ExpressVPN Aircove AX1800 → installing stock GL.iNet / OpenWrt firmware (secure boot / hardware unlock?)

Routers
1

Has anyone actually managed to flash GL.iNet stock firmware or OpenWrt on the ExpressVPN Aircove AX1800?

I understand it’s hardware-equivalent to GL-AX1800 (IPQ6018) but ships locked I think. I’m looking for confirmed info, not guesses:

  • Secure boot: software-enforced or hardware-fused?

  • Any known access via UART/JTAG, downgrade, or early bootloader?

  • Any successful or failed attempts documented?

I’m not comfortable with hardware work but I accept brick risk — just trying to avoid duplicating already-dead paths.

Links or firsthand experience appreciated.

2

It’s possible using UBoot flashing to go either way, so ExpressVPN Aircove to GL-iNet Flint and vice versa.

Can you confirm you can get into UBoot:Debrick via Uboot - GL.iNet Router Docs 3

3

thanks for your answer. Actually I tried the Debrick tutorial, but when trying to access the Uboot, I get the Expressvpn UI, and not the Uboot UI.

This is why I’m looking for any possible alternative solution.

Thanks !

4

The aircove os changes the standard IP address for uboot I believe, try same uboot steps but use 192.168.132.1 instead

5

Yes the uboot UI on aircove is http://192.168.132.1/uboot.html and it loads the Expressvpn UI and not the stock Uboot UI

6

Hi, I have been trying to do this too, but without success, every route takes me back to the Express gui…. have you had any luck?

7

strange, I’ll try and load aircove firmware later today and see if I can go back, will let you know how I get on…

8

Yes you will be able I think if it’s not branded expressvpn router. I believe this firmware lock is for those sold by ExpressVPN.

9

no solution found, just waiting if any member had a solution for us

10

I should add that I bought the Aircove with ExpressVpn ready flashed by them, so I am wondering if they did something else to prevent access to anything but their GUI.Doing full reset makes no difference🙁

11

OK good news, I took my gl.inet flint running gl.inet firmware and loaded latest aircove os on it (expressvpn_router_5.5.1.6514_release_aircove-ax1800.img), started it up and set admin password on aircove os etc so definitely was running aircove os. I was then eventually able to return it to gl.inet firmware (and gl.inet uboot), router is currently running a 4.8.2 beta since I’d previously downloaded that but once it has gl.inet uboot you should be able to load whatever version you need. I followed a combination of bits of information I’ve seen spread across this forum and briefly spoke to ExpressVPN support, below is a working process all in one place…

I used an old Win10 laptop and I’ve listed steps exactly as I followed them, some aren’t essential to follow exactly as written but can be sure it works if you do…

  1. Connect cable from PC to WAN port of router running Aircove OS (unplug any other cables)
  2. Manually set computer IP address to 192.168.132.66, subnet mask 255.255.255.0, gateway 192.168.132.1 (no need to enter anything for DNS, leave that section blank)
  3. Hold the SYNC button on the side of the router running aircove os (not the reset button on the back) and with that held down turn the power on to the router, keep holding down until you see 1 white and then 2 blue flashes of the front LED, you must then let go, if hold it for too long you will miss and not get into uboot. This seems to require precise timing to enter uboot so may take a few tries
  4. If worked OK should be able to open a browser (I used Chrome and Incognito mode) and access 192.168.132.1/uboot.html
  5. From that uboot screen load the original gl.inet uboot file (named uboot-gl-ax1800-20220711-md5-9890c67c3dafa5aec172f3a31583f9a7.bin), no need to rename it to be shorter
  6. Wait for the file to load and then give the router a long time to make sure it has fully finished, I had other jobs to do so left the router for 30mins or so before I came back to it which is plenty
  7. At this point you can power off the router, change to a static IP of 192.168.1.1, subnet mask 255.255.255.0, gateway 192.168.1.1 as normal for accessing gl.inet uboot
  8. Power on the router and this time hold in the standard reset button on the rear until front light flashes white 5 times then release (standard gl.inet uboot process)
  9. From browser access 192.168.1.1 and load gl.inet firmware file, I used ax1800-4.8.2-0819-1755568085.img that I'd previously downloaded
  10. Wait until the light on the front of the router starts slowly flashing to show it is finished and now awaiting setup
  11. Set IP back to DHCP and access 192.168.8.1 in browser to setup the router as normal with admin password etc

You can get the gl.inet uboot file from here: https://github.com/gl-inet/uboot-ipq60xx/raw/master/uboot-gl-ax1800-20220711-md5-9890c67c3dafa5aec172f3a31583f9a7.bin
You can get the gl.inet firmware from here: GL.iNet download center

cc: @jasonbourne

12

Hi, thank you for all of that and documenting it thoroughly.

I too read through lots of the suggestions here and elsewhere, and then decided to experiment as I had little to lose.

I discovered that when I held in the reset button and powered the router, the blue led lit up , then it flashed 5 times (all blue, no white flashes). Immediately I let go the reset button, the led turned white and I was then able to access the Uboot as you have described. You are correct, timing is very important, it may take serveral goes to let go the reset button at exactly the right time. I then flashed the new Uboot file from that screen.

I then changed the static address of my PC to 192.168.1.66 and was then able to access the Uboot on 192.168.1.1 from where I was able to flash with the new WRT file.

I then changed my static ip to 192.168.8.66 and to my delight was able to enter the wrt login screen at 192.168.8.1.

Phew!

13

OK great, glad it worked for you and with two confirmed Aircove OS → gl.inet firmware success stories this should help others who may want to experiment with the Aircove OS and know for sure they can get back afterwards if needed. I’m surprised you got in to uboot as described whilst running Aircove OS as that didn’t work for me but whatever you did it worked and that’s all that matters! For reference I’ve quoted the exact steps ExpressVPN support team gave me below:

“For resetting it, you will do these:
Unplug the power cable
Press and hold the reset button at the side. While pressing and holding the button, plug in the power cable
Keep holding the reset button until you see 1 white and 2 blue flash then release it“

Ps unless you missed some steps from your post it sounds like you changed firmware back to gl.inet but didn’t reflash the gl.inet uboot? Probably best to do that from 192.168.132.1/uboot.html screen to get a reliable uboot if ever needed in future (the update for uboot itself is done from a different page than the firmware loading uboot page)…