Changing CFE defaults

The following is a guide from that I've copied here, with added commentary. I am not the original author, that credit goes to Oleg.

Copyright © 2005 Oleg I. Vdovikin IMPORTANT: This information provided AS IS, without any warranties. If in doubt leave this page now. This information applies to WRT54G hw rev 2.0, 2.2, 3.0. No other units were tested, but most likely WRT54GS units should be the same. WRT54G hw rev 1.x use different layout, so you need to adjust things accordingly.

The wrt54g v.2.2 unit was kindly donated to me by maxx, the member of the forum. I would like to publically say thank you to him.

Telnet/ssh to your router running your favorite firmware and type the following

dd if=/dev/mtdblock/0 bs=1 skip=4116 count=2048 | strings > /tmp/cfe.txt
dd if=/dev/mtdblock/0 of=/tmp/cfe.bin

Copy both cfe.bin and cfe.txt to your linux box (this is required).

To copy files from your router to your computer, make sure the Dropbear package is installed, and type:

scp root@:/tmp/cfe.bin /directory/on/your/computer
scp root@:/tmp/cfe.txt /directory/on/your/computer

Check cfe.txt, it should look like this (this is from v.2.2):

vlan0ports=1 2 3 4 5*
vlan1ports=0 5

Open cfe.txt using text editor and change defaults in the way you like (but be extremely careful, as some changes could prevent device from booting and you will need to use JTAG cable to bring it back to life). For me I've decided to enable both Afterburner (Speedbooster) and set boot_wait to on by default, so reset to default no longer messes the things, so I've applied this pseudo-patch (please note, that I've added bit 0x200 to boardflags to enable afterburner):


To make life easier for me, I added “reset_gpio=6” to the cfe.txt file. This way, if I do set something wrong, like clkfreq, and the router just locks up, I wont have to try over and over again to hit a very slim window with the JTAG to erase the nvram. I can just hold reset when the router powers on, and it will use the default nvram values stored in the cfe.

If you do not understand some things in this file, do not try to edit it. This is also applies to afterburner. I've also tried to change default lan_ipaddr, but this does not work in the way I expect: CFE started to answer to ping request to new lan_ipaddr, but it does not accept tftp transfers...

You will need a nvserial utility which comes with several GPL tarballs. Linksys supplies it in the wrt54g.1.42.3, wrt54g.1.42.2, wap55ag.1.07, wap54gv2.2.06. Launch nvserial in the way like this on your x86 linux box: You can get nvserial from

nvserial -i cfe.bin -o cfe_new.bin -b 4096 -c 2048 cfe.txt

It works really slow, but it should finally create cfe_new.bin file for you, which has new embedded nvram.

Recompiling kernel with writable pmon partition

By default most firmwares has pmon partition write protected, i.e. you can't flash anything to this first 256k of flash. This is to prevent corrupting PMON/CFE. To remove this “lock” you will need to compile your own firmare with the following patch, you will need to copy the patch into “target/linux/linux-2.4/patches/brcm”. (This patch works with WHITERUSSIAN RC3)

--- linux-2.4.30/arch/mips/bcm947xx/setup.c.orig        2005-09-21 11:24:09.000000000 -0400
+++ linux-2.4.30/arch/mips/bcm947xx/setup.c     2005-09-21 13:48:46.853425632 -0400
@@ -174,7 +174,7 @@

 static struct mtd_partition bcm947xx_parts[] = {
-       { name: "pmon", offset: 0, size: 0, mask_flags: MTD_WRITEABLE, },
+       { name: "pmon", offset: 0, size: 0 /*, mask_flags: MTD_WRITEABLE,*/ },
        { name: "linux", offset: 0, size: 0, },
        { name: "rootfs", offset: 0, size: 0, },
        { name: "nvram", offset: 0, size: 0, },

Note: At least on White Russian recompiling the kernel is not necessary. Theres a kernel module thats makes the CFE Partition writable at

So, once you've recompiled and flashed your new firmware you need you upgrade CFE. This process is dangerous, as flash failure during it will prevent your unit from booting. Copy cfe_new.bin to your wrt54g and flash it. The exact commands are dependent on the firmware. With OpenWrt I've used the following:

mtd unlock pmon
mtd write -f /tmp/cfe_new.bin pmon

I recommend using the JTAG cable method for re-flashing your CFE. If something were to go wrong, you would end up needing the JTAG cable anyways. It's really cheap and easy to build, and makes it possible to recover from almost any error you make when writing to the flash. Check out '

Embedded nvram is only used, when real nvram is either corrupted or empty (CRC/magic checks fails), so you will need to erase nvram or to reset to defaults. With OpenWrt type this:

mtd erase nvram

Then cross your fingers and reboot your unit. And remember - I'm not responsible for any damage to your unit, as this information is provided AS IS for my own pleasure. Posted: 2005-04-03

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2018/02/20 18:50
  • by bobafetthotmail