Usually, you can tell when this process is completed by the WAN light coming on, but it does take several minutes. Go have a beer. There are starting to be more and more people who BRICK their routers by not waiting until the nvram is rebuilt, PRIOR to doing a hard reset. YOU NEED TO WAIT!

Reverting

Reverting DD-WRT

Read the peacock announcement found here: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=51486
Do a hard 30/30/30 on the router according to note 1 of the peacock announcement (30/30/30)
Set a static IP on your computer to 192.168.1.7. Subnet mask should be 255.255.255.0.
Connect the lan cable from your computer to a LAN port of your router. Make sure your router is plugged in. Nothing should be connected to your computer or the router except the lan cable between them. Turn your firewall and any wireless computer connections OFF.
Power cycle the router (uplug the power from the router for 30 seconds and then plug it back in)
Open your browser to 192.168.1.1 by putting that in the browser address window of your browser. You should open the linksys webgui and NOT a page that says Management Mode. If you see management mode, power cycle the router again.
Enter your username and password
Go to administration and firmware upgrade
Navigate to the folder that you are using, and select FW_E1000_1.0.01.007_US_20100415.bin.
Hit upgrade
When you get a success, wait FIVE FULL minutes.
When you can again access the Linksys webgui using a browser at 192.168.1.1, do another hard 30/30/30 on the router.
Reset your computer ethernet connection to auto IP and auto DNS

JTAG-Serial Info

JTAG

JTAG Pinouts

nTRSt - R64 - 1o o2  GND
  TDI - R65 - 3o o4  GND
  TDO - R66 - 5o o6  GND
  TMS - R67 - 7o o8  GND
  TCK - R68 - 9o o10 GND
  N/C - -- - 11o o12 N/C

JTAG Recovery

Source

As most know.. The wrt160n v3 & the E1000 v1 are identical in regards to hardware.

As most know, Linksys has disabled the jtag circuit in these routers by leaving out smt components (just like the 610 v2 & E3000)

I'll link this in another thread where a dd-wrt member needs jtag for this router.

I traced the jtag header to the missing components. What needs to be done, is to bridge the pads on the pcb. There are 5 pads that need to be bridged.

Four can be found on the bottom of the pcb, and one on the top.

They are marked R64, R65, R66, R67, & R68.

R67 is on the top side of the pcb, and the rest on the bottom.

Attached are pics showing the pads that need to be bridged as well as the jtag output doing a -probeonly.

The ribbon cable you will see in one of the pics, is connected to a serial header I hot glued to the side of the pcb. This router I purchased to assist the devs (Eko) in porting dd-wrt to this router. Cuz we bricked it many times, pogo pins to the serial pads would not do. I needed something I could connect to many times.

jtag output

C:\E1000>tjtag302 -probeonly

==============================================
EJTAG Debrick Utility v3.0.2 RC2-1 Tornado-MOD
==============================================

Selected port = 0x378

Intial value of Control register is 000000CC
Intial value of status register is 0000007F
01111111 (0000007F)

Status bit 7 Busy Inverted pin 11 = 1
Status bit 6 *Ack pin 10 = 1
Status bit 5 Paper-out pin 12 = 1
Status bit 4 Select pin 13 = 1
Status bit 3 *Error pin 15 = 1
* means low = true, e.g., *Error

VCC connected
values of Control register after init 0x000000CC
value of status register after init 0x0000007F
system reset complete

Detected IR chain length = 32
Number of device(s) = 1

idcode 0x000a817f 32
Jtag is in LV mode
switching to MIPS mode
Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00010000000010001100000101111111 (1008C17F)
*** Found a Broadcom BCM5356A1 KFGB REV 1 CPU chip ***

- EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000)
- EJTAG Version ....... : 3.1
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Init PrAcc ... Done
Clearing Watchdog ... Done


Chip ID b83a
Chip Rev 0
Package Options 2
Number of Cores 5
Core Revision 63
Core Type 8830
Core Vendor ID 15200000
Flash Type 100
Flash Type = SFLASH_ST
Dest is bits 0
Dest is bits1 0
Dest is bits 0
Flash is byteswapped 0
Endian Type is LE 0
PLL Type 00000000
00000000000000000000000000000000 (00000000)
00000000000000000000000000000000 (00000000)
00000000000000000000000000010010 (00000012)
Done

Flash Vendor ID: 00000000000000000000000011000010 (000000C2)
Flash Device ID: 00000000000000000010000000010110 (00002016)
*** Found a Macronix MX25L3205D (4MB) Serial Flash Chip ***

- Flash Chip Window Start .... : 1FC00000
- Flash Chip Window Length ... : 00400000
- Selected Area Start ........ : 00000000
- Selected Area Length ....... : 00000000



*** REQUESTED OPERATION IS COMPLETE ***


C:\E1000>

Serial

Serial Pinouts

VCC  o TP12
 TX  o TP13
 RX  o TP14
N/C  o TP15
GND  o TP16

Serial Recovery

First familiarize yourself with Serial Recovery and reference the serial pinout (E1000v2).

Once at the prompt you need to assign an IP/Subnet mask to eth0. I'm not sure if eth0 is the routers interface to the switch or one specific port but I had a CAT5 cable hooked up to port 1 on the router and it worked.

If you type "ifconfig eth0" you will see that there is no address assigned to the interface. The following command will assign an address/mask.

CFE> ifconfig eth0 addr=192.168.1.1 mask=255.255.255.0

Now you can flash using a TFTP client from your computer, which is plugged in to port 1 on the router, just like the Serial Recovery page says.

flash -ctheader : flash1.trx