MR6550 IMEI and telnet access

[igorjrr]

Is there a way to OPENLOCK on MR6550?
sierrakeygen is not updated to support this model/firmware.
I need to change IMEI.
Thanks.

[Rich Hathaway]

treat it like it was sdx55 then it can work if it is not updated to the latest version, if it is you have to downgrade it before it will work.

[igorjrr]

treat it like it was sdx55 then it can work if it is not updated to the latest version, if it is you have to downgrade it before it will work.

Thanks, I tried and it doesn't work. I'm not sure there is a downgrade for this model (MR6550) which is the newest, unlocked version.
I hope someone can crack and update sierrakeygen (or another tool) to be able to issue OPENLOCK on this model MR6550.

[Whiplash104]

I finally figured out that he's holding back the support for newer firmware on the MR6500 and later because of people using it for profit.
See https://github.com/bkerler/edl/blob/mas ... _README.md Generate your challenge eg "AT!OPENLOCK?" and he'll send back the response key. I used the email on https://github.com/bkerler

[igorjrr]

I finally figured out that he's holding back the support for newer firmware on the MR6500 and later because of people using it for profit.
See https://github.com/bkerler/edl/blob/mas ... _README.md Generate your challenge eg "AT!OPENLOCK?" and he'll send back the response key. I used the email on https://github.com/bkerler

Thank you, so you leave the session open until he replies to you? Because the challenge changes each time.
If you need to do any modification after, you'd need him again, right, there is no way to unlock it permanently?

[Netdontwork]

Hey, sorry if this isn't the best place but can someone point me to how you guys got Telnet and are running At commands? I want to do this with my MR6500, any help would be greatly appreciated!

[Rich Hathaway]

You either need to send them thru the modem port if you have it enabled or the telnet port @192.168.1.1:5510

[Whiplash104]

I finally figured out that he's holding back the support for newer firmware on the MR6500 and later because of people using it for profit.
See https://github.com/bkerler/edl/blob/mas ... _README.md Generate your challenge eg "AT!OPENLOCK?" and he'll send back the response key. I used the email on https://github.com/bkerler

Thank you, so you leave the session open until he replies to you? Because the challenge changes each time.
If you need to do any modification after, you'd need him again, right, there is no way to unlock it permanently?

Yes I did the "AT!OPENLOCK?" and sent him the challenge response. I left the telnet session open and untouched. He happened to respond in a couple of hours and the response he sent worked. So it worked but it did nothing for me because I later realized that what I needed was AT!OPENMEP? so I could eventually change the IMEI but I found that the new firmware version has removed AT!OPENMEP? It just doesn't exist. I'm pretty much stuck. If OPENMEP worked I'd have just asked him (again) for that but I can't get it to work.

Since Netgear locked down the new firmware, I really wish BKerler would release it so that people could start working on hacking it despite the profiteers. I feel like it's just hampering us from any progress. I get why he doesn't want people profiting.

I mean if anyone knows the steps that might work to change the IMEI with the latest firmware, I'd love to know. I'm assume Bjoren will send the key again if I ask politely.

[zhongfu]

So it worked but it did nothing for me because I later realized that what I needed was AT!OPENMEP? so I could eventually change the IMEI but I found that the new firmware version has removed AT!OPENMEP? It just doesn't exist. I'm pretty much stuck. If OPENMEP worked I'd have just asked him (again) for that but I can't get it to work.

Just curious, what's your firmware version (e.g. with

Code: Select all

AT!PACKAGE?

)? Mine's fully updated and still seems to work fine, and I've managed to unlock it with OPENMEP a few times so far.

[igorjrr]

Just curious, what's your firmware version (e.g. with

Code: Select all

AT!PACKAGE?

)? Mine's fully updated and still seems to work fine, and I've managed to unlock it with OPENMEP a few times so far.

How did you pass the challenge with the latest firmware version?

[zhongfu]

How did you pass the challenge with the latest firmware version?

I figured out how to generate the right answers for the challenges in the newer firmware versions (at least for my model of the MR6550), so I guess I could help you with unlock codes if you send me a challenge.

I'm just more curious about what they said regarding AT!OPENMEP? being entirely missing from their version of the firmware, so I wanted to pull a copy of that specific firmware version to see what's up

[w1lliam]

@zhongfu

Is it possible that you can provide the formula to do at!openlock? At least it can unlock Telnet for many users who needs to do further tweaks?

I am the author of mrCONFIG, would love to integrate that to tinyurl.com/mrCONFIGTools for all the users who are looking for resolution on MR6550

[zhongfu]

@zhongfu

Is it possible that you can provide the formula to do at!openlock? At least it can unlock Telnet for many users who needs to do further tweaks?

I am the author of mrCONFIG, would love to integrate that to tinyurl.com/mrCONFIGTools for all the users who are looking for resolution on MR6550

I'd love to, but I wouldn't have been able to do it without bkerler's work, so I'd like to respect his wishes here.

I tried emailing him to ask if he'd be open to a compromise, e.g. some hosted service with a CAPTCHA to make it difficult for services like DC-Unlocker to profit off it. I haven't heard back from him though.

[w1lliam]

Understood, just hope that B.Kerler's action won't impact many users out there as they are not trying to get any profits from this keygenerator but self satisfied to unlock features under the hood for this device.

[Whiplash104]

How did you pass the challenge with the latest firmware version?

I figured out how to generate the right answers for the challenges in the newer firmware versions (at least for my model of the MR6550), so I guess I could help you with unlock codes if you send me a challenge.

I'm just more curious about what they said regarding AT!OPENMEP? being entirely missing from their version of the firmware, so I wanted to pull a copy of that specific firmware version to see what's up

This is what I get:

Code: Select all

AT!OPENMEP?
AT!OPENMEP?
ERROR

Code: Select all

AT!OPENLOCK?
AT!OPENLOCK?
8F40A0AD3ACCCBD9

OK

AT!OPENMEP?
AT!OPENMEP?
ERROR

AT!OPENCND?
AT!OPENCND?
03A415EC82C4D402

OK

As to what's on my MR6500:

Code: Select all

AT!PACKAGE?
MR6500-1A1NAS_NTGX65_12.01.16.00_ATT_02.22

Device
AT&T WiFi
Model: MR6500
Hardware Version: 1.0
Firmware Version: NTGX65 12.01.16.00
Modem Version: MPSS.DE.2.0-00989-OLYMPIC GENALL PACK-1.24512.2.27958.4
GUI Version: MR6500-1A1NAS 05.00.78.00
PRI Version: 02.22
Firmware Build Date: 2023/04/17

Is any of that helpful? Am I doing something wrong like skipping a step? I had already entered the challenge response from bkerler (and it worked) for OPENLOCK but OPENMEP has always returned ERROR for me.
Sorry for the latent responses, I'll try to check in more frequently.

[w1lliam]

So it seems all the FW for M6/M6Pro released by April, and onward, would have new keygen formula. My MR6450 just got upgraded and OPENLOCK nolonger works, fortunately I have preserve my Telnet after upgraded.

[dfkinca]

As to what's on my MR6500:

Code: Select all

AT!PACKAGE?
MR6500-1A1NAS_NTGX65_12.01.16.00_ATT_02.22

Device
AT&T WiFi
Model: MR6500
Hardware Version: 1.0
Firmware Version: NTGX65 12.01.16.00
Modem Version: MPSS.DE.2.0-00989-OLYMPIC GENALL PACK-1.24512.2.27958.4
GUI Version: MR6500-1A1NAS 05.00.78.00
PRI Version: 02.22
Firmware Build Date: 2023/04/17

Looks like you are talking about the Netgear MR6500 (ATT version).

zhongfu was talking about, and this thread is directed to, a different Netgear, the MR6550 (unlocked version).

There are significant differences in ability to access MR6500 vs MR6550, from what I have seen.

[vartanarsen]

Hi all stumbled upon this forum after getting my 6550 and not being able to use dc on it to repair imei. Is there a working solution ? I am not skilled beyond using a friendly interface

[w1lliam]

With new unlock code generator done by B.Kerler, mrCONFIG v4.80 is now able to unlock Telnet (IMEI repair still not available though).
try it with your updated device, MR6550 is with new gen of unlock code from beginning) as below syntax

mrCONFIG -ac xxxx -entel -ngkeygen

Access code, xxxx here, can be obtained from the author at mrconfigtools@gmail.com, free of charge
mrCONFIG can be downloaded from https://tinyurl.com/mrCONFIGTools

Applicable models are -
MR6110-TLAUS
MR6400-1DNNAS
MR6500-1TLAUS
MR6450-100EUS
MR6500-1A1NAS
MR6550-100PAS

[bkerler]

Currently, only few SKU are supported. I need the following information:

SKU (like MR6500-1TLAUS)
Output of AT!PACKAGE?
Output of AT!PRIID?
Output of AT!WUURL

Currently, we are seeking for such information for all MR2xxx, MR5xxx and MR6xxx models.

AT&T / Telstra / Dish devices aren't supported atm !

[zhongfu]

i've also spun up a web keygen, if you're too lazy to figure out how to set up python: https://sierra-keygen.uu.sg/

just don't pay for dc-unlocker and similar tools, because they're evidently profiting off free work without attribution, or putting any effort into improving what they took -- otherwise they'd already have added support a long while ago

[idavis935]

MR6500-1A1NAS

AT!PACKAGE?
AT!PACKAGE?
MR6500-1A1NAS_NTGX65_12.01.16.01_ATT_02.23

OK
AT!PRIID?
AT!PRIID?
PRI Part Number: 23115205

Revision: 02.23

OK
AT!WUURL
AT!WUURL
ERROR

[hkm2030]

my dear
What should I do after I used this command to change the imei number of the M5 modem?
How to write the command to change the modem imei

[Rich Hathaway]

You cannot change the imei via openlock, it requires MEP access.
But the powers that be here do not like posting of such things

[cgigate]

You cannot change the imei via openlock, it requires MEP access.
But the powers that be here do not like posting of such things

MEP has nothing to do with IMEI ....

[Rich Hathaway]

It can be done thru efs and the nv but most use openmep friend

[Ryno3]

Hello I'm new here. I recently switched to t-mobile and now I have 2 extra unlimited data sim cards because of the plan I got. So I got the bright idea to put one in a hotspot, so I bought a netgear m6 pro mr6550-pas. After the fact I learned I either need a hotspot data sim OR from what I've read change the IMEI on the hotspot to a tablet/phone imei. I've got 0 experience or knowledge really of sierrakeygen or any tools to do this so any help would be greatly appreciated.

[Didneywhorl]

Hello I'm new here. I recently switched to t-mobile and now I have 2 extra unlimited data sim cards because of the plan I got. So I got the bright idea to put one in a hotspot, so I bought a netgear m6 pro mr6550-pas. After the fact I learned I either need a hotspot data sim OR from what I've read change the IMEI on the hotspot to a tablet/phone imei. I've got 0 experience or knowledge really of sierrakeygen or any tools to do this so any help would be greatly appreciated.

If you just need a modem to use with other systems/routesr instead of a portable hotspot, you can do the mods on the M6 or you could get an InvisaGig and make it much simpler through and through.

[roaminggnome]

Hello I'm new here. I recently switched to t-mobile and now I have 2 extra unlimited data sim cards because of the plan I got. So I got the bright idea to put one in a hotspot, so I bought a netgear m6 pro mr6550-pas. After the fact I learned I either need a hotspot data sim OR from what I've read change the IMEI on the hotspot to a tablet/phone imei. I've got 0 experience or knowledge really of sierrakeygen or any tools to do this so any help would be greatly appreciated.

Unless you want the hotspot size and it battery powered, there are better options out there imo.

[Ryno3]

Hello I'm new here. I recently switched to t-mobile and now I have 2 extra unlimited data sim cards because of the plan I got. So I got the bright idea to put one in a hotspot, so I bought a netgear m6 pro mr6550-pas. After the fact I learned I either need a hotspot data sim OR from what I've read change the IMEI on the hotspot to a tablet/phone imei. I've got 0 experience or knowledge really of sierrakeygen or any tools to do this so any help would be greatly appreciated.

If you just need a modem to use with other systems/routesr instead of a portable hotspot, you can do the mods on the M6 or you could get an InvisaGig and make it much simpler through and through.

I do like the idea of it being portable but more so I already have the m6 pro so I figured I'd give it my best shot to make it work with my spare unlimited voice/data sim.

[Didneywhorl]

I do like the idea of it being portable but more so I already have the m6 pro so I figured I'd give it my best shot to make it work with my spare unlimited voice/data sim.

Nothing wrong with that!

[Alainx]

Hello, I have a MR6550-APS with FW 12.01.44.00, is there any means to enable telnet and AT commands?

[Rich Hathaway]

Hello, I have a MR6550-APS with FW 12.01.44.00, is there any means to enable telnet and AT commands?

It should already be enabled in that one, are you sure it is not MR6500 model ?

[Alainx]

Hello, I have a MR6550-APS with FW 12.01.44.00, is there any means to enable telnet and AT commands?

It should already be enabled in that one, are you sure it is not MR6500 model ?

Yes, I have 2 M6 Pro:
-MR6500-1TLAUS
-MR6550-100APS

Both of them are telnet enabled. According to the KB here, these 2 models have different band setting.
I want to do some researches to add bands from 6550 firmware to 6500.
I have read all articles within this forum, the most feasible way is to hack into the NAND and edit some settings.
Do you have any suggestions?

https://kb.netgear.com/000065402/What-a ... le-hotspot