Hello
I recently wanted to try OpenWRT on my TL-MR6400v5.0 LTE gateway.
I used the instructiosn mentioned here: https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=b641eb6ecfbfc2c6a488483332d4b5a6ee4c736c
It worked, I could ssh to it, but with the lack of LuCi and no easy way to enter the PIN code of the SIM card with the CLI, I wanted to switch back to the latest firmware (TL-MR6400v5_1.3.0_0.9.1_up_boot(201207)_all_2020-12-08_08.39.09.bin)
I renamed TP-Link's firmware file to "tp_recovery.bin" and served it with TFTP on 192.168.0.225, as mentioned in the instructions
Then my router was bricked!
I found this post:
https://forum.openwrt.org/t/tl-mr6400-v5-back-to-stock-firmware/87275/8
It did not mention the latest firmware and has a typo in the dd command accepted as a solution (cout instead of count)
When using the latest firmware, if I used the count=16000 parameter, the router was also bricked
So I used this dd command, just to try:
dd if="TL-MR6400v5_1.3.0_0.9.1_up_boot(201207)_all_2020-12-08_08.39.09.bin" of=tp_recovery.bin bs=512 skip=1
No "count" parameter as you can see. And then, it worked!
I don't think this knowledge is available anywhere, so I took the time to create this post...
In short, the first 512 bytes of the TP-Link firmware have to be ripped of the image served by TFTP, but no "count" restriction seems to work. Hopefully, I am quite knowledgeable with TFTP and DD as well as with embedded firmware/software.
I just hope this could help someone else in the future
Best regards