Guide on unlocking TP-Link Archer MR200 from your carrier

Community Builds, Projects & Packages
62

You only can return to stock by flashing the dump I sent you via SOIC8

63

Yep that is correct.

64

I will need some help.
I have connected the raspberry SPI to the chip but i am getting the following
maggot@ObserviumPi:/boot $ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -w recovery.bin
flashrom v1.2 on Linux 6.1.21-v8+ (aarch64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Using default 2000kHz clock. Use 'spispeed' parameter to override.
Found Macronix flash chip "MX25L6405" (8192 kB, SPI) on linux_spi.
Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) on linux_spi.
Found Macronix flash chip "MX25L6406E/MX25L6408E" (8192 kB, SPI) on linux_spi.
Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E/MX25L6473F" (8192 kB, SPI) on linux_spi.
Multiple flash chip definitions match the detected chip(s): "MX25L6405", "MX25L6405D", "MX25L6406E/MX25L6408E", "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E/MX25L6473F"
Please specify which chip definition to use with the -c option.
maggot@ObserviumPi:/boot $ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -w recovery.bin -c MX25L6405
flashrom v1.2 on Linux 6.1.21-v8+ (aarch64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Using default 2000kHz clock. Use 'spispeed' parameter to override.
Found Macronix flash chip "MX25L6405" (8192 kB, SPI) on linux_spi.
Error: Image size (8126464 B) doesn't match the flash chip's size (8388608 B)!

i am trying the recovery you send me.
but no luck
Any help is much appreciated
Thank you!

65

Ah hold up, my bad.

You should extract the rar, and flash the recovery bin via TFTP.

66

never mind i have flashed the firmware with SPI after that i downloaded the official from tp link and now it bricked nothing works . I will recycle it . i order an 6400 unlocked i am done with it!
Thanks for the help i learned one or two things .

67

Hi again could i ask for a favour ? Could you upload the firmware MX25L6433 of your working MR200 . To try reflash it ?
Thanks in advanced

68

You should use the Orange dump to restore, afterwards restore the MR200v2 dump via TFTP.

The guide tells many times not to use the TP-Link firmware!

69

I think you did not understand me i need the firmware of the chip MX25L6433 the bios i have it. But now the MR200 is bricked as the firmware was corrupted. if you can ok if you cannot send me the firmware of the chip it;s ok too . The orage dump is not flashing to the chip.

70

Hi,

Can the MR200 tag the wlan device to VLAN10?

Why? I intend to move from Orange to EDPNet in Belgium and use fibre instead.

EDPnet state that "make sure that your hardware has a Gigabit Ethernet port, that it can build up a PPP-session and that it supports vlan 10 tagging."

I don't think a GB NIC matters because the fibre speed is 100MB/s down and 50MB/s up.

71

Unfortunately I am not experienced in interfacing within OpenWRT.

1 Like
72

OK. I shall take this as a no to my question and look at a different wifi router.

Although from what I read most residental routers are too poor to work reasonably well with fibre optic home connections. I think that this means I might not get a fibre connection anyway:- It would be a pity to get a 100mbs downlink and then only 20mbs down although this would be better than my existing 10mbs down.

73

Yeah these routers are mainly made for SIM use.

1 Like
74

Yes I agree. It's what I use it for now.

Just don't want to buy a new router when my current one works.

75

Hey there.
Hope this help you.

Unlock MR200 V1 modem:
From openwrt console run adb shell

On modem console run:
uci set network_status.network_status_data.unlockPlmn=1
uci commit network_status

Reboot Mr200 (Power OFF/ON)

Tested on MR200(UN) 1.0 locked on Orange.
cat /etc/config/product

config product 'info'
                option board_type 'mdm9225'
                option product_type 'mr200-un-v1'
                option product_id '02000001'
                option product_id_ext '02000201'
                option product_name 'MR200(UN) 1.0'
                option hardware_ver '1.0'
                option firmware_ver '1.0.0'
                option firmware_ver_build 'Build 17/07/31 09:20:12 Rel.27n OFR'
                option product_region 'UN'
                option product_series 'MR200'
                option vendor_name 'TP-LINK Technologies Co., Ltd.'
                option ssid_prefix 'TP-LINK_LTE_MODULE_'
2 Likes
76

Hey! Thanks so much!

I will put it in the guide, of course will credit you as well.

77

Glad to help.

Please delete last four sections on the guide:

  • Type cat /etc/config/product
  • Delete the information regarding confif product 'info '
  • Paste the following
  • Restart again

I put here the output of “cat” command just for info about router that I unlocked with this method.
Don't have to delete/paste anything.

78

Ah I thought you wanted to modify the config data as well so the modem identifies as a universal one.

Will change the guide now!

79

do u have the Hellas Wind carrier specific bootloader so that i don't have to connect a rpi to it?

80

Hey, use the MR200_V2 dump listed here in posts.

82

Is possible to show info about currently connected lte band ? No info on 192.168.225.1 about band. Maybe is possible through ADB.