Linksys WRT610N v2.0

From DD-WRT Wiki

Jump to: navigation, search


[edit] Updated 2018-04-28

Currently updating (29th) if you see this message.
These are showing up in second-hand bins (thrift shops) for a couple of bucks, so I converted one to an E3000 and will update this wiki. Primarily I will focus on how to convert it to an E3000, and then update the E3000 DD-WRT Wiki page.
Current output from Status page:
Router ModelLinksys E3000
Firmware Version DD-WRT v3.0-r33555 mega (10/20/17)
Kernel VersionLinux 3.10.107 #16360 Fri Oct 20 11:07:53 CEST 2017 mips

[edit] Intro (links)

The device hardware is identical to a Linksys_E3000.
It can be switched over to an E3000 by following the instructions in the section below.

Further reading: WikiDevi page: [1]
OpenWRT Wiki page: Archived
OpenWRT Wiki page: Current

  • Both OpenWRT pages point to the E3000 pages, because again, the hardware is the same in the later model E3000 as the WRT610Nv2

[edit] Important Notes


  • During configuration or flashing a device, the only cables that should be attached to the device are the network cable to your computer and the power cable.
  • This unit must use K2.6/K3x or newer firmware.
  • No "Easy recovery" after a 30-30-30 reset! Please read this.

See details and other alternatives on recovery section.

[edit] Installation

Make sure you use a firmware with wrt610nv2 in the filename for the initial installation such as:

First read the Peacock Announcement
See Where do I download firmware? for links to newer builds. Do not consider these firmware recommendations.

  1. Flash firmware through the Linksys WebGUI.
  2. After a couple minutes you should see an "Update Completed Successfully" Screen.
  3. least three minutes after that just to be safe.
  4. Do a power cycle of the router. (Unplug the cord, count to 10 and plug it back in.)
  5. Wait for the lights to return to normal, usually about 2 minutes.
  6. Do a reset. Wait. Check for the password page and login to change the password.
  7. Once running DD-WRT, flash a big build, if desired, following the steps in note 1 of the Peacock Announcement: dd-wrt.v24-15962_NEWD-2_K2.6_big.bin

Make sure that you do not flash any build to your router that has the name of a different model router at the end of the filename.

[edit] Recovery (Unbricking)

[Doesn't work after 30-30-30 reset!]
A simple way to recover a bricked device is:

  1. unplug all ethernet ports (Important!)
  2. unplug power
  3. plug power in
  4. wait 2-2.5 seconds
  5. press the reset button and keep it pressed for 5 seconds, then release it
  6. reconnect ethernet (DHCP shoud give IP address to computer)
  7. point your browser at You should see a "Management Firmware update" screen where you can flash the original (Linksys) firmware.

Windows Vista/7 may have trouble with TFTP. Try using Linux or Windows XP. [2]

Alt Method by redhawk0

WRT610Nv2 debricking....Info and Howto
Just an FYI thread.....

I received a 610Nv2 today that was bricked. I tried the power cycle, reset button for 5 seconds, web browser management mode method for debricking....but I was without luck.

It would respond with TTL=100 all the time....even after a successful flash of the 610nv2 trailed build.

I believe the owner indicated that it was flashed accidentally with a V24 build. These 610Nv2 require K26_NEWD2 builds.

  1. So...I installed my Serial header to see what was going on. It said the CRC was correct (expected and calculated were the same)....but the CFE saw it as an invalid header....even though it is the trailed build that had 610N in the header.
  2. I tried to flash the OEM firmware...but tftp.exe won't accept a file over used tftpd32 server to flash the unit using the serial port and CFE commands.
  3. I renamed the Linksys OEM 610Nv2 FW to code.bin and pointed to its directory in the tftpd32 server program.
  4. Broke into the CFE and issued the following commands to move the firmware to the unit.
  5. flash -ctheader flash0.os
    • (where was the static IP assigned to my laptop running the tftp server)
  6. when it finished programming....I typed "load"
  7. The unit finished the process and rebooted into Linksys FW. Then I could load the K26_NEWD2_mini_610nv2.bin build through the Linksys FW upgrade tab.
  8. power cycle, hard reset, then flashed the latest K26_NEWD2_14473_big.bin file.
  9. power cycled, hard reset again...then configured. All working great on this unit....hard reset again...and shipping it back to the owner.

Hope it helps someone else...this was one of the trickiest Debrickings that I ever had to deal with. (first time with a 610Nv2 unit)

- redhawk

[edit] NVRAM Erase breaks Management Mode

Many people have difficulties getting the WRT610Nv2 into management mode using the technique above. It appears that after the nvram is erased (via a 30-30-30 reset for example) the regular "press reset after startup" technique no longer works. This will require recover via serial console. An alternative is to short two particular pins on the flash chip during startup, but this is not recommended. Boot-up TFTP is not an viable option, as it will appear to work if your firmware file is under 3.8MB, but the upload will not be flashed.

[edit] E3000 Conversion

Instructions are based on information from the following references:
Upgrade Your Linksys Router, Literally!
DD-WRT Forum Index -> Broadcom SoC based Hardware -> WRT610N V2 conversion to E3000 (stock firmware) -> Barryware
DD-WRT Forum Index -> Broadcom SoC based Hardware -> Change your 610n V2 into an E3000 and
DD-WRT Forum Index -> Broadcom SoC based Hardware -> Change your 610n V2 into an E3000 - Amended SEE THIS THREAD

  • NOTE: Refer to last thread for files and other information contained in this procedure

  1. Flash your router with DD-WRT (an ordinary K26 build, see above), reset to defaults, set an admin password, and enable SSH.
  2. Open and save your current CFE to a safe place.
  3. Download the CFE for the E3000 router below:
    • (SHA1 Sum: b3cbe0d0ba8088ed3ff0a206b8866a02e8ec5ba4) [link]
  4. Using a Hex editor, modify the CFE so that it has your router’s MAC address, serial number, and 8-digit easy access PIN. All of these numbers are on the sticker under your router. The easy access PIN is the number that is in the white space next to the “synchronize” arrows and looks like XXXX-XXXX. In the CFE, it is a single string XXXXXXXX.
    • Here are the offsets…
    • E3000:
    • MAC @ 0x1E00
    • SN @ 0x3FE30
    • PIN @ 0x3FCDC
  5. Connect your router to a reliable power source. REMEMBER: Do NOT power cycle your router at any time until you have completely finished and can confirm that the router has booted up into an operational state.
  6. SCP the modified CFE into /tmp on the router. (WinSCP)
  7. SSH into your router using “root”. The password is your web interface password.
  8. Run the following commands:
    • cd /tmp
    • mtd unlock cfe
    • mtd write -f [cfe's file name] cfe
  9. It will only take a few seconds to flash the CFE. But you are not done yet – DO NOT REBOOT. Go back to the router’s web interface and upload the modified firmware, making sure your set the “Reset to defaults” option. This modified firmware tricks your router in thinking its the proper build, but is indeed the build for the converted model so that after a reset, it can boot the proper image.
    • The downloads are here:
    • E3000 Modified DD-WRT (SHA1 Sum: efab4812ca602466942d7d0eb81fbfd014ca5789)
  10. The router will reset itself upon flashing this modified firmware. Be patient – it can take up to 10 minutes and a few reboot cycles to complete. If your are successful, you should be able to access the DD-WRT admin page at
  11. One last thing: set a password, and flash a proper DD-WRT E3000 build, making sure you reset to defaults again.

Done! You should now have a converted E3000! You can even flash the stock firmware for the E3000 and use it if you’d like.

What I found was that DD-WRT actually likes the extra NVRAM better. YMMV. Cheers!