TP-Link Archer MR600 exploration

Hey, is there a chance of full support of the router with installation without soldering?

You don't need to solder anything, just put the pin header into the holes and hold them in a way they make contact (or use a rubber band or something similar).

If you mean without opening the case: Not at the moment, but I'm pretty sure it is possible to create a version that is flashable from stock web interface since many different TP-Link image formats are known.

Hi, I flashed OpenWRT on the MR600. I would like to install OpenVPN but I get an error

Collected errors:
 * pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.123-1-0f0db065e0b57643d380de80339ea0ed) for kmod-tun
 * pkg_hash_fetch_best_installation_candidate: Packages for kmod-tun found, but incompatible with the architectures configured
 * satisfy_dependencies_for: Cannot satisfy the following dependencies for openvpn-openssl:
 *      kernel (= 5.15.123-1-0f0db065e0b57643d380de80339ea0ed)
 * opkg_install_cmd: Cannot install package openvpn-openssl.

Can anyone help me? What can I do?

Update the image you flashed to the current one.

If I use force, the device does not wake up.

if i use
mr600-v2-initramfs-kernel.bin
and
mr600-v2-sysupgrade.bin
then Bad magic appears

What is your current installed version of OpenWRT?

Probably a dumb question but did you try installing the latest snapshot release?

no, but I think I will and let you know... :slight_smile:

TP-LInk MR600 != OpenMesh MR600

Wrong firmware, not for this model. These are two different models.

Thank you very much Cezary (Dziękuję Cezary :slight_smile: )
is it possible to install openvpn?

Just install if you have enough free space.

A small difference but a big change :slight_smile:
If anyone needs https://downloads.openwrt.org/snapshots/targets/ramips/mt7621/openwrt-ramips-mt7621-tplink_mr600-v2-eu-squashfs-sysupgrade.bin

Thank you for sharing your method; it worked pretty well for me. However, I'm seeking some guidance on how you managed to determine the correct values for "bs," "skip," and "count." I've been trying to install the latest version, and despite following the suggestion in this forum post (URGENT: Trying to revert to original firmware, but Failed to erase block - #8 by brenton), I couldn't quite figure it out.

Here's the output from the binwalk command that I attempted:

$ binwalk 'Archer_MR600v2_1.6.0_0.9.1_[220105-rel58321]_up_boot_Release_2022-01-05_16.41.23.bin'
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
73936         0x120D0         U-Boot version string, "U-Boot 1.1.3 (Jan  5 2022 - 15:46:51)"
132096        0x20400         uImage header, header size: 64 bytes, header CRC: 0x3676CEB7, created: 2022-01-05 07:52:13, image size: 1950293 bytes, Data Address: 0x81001000, Entry Point: 0x813D34D0, data CRC: 0x9D6B59CA, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
132160        0x20440         LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 5622656 bytes
2228736       0x220200        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 9988072 bytes, 731 inodes, blocksize: 131072 bytes, created: 2022-01-05 08:12:14
16515584      0xFC0200        Zip archive data, at least v1.0 to extract, name: bin/
16515646      0xFC023E        Zip archive data, at least v1.0 to extract, name: lib/
16515708      0xFC027C        Zip archive data, at least v2.0 to extract, compressed size: 26325, uncompressed size: 227187, name: lib/NetIspInfo.ini
16542345      0xFC6A89        End of Zip archive, footer length: 22
16542367      0xFC6A9F        Zip archive data, at least v2.0 to extract, compressed size: 3776957, uncompressed size: 4569088, name: mdm9640-boot.img
20319398      0x1360CA6       Zip archive data, at least v2.0 to extract, compressed size: 27316734, uncompressed size: 38535168, name: mdm9640-sysfs.ubi
47636207      0x2D6DEEF       Zip archive data, at least v2.0 to extract, compressed size: 30722848, uncompressed size: 38404096, name: NON-HLOS.ubi
78359380      0x4ABAB54       End of Zip archive, footer length: 22

I hope you can provide insight into how you determined these values. Your assistance would be greatly appreciated.

Thank you.

I managed to flash the router, but WiFi keeps turning off or stays off.

MediaTek MT7603E 802.11b/g/n
Device is not active

MediaTek MT7613BE 802.11ac/n
Device is not active

Enable/Disable won't work.
I did a "factory reset", after that the 2,4 GHz could be actoivated, but when I changed the settings (SSID, encryption, channel) it went to disabled

Any suggestions how to solve it?

Looks like the compilation i used allows much more setting than the hardware is capable of. Orginal software allows for example only a few channels at the low end of the 5G band, so using a channel too high or too wide (80 vs 160 MHz) simply doesn't work

Hello,
well the values were deduced manually from specific binary image - your binwalk report is actually a very good base to start from, although not fully reliable unless you know what the structure looks like. "bs" is just block-size, so the multiplier for other two values ... that means important parts are the start of firmware.bin in full image (=="skip""bs"== 0x20200 in my case) and its size (=="count""bs"== 0xfa0000).
As I wrote before, you need to "extract kernel and rootfs images" - now kernel itself is the "uImage" block, so in your case it starts at 0x20400 and ends at 0x220200 (where a "squashfs" filesystem begins, which means rootfs), and rootfs is from 0x220200 till ... somewhere - it's difficult to say from all the "zip" starts/ends where exactly, those headers are not that relevant.
HOWEVER - TP-Link MTD partition for uImage/kernel also contains internal 512bytes header which binwalk does NOT identify - thus firmware.bin starts at 0x20200 instead of 0x20400.
Leaving that header out would effectively kill your router - u-boot could not boot kernel image without it.
As far as I can tell, my bs/skip/count values should be valid for any version of TP-Link binary image, which should always begin with a full-scale dump of main router flash. Everything after 0xfc0200 (all those "Zip archive data" blocks) are just parts of modem firmware, which is completely independent and does not have to be upgraded/downgraded to switch between stock tp-link and openwrt.

1 Like

Thank you for your reply. Now I understand why the 512 bytes are added and how to infer the block size skip and count values from binwalk output.

I recently came across a video that guided me through the process of installing OpenWRT on my TP-Link Archer MR600 V2 router. Initially, the idea seemed promising which led me to go ahead and flash my router with OpenWRT.

Having used it for a few days now, I feel compelled to share my experience, particularly around the Wi-Fi performance which has been far from satisfactory. The range and speed have deteriorated significantly post-installation, making the Wi-Fi functionality practically unusable. Devices are experiencing random disconnections, which was not an issue before.

Previously, the 2.4 GHz band provided a robust range, but now even a device located merely 10 meters away struggles to maintain a good signal strength. As for the 5 GHz band, the less said the better; its performance has been abysmal.

I am sharing this as a cautionary tale for anyone contemplating flashing their TP-Link Archer MR600 V2 with OpenWRT. The downgrade in performance has essentially reduced my once capable router to nothing more than an Ethernet hub. Therefore, I would urge potential flashers to weigh the pros and cons meticulously before proceeding with the installation of OpenWRT.

This post was given a linguistic makeover by ChatGPT. So if the grammar is shining, you know who to thank! #BadEnglishImprovedByChatGPT

1 Like