Wireless Joint

Two more minor nits/comments/questions re: your MANGLE process/terminal commands:

1. What is the directory where you choose to save your 'script.sh'? (You may be missing a 'cd' command at the beginning of your provided sequence of commands, unless you save it in the home directory)

[EDIT START]
I ...

WONDERFUL POST; I LOVE the fact that you put all this information in one place; thank you for having done that!

I understand that you are only sharing what you did (and NOT recommending that others do this), but one minor feedback point:

I think that there are still unresolved issues with the .54 ...

Thank you for the more detailed explanation re firmware, @AKosterin. Your warnings are well-articulated, and heard (at least by me).

So now, slightly OT, I am curious to get my devices on stable FW sooner than later. To that end,

1. is it possible to downgrade FW on Netgear MR6550, without ...

Firmware .53 is not a stable build. I post such firmware for researchers. And more than once I have not recommended installing firmware that does not have positive comments on community forums



It is a very wonderful version and works very efficiently. We contacted the company to approve this ...

You can flash the newest 6550 FW onto the 6550 and it's still wide open.


Similar question as to your "wide open": does 6550 FW flash onto 6550 (plus auto update to latest 6550 FW flash) have OPENLOCK, OPENCND, and (most importantly) OPENMEP functionality on your latest FW 6550?


Answering ...

Apparently the firmware I flashed before giving up reopened everything . . . . Root telnet port 23 also works apparently!


So when you say "reopened", do you mean that 6550 FW flash onto 6500 allows for OPENLOCK, OPENCND, and (most importantly) OPENMEP functionality to be restored on your 6500 ...

Thank you for having shared this information.

Two questions:
1. How do we flash these to our devices? fdt.exe? some other way?
2. For 6550-PPAS, which is the last version that still has OPENMEP and OPENLOCK available via telnet?

So I am following up on my post from a few months ago, after having used this for a couple of months.

Overall, I am pleased at my modded MR6500, and at the restored OPENLOCK/OPENMEP functionality. Except for one small, remaining nit . . . (for which I hope someone in the community has a potential ...

I am the OP, and I was one of the “beta” testers for Rich’s service on my stock, SIM-unlocked MR6500. I wanted to report back results.

Overall, I am very pleased, both with the modded performance of the Rich-serviced MR6500 and with Rich’s service.

Regarding the modded performance of the Rich ...

If you have telnet then I can get you to fastboot mode which means remote loading is possible, thus downgrading is possible.

edit: let me be more clear... do you have root or just telnet? if you have $ or # that is good it is root, if you have only AT commands via telnet with no AT!OPENMEP ...

My SIM unlocked MR6500 has had its functionality and full access to GUI restored (see other thread in this forum - I did not want to thread jack that thread), but unfortunately had to have its firmware upgraded to latest firmware (NTGX65_12.01.16.01). Which means I have OPENLOCK functionality (and ...

if your device was updated to the current version it may have trouble being downgraded as I believe it is fuzed now, not positive as I do not have this device only have worked on a couple of them like this remotely. If I ever get one I will tell you for sure if it is or not.


I am interested in ...

Thanks for the info.

Your 6500 build (or even 6550 build, should that ever develop) sound intriguing; I am interested (and will reach out via PM). Does your 6500 build block additional FW updates?

Re the 6400 or 6150 build on 6500 device, do you have any concerns about e-fuze being triggered and ...

I have a SIM-unlocked Netgear MR6500. Out of warranty. Was running (well), until recent sluggishness caused me to factory reset device.

After physical factory reset of device (pushed paperclip end into "reset" hole; held for 10 seconds to allow to reboot), subsequent device reboots result in the ...

As to what's on my MR6500:

AT!PACKAGE?
MR6500-1A1NAS_NTGX65_12.01.16.00_ATT_02.22

Device
AT&T WiFi
Model: MR6500
Hardware Version: 1.0
Firmware Version: NTGX65 12.01.16.00
Modem Version: MPSS.DE.2.0-00989-OLYMPIC GENALL PACK-1.24512.2.27958.4
GUI Version: MR6500-1A1NAS 05.00.78.00
PRI ...

Thanks for the info; I think I have it now back to stock as far as the dx command changes go.

Strangely, I now have the MR6500 working on the Verizon network (shows 5GMMWAVE connection on B66 - getting DL speeds of 196 - 274 Mb/s). Not sure which of the following that I did solved the Verizon ...

Thanks, Rich.

I tried both those AT commands (e.g., AT+CFUN=1,1 (the second 1 means reset); AT!GRESET) already and, yes, as you state, those commands do not change the modem values that I sent with DX (my mistake for not having backed up original values).

The only changes I made via DX were with ...

I have a Verizon Home 5G box (with separate SIM card - ASK-NC1338 (cellular modem based on Qualcomm X55 chipset) - APN "V5GA01INTERNET"), and related service. I OWN the Verizon Home 5G box (ASK-NC1338); eBay purchased of BNIB item.

I also have the following Netgear hotspots: MR5100 (ATT version ...

So I searched on Google for DM commands and using the EFS, and other than manuals that point to AT commands (where DM is a command under the AT umbrella), I am not finding much.

One quick question: Is there a command that I can issue that will reset ALL modem variables back to factory default ...

Thanks, guys, for your response.

Yes, device has been factory reset. Multiple times. Using both the GUI and the physical reset button. NV item re FOTAChkAllow does not change on reset.

I was just wondering if, when Verizon/Visible networks are negotiating a cellular connection with the device, the ...

I had had my MR6500 working on the Visible (Verizon) network (IMEI repaired to 5G phone I own with same modem chipset); now, after some tinkering by me (I could not leave well enough alone, I know!),my MR6500 no longer will activate on the Visible (or Verizon) networks.

My (didn't leave well enough ...

You should send your response back to it as soon as you get it and try not to wait, if you wait to return it to the device then just recalc the challenge first again and discard the first (the old) one.
you generated it correctly.


Thank you for your confirmation; everything worked. On 3x ...

Just do the factory reset (unless you have something on it you don't want to lose)
then you should have access with putty again, as for your errors in the challenge and response
Not enough info for someone to help you figure this out.
run one again and post the challenge, command you used and your ...

You can send them to the modem port to re-enable telnet on port 5510


So I researched and tried this process on a MR5100 (ATT) with Putty (Windows) using the following settings:
Serial
COMX (where X was the port number for the WWAN network Port under my Device Manager).
I was able to get a Putty ...

Last time I unlocked an MR1100 (purchased outright from Best Buy), I went to https://www.att.com/deviceunlock/ . Directions are pretty straightforward.

AT!OPENLOCK="9986D27C2F53443B"
With AT commands, you will either get an OK or ERROR, if you get OK then whatever you were doing
is completed, error of course means it did not work for whatever reason, you don't need to do any AT!RESET for
completed commands sent to work, OK means your device ...

Apologies for my lack of specifics; your AT!OPENLOCK worked to unlock my device. So, THANK YOU!

Having said that, after I successfully changed the password with AT!OPENCND="[mypwd]" command, I accidentally unplugged my device before I could save changes and reboot with an AT!RESET command (I assume ...

Can anyone assist me in please calculating my challenge answer?

Device: MR5200
Challenge: 7753E2C42827C4EF

Thanks in advance.

Trying to get my newly acquired MR5200 both band optioned/locked, and get the correct challenge answer (for those who are willing to share).

Using the guide at https://github.com/bkerler/edl/blob/master/sierrakeygen_README.md . I was able to telnet into the device, and generate the specific ...