Mercusys MR90X UBI install, Wi-Fi doesn't work and wrong mac address

bosukes · October 7, 2025, 10:57pm

I did the Openwrt u-boot layout option while installing. It worked, but on Luci no Wireless section at lall. So it says this:
Copy OpenWrt openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-bl31-uboot.fip, openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-preloader.bin, openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-squashfs-sysupgrade.itb and MT7986_EEPROM.bin, default-mac (from /tp_data backup) to the /tmp folder of the router using scp.

Ok but where do we get that MT7986_EEPROM.bin ? and default-mac? I actually asked chatgpt(yeah, big mistake) it said to me just get first some bytes of tp_data.bin file, I did that. It said that for the mac address too. But in turn I get no Wireless section on the luci and wrong mac address. Some random generated maybe. So I checked the logs, and this:

root@OpenWrt:/opt/zapret# dmesg | grep -i wifi
[   12.425923] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20240823160739a
[   12.624490] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20240823160804
[   12.727282] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20240823160840
[   12.833941] mt798x-wmac 18000000.wifi: eeprom load fail, use default bin
[   12.840975] mt798x-wmac 18000000.wifi: Direct firmware load for mediatek/mt7986_eeprom_mt7975_dual.bin failed with error -2
[   12.852349] mt798x-wmac 18000000.wifi: Falling back to sysfs fallback for: mediatek/mt7986_eeprom_mt7975_dual.bin
[   12.899280] mt798x-wmac: probe of 18000000.wifi failed with error -12
root@OpenWrt:/opt/zapret# dmesg | grep mt76
root@OpenWrt:/opt/zapret# iw dev
root@OpenWrt:/opt/zapret# lsmod | grep mt76
cfg80211              299008  4 mt7915e,mt76_connac_lib,mt76,mac80211
compat                 12288  3 mt76,mac80211,cfg80211
mac80211              581632  3 mt7915e,mt76_connac_lib,mt76
mt76                   73728  2 mt7915e,mt76_connac_lib
mt76_connac_lib        45056  1 mt7915e

bosukes · October 9, 2025, 9:26pm

What I found is, there seems to be those strings inside tp_data.bin file, but I don't exactly know how to get those. See here. There are those MT7986_eeprom.bin and default-mac there:

user:~/Belgeler/openwrt mr90x$ strings tp_data.bin 
UBI#
UBI#
UBI#
UBI#
UBI!
tp_data
UBI#
UBI!
tp_data
UBI#
UBI#
UBI!
UBI#
UBI!
UBI#
UBI#
UBI!
,RF	
,RF	
@RI	
'_7V
UBI#
UBI!
UBI#
UBI!
UBI#
UBI#
UBI#
UBI#
UBI#
UBI#
UBI#
UBI#
UBI#
UBI#
UBI#
UBI#
UBI#
UBI#
UBI!
device-id
MT7986_EEPROM.bin
MT7986_BTNFLAG.bin
#product-info
_Q5<
default-mac
UBI#
UBI!
dev_id:80272D74A9DA15B4F7BDCC93B3ADE0322384320C
333&
pD)4
GGYix
IIYmz
IIZmy
HHYlx
HHXj)
JJ[my
JJZjw
FFYiu
IIXmz
KK\lw
GGZj{f
JJZo}~
n{>X
333&
pD)4
GGYix
IIYmz
IIZmy
HHYlx
HHXj)
JJ[my
JJZjw
FFYiu
IIXmz
KK\lw
GGZj{f
JJZo}~
n{>X
333&
pD)4
GGYix
IIYmz
IIZmy
HHYlx
HHXj)
JJ[my
JJZjw
FFYiu
IIXmz
KK\lw
GGZj{f
JJZo}~
n{>X
333&
pD)4
GGYix
IIYmz
IIZmy
HHYlx
HHXj)
JJ[my
JJZjw
FFYiu
IIXmz
KK\lw
GGZj{f
JJZo}~
n{>X
vendor_name:Mercusys
vendor_url:www.mercusys.com
product_name:MR90X
device_name:AX6000 8-Stream Wi-Fi 6 Router
country:DE
product_ver:1.0.0
hw_ver:00000001
product_id:01100901
special_id:45550000
hw_id:BF5482FF3A26BC14AA41E73D1A5E5C3D
oem_id:C94E9FA6DCF3226C23DD3AB28D1E12F5
vendor_name:Mercusys
vendor_url:www.mercusys.com
product_name:MR90X
device_name:AX6000 8-Stream Wi-Fi 6 Router
country:DE
product_ver:1.0.0
hw_ver:00000001
product_id:01100901
special_id:45550000
hw_id:BF5482FF3A26BC14AA41E73D1A5E5C3D
oem_id:C94E9FA6DCF3226C23DD3AB28D1E12F5
vendor_name:Mercusys
vendor_url:www.mercusys.com
product_name:MR90X
device_name:AX6000 8-Stream Wi-Fi 6 Router
country:DE
product_ver:1.0.0
hw_ver:00000001
product_id:01100901
special_id:45550000
hw_id:BF5482FF3A26BC14AA41E73D1A5E5C3D
oem_id:C94E9FA6DCF3226C23DD3AB28D1E12F5
57666556
UBI#
UBI!
UBI#
UBI#
UBI#
UBI#

So according to chatgpt, I extracted the MAC address but it's not what is router's actual mac address. It doesn't match. Help please.

frollic · October 10, 2025, 5:13am

According to Mercusys mr90x install problem, you should have made a copy.

bosukes · October 10, 2025, 9:18am

Yes I did with cat

cat /dev/mtd0 > /tmp/boot.bin
cat /dev/mtd5 > /tmp/tp_data.bin

I have those bin files too on my pc.

frollic · October 10, 2025, 9:27am

See if Cant unbrick my Mr90x - #7 by Cthulhu88 helps.

bosukes · October 10, 2025, 9:30pm

Nope, not helpful but I found this. This AA:BB:.. is the real mac address of the device. So, I was trying to find that in the file and this happene

d:
user@debian13:~/İndirilenler$ grep -oba $'\xAA\xBB\xCC\xDD\xEE\xFF' tp_data.bin
3428400:0���]

It's at this 3428400, but how should I get it? Chatgpt helped me get it, but should default-mac be a text file of the mac adress, or the binary version of the mac address?
I also found the other MT7986_eeprom.bin file with the help of AI. It gave me 4 possible eeprom files 4kb, 8kb, or 12kb which one could it be?

Cthulhu88 · October 11, 2025, 5:54am

Why are you asking us? Ask “AI” instead as it’s always giving quality answers, right?

The post @frollic linked is a possible way to recovertp_data.binin case you didn’t backup it and replaced its mount/partition. It’s only viable if the data wasn’t overwritten to begin with.

You already have yourtp_data.bin,obviously you don’t need to go through this. Next time, follow the proper instructions listed at https://openwrt.org/toh/mercusys/mr90x_v1#installation_openwrt_u-boot_layout which clearly says:

Had you copied the contents of your/tp_dataas this instruction tells you to, you would already have those files extracted and available to you instead of “having” to ask an expensive advanced web scraper, which won’t even tell you the obvious/correct answer.

P.S. Mandatory rude response to lazy people using “AI” as sages instead of reading instructions written by actual humans.

bosukes · October 11, 2025, 7:49am

Mate I got the tp_data.bin alright? It's a damn binary file what are you talking about here bro? It's not a damn folder. It doesn't say copy the contents of the tp_data it says cat /dev/mtd0 > tp_data blah blah, as a binary file!!! Instructions are totally unclear and messy

elder_tinkerer · October 11, 2025, 8:10am

Well, it says both...
At first the part you refer to, and in the next line the part that @Cthulhu88 refers to.
And yes, the instructions are quite overwhelming. But in my opinion neither totally unclear nor messy.

Cthulhu88 · October 11, 2025, 12:02pm

Because "AI" told you so? Even though it can't give you this very simple and obvious answer.
Not being lazy and actually doing some proper research would've led you to run binwalk on tp_data.bin, which in turn would've told you what it's. Even if you don't know how to traverse and extract its files, a simple web search would've given you the answer right away, as you know what tp_data.bin is (this is actually deducible by just reading the flashing instructions, but binwalk will provide you with the exact info).

bosukes · October 11, 2025, 4:22pm

binwalk tp_data.bin doesn't do anything even with options. Gives some empty files. Also one more thing, must the default-mac file be a text file containing( AA:BB:CC:DD:EE mac address like this) or a .bin of the mac address? I found the EEPROM though, supposedly. Will try today.

bosukes · October 12, 2025, 10:18am

Ok I only need this now, is default-mac a text file? or a bin file?

bosukes · October 12, 2025, 8:09pm

Nevermind fixed it

frollic · October 12, 2025, 9:52pm

If the instructions are hard to understand, please post what you think requires clarification...

bosukes · October 12, 2025, 9:58pm

Openwrt u-boot layout stage 16 must be like this instead.Chmod's are neccessary otherwise can't copy those EEPROM files:

cat /dev/mtd0 > /tmp/boot.bin
cat /dev/mtd5 > /tmp/tp_data.bin
chmod 644 /tp_data/MT7986_EEPROM.bin
chmod 644 /tp_data/MT7986_BTNFLAG.bin #this file might not be neccessary but do it anyway
cp -r /tp_data /tmp/tp_data

Then grab those with scp:

scp -P 20001 -r -O -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa root@192.168.1.1:/tp_data .
scp -P 20001 -O -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa root@192.168.1.1:/tmp/boot.bin .
scp -P 20001 -O -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa root@192.168.1.1:/tmp/tp_data.bin .

Also backups must be first otherwise, if electric goes down router might be dead.
Btw AI totally failed this time. Couldn't grab the EEPROM files from the BIN file, I had to go to stock firmware over and get the tp_data folder instead. I advise against it on such dangerous operations.

Cthulhu88 · October 13, 2025, 5:21am

This time? lol.

tp_data.bin is literally the binary contents of a filesystem, therefore you just need to mount it. binwalk SHOULD be able to tell you what filesystem type it's. Guess "AI" isn't really AI, huh?
The answer to whether mac address is binary or text is one post above the one linked by @frollic in which I describe the macaddr layout.

P.S. I don't even own this device, all of my info comes from reading the wiki page and its DTS file (which is linked in the thread linked by @frollic ). Stop rotting your brain with "AI" and do the research yourself.

bosukes · October 13, 2025, 7:18am

Its a mtd you cant mount directly. You cant just dd it to a disk either. Ubi reader files couldnt read it, throws bunch of errors. Also binwalk doesnt help here the result file comes out as empty with any options.

Cthulhu88 · October 13, 2025, 10:33am

[roberto@cthulhu router_files]$ binwalk router1.mtd8.ubi.bin

                                                           /home/roberto/Desktop/router_files/router1.mtd8.ubi.bin
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
DECIMAL                            HEXADECIMAL                        DESCRIPTION
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0                                  0x0                                UBI image, version: 1, image size: 17301504 bytes
17301504                           0x1080000                          UBI image, version: 1, image size: 16384000 bytes
33685504                           0x2020000                          UBI image, version: 1, image size: 16121856 bytes
49807360                           0x2F80000                          UBI image, version: 1, image size: 16121856 bytes
65929216                           0x3EE0000                          UBI image, version: 1, image size: 15204352 bytes
81133568                           0x4D60000                          UBI image, version: 1, image size: 9043968 bytes
90177536                           0x5600000                          UBI image, version: 1, image size: 9043968 bytes
99221504                           0x5EA0000                          UBI image, version: 1, image size: 7077888 bytes
106299392                          0x6560000                          UBI image, version: 1, image size: 4325376 bytes
110624768                          0x6980000                          UBI image, version: 1, image size: 4325376 bytes
114950144                          0x6DA0000                          UBI image, version: 1, image size: 2490368 bytes
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Analyzed 1 file for 85 file signatures (187 magic patterns) in 65.0 milliseconds
[roberto@cthulhu router_files]$

[roberto@cthulhu router_files]$ sudo modprobe nandsim id_bytes=0x98,0xd1,0x90,0x15,0x76,0x14,0x01,0x00
[roberto@cthulhu router_files]$ cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00800000 00001000 "intel-spi"
mtd1: 00800000 00001000 "BIOS"
mtd2: 08000000 00020000 "TC58NVG0S3E 1G 3.3V 8-bit"
mtd3: 08000000 00020000 "NAND simulator partition 0"
[roberto@cthulhu router_files]$ sudo flash_erase /dev/mtd2 0 0
Erasing 131072 Kibyte @ 0 -- 100 % complete
[roberto@cthulhu router_files]$ sudo ubiformat /dev/mtd2 -y -f router1.mtd8.ubi.bin -O 2048
ubiformat: mtd2 (nand), size 134217728 bytes (128.0 MiB), 1024 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 1023 -- 100 % complete  
ubiformat: 1024 eraseblocks are supposedly empty
ubiformat: flashing eraseblock 895 -- 100 % complete  
ubiformat: formatting eraseblock 1023 -- 100 % complete  
[roberto@cthulhu router_files]$ sudo ubiattach -p /dev/mtd2 -O 2048
UBI device number 0, total 1024 LEBs (130023424 bytes, 124.0 MiB), available 130 LEBs (16506880 bytes, 15.7 MiB), LEB size 126976 bytes (124.0 KiB)
[roberto@cthulhu router_files]$ sudo modprobe ubi
[roberto@cthulhu router_files]$ mkdir mnt
[roberto@cthulhu router_files]$ ls /dev/ubi*
/dev/ubi0  /dev/ubi0_0  /dev/ubi0_1  /dev/ubi0_2  /dev/ubi0_3  /dev/ubi_ctrl
[roberto@cthulhu router_files]$ sudo mount -t ubifs /dev/ubi0_3 mnt
[roberto@cthulhu router_files]$ ls mnt
upper  work
[roberto@cthulhu router_files]$ ls mnt/upper
etc  run  usr
[roberto@cthulhu router_files]$ cat mnt/upper/etc/fw_env.config
/dev/ubi0_0 0x0 0x1f000 0x1f000 1
/dev/ubi0_1 0x0 0x1f000 0x1f000 1
[roberto@cthulhu router_files]$ cat mnt/upper/etc/dnsmasq.servers
server=127.0.0.1#5353
server=::1#5353
[roberto@cthulhu router_files]$

Binary content of my router's UBI filesystem fetched directly from the router at /dev/mtd8. A suitable nandsim ID obtained from the kernel's driver source code https://elixir.bootlin.com/linux/v6.12.51/source/drivers/mtd/nand/raw/nand_ids.c

A simple web search on Brave for "mount ubi+linux" gave me the solution in the second result: https://stackoverflow.com/a/67334943

bosukes · October 13, 2025, 11:19am

Yeah well that worked, thanks. But in the wiki it only says in a small word that you clearly have to copy directory completely. This devices are already very expensive, also new so very little documentation to recover. So better to write a good documentation, am I right?
If you miss that it's extremely difficult. Also that commands are just way too expert mode. I've tried with some python ubi_reader program I've seen on stackoverflow, that didn't work. What the hell is modprobe nandsim id_bytes=0x98,0xd1,0x90,0x15,0x76,0x14,0x01,0x00 that doesn't even make any sense with those random numbers and all. I am surprised it even works because it seems like as if it is for a very spesific problem. Even I wouldn't try this on my main pc because it seems dangerous like rm -rf /. It works because you know what works and whatnot. Most people do not. Just because people are not pro like you, doesn't mean you have to be an a**.
Even copying those files were problematic because I had to change chmod of that EEPROM file. Which I asked AI for that. chmod somenumber eeprom.bin something.

sudo modprobe nandsim id_bytes=0x98,0xd1,0x90,0x15,0x76,0x14,0x01,0x00
cat /proc/mtd
dev:    size   erasesize  name
mtd0: 02000000 00001000 "BIOS"
mtd1: 08000000 00020000 "NAND simulator partition 0"
sudo flash_erase /dev/mtd1 0 0
Erasing 131072 Kibyte @ 0 -- 100 % complete 
sudo ubiformat /dev/mtd1 -y -f tp_data.bin -O 2048
ubiformat: mtd1 (nand), size 134217728 bytes (128.0 MiB), 1024 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 1023 -- 100 % complete  
ubiformat: 1024 eraseblocks are supposedly empty
ubiformat: flashing eraseblock 31 -- 100 % complete  
ubiformat: formatting eraseblock 1023 -- 100 % complete  

sudo ubiattach -p /dev/mtd1 -O 2048ubiattach: error!: UBI is not present in the system
sudo modprobe ubi
sudo ubiattach -p /dev/mtd1 -O 2048
UBI device number 0, total 1024 LEBs (130023424 bytes, 124.0 MiB), available 980 LEBs (124436480 bytes, 118.6 MiB), LEB size 126976 bytes (124.0 KiB)
mkdir mnt
sudo mount -t ubifs /dev/ubi0_0 mnt

user@user:~/Belgeler/openwrt mr90x/mnt$ ls -la
toplam 40
drwxr-xr-x  2 root root   600 Ağu 29  2024 .
drwxrwxr-x 12 user user  4096 Eki 13 14:02 ..
-rw-r--r--  1 root root     6 Ağu 29  2024 default-mac
-rw-r--r--  1 root root    47 Ağu 29  2024 device-id
----------  1 root root     0 Ağu 29  2024 MT7986_BTNFLAG.bin
----------  1 root root 20480 Ağu 29  2024 MT7986_EEPROM.bin
-rw-r--r--  1 root root     9 Ağu 29  2024 pin
-rw-r--r--  1 root root   275 Ağu 29  2024 product-info

Cthulhu88 · October 13, 2025, 3:18pm

It was the second result on my search for "mount ubi+linux". I never had the need to manually mount an UBI image before, and I didn't even know tp_data.bin was UBI (only that it was a filesystem image) until you mentioned UBI, so I downloaded my UBI filesystem from my router and looked up how to mount it.
This is why I am being an "ass"; all of this took me around 30 mins of research, you could've done the same thing instead of wasting everyone time (including yours) with "AI" slop.

Literally mentioned in my post with a link. You can search what nandsim is yourself and the id is the first ID in the link that closely matches the nand chip of my router.

	{"TC58NVG0S3E 1G 3.3V 8-bit",
		{ .id = {0x98, 0xd1, 0x90, 0x15, 0x76, 0x14, 0x01, 0x00} },
		  SZ_2K, SZ_128, SZ_128K, 0, 8, 64, NAND_ECC_INFO(1, SZ_512), },

128 MiB storage size, 2 KiB page size , 128 KiB erase size.