TL-MR6400-v5 flash OEM firmware 1.3.0_0.9.1 with TFTP


I recently wanted to try OpenWRT on my TL-MR6400v5.0 LTE gateway.

I used the instructiosn mentioned here:;a=commit;h=b641eb6ecfbfc2c6a488483332d4b5a6ee4c736c

It worked, I could ssh to it, but with the lack of LuCi and no easy way to enter the PIN code of the SIM card with the CLI, I wanted to switch back to the latest firmware (TL-MR6400v5_1.3.0_0.9.1_up_boot(201207)_all_2020-12-08_08.39.09.bin)

I renamed TP-Link's firmware file to "tp_recovery.bin" and served it with TFTP on, as mentioned in the instructions

Then my router was bricked!

I found this post:
It did not mention the latest firmware and has a typo in the dd command accepted as a solution (cout instead of count)

When using the latest firmware, if I used the count=16000 parameter, the router was also bricked

So I used this dd command, just to try:
dd if="TL-MR6400v5_1.3.0_0.9.1_up_boot(201207)_all_2020-12-08_08.39.09.bin" of=tp_recovery.bin bs=512 skip=1
No "count" parameter as you can see. And then, it worked!

I don't think this knowledge is available anywhere, so I took the time to create this post...
In short, the first 512 bytes of the TP-Link firmware have to be ripped of the image served by TFTP, but no "count" restriction seems to work. Hopefully, I am quite knowledgeable with TFTP and DD as well as with embedded firmware/software.

I just hope this could help someone else in the future

Best regards

The devicepage would be the place to store this information.

I did not help !! :smiley:

I bricked one of my MR6400v5 and read about the reason in your post afterwards.

I'll try to put that into the devicepage



Seem you successfully get your modem connected... i checked my ifconfig same as yours...
the weird thing is we dont get MAC ADDRESS... so far i dont get any errors...
here i attach my compiled stable 21.02.0... plus it has scripts for WAN & SIGNAL STRENGTH led..
hope you can give a try....

Thank You

1 Like

Dear fachos.

thanks very much for your OpenWrt-21.02.0 files. I will try them this weekend and let you know wether they work or not


Where do you use the command? adding it in .bin file or in tftp .ini file?

dd is a file operation program, run from a cmd or powershell window, or linux cli.

I got the same, debricked router
But now this problem
I tried almost all versions, Error code: 71211 *
4G modem does not work

tp-links firmware, ask tp-link.

A thread has been created for this issue ^


Hello @fachos

I'm using your compiled firmware on my MR6400 v5.2.

I installed via tftp and works good even with signal leds. But there is a glitch. I'm not using this router always.

And whenever I need to use I had to press reset button on back or login with luci and reboot. Because if I didnt these no signal leds and no internet connection established. I see NETWORK_REGISTRATION_FAILED on QMI section.

Do you have any idea to solve this ?

Not: I'm using Russian MTS sim card in Turkey just for testing. Router will go to Russian next week with this sim card.