Netgear MR1100 att firmware to unbranded

[bcase7090]

I came across this post on the Netgear site and figured I would share it since this has been something I have been looking to do.


https://community.netgear.com/t5/Mobile ... rue#M17374

@Mrblazed wrote:

Download the newest generic firmware from the Netgear support site for your country (the routers country).
https://www.netgear.com/support/product ... 2.06.11.00

Download FDT.exe version 4.6.2.0. (You’ll have to Google)
https://www.dropbox.com/s/s27ftyfjpvn9819/fdt.exe?dl=0

Download AC78x Netgear drivers version 4.3.00

http://www.downloads.netgear.com/files/aircard/AC_790S_Telstra/AC78xSDrivers.exe

Download Putty
https://www.putty.org

1) Put everything in the same folder (ex. C:\Desktop\mr1100 )
2) Install drivers
3) Connect MR1100 directly to computer with USB cable.
There are 2 USB ports on the MR1100. Standard and Micro (micro is same port used for charging the MR1100).
Use of the micro USB port for connecting the MR1100 to your PC.
4) Open putty, telnet into MR1100 ip address (default is 192.168.1.1 which is no secret) with port 5510
Note: normal telnet session prompts for login ID and password. You don't get that here, so just start typing the

following command.
5) AT!BOOTHOLD
Once you type this command, you will get a response back just saying 'OK'. You should also see 'NetGear' boldly

displayed on the MR1100,
and the small status LED will be flashing red.
6) Close Putty
7) Open 'cmd' window, change directory prompt to where you downloaded everything to (ex

C:/Desktop/mr1100). Type ”fdt.exe insertfilename.secc.spk” and hit enter.
fdt.exe NTG9x50C_12.06.11.00.secc.spk
8) Do not touch anything. If the command prompt tells you after “resetting device” that the upgrade failed, ignore it

and let the MR1100 do its thing. The screen on the MR1100 may show its downloading the firmware, and at

some point It may look like it’s frozen, but it should finish and boot by itself after about 10 minutes. Again as

Mrblazed advised, DON'T MESS WITH IT UNTIL COMPLETELY DONE.

9) When its done, the display on the MR1100 should look different, and have status info, usage amount...etc on

the display.

make sure you can page through the different displays on the screen using the 'home' button on the MR1100.

You can also log into the MR1100, and navigate to Settings > Administration > Firmware Update... there you

should see the new firmware version, which also confirms your MR1100 update was successful.

------------------

So after all said and done, I was still having issue with battery charging. The MR1100 would get to about 33% charge and then discontinue with overheat mode. I solved that issue very easily by shutting modem off for a couple of hours. I then tired a different trick by adding a cooling fan from AC Infinity that fits nicely between my router and the MR1100. It now registers a much cooler temp and will charge while the unit is being used. Only $13 on Amazon. Voila!!!

[Rich Hathaway]

If you are using FDT you do not need to send that AT command or do anything with putty at all, just simply remove the battery then hold power and plug the usb in and keep holding power about 8 seconds or until the device goes into Factory download mode then simply execute FDT, also it does not matter with sierra hotspot devices if you interrupt them while they are updating as they are not a live load, if you interrupt them then when you give the device power again it will resume where it left off, I am not saying to do this just stating they are not live loaded when loaded by FDT. If you are loading the ATT firmware back to them do not do that as it is a live load by patched NPRG/ENPRG.
@ bcase7090 You can use this without a battery and that will keep your heat down

[bcase7090]

Thanks Rich, just a heads up, I cross posted this and I do not have a heat problem, I just wanted to share this info because I Googled this a while back because I saw someone offering this a service on ebay. I was unable to find it untill now.

[bcase7090]

@Rich Hathaway, I noticed you officer a wide range of services, it seems like o can not PM you here, what is the best way to contact you?

[Rich Hathaway]

@bcase7090
You can reach me at mifis.us
I cannot send or receive any messages on this site. I have tried to msg mods and admin about it to fix or inquire why but I can not do that either, sorry
edit: Maybe a mod will see this and msg me about it.

[gscheb]

Have two of these things. Had them for years at about the same time they both pretty much quite working.
Tried to update software before but says don't need to be updated in the menu.
Would this work to force it to do something maybe?

[Rich Hathaway]

@ gscheb
that depends on what you mean by "pretty much quite working"
If it needs reloaded, FDT can only load from the factory normal or factory dl mode if your device is in QDL mode (9008 or 900E) it would need to be loaded byte by byte with a patched loader. I can load the AT&T firm back to it for you, I made a build and tool for it a few years ago, it can reload and recover dead devices.
or if it does not need reloading firmware and has some other problem tell me what it is, I'll try to help you, I know this device well.

[Didneywhorl]

Messaging was turned off due to too many people trying to use the forum, that The Wireless Haven built and maintains, to sell their own products and services to current and potential The Wireless Haven customers.

Many scammers and bookdoor sellers abound in this niche.

[msoengineer]

I guess I leapt before I, look, looked and now I have my ATT MR1100 on the unbranded firmware, but I lost my ability to usb tether and possibly ethernet port too... This functionality was working under the ATT firmware. DOH

I found this reddit that says there is no way back now...
shows there are 4 models and two won't support usb tether... what should I do?
Apparently going back to the att firmware is not possible?

The bloody sticker inside doesn't show the actual sku outside 6420B and model MR1100

I appreciate any assistance!

https://www.reddit.com/r/ATT/comments/g ... sb_tether/

[Didneywhorl]

Rich is pretty good at the M1 stuff. Hopefully he chimes in.

[Rich Hathaway]

That device can be loaded back to AT&T thru QDL Mode, however there was never any leak of the AT&T firmware.spk (that I know of)
someone on here a few months ago claimed to have it, but never posted any link, I believe them to be mistaken about having it.
You may be able to enable the RNDIS (tether) port on your current platform, I have not tried that on your firm here is how to do it.
So send, calc, and pass the MEP challenge on it then send
AT!UDPID=68E2
That should enable it, if you have to have the AT&T firm reloaded back to it I can help you, I wont post my custom AT&T firmware to the public but I can run it for you on your device.

[KEN_Z5]

Rich Hathaway. so how can you help reload the AT&T firmware?

[Rich Hathaway]

Rich Hathaway. so how can you help reload the AT&T firmware?

I can reload it back to stock AT&T for you.

[Weasel18]

Rich Hathaway. so how can you help reload the AT&T firmware?

I can reload it back to stock AT&T for you.

Do you mind trying to help me? i flashed the generic fw and now seems to be in a boot loop. no matter how many times i try in Download mode to reflash the generic it doesnt make a difference .

[Rich Hathaway]

Rich Hathaway. so how can you help reload the AT&T firmware?

I can reload it back to stock AT&T for you.

Do you mind trying to help me? i flashed the generic fw and now seems to be in a boot loop. no matter how many times i try in Download mode to reflash the generic it doesnt make a difference .

I can load the factory ATT firm back to it but it is a byte by byte load and cannot be done remotely, it would take hours and hours like that, you would have to mail it to me to be loaded like this.

[DamianHusky]

So i was able to successfully flash my ATT branded MR1100 to the unbranded firmware but there are some like.. oddity's. I can't get Ethernet to work at all but USB tethering works fine.. but on that note under Mobile Router Setup i don't get the options for USB tethering.. I had to use the IOS app to change it from charging only. The model number i have under the battery is MR1100ABS-2A1NAS which is the ATT Business but i thought loading the regular firmware would get me Ethernet tethering but apparently not.. but i still don't understand why that wouldn't work but USB tether does.. The firmware i loaded is NTG9x50c_12.06.11.00. I know this is kind of an old thread but i was hoping someone could give me some insight on why this thing is acting so weird or possibly point me in the direction of a Firmware that would work better.

[Rich Hathaway]

Use the AT&T firmware or if you dont have it use the EUS firmware, when you load with fdt it does not touch the efs partition so settings and such stay the same, if you want a complete load from 0 you will have to do a byte by byte load and not use fdt

[modernuser]

@ gscheb
that depends on what you mean by "pretty much quite working"
If it needs reloaded, FDT can only load from the factory normal or factory dl mode if your device is in QDL mode (9008 or 900E) it would need to be loaded byte by byte with a patched loader. I can load the AT&T firm back to it for you, I made a build and tool for it a few years ago, it can reload and recover dead devices.
or if it does not need reloading firmware and has some other problem tell me what it is, I'll try to help you, I know this device well.

Hey, can I get a link to that pUtty-able ATT file for the MR11100ATT?

[Rich Hathaway]

Hey, can I get a link to that pUtty-able ATT file for the MR11100ATT?

Putty-able file? not sure what you mean, the file I was talking about is loaded by a script using a patched loader and has nothing to do with putty, at some point I will make the files I made public, but for now, I am still using it too much to do that.

[semsem]

Hey, can I get a link to that pUtty-able ATT file for the MR11100ATT?

Putty-able file? not sure what you mean, the file I was talking about is loaded by a script using a patched loader and has nothing to do with putty, at some point I will make the files I made public, but for now, I am still using it too much to do that.

Hi.

I have mr100 eus model. From the moment I bought it used on eBay it was stuck on firmware update screen and it would not accept any firmware via fdt.exe except the Telstra firmware version 10.25. Any other firmware would not flash successfully and it would just hang on the firmware update screen. I wish If you could help me install the original European firmware on it because it works better for me with LTE bands. Thanks!

[Rich Hathaway]

You do not have to load different firmware to manipulate the bands on this device, I won't go into it here but there is plenty on the web about band configuration and calculating the proper bitmasks for them for this model, all you need is putty or a command line to the modem to change them

[semsem]

You do not have to load different firmware to manipulate the bands on this device, I won't go into it here but there is plenty on the web about band configuration and calculating the proper bitmasks for them for this model, all you need is putty or a command line to the modem to change them

Sorry for the late reply.. The problem is that the LTE bands carrier aggregation combinations are different between the European and the Australian firmwares. Just as an example, the EU firmware can do B1+B3+B28 while the AUS can only do B3+B28

[Rich Hathaway]

FDT has a force option the key for it is -f have you tried it? if you can't get it to load I can force load it for you remotely with other tools.

[semsem]

FDT has a force option the key for it is -f have you tried it? if you can't get it to load I can force load it for you remotely with other tools.

Yes I tried the force option with the same result. Yes I can setup a remote session. Thanks!

[KEN_Z5]

I can reload it back to stock AT&T for you.

Do you mind trying to help me? i flashed the generic fw and now seems to be in a boot loop. no matter how many times i try in Download mode to reflash the generic it doesnt make a difference .

I can load the factory ATT firm back to it but it is a byte by byte load and cannot be done remotely, it would take hours and hours like that, you would have to mail it to me to be loaded like this.

unfortunately it would be too expensive for me to mail it from where i am. any solutions to sudden shut downs " its running the latest firmware" ?

[mangochutney]

Hi folks, New to the joint.

I'm assessing whether I should convert my retail 101NAS unlocked AT&T M1 running fw from 2018 to a more recent generic Netgear version.

I read somewhere that doing so may disable some LTE features, specifically speed enhancements but I cannot find the source any more...
May I ask if this is true?

[Rich Hathaway]

unfortunately it would be too expensive for me to mail it from where i am. any solutions to sudden shut downs " its running the latest firmware" ?

To know what to do to fix this one needs to know what the reason is that it is doing it. I would suggest to pull the logs and
have a look at them and see if you find out why it would be doing that, then you can have an idea of how to go about fixing it.
Loading firmware should always be the very last option because it is dangerous.

I read somewhere that doing so may disable some LTE features, specifically speed enhancements but I cannot find the source any more...
May I ask if this is true?

Take some good advice and do not try and reload your firmware.
What do most people do after doing this?
They try to find a fix for what they just messed up, if your device is working good now why would you want to
to take the chance on borking it up?
The bands are easily manipulated without the danger of trying to load firmware, this device is easily messed up
by trying to write new firm to it.

[mangochutney]

...this device is easily messed up by trying to write new firm to it.

I appreciate your advice! Current firmware is a bit unstable compared to the 100 unit I have running latest Netgear FW. I am using the band locking technique but am seeing issues if I try to combine 2+ LTE bands, it keeps dropping the connection and re-syncing whereas my 100 unit does not. Running on a single band however does work fine and is stable. I read that the AT&T 05.05 fw is glitchy(?), hence pursuing this. Newer firmware apparently improves upon carrier aggregation (also adds band 14).

To follow up with the question of breaking features, I think it was LAA that breaks when changing fw, but that is something I don't think I would ever use here in a remote part of Canada. I was wondering if you are aware of any other features that break?

I used to put DD-WRT / Tomato firmware on Linksys and Asus routers, are these M1's more finicky? I've discovered the easy way of putting the unit into recovery mode rather than trying to halt bootup. The upgrade method seems to be a relatively easy process to complete(?) with risk of course... I have bricked an Asus router before

Your further comments and advice appreciated.

[y3King]

I can reload it back to stock AT&T for you.

Do you mind trying to help me? i flashed the generic fw and now seems to be in a boot loop. no matter how many times i try in Download mode to reflash the generic it doesnt make a difference .

I can load the factory ATT firm back to it but it is a byte by byte load and cannot be done remotely, it would take hours and hours like that, you would have to mail it to me to be loaded like this.

pls Rich Hathaway how can you help me reload mr1100 has been in boot loop for the past 3month I have tried all I could. pls any way you can put me thru through video explanation Its welcome

[Rich Hathaway]

If your device wont take the firmware in spk form via fdt it would have to be loaded from 0 with a byte by byte type of load from emergency mode.
This is only possible if you have the proper firmware and patched loader (ENPRG9x55).

[y3King]

Can you pls work me thru i have the generic Netgear device not ATT

[Rich Hathaway]

It does not matter which one you have, if it needs to be recovered and it won't take an spk, you need to load it from
9008 mode and unless you have the raw firm (not spk) you won't be able to do it, you can unpack that spk with some older sierra tools and possibly recover it this way, it would be helpful to know which partition is messed up to keep you from having to load them all. (never load any part you do not need to) that is just asking for more problems than you currently have.
Here are the partitions and their sizes and address's from the consol view and the returned hello information from after you successfully send the loader, you will need them to load whatever part you end up loading.

Hello ver: 3
Chipset: MDM9x5x
NAND controller base address: 079b0000
Nand flash: Toshiba NM1484KSLAXAJ, NAND 512MiB 1.8V 8-bit
Sector size: 516 byte
Page size: 4096 byte (8 sectors)
Pages num in block: 64
OOB Size: 256 byte
ECC Type: BCH, 8 bit
ECC Size: 13 byte
Spare size: 2 byte
Bad block marker position: user+175
Total Flash Size = 2048 blocks (512 MB)
erasing flash
# Start Size A0 A1 A2 F# format ------ Name------
============================================================

00 0 00000a ff 01 00 00 LNX 0:SBL

01 a 00000a ff 01 ff 00 LNX 0:MIBIB

02 14 00005a ff 01 ff 00 LNX 0:EFS2

03 6e 000004 ff 01 00 00 LNX 0:TZ

04 72 000003 ff 01 00 00 LNX 0:RPM

05 75 000004 ff 01 00 00 LNX 0:aboot

06 79 000029 ff 01 00 00 LNX 0:boot

07 a2 000002 ff 01 00 00 LNX 0:SCRUB

08 a4 00011b ff 01 00 00 LNX 0:modem

09 1bf 000006 ff 01 00 00 LNX 0:misc

10 1c5 00002a ff 01 00 00 LNX 0:recovery

11 1ef 000003 ff 01 00 00 LNX 0:fota_none

12 1f2 00005b ff 01 00 00 LNX 0:recoveryfs

13 24d 000222 ff 01 00 00 LNX 0:system

14 46f 00003e ff 01 00 00 LNX 0:PAD1

15 4ad 000051 ff 01 00 00 LNX 0:USERRW

16 4fe 0000eb ff 01 00 00 LNX 0:HDATA

17 5e9 0001d7 ff 01 00 00 LNX 0:NTGFOTA

18 7c0 000023 ff 01 00 00 LNX 0:CUST

19 7e3 00001d ff 01 00 00 LNX 0:PERSIST
============================================================
Partition Table Version: 4

[y3King]

it's a loti can't comprehend i must tell

[mangochutney]

That's Rich just showing off
He obviously knows his stuff...

[tambutso]

It does not matter which one you have, if it needs to be recovered and it won't take an spk, you need to load it from
9008 mode and unless you have the raw firm (not spk) you won't be able to do it, you can unpack that spk with some older sierra tools and possibly recover it this way, it would be helpful to know which partition is messed up to keep you from having to load them all. (never load any part you do not need to) that is just asking for more problems than you currently have.

Rich what is the difference between an SPK firmware and a CWE one? Is there a way to convert one to the other?

[Rich Hathaway]

spk files are a combined nvu (carrier config files)/cwe (signaling firmware) file, Sierra prefers to push spk files out because it means there is some control for peeps not to pair them incorrectly which causes bricks.

If you have nvu/cwe files you can create an spk using swicwe, which is only Linux friendly and is only for WP units, not for EM/MC or newer.

[tambutso]

thank you for the info @Rich Hathaway . I am thinking more along the lines of the Nighthawk Mobile routers. I think OTA FW are push as CWE, and manual updates via netgear public fw repo are in SPK format. would swicwe work in converting Netgear Nighthawk Mobile router firmwares from CWE to SPK? and would it be safe to use this converted file to do manual updates?

[Rich Hathaway]

thank you for the info @Rich Hathaway would swicwe work in converting Netgear Nighthawk Mobile router firmwares from CWE to SPK? and would it be safe to use this converted file to do manual updates?

You would have to just try it, but tell me why would you wish to do that there is no need, I mean if you can load a cwe then you can load an spk, either of them can only load from normal or factory dl mode but neither can load from emergency.

I made MBN and UBI files to load and/or recover them, and on occasion, I will use an spk for a speedy load if I don't need the byte by byte load or need to erase back to 0 first or just need a factory firmware on one.

[pipestek]

Hello I'm new here

so first I tried the putty method and that somehow didn't work I eventually tried the method where I remove battery and hold power button plugged in to usb in computer the update or download method I guess is called. That actually worked it flashed the firmware I put the latest from the netgear page support section for the generic firmware for mr1100 NTG9X50C_12.06.11.00 after flashing it and rebooting it looks different looks better than that ugly at&t firmware.
One thing I noticed and really why I flashed this generic firmware was the battery overheating issues and that it seems to be resolved with this firmware conversion.

Seems to be working fine I didn't notice any speeds differences or improvements but now im able to charge the batteries without overheating and stopping the charging process.

But I noticed some weird things on the netgear dashboard my first thought was that i will be able to use the generic netgear url dashboard but is just the at&t one.
also somehow under the dashboard under Service number now shows n/a instead of the plan line number like it used to and also under security- sim security it shows an unlock tab in blue when my simcard is clearly not security locked as I can reboot and turn on/off the netgear physically and remotely without asking for a pin or a password to be able to use it. Lastly upon checking for firmware updates it either gets stock checking and says there was an error and will try in 48 hours or I get "the session could not be completed and the device auto retry the check for an available update, I now see the upload firmware choose file but when you when to press on the upload blue button you'd see a red not available floating icon whe you hover over it so cant upload firmware either or auto upload, Just these odd things..

Any thoughts would be greatly appreciated.
Thanks!

[pipestek]

I thought that after flashing using fdt method it will completely turn the at&t m1 to a fully fledged netgear generic version.
but I noticed that when I go to the 192.168.1.1 dashboard still shows AT&T at the top and is the same AT&T netgear menu really.
and some odds things like I thought after coverting it it will be like brand new but it keeps all information from previous AT&T firmware

[pipestek]

cant update generic firmware via 192.168.1.1 it just shows some random error messages on the check update and service number shows n/a instead of the plan service phone number.

[Rich Hathaway]

your screen should be purple after loading the generic build and not blue anymore, sounds to me like it did not load or maybe got sent by fdt but did not unpack and install properly, or maybe did not pass the integrity check.

[pipestek]

Hey Rich, the boot up screen is purple and it says NETGEAR no more AT&T branding also added a color to the battery bar. But I'm referring to this m1 dashboard when you login on 192.168.1.1 still looks all at&t it even says it on top of the dashboard screen.

[Rich Hathaway]

Do the factory reset and see if that changes it although I don't think those WebUI images are backed up but not for sure without looking, Its been a while since I fooled with an m1.
But those generic builds do not have ATT branding

[pipestek]

Do the factory reset and see if that changes it although I don't think those WebUI images are backed up but not for sure without looking, Its been a while since I fooled with an m1.
But those generic builds do not have ATT branding

NO that didn't change anything doing the factory reset for the webui login. the m1 itself looks like a generic now but on the webui it still looks the same at&t and cant update firmware either.
I sent you an email if you can reply back from your website.
Thanks!

[pipestek]

I got all figured it out. Had to delete cookies on my browser somehow that fixed the webui now is all netgear. Just the Battery life and charging improvements is well worth converting it to the generic netgear.

Thanks!

[Hogwild]

I think you meant browser cache, not cookies, yes?

[Klaus4]

Hi!

I solved the bootloop but wanted to change to the EU FW. But it didn´t work out is there any fullflash for the EU version one I can use for a try to reflash it.
thanks

by the way is it unlocked after the new flash?

[jericsmith]

Hi!

I solved the bootloop but wanted to change to the EU FW. But it didn´t work out is there any fullflash for the EU version one I can use for a try to reflash it.
thanks

by the way is it unlocked after the new flash?

Anything in particular you did to solve the bootloop issue?

[Hogwild]

How large would a full EU flash file be?

[Rich Hathaway]

The EU factory .spk file is 106,844 KB and a full firmware for it is 577,056 KB

[Klaus4]

do you have any idea where to get the full download?

[Rich Hathaway]

I had to make mine, there is no public file or leak for it from netgear or sierra, so you would likely have to make one if you want it.

[Klaus4]

please can you explain how to make this file? and will be the Imei and other serialnumbers be storen in the backup?

[Rich Hathaway]

Its not that I am not wanting to help you but it is far to much to just type out.

[Klaus4]

it showes unlocked but will not work with austrian cards. Is it only a batterycharger or not?

[Rich Hathaway]

check the apn

[Klaus4]

how can i set it to auto cause ATT&T is still set as active.l

[Rich Hathaway]

Set your apn then it will search for your network by mcc/mnc read from the sim card.

[Klaus4]

oThanks all is working but i lost some screws witch one can I use ore are nearly the origrinal.

thanks

[Rich Hathaway]

Look for yourself, if you can find it there.


https://fcc.io/PY3/17200378

[Klaus4]

Does anyone have a stl file from the complete housing?

[Rich Hathaway]

what do you mean "stl file from original housing" ?

[Klaus4]

yes for printing 3d spareparts

[Rich Hathaway]

oh, 3d printer file, ok I misunderstood what you were wanting.

[Klaus4]

@rich do you have them?

[Rich Hathaway]

No, sorry, I am afraid if I bought a 3d printer I would never get anything done but play on it all day long. so I have not collected any files for printing.

[Didneywhorl]

No, sorry, I am afraid if I bought a 3d printer I would never get anything done but play on it all day long. so I have not collected any files for printing.

Truer words have never been spoken. Mine keeps trying to whisper about the old days of when it was first unboxed, enticing me with its jezebel ways.

[Rich Hathaway]

lol
Be strong grasshopper

[Klaus4]

Next week I will go to a 3d scanning and printing shop.

By the way I have got two more devices one is not powering up. No led flashin or something else. And one with always tries to power up but it doesn not. This device i have flashed serveral times but no changes. So are they really dead or is there any other solution to fix them?

Thanks

[Rich Hathaway]

Yes, read thru this thread, if your prob is not hardware they can be fixed.

[Klaus4]

is there any firmware diffrence between 1anas and 2a1nast?

[Carbon87]

I can reload it back to stock AT&T for you.

Do you mind trying to help me? i flashed the generic fw and now seems to be in a boot loop. no matter how many times i try in Download mode to reflash the generic it doesnt make a difference .

I can load the factory ATT firm back to it but it is a byte by byte load and cannot be done remotely, it would take hours and hours like that, you would have to mail it to me to be loaded like this.

Is this still something you offer? What do you charge? I have a bricked 2A1 and don't believe there is any other way to recover it. It just loads the Netgear logo and then spinning wheel, and then repeats.

[Rich Hathaway]

Yes, I can help you to recover it, however, this is not my personal sales thread.
look here for that ---->viewtopic.php?p=26991#p26991

[arni7]

Hello

can anyone help ?
device MR1100-100eus in bootlop as in the video


how can I revive it