Guide on unlocking TP-Link Archer MR200 from your carrier

Not that I know of.

Hello.
I opened a new topic for helping me to unbrick an Archer MR200 through an ESP32 (arduino compatible device) because I have no a raspberry neither CH430 programmer:

If you know how to deal with it, would be great for me to recover this device :slight_smile:

Thank you very much.

Definitively I got to flash the firmware with an ESP32 (arduino) device via SPI using spi-flash-programmer.
I changed #define SPI_SPEED F_CPU/12 instead of #define SPI_SPEED F_CPU/2 at .ino
I left baudrate at 115200.
After 2 and half hours, the firmware was written and I could unbrick the router :slight_smile:

Now I have OpenWRT firmware v22.03 running on the router.
I can access to the modem web interface on 192.168.225.1/login.html
I followed the instructions on https://openwrt.org/toh/tp-link/archer_mr200 in order to unlock the modem and it says:

**Process**

*[NEW METHOD] This variant can be used to unlock the modem without flashing an unlocked firmware, this is helpful in case your modem is running a newer version and is preventing flashing the unlocked firmware. Provided by user liviu.*
* Flash OpenWrt firmware
* Connect to the router either via LAN or WiFi
* Download Android Debug Bridge to your computer
* Connect to router's ADB shell by typing `adb connect (router IP)` and then `adb shell`
* Now run these commands `uci set network_status.network_status_data.unlockPlmn=1`, `uci commit network_status`
* Restart the router

but I cannot connect through adb from my computer. When I run adb connect 192.168.1.1 or adb connect 192.168.225.1 I get failed to connect to '192.168.1.1:5555': Connection refused
or failed to connect to '192.168.225.1:5555': Connection refused

But I can run adb from the routers console:

root@OpenWrt:~# adb shell
/ # uci set network_status.network_status_data.unlockPlmn=1
/ # uci commit network_status
/ # exit

Are you sure that the adb connection should run from computer's console?

Also, when I type cat /etc/config/product there is no such file on the router's filesystem. Is this normal?

Thank you very much :smiley:

Hey, you must connect to the router via WiFi to access the IP address.

Is not possible to run the adb connection through ethernet?
I connected via wifi and still the same error trying to connect from the computer's terminal:

adb connect 192.168.1.1
* daemon not running; starting now at tcp:5037
* daemon started successfully
failed to connect to '192.168.1.1:5555': Connection refused

Any suggestion? :slight_smile:

You have to connect to OpenWRT via SSH shell, then in the shell type "adb shell", you have misread the guide.

Then, I have done it already.
But this guide (https://openwrt.org/toh/tp-link/archer_mr200) says to connect adb from the computer. doesn't it?

  • Connect to the router either via LAN or WiFi
  • Download Android Debug Bridge to your computer
  • Connect to router's ADB shell by typing adb connect (router IP) and then adb shell

But I can see Liviu here said:

From openwrt console run adb shell

On modem console run:
uci set network_status.network_status_data.unlockPlmn=1
uci commit network_status

Reboot Mr200 (Power OFF/ON)

Maybe should be modified the official wiki?

I will sort it out later, just follow the SSH method for now, a bit busy.

Can I flash this .bin directly on EEPROM in order to restore the bootloader and the carrier / modem configuration? Because I didn't make a backup of my EEPROM before to flash this .bin

Originally this router had installed a Flybox firmware. Should I flash one of this firmwares in order to make it work the 4G modem?

I would like to make it work with Simyo (Spain) which uses the orange network but i cannot get connection after filling the apn data.

Please help. I am really lost trying to make work this device with a Simyo SIM card (Orange network) and openwrt.
I have bricked the device several times.
With an ESP32 and a SOIC8 adapter I have flashed the dump of MR200 v2 (https://xwtk.cloud/delivery/ArcherMR200_v2.rar) in my v1 device.
After that I never got to connect to the web (192.168.1.1) of the router (the power led keeps blinking forever). It seems that this .bin doesn't suit to the device, but I can upload a recovery from TFTP.
When I upload mr200_back_to_stock.bin from MR200.zip (from the official openwrt wiki: https://drive.google.com/open?id=0B9LBOwJy0I9lUHVmRHllV25UX2s) I got to access web config of TP-Link firmware: Firmware Version:0.9.1 0.0 v004a.0 Build 160118 Rel.50197n Hardware Version:Archer MR200 v1 00000000 IMEI:867787025921333 Support
Then, If I try to update the firmware with
Archer_MR200(EU)_V1_160905_1476936302791w.zip
I got Error code:500 Unknown error
I have tried to upload the .zip file and also the .bin file with the same results.
Now I am blocked and I don't know how to follow in order to update modem firmware because I didn't make a backup of the EEPROM before to brick it.

Is there any way to make work this device if I didn't make the backup of the EEPROM?

I answer myself :slight_smile:
I found a complete dump of an MR200v1 with stock TP-Link firmware (0.9.1 1.1 Build 160905 Rel.60037n) including the partitions mtd1 (Uboot), mtd 5, 6 and 7.

I flashed the EEPROM with an ESP32 (Arduino device) using https://github.com/nfd/spi-flash-programmer and a SOIC8 adapter. I changed SPI_SPEED F_CPU/10 (see issue: https://github.com/nfd/spi-flash-programmer/issues/18#issuecomment-1704099566) and after rebooting I had a totally functional TP-Link stock firmware that I upgraded to LEDE (following the openwrt wiki) and after that I upgraded to openWRT 22.03.5 (https://downloads.openwrt.org/releases/22.03.5/targets/ramips/mt7620/openwrt-22.03.5-ramips-mt7620-tplink_archer-mr200-squashfs-sysupgrade.bin).
Then I connected to ssh root@192.168.1.1, entered in the adb shell and changed the unlock of the sim.
All looks like it is working flawless except that I couldn't connect to my mobile operator because the signal is not enough but when scanning networks it finds several antennas. I will test it in a better coverage area (I live in the country)
Thank you very much for your support :slight_smile:

Update: I have tested the device in the city and connected to the mobile network at the first time. Now it is working like a charm :smiley:

But I notice that the 4G connection is not very stable and the icon on the web control panel of the modem looks like the signal is very week:


Do you think is this a normal behavior? I am at the center of the city and I get maximum signal with the same SIM on my mobile phone.
I also have tried to update the firmware of the modem from the web control panel without success: always an error message:
Update failed. The update file is not suitable for the current firmware.
Now I have Firmware Version: 1.0.0 Build 160928 Rel.1011n on the modem.
Any suggestion to update???
Also I have opened a post asking advice to upgrade the 3G/4G external antennas of the device:

Thank you very much for your support :smiley:

Thanks for the dump this solve my issue. Yes i tried also to update the firmware but i get the same error as you. It's not an issue for me the router is working and it is unlocked the speed are good the little less that my mobile but for sure better that my cable modem especially in the upload. Have you tried updating to the latest firmware with the power and hold reset button ? Do you think i will brick it again?
Thanks again!

I have the orange flybox Archer MR200
I followed the installation steps on the wiki:

And Unlocking the router modem steps:

And now I have openwrt installed but the connection status stays at disconnected, did I do something wrong?

The instructions on the wiki seem wrong to me (corrected now). I suggest following this one:

Once the modem is unlocked I suggest opening a separate topic if you have problems connecting.

1 Like

thanks for the fast response :slight_smile:
I did the instructions but doesn't seem to make a difference. Is there a way to check if it is setup correctly.

Install picocom kmod-usb-serial-option if not installed already.
Connect to the modem's AT port (probably, /dev/ttyUSB1) with picocom and query the registration status with AT+CEREG?

At USB0 I get this:

USB1 & USB2 I can't type anything after the Terminal ready, I don't know how this program works.

0,1 means "registered, home network"
Everything looks good.