SIM Unlocked MR6500 with latest FW - Ability to turn on OPENMEP?

[dfkinca]

My SIM unlocked MR6500 has had its functionality and full access to GUI restored (see other thread in this forum - I did not want to thread jack that thread), but unfortunately had to have its firmware upgraded to latest firmware (NTGX65_12.01.16.01). Which means I have OPENLOCK functionality (and can access root telnet (port 23))), but I do not have OPENMEP functionality.

I would be open to receiving any ideas on how to restore OPENMEP functionality.

Specifically, comments on how to do any of the below:
1. modify some config file on latest FW (i.e., through access via root telnet (port 23));
2. create a franken-FW (i.e., pair latest modem from latest FW, with system from prior FW (or MR6400 FW) that had OPENMEP enabled, and flash the resulting franken-FW);
3. some other path to restoring OPENMEP functionality.

Thanks in advance for any ideas.

[Rich Hathaway]

If you have telnet then I can get you to fastboot mode which means remote loading is possible, thus downgrading is possible.

edit: let me be more clear... do you have root or just telnet? if you have $ or # that is good it is root, if you have only AT commands via telnet with no AT!OPENMEP? working it is not so good.

[dfkinca]

If you have telnet then I can get you to fastboot mode which means remote loading is possible, thus downgrading is possible.

edit: let me be more clear... do you have root or just telnet? if you have $ or # that is good it is root, if you have only AT commands via telnet with no AT!OPENMEP? working it is not so good.

I believe I have root shell (telnet port 23 access - "#" prompt).

[Rich Hathaway]

Ok lets see if we can enable the ports again on it, you will need Flexihub on a Windows PC and don't bother to register an account I will send you a token to log in with.
We will need somewhere to txt in realtime so I can instruct you
my skype and my email which we can use for google chat are on my profile page

[Rich Hathaway]

I made a file to downgrade these devices, mr6500, 6400, 6150, 1100, 5100, 5200 and soon 6550
This should restore the ability to use OpenMEP back to the device and for the devices that now have port 5510 closed
This will reopen it for you making your device accessible again.

I need some testers to test them out, and report back to this thread your findings, these can be loaded remotely.

testers please know that this is a very beta process.

I have tried it with success on mr5200 and mr1100 and all challenges and port 5510 were restored.

While I am calling it a downgrade this does not tick the version back it will remain the same even though it will have some parts on an older platform.

let me try to answer some questions that will be asked

Q. Can my device get messed up?
answer-- of course, it can.
I have full firmware for all these versions listed so if your device happens to get messed up it can be restored but you would have to mail it in for full firmware loading.

Q. How long does it take?
A. about 5-10 min for remote loading

Q. how does remote loadiing work?
A. Via Flexihub, you will need to DL and install it on a Windows PC, no need to make an account for it or pay for it, I will send a token for you to log in with.

Q. Is there a charge for this?
A. No, not for beta testing this

Q. What is required of me?
A. One of the models listed, a Windows PC with Flexihub on it, a USB C to USB A cable, a little common sense, and some general knowledge of these devices.

Please message me here or away,(my email or Skype) to help become a beta and test this
Also, feel free to ask any questions you have here, and ill try to answer them.

Thanks
edit now that I posted this here I realize I should have have made its own thread for it lol. dooohhhh!!

[Rich Hathaway]

update::
since this is really a 6500 thread, it is the device that has given me the most trouble, it is now 100% working with
port 5510 and MEP access again, before I was downgrading or trying to for this one I had to tick the version up to get it to work because of the device being fuzed now on the platform 12.01.16.01, anyway now it is debranded with all the goodies that netgear and AT&T took away with this update, I still need some testers for this one

[w1lliam]

update::
since this is really a 6500 thread, it is the device that has given me the most trouble, it is now 100% working with
port 5510 and MEP access again, before I was downgrading or trying to for this one I had to tick the version up to get it to work because of the device being fuzed now on the platform 12.01.16.01, anyway now it is debranded with all the goodies that netgear and AT&T took away with this update, I still need some testers for this one

Hi Rich,

If my MR6500-1A1NAS still remained as 10.01.31 (because of I am not staying in the coutnry), would it still legit to test with your patches? I am willing to take this trial if it is viable.

[Rich Hathaway]

Yes you can but it is kind of defeating the purpose of this since it is for people that buy these almost thousand-dollar devices then right after they get them they update and lock the owners out making them not unlockable or moddable/adjustable to use on the carrier of their choice or use the band that works best in the area they are using them in, if yours is still on 10.xx then you can still do all of that.

[alexlooka]

Hello guys! I hope you are doing well

Can I request from you an a previous downgrade firmware for mr6500?

[w1lliam]

Yes you can but it is kind of defeating the purpose of this since it is for people that buy these almost thousand-dollar devices then right after they get them they update and lock the owners out making them not unlockable or moddable/adjustable to use on the carrier of their choice or use the band that works best in the area they are using them in, if yours is still on 10.xx then you can still do all of that.

Hi Rich,

My intetion was to try this out, but since no chance to upgrade my MR6500, as out of the country without ATT sim. Maybe I can wait for your final solution done for release, or service, is available. Thanks

Regards,
William

[Rich Hathaway]

I have enough testers for the 6500, thank you to the testers, hopefully they will report back here with their findings soon.

[hkm2030]

I have enough testers for the 6500, thank you to the testers, hopefully they will report back here with their findings soon.

Engineer Rich Hathaway, I would like to contact you via email or WhatsApp, please

[Rich Hathaway]

My email is in the first post here
viewtopic.php?p=27836#p27836
or on my profile page

[dfkinca]

I am the OP, and I was one of the “beta” testers for Rich’s service on my stock, SIM-unlocked MR6500. I wanted to report back results.

Overall, I am very pleased, both with the modded performance of the Rich-serviced MR6500 and with Rich’s service.

Regarding the modded performance of the Rich-serviced MR6500, I have only one word: WOW!

I use this MR6500 (SIM unlocked) as my backup hardware for my 5G Home Internet service; its low power consumption makes it ideal in this backup role. To get my 5G Home Internet service to work properly, I did need to perform “magic” (only possible through the OPENLOCK and OPENMEP functionality restored at the firmware level by Rich’s service), and to install a TTL-mod script (TTL 65 for this particular provider). But, once I got things working properly, WHAT A DIFFERENCE! I would have been happy with just the restored OPENLOCK/OPENMEP functionality, but the additional speed dethrottling enabled by Rich's service blew me away. When compared to the stock MR6500 performance, my Rich-serviced MR6500 has similar ping times, but a 2-3x speed increase; and, when compared to the stock MR5100 (unlocked) performance, my Rich-serviced MR6500 has similar ping times, but a 4-5x speed increase. For example, testing my Rich-serviced MR6500 yielded speedtest results of 220-280 Mbps (with 38-40 ms ping times) and Fast.com results of 220-300 Mbps. And, this is with beta firmware (i.e., additional device speed throttles have not yet been enabled by Rich’s service)! I am truly impressed.

Regarding Rich’s service, it has been great. Rich was very available on Skype, and answered all my questions in a technical (my preference), timely manner before I shipped him my device. Rich had a one-day turnaround for the service at his shop (USPS mailing, each way, took a bit longer). And, when I received back my Rich-serviced MR6500, Rich made himself available to address any questions I had (fortunately, everything worked after appropriate mods made). I would enthusiastically work with Rich again on any related project.

Feel free to direct any questions re Rich's service my way; for questions regarding "magic" and TTL-mod scripts, please search this forum (answers, or links/hints to answers, are all there).

[Orlimar1]

I was also allowed a beta test. Unfortunately my buddy still has my data sim card so I haven't been able to put the mr6500 through it's paces just yet.

However I did want to mention that I also experienced the same 1 day turn around time from Rich's service. Thanks again to Rich and hopefully I can report back with more working experience soon.

[anjesh]

My email is in the first post here
viewtopic.php?p=27836#p27836
or on my profile page

hey rich,
I have a mr6150 with the 12.x firmware on it, are you still looking for beta tester for this device?

[Rich Hathaway]

HI no testing is done, everything is working properly

[ondr3j]

Sorry to hijack this thread, but I am interested in this also.

Rich, were you able to put together a 12.x firmware with openmep?

Also, would you be able to share MR6500-1A1NAS 10.04.22.01 spk?

[Rich Hathaway]

Rich, were you able to put together a 12.x firmware with openmep?

Yes

Also, would you be able to share MR6500-1A1NAS 10.04.22.01 spk?

no I did not make this file public, you can msg me about it if you wish.

[mr7359289]

Hi Rich,
I need your kind support in this matter too.
MR6500
FW 12.01.16.01
FW Date 2023/06/24

[Rich Hathaway]

ok

[dfkinca]

So I am following up on my post from a few months ago, after having used this for a couple of months.

Overall, I am pleased at my modded MR6500, and at the restored OPENLOCK/OPENMEP functionality. Except for one small, remaining nit . . . (for which I hope someone in the community has a potential resolution, since Rich and I have failed to connect in real time to work out a resolution despite my efforts over the last 2+ months - whatever is going on, Rich, to keep you silent, I hope things are ok with you and yours!)

The nit: adding cellular APNs.

More specifically:

Issue 1: Once I insert my particular service provider's SIM card (nanoSIM - 4FF) into the modded MR6500, I can no longer add a cellular APN. I can edit the existing cellular APN for that service provider that pops up (which is how I got the service to work), but I cannot add an additional cellular APN.

Issue 2: Also, probably a related issue, when I remove that first service provider's SIM card and insert a different SIM card from a second service provider, that second service provider's MR6500 preprogrammed APN fails to pop up, and I cannot add a cellular APN. The only way I can get service to work on the second service provider is to factory reset the device and redo the OPENMEP / OPENLOCK "magic"; once that has happened, and I insert the second service provider's SIM card, I fall back on Issue 1 (i.e., preprogrammed APN pops up, and I can edit that for the second service provider, but I cannot add a cellular APN).

Since Rich has been silent/unavailable since mid-October to help me resolve this remaining nit, I am opening this up more generally to the community: does anyone have any thoughts about how to resolve this remaining nit?

I am the OP, and I was one of the “beta” testers for Rich’s service on my stock, SIM-unlocked MR6500. I wanted to report back results.

Overall, I am very pleased, both with the modded performance of the Rich-serviced MR6500 and with Rich’s service.

Regarding the modded performance of the Rich-serviced MR6500, I have only one word: WOW!

I use this MR6500 (SIM unlocked) as my backup hardware for my 5G Home Internet service; its low power consumption makes it ideal in this backup role. To get my 5G Home Internet service to work properly, I did need to perform “magic” (only possible through the OPENLOCK and OPENMEP functionality restored at the firmware level by Rich’s service), and to install a TTL-mod script (TTL 65 for this particular provider). But, once I got things working properly, WHAT A DIFFERENCE! I would have been happy with just the restored OPENLOCK/OPENMEP functionality, but the additional speed dethrottling enabled by Rich's service blew me away. When compared to the stock MR6500 performance, my Rich-serviced MR6500 has similar ping times, but a 2-3x speed increase; and, when compared to the stock MR5100 (unlocked) performance, my Rich-serviced MR6500 has similar ping times, but a 4-5x speed increase. For example, testing my Rich-serviced MR6500 yielded speedtest results of 220-280 Mbps (with 38-40 ms ping times) and Fast.com results of 220-300 Mbps. And, this is with beta firmware (i.e., additional device speed throttles have not yet been enabled by Rich’s service)! I am truly impressed.

Regarding Rich’s service, it has been great. Rich was very available on Skype, and answered all my questions in a technical (my preference), timely manner before I shipped him my device. Rich had a one-day turnaround for the service at his shop (USPS mailing, each way, took a bit longer). And, when I received back my Rich-serviced MR6500, Rich made himself available to address any questions I had (fortunately, everything worked after appropriate mods made). I would enthusiastically work with Rich again on any related project.

Feel free to direct any questions re Rich's service my way; for questions regarding "magic" and TTL-mod scripts, please search this forum (answers, or links/hints to answers, are all there).

[w1lliam]

try to edit /mnt/userrw/ntgnv/apns-conf.xml for coressponding carrier, apns.xml will be generated/derived from this apns-conf.xml whenever new sim card inserted. delete existing apns.xml before starting this (tried with MR6110-1TLAUS/MR6450-100EUS but should be the same for MR6500)

Quickest way is just edit apns.xml to add extra entries, just copy from the first entry and edit its mcc/mnc also apn setting. Editing, adding entry for, apns-conf.xml would have your sim mapped to apns.xml whenever you insert new one.

[Rich Hathaway]

Hi sorry @ dfkinca I have not been here for a while, have been busy with a couple of big commercial jobs
and I am the only high-level tech here so most of it falls on me to do, I am supposed to be semi-retired but I find myself working something like 80 hours a week. anyway
if your using AT&T you will have to clear out the restricted APNS file and then set that file to not used (00)
What William said can work also.
That file is backed up in 2 places in the efs once in the filesystem and in the userrw partition also

apn backup.PNG

if you want it to be permanent you need to delete the backups and then rebuild the nvbackup or you will be needing my services if you use the reset function.
apns can also be written on the backend thru the modem port
you are not able to write an apn from the screen of the device? you should be able to if it's not AT&T or you disabled the restricted apns. AT&T does not want you using the fast apns so they write disable files to keep you from doing it lol.
if you message me on Skype or GC sorry been too busy to keep up with it, when it gets crazy sometimes I have to just step away I'm only one person, somedays there are a few hundred messages that come through there, and email, its a full time job just reading and responding to all that.

these are the restricted apn's

nrphone;enhancedphone;nxtgenphone;phone;pta;wap.cingular;firstnet-phone;ndo;endo;ims


anyway, Merry Christmas People

[MrSteve]

I think i can benefit from this. I have 3 Nighthawk M6 pro 6500s from at&t. all 3 have the NTGX65_12.01.16.01 firmware.

I'd like to at least get one up and going. Is rich still doing beta testing?? If So i would like to be a part of it. or perhaps someone can remote my pc and do it for me?? I was really hoping the dc unlock program would work.

I am also curious if my mr6500 would work using dc unlock once the firmware is modded?

[Rich Hathaway]

I think we already spoke via email but I did not tell you that dc from what I know still cannot pass the newer algo of any of the challenges I do not use it so who knows maybe they already stole it and put it in there lol

[mr6500user]

Hi sorry @ dfkinca I have not been here for a while, have been busy with a couple of big commercial jobs
and I am the only high-level tech here so most of it falls on me to do, I am supposed to be semi-retired but I find myself working something like 80 hours a week. anyway
if your using AT&T you will have to clear out the restricted APNS file and then set that file to not used (00)
What William said can work also.
That file is backed up in 2 places in the efs once in the filesystem and in the userrw partition also

apn backup.PNG

if you want it to be permanent you need to delete the backups and then rebuild the nvbackup or you will be needing my services if you use the reset function.
apns can also be written on the backend thru the modem port
you are not able to write an apn from the screen of the device? you should be able to if it's not AT&T or you disabled the restricted apns. AT&T does not want you using the fast apns so they write disable files to keep you from doing it lol.
if you message me on Skype or GC sorry been too busy to keep up with it, when it gets crazy sometimes I have to just step away I'm only one person, somedays there are a few hundred messages that come through there, and email, its a full time job just reading and responding to all that.

these are the restricted apn's

nrphone;enhancedphone;nxtgenphone;phone;pta;wap.cingular;firstnet-phone;ndo;endo;ims


anyway, Merry Christmas People

Hi Rich,

We appreciate all the help you provide here,
I have an MR6500 ATT Locked
Model is 1A1NAS
Firmware version is: NTGX65_12.01.16.01
Device is kind of brand new, my wife opened it and decided to click firmware update xD

Any idea if we can get it moded/unlocked/imei changed/bands/etc..?
I checked with MrConfig and he sent me your way.
Thanks a lot for your help

[Rich Hathaway]

Yes of course, but this forum is not my personal sales thread so pls msg me away from here.

[spyderchiken]

Hello Rich,

I just got a MR6500 and it already had NTGX65_12.01.48.00 on it. I'm looking to downgrade it so I can repair the IEMI. After some searching over the past two days you are the best I have found so far. I'm new on the forum and have not used one of these devices before but was wondering if you would be able to help.

[Rich Hathaway]

Yes I can restore the openmep function on it for you so you can repair the imei again, you can send me a pm about it.

[w1lliam]

Verified MR6550-100PAS FW running on top of MR6500-1A1NAS is working fine, OPENLOCK/OPENMEP are all working with latest keygen.
No FW file from me, am just getting confirmation from mrCONFIG/mrUNLOCK user.

[Ntek2024]

Ok lets see if we can enable the ports again on it, you will need Flexihub on a Windows PC and don't bother to register an account I will send you a token to log in with.
We will need somewhere to txt in realtime so I can instruct you
my skype and my email which we can use for google chat are on my profile page

Hello I have the ATT sim Unlocked netgear 6500. What is the cost to get it unlocked to support all networks, speed and bands? Thank you for your help.

[usrname]

@Rich Hathaway After owning a MR1100 for a several months I've upgraded to an MR6150. It's currently running Firmware

Code: Select all

NTGX65_12_01.31.00

and I'm able to telnet into port 5510 and run AT commands. As of now these commands currently work;

Code: Select all

AT!BAND=?
AT
AT!PACKAGE?
AT!FMBADBLOCKS?
AT!CUSTOM?
AT!NVIMEIUNLOCK
AT!NVENCRYPTIMEI
AT!RESET
AT!OPENLOCK?

Here's the issue, as soon as I put a valid sim in the device it starts to do a firmware update. I'm concerned that any updates will wipe my

Code: Select all

AT!NVENCRYPTIMEI

settings and will close port 5510. I've searched all over and I can't seem to figure out how to prevent the software update from happening while connected. Is there some custom firmware which might work for this? I was going to DM you, but my account is too new.

Thanks,
usrname

[Rich Hathaway]

You should be able to boot it up without a sim so you can work on it without it updating.
I can kill updates for you if you need it.

[usrname]

@Rich Hathaway I figured it out after digging through the file system to determine the domain it's using to reach out for updates. I then did a local dns override for the aforementioned domain.

[Charles.s]

@Rich Hathaway
I'm new in this forum. Try to get you contact info but can't seem to find it.
Anyways I have a MR6500-1A1NAS. I want to get it unlock for all bands if possible. Going to south asia and I want all network unlocked.
Pm you info so I can get in touch with you.

Thank you

[Hopper]

I would also appreciate gaining access to the 12.01+ firmware with all bands if possible.

[TopSoft]

I originally didn't want to say anything but I somehow got my Nighthawk M6 Pro MR6500 to run the MR6550 firmware and all the AT commands that don't work on the MR6500 latest update seme to work in there.
My nighthawk previously wouldn't work with OPENMEP after an update.


Sorry about the quality on the second image, I was in a rush to go somewhere and I couldn't get snipping tool to open.

[telekomunist]

I originally didn't want to say anything but I somehow got my Nighthawk M6 Pro MR6500 to run the MR6550 firmware and all the AT commands that don't work on the MR6500 latest update seme to work in there.
My nighthawk previously wouldn't work with OPENMEP after an update.


Sorry about the quality on the second image, I was in a rush to go somewhere and I couldn't get snipping tool to open.

Could you please share more details:
what was your original MR6500 image?
What type of firmware upgrade have you performed? Could you please share how you make the firmware upgrade?
Does the new image unlock 5G channels and aggregations?
is it stable /operational ?

[TopSoft]

I originally didn't want to say anything but I somehow got my Nighthawk M6 Pro MR6500 to run the MR6550 firmware and all the AT commands that don't work on the MR6500 latest update seme to work in there.
My nighthawk previously wouldn't work with OPENMEP after an update.


Sorry about the quality on the second image, I was in a rush to go somewhere and I couldn't get snipping tool to open.

Could you please share more details:
what was your original MR6500 image?
What type of firmware upgrade have you performed? Could you please share how you make the firmware upgrade?
Does the new image unlock 5G channels and aggregations?
is it stable /operational ?

At the moment I do not have the laptop with the firmware but I downloaded it from this site on that firmware thread. I will check which one I used when I get around to it.
I did not do any firmware modifications it just flashed, rebooted a couple times then said update successful. Everything appears to be stable and working, for some reason it also unlocked the manual firmware update on the web ui.

[roaminggnome]

I originally didn't want to say anything but I somehow got my Nighthawk M6 Pro MR6500 to run the MR6550 firmware and all the AT commands that don't work on the MR6500 latest update seme to work in there.
My nighthawk previously wouldn't work with OPENMEP after an update.


Sorry about the quality on the second image, I was in a rush to go somewhere and I couldn't get snipping tool to open.

Could you please share more details:
what was your original MR6500 image?
What type of firmware upgrade have you performed? Could you please share how you make the firmware upgrade?
Does the new image unlock 5G channels and aggregations?
is it stable /operational ?

At the moment I do not have the laptop with the firmware but I downloaded it from this site on that firmware thread. I will check which one I used when I get around to it.
I did not do any firmware modifications it just flashed, rebooted a couple times then said update successful. Everything appears to be stable and working, for some reason it also unlocked the manual firmware update on the web ui.

You can flash the newest 6550 FW onto the 6550 and it's still wide open. I got a 6550 and it updated to .47 on its own and then I flashed .51 onto it manually. Lots of others are flashing 6550 onto 6500 without an issue too. In a month or two, we might have one universal FW that unlocks bands and and works on every M6 model.

[TopSoft]

Could you please share more details:
what was your original MR6500 image?
What type of firmware upgrade have you performed? Could you please share how you make the firmware upgrade?
Does the new image unlock 5G channels and aggregations?
is it stable /operational ?

At the moment I do not have the laptop with the firmware but I downloaded it from this site on that firmware thread. I will check which one I used when I get around to it.
I did not do any firmware modifications it just flashed, rebooted a couple times then said update successful. Everything appears to be stable and working, for some reason it also unlocked the manual firmware update on the web ui.

You can flash the newest 6550 FW onto the 6550 and it's still wide open. I got a 6550 and it updated to .47 on its own and then I flashed .51 onto it manually. Lots of others are flashing 6550 onto 6500 without an issue too. In a month or two, we might have one universal FW that unlocks bands and and works on every M6 model.

That's pretty neat, I pretty much discovered this accidentally and I was shocked after I gave up for a month and then tried to unlock again and it just worked.. Apparently the firmware I flashed before giving up reopened everything and I was just dumb. Root telnet port 23 also works apparently!

[roaminggnome]

That's pretty neat, I pretty much discovered this accidentally and I was shocked after I gave up for a month and then tried to unlock again and it just worked.. Apparently the firmware I flashed before giving up reopened everything and I was just dumb. Root telnet port 23 also works apparently!

That happened to my a 6150... I reset it when it was acting weird, which caused it to close all ports, like telnet, I mailed it off to Rich for him to try to beta modded FW on, when I got it back, it just crashed and restarted nonstop, so I loaded 6400 fw onto it, which didn't work. I loaded 6550 fw on it a couple weeks ago and now it works flawlessly again.

[bruceleeroy]

I originally didn't want to say anything but I somehow got my Nighthawk M6 Pro MR6500 to run the MR6550 firmware and all the AT commands that don't work on the MR6500 latest update seme to work in there.
My nighthawk previously wouldn't work with OPENMEP after an update.


Sorry about the quality on the second image, I was in a rush to go somewhere and I couldn't get snipping tool to open.

Could you please share more details:
what was your original MR6500 image?
What type of firmware upgrade have you performed? Could you please share how you make the firmware upgrade?
Does the new image unlock 5G channels and aggregations?
is it stable /operational ?

At the moment I do not have the laptop with the firmware but I downloaded it from this site on that firmware thread. I will check which one I used when I get around to it.
I did not do any firmware modifications it just flashed, rebooted a couple times then said update successful. Everything appears to be stable and working, for some reason it also unlocked the manual firmware update on the web ui.

Based upon your screenshot, it looks like it's MR6550-100PAS_23115682_NTGX65_12.01.20.00_00_Generic_01.28_00.secc.

The all important question is, was your MR6500 on the 12.xx firmware and you didn't do anything except flash it with the MR6550 firmware?

[dfkinca]

Apparently the firmware I flashed before giving up reopened everything . . . . Root telnet port 23 also works apparently!

So when you say "reopened", do you mean that 6550 FW flash onto 6500 allows for OPENLOCK, OPENCND, and (most importantly) OPENMEP functionality to be restored on your 6500?

You can flash the newest 6550 FW onto the 6550 and it's still wide open.

Similar question as to your "wide open": does 6550 FW flash onto 6550 (plus auto update to latest 6550 FW flash) have OPENLOCK, OPENCND, and (most importantly) OPENMEP functionality on your latest FW 6550?

[dfkinca]

You can flash the newest 6550 FW onto the 6550 and it's still wide open.

Similar question as to your "wide open": does 6550 FW flash onto 6550 (plus auto update to latest 6550 FW flash) have OPENLOCK, OPENCND, and (most importantly) OPENMEP functionality on your latest FW 6550?

Answering my own question as to 6550 (for community benefit): when I flashed my used 6550 with the .51 FW (after letting 6550 update automatically to .47 FW), OPENLOCK, OPENCND, and OPENMEP functionality still work with no issue!

Now, still need answer as to 6500 . . .

[roaminggnome]

You can flash the newest 6550 FW onto the 6550 and it's still wide open.

Similar question as to your "wide open": does 6550 FW flash onto 6550 (plus auto update to latest 6550 FW flash) have OPENLOCK, OPENCND, and (most importantly) OPENMEP functionality on your latest FW 6550?

Answering my own question as to 6550 (for community benefit): when I flashed my used 6550 with the .51 FW (after letting 6550 update automatically to .47 FW), OPENLOCK, OPENCND, and OPENMEP functionality still work with no issue!

Now, still need answer as to 6500 . . .

It works on 6500. But what's odd is, if you load 6550 on to a 6400, it no longer connects to Dish/PG 313340.

[TopSoft]

Could you please share more details:
what was your original MR6500 image?
What type of firmware upgrade have you performed? Could you please share how you make the firmware upgrade?
Does the new image unlock 5G channels and aggregations?
is it stable /operational ?

At the moment I do not have the laptop with the firmware but I downloaded it from this site on that firmware thread. I will check which one I used when I get around to it.
I did not do any firmware modifications it just flashed, rebooted a couple times then said update successful. Everything appears to be stable and working, for some reason it also unlocked the manual firmware update on the web ui.

Based upon your screenshot, it looks like it's MR6550-100PAS_23115682_NTGX65_12.01.20.00_00_Generic_01.28_00.secc.

The all important question is, was your MR6500 on the 12.xx firmware and you didn't do anything except flash it with the MR6550 firmware?

Yes my MR6500 was on 12.xx firmware beforehand.

[helloguys]

If you have telnet then I can get you to fastboot mode which means remote loading is possible, thus downgrading is possible.

edit: let me be more clear... do you have root or just telnet? if you have $ or # that is good it is root, if you have only AT commands via telnet with no AT!OPENMEP? working it is not so good.

I'm a newly registered user. The forum won't allow me to PM you. Is there an alternative? I was trying to enable TELNET for my MR6500 with firmware 12.01.48.00 (2023/11/07). Thanks!

[J12358]

Verified MR6550-100PAS FW running on top of MR6500-1A1NAS is working fine, OPENLOCK/OPENMEP are all working with latest keygen.
No FW file from me, am just getting confirmation from mrCONFIG/mrUNLOCK user.

Hi, would this mrCONFIG user be able to report back on the if the 6550 FW on top of the 6500 resulted in the frequency bands (b71 as an example) being usable?

I'm in a similar boat with a M6500-1A1NAS on 10.x FW looking to allow as many freq bands as possible for flexibility while traveling. So far through reading the forum posts it seems Rick's business in KS is an option but also self flashing seems to be an alternate path (whether through mrCONFIG or atd in powershell).

[telnettlen]

If you have telnet then I can get you to fastboot mode which means remote loading is possible, thus downgrading is possible.

edit: let me be more clear... do you have root or just telnet? if you have $ or # that is good it is root, if you have only AT commands via telnet with no AT!OPENMEP? working it is not so good.

Hello,

I am trying to perform an IMEI repair on my Netgear MR 6110. Here's more info from running ati via telnet:

Manufacturer: Netgear, Incorporated
Model: MR6110
Revision: NTGX65_12.01.16.01 r10420 ntgrbc-fwbuild7.netgear.com 2023/06/24 20:30:19

Following tutorials online, I am able to make to create a challenge, use SierraKeygen, and pass the response back, but I am not able to change the IMEI.

Trying 192.168.1.1...
Connected to attwifimanager.
Escape character is '^]'.
AT!OPENLOCK?
AT!OPENLOCK?
44676EEBF93FCD4C

OK
AT!OPENLOCK="1D40765052874ADF"
AT!OPENLOCK="1D40765052874ADF"
OK
at!nvmeidunlock
at!nvmeidunlock
OK
at!nvencryptimei=..,..,..,..,..,..,..,..
at!nvencryptimei=..,..,..,..,..,..,..,..
ERROR


Would you be able to help me? I would have DM'd you directly but I am a new user.

[w1lliam]

you should do AT!OPENMEP instead of AT!OPENLOCK

[TopSoft]

Apparently the firmware I flashed before giving up reopened everything . . . . Root telnet port 23 also works apparently!

So when you say "reopened", do you mean that 6550 FW flash onto 6500 allows for OPENLOCK, OPENCND, and (most importantly) OPENMEP functionality to be restored on your 6500?

You can flash the newest 6550 FW onto the 6550 and it's still wide open.

Similar question as to your "wide open": does 6550 FW flash onto 6550 (plus auto update to latest 6550 FW flash) have OPENLOCK, OPENCND, and (most importantly) OPENMEP functionality on your latest FW 6550?

Yes. sorry for the super late reply!

[BPcarney]

@telnettlen can you share what tutorial you were following here? I’m just trying to unlock the same model. No need to change IMEI

And @Rich Hathaway can you confirm is it actually possible with the latest firmware? I have gotten a code from mrconfig already.

Hello,

I am trying to perform an IMEI repair on my Netgear MR 6110. Here's more info from running ati via telnet:

Manufacturer: Netgear, Incorporated
Model: MR6110
Revision: NTGX65_12.01.16.01 r10420 ntgrbc-fwbuild7.netgear.com 2023/06/24 20:30:19

Following tutorials online, I am able to make to create a challenge, use SierraKeygen, and pass the response back, but I am not able to change the IMEI.

Trying 192.168.1.1...
Connected to attwifimanager.
Escape character is '^]'.
AT!OPENLOCK?
AT!OPENLOCK?
44676EEBF93FCD4C

OK
AT!OPENLOCK="1D40765052874ADF"
AT!OPENLOCK="1D40765052874ADF"
OK
at!nvmeidunlock
at!nvmeidunlock
OK
at!nvencryptimei=..,..,..,..,..,..,..,..
at!nvencryptimei=..,..,..,..,..,..,..,..
ERROR


Would you be able to help me? I would have DM'd you directly but I am a new user.

[Rich Hathaway]

It is mep you need to use which is locked out on your platform, there is no need to load firmware anymore to correct the now closed port and no mep functionality, it can be corrected on any device on any platform now and keeping the os intact