Wireless Joint

So I got a mr6550 for a few days (I already had to send it back to the owner)
But I had it long enough to pull what I needed to make a build from it, I loaded it successfully
on a mr6500 and it ran without issue, got service, and overall looked good.
I do not have time to test much, if a couple of you guys are interested in testing it
hit me up and I'll load one up for you, only a couple testers needed, it should run on other builds as well but I cannot say this to any certainty, yet...
This should be a much easier way to enable the rest of the bands on these models than doing it by filesystem, efs, and rfnv.

Hello, Rich Hathaway. I am from China and I have MR6450-100EUS. I want to beta test it to open the N79 frequency band. Is your firmware model MR6550-100PAS or MR6550-100APS?

Someone ask me in a pm what bands the 6550 has enabled, a quick google search will tell you
MR6550-100PAS – United States & Canada (Unlocked)
Model MR6550-100PAS
5G Technology Sub-6GHz+mmWave
5G Bands 2/5/7/12/14/25/29/30/38/41/48/66/71/77/78/260/261
4G Technology LTE CAT20
4G Bands 1/2/3/4/5/7/12/13/14/25/26/28/29/30/40/41/46/48/66/71

Hi Rich,

One question, what would happened when flashed MR6500, now is becoming MR6550, upgrade its FW later? Is it still remained as "MR6550" or the upgrade path will be broken going forward?

Regards,
William

I disabled updates so nothing will happen

Hi Rich, Gabe here. I would like to test your new fw on my MR6500. Thanks,

I’d be open to helping you test as well. Just let me know what I need to do to.

hope you will teach us how to do it. I really need to add some necessary bands on my 6500

I have a dozen betas already, we dont want to over-do in case there is something wrong with it, which I highly doubt, but you never know.
I made it along factory lines and only modified the update address so it cannot connect and update, everything else is factory 6550, if there is any issues it will likely be because of overwrite of the efs and userdata parts, but we will know soon.

Hi Rich,
Is this something you could help me with if it opens up the bands?

sure

Rich Hathaway wrote: Mon Dec 04, 2023 8:36 amsure

Without the need to send it to you?

I have done a bit more since we last spoke - I have managed to dump all of the mtdblock files onto my laptop - if its any use?

No, I do not need them, but yes it is a mail-in-only service because of the type of load it is, it cannot be done over network, it would take a couple of days to complete and likely would not run to completion uninterrupted which would mean you would have to send it in to be recovered anyways. So might as well just send it and alleviate the possibility of borking it.

Hi Rich, I see you have enough beta testers already. But I am also interested in help upgrading my mr6500 for n41,n71. TIA

Rich Hathaway wrote: Mon Dec 04, 2023 9:42 am No, I do not need them, but yes it is a mail-in-only service because of the type of load it is, it cannot be done over network, it would take a couple of days to complete and likely would not run to completion uninterrupted which would mean you would have to send it in to be recovered anyways. So might as well just send it and alleviate the possibility of borking it.

I have PM'd you Rich

Rich Hathaway wrote: Fri Dec 01, 2023 9:03 am I have a dozen betas already, we dont want to over-do in case there is something wrong with it, which I highly doubt, but you never know.
I made it along factory lines and only modified the update address so it cannot connect and update, everything else is factory 6550, if there is any issues it will likely be because of overwrite of the efs and userdata parts, but we will know soon.

greeting sir, can i know what is the status of flashing mr6550 onto mr6500 until now? is it working properly? any comments from beta tester would highly aprreciated..if this working properly, i would need your help to do the flashing..

Yes so far so good but its only been a few days, give it some time for proper testing

@Rich Hathaway checking to see if you got my PM from earlier.

Just patiently waiting for the release. I’m excited for this.

Once this is tested will you be releasing it for everyone? Thanks!

Will you be updating this thread when you're ready to roll this out to end users?
I'm in Michigan and would like to send you my locked MR6500

Hi Rich, I’m very curious to see how development goes with this as I just received an Att Sim unlocked MR6500 which I’ll be planning on using with Tmobile in the near future (I’ll need those bands unlocked for TMO)

I will likely be another person here amongst the list of eager individuals waiting for your progress update.

Still testing this I will update this thread when there is solid news that is confirmed, right now all I can say is it is loading and running with no problems on the 6500 and the 6400

Hey Rich, hopefully the testing is going as expected
I am interested as well, got a ATT unlocked 6500 as well hoping to get the rebooting issue resolved.
Running it on Fi, when it stays active

Rebooting issue? How often does yours reboot?

Very Sporadically. Between 5 min to 1 hour. I have reset the device along with changing what power settings are available. Thankfully I am using this as a fall back device for my home network.

dmesg it so you can see what is going on

@Rich Hathaway Hi I just registered to reply to this thread in order to see if you can help me flash the mr6500 I have. Unfortunately it is already on the updated firmware and I don’t have openmep. Please DM me on where to mail the device and how I can pay you, PayPal or Venmo. Thanks.

I was finally able to get root access to the device, not really seeing anything that jumps out at me. I should probably just DM, instead of trying to troubleshoot in this thread

waldoinc wrote: Sun Jan 07, 2024 9:47 am I was finally able to get root access to the device, not really seeing anything that jumps out at me. I should probably just DM, instead of trying to troubleshoot in this thread

Can you please write up a guide, I really want to get root access too.

@Rich Hathaway
How's it looking in terms of testing?
And if no issues as yet - how long do you think before you will consider carrying out changes to other devices?

Rich Hathaway wrote: Wed Nov 29, 2023 5:35 pm So I got a mr6550 for a few days (I already had to send it back to the owner)
But I had it long enough to pull what I needed to make a build from it, I loaded it successfully
on a mr6500 and it ran without issue, got service, and overall looked good.
I do not have time to test much, if a couple of you guys are interested in testing it
hit me up and I'll load one up for you, only a couple testers needed, it should run on other builds as well but I cannot say this to any certainty, yet...
This should be a much easier way to enable the rest of the bands on these models than doing it by filesystem, efs, and rfnv.

Great job. I am glad to test your firmware

Rich Hathaway wrote: Sat Jan 06, 2024 1:32 pm dmesg it so you can see what is going on

Hi Rich I'm very interested to become a beta tester. However due to being newly registered, I'm not able to dm you .

Keen to see where its going as I'm travelling out Australia soon so it would be nice to have all the bands

Current status:
MR6500 - Telstra, Australian ver.
Telnet Root: yes with #
Firmware: NTGX65_12.01.41.00

@Rich Hathaway , I apologize for getting off subject, but I've got an MR6500 that occasionally reboots and/or freezes, and will not update firmware. After reading through some of your posts, perhaps I'm lucky that it hasn't updated.

Unfortunately, the device will not function in "Performance" mode, and it is primarily used as a fixed modem for my home network.

Being a new member to the forum, I'm unable to PM you.

Do you have any advice on how to mitigate my issues?

As you're probably aware, NetGear is absolutely worthless as when it comes to getting help. I've scoured their support forums and found very little advice, and what I have found suggest trying to force the update by removing the SIM and enabling data offloading.

If you have a few moments to respond, I'd greatly appreciate it. I'd love for this to be a reliable device.

Thanks!

I have all the betas I need at the moment.
To update this thread, the 6550 loads and runs fine on 6500 and most of the features one would want
work, such as, it is unlocked, the AT&T branding is gone, the menus reflect the 6550 firm, bands are working but it wants to keep using the 6500 bands still even though the bitmasks have changed, the userrw and cust parts still need work to reflect the 6550 device, I need to get a 6550 here that I can destroy, I only say that because it may happen.
it seems the 6550 is somewhat rare.


@ Meezy
what do you mean "it will not function in "Performance" mode" you mean it won't get service or?

Rich Hathaway wrote: Wed Jan 24, 2024 9:46 am I have all the betas I need at the moment.
To update this thread, the 6550 loads and runs fine on 6500 and most of the features one would want
work, such as, it is unlocked, the AT&T branding is gone, the menus reflect the 6550 firm, bands are working but it wants to keep using the 6500 bands still even though the bitmasks have changed, the userrw and cust parts still need work to reflect the 6550 device, I need to get a 6550 here that I can destroy, I only say that because it may happen.
it seems the 6550 is somewhat rare.


@ Meezy
what do you mean "it will not function in "Performance" mode" you mean it won't get service or?

Hi Rich,
My modem still cannot pick up 5G bands after flash the 6550 firmware..only 4G bands. Do i need to wait for your newly build firmware ? or there is any way to fix it? .waiting for your reply

New to this forum so unable to DM. While I'm new to the topic my background includes RE, including IoT devices. Was looking to acquire an used MR6500 (one showed up on Facebook market place near me). Happy to do some testing with Beta firmware @Rich Hathaway and see if I can contribute some valuable feedback.

Yes this is a constant work in progress because so little is known about 5g hacking currently, what band are you needing to pickup?

@Rich Hathaway

Just picked up an MR6500 and unfortunately it’s on the 12.0.x firmware. I am patiently waiting to see your work on the MR6550 firmware but I am worried I will never be able to reflash my firmware. In your opinion, is it inevitable that one day 12.0.x owners can reflash their MR6500?

Rich Hathaway wrote: Sat Jan 27, 2024 8:22 am Yes this is a constant work in progress because so little is known about 5g hacking currently, what band are you needing to pickup?

My country uses these bands for 5G
700 MHz (b28)
3.5 GHz (n78)

So i need these bands to work properly..

btw in the BAND REGION setting only has two options
1. 4G + 5G
2. 4G only..

can you reply in Skype to sort this out?

Any reported issues with the tester? Is the flash service ready for other MR6500 devices? Does it matter what firmware version is install to start with? Thanks

This is working without issue running on any mr6xxx device but enabling bands is still having some trouble there are a couple of us working on it.

Greetings Everyone,
I am here because I purchased a couple of used ATT NETGEAR MR6500's and I am looking to update the firmware for them. I am having overheat issues and I am sure the firmware for both are fairly old.(10.4.22.00 and 10.1.47.00) any help that can be offered would be greatly appreciated.
I am a contractor in Iraq and getting things from the US is a major pain.
Again thank you very much.

If you're running them off AC power, have you tried removing the batteries in them? Some of the MR series overheat when the batteries are left in, but less so when they're removed. I don't know if that applies to the 6500 series, but it would be an easy thing to test.

i'm new here, however i'd love to test this firmware. I have a new to me 6500 on 12.01.48.00 I'd love to be able to change the imei as i have on my 5200, & enable telnet.

Rich Hathaway wrote: Tue Feb 13, 2024 10:12 am This is working without issue running on any mr6xxx device but enabling bands is still having some trouble there are a couple of us working on it.

Hi @Rich Hathaway,
Any update on the progress of enabling bands?

I am waiting on another 6550 to arrive here to continue this work, I do not have this model on hand right now

I'm in, I just installed an old firmware from a MR6550 to my MR6500. Trying to get it unlocked using sierrakeygen but it seems the codes generated by the script aren't working.

Rich Hathaway wrote: Tue Feb 13, 2024 10:12 am This is working without issue running on any mr6xxx device but enabling bands is still having some trouble there are a couple of us working on it.

I'm on firmware 10.01.21.00.

SDX65 modems should be able to handle most bands, or at least the ones I'm trying to "activate". I've been working on it for a few hours and I'm assuming your group is not using the AT commands. I've been trying to add the bands manually and force enabling them. However, I cannot figure out the structure of the command.

Is it safe to assume you are working on modifying the firmware?

yujili wrote: Mon Mar 04, 2024 1:37 am

Rich Hathaway wrote: Tue Feb 13, 2024 10:12 am This is working without issue running on any mr6xxx device but enabling bands is still having some trouble there are a couple of us working on it.

I'm on firmware 10.01.21.00.

SDX65 modems should be able to handle most bands, or at least the ones I'm trying to "activate". I've been working on it for a few hours and I'm assuming your group is not using the AT commands. I've been trying to add the bands manually and force enabling them. However, I cannot figure out the structure of the command.

Is it safe to assume you are working on modifying the firmware?

It's quite different this time. This time the branded modems REMOVED the bands from its code so that you cannot simply enable it back like older models. Thus they need to figure out a way to flash back the full band code to the modem first. And it's not written in the normal firmware that is easy to deal with. It's a separate system. That's why Rich says that he needs more time and another 6550 to figure out what to dump out from the 6550 and what to dump into other models.

It's quite different this time. This time the branded modems REMOVED the bands from its code so that you cannot simply enable it back like older models. Thus they need to figure out a way to flash back the full band code to the modem first. And it's not written in the normal firmware that is easy to deal with. It's a separate system. That's why Rich says that he needs more time and another 6550 to figure out what to dump out from the 6550 and what to dump into other models.

It is not likely that SDX65 chip set disabled the bands. Likely it is a firmware limitation by netgear, therefore we can write the bands back into the code for the older firmware.

It's weird that netgear used their man hours to lock down their software.

I currently have a 6550 Modem as well trying to dump stuff from.

I got a 6550 with FW 12.01.13.00 2023/04/03, older than anything leaked. It's moddable.

Hello I have an AT&T MR6500 modified to have the IMEI of an iPad. I see you have rolled the firmware over from the MR6550 and I wanted to do that to get T-Mobile Bands as I have a business tablet plan I want to put into the hotspot. My firmware is on NTGX65_10.04.22.01. I am really only interested in just getting all the network bands unlocked since Netgear and AT&T decided to lock down this device to it's full potential.

Hi Rich, new member, so I can't dm. I'm interested in your services to update fw and change imei. Happy to run whichever latest version you have. I have an ATT 6500. Is there specific contact information you prefer to use to communicate about this? Thanks

Hi Rich, I'm a new member and unable to dm. I'm interested in your services to update fw and change imei. Happy to run whichever latest version you have. I have an ATT 6500. Is there specific contact information you prefer to use to communicate about this? Thanks

its right above your post

Hi Gents,
How's the testing going?

Hi Rich,

I’m shipping out the three units today. They should arrive with you tomorrow.

One of the model numbers has DSP at the end. Does that matter for your process? I can’t find anything online about that specific model.

Thanks,
Brett

any latest news?

Rich:

I too would like a copy of this, if you can find a spare moment.

Thanks.

User Update

Current state:

The mr6500 units that Rich prepared for me have been working great.

The first few times I booted one of them, it would take 5 minutes or more to boot. Discovered quickly that the battery was swollen. Replaced the battery and it boots up in around 45 seconds most of the time.

All on AT&T right now.

I used one of them at the RSA conference a few weeks back. I had it in my backpack for the day and walked the expo hall for hours without any service interruptions. This was a big improvement over my mr1100 that I used last year.

The antennas in these are much better than my other devices; 10s of db better in any given area.

Also, the logic for determining which band to use seems to be much better. With my mr1100, I created custom band configs to force it to use a certain band/tower. I haven't needed to do that with the mr6500 (mr6550 firmware); I haven't run into a situation yet in very rural or very dense city where it has let me down with usable speed.

On my old model, I needed to use a vpn client often to get past AT&T throttling/traffic shaping. I have not needed to do this yet on the mr6550. I have tested it, and there is a difference in speed, sometimes vpn is better, sometimes vpn is worse, but the overall throughput, regardless of content being transmitted/received never has a noticeable impact from any network throttling. My speedtest.net, fast.com, and ipfail.org tests all meet or exceed my current needs.


Future State:

Still need to try the modems in high performance mode without batteries and take measurements. Future use case is as a failover connection with SDWAN.

Will update as things progress.

brettgavin wrote: Wed May 29, 2024 11:30 am
My speedtest.net, fast.com, and ipfail.org tests all meet or exceed my current needs.

Why would you need to use a VPN to access a site like IPFail.org?
It doesn't seem to be a speed test site like the others.

jiang852008@gmail.com I want try it

hi

can i try your firmware ?

thanks

Does it enabled n71 with ported firmware?

Hi Rich,

I am also interested in testing your solution but cannot write dm yet. I have the mr6500 series unlocked, but some bands are definitely missing in Europe. Also it happens a lot that when I stop using my computer or phone, then after a few minutes the connection is basically broken (pages not loading, while connection seem to be up) and I have to reconnect my device to get to the proper speed again.

For now beta testing is closed, as it stands now everything done is tested fairly well and while work still needs done on this
I do not have a 6550 I can work with at the moment, a few people have allowed me to work with their 6550 devices and
a big thank you to them, I need one I can possibly bork to continue and finish this project.

6550 firm can be loaded to other devices via fastboot/bootloader (this is not for spk or cwe)This project is not for use with fdt or that type of load.

All partition parts are made and loadable across different platforms now and some good features are written into some of the parts such as hard coded comports and adb, debranding, remove apn restrictions, remove the need to complete the security challenge to make some values writeable and restore openmep and openlock challenges on devices that have been "locked-out".
IMEI can be written without the need to complete the security challenge now (soft and hard coding)

As far as adding bands this is where work needs to be finished, while new bands such as N71 N41 N78 N28 etc, bands that are not available in the 6110, 6150, 6400, 6500 and others can be added and seen to verify it, these devices still do not want to stay on them and need further work, I get asked about this alot.

I have alot of time in this project and would like to finish it up it will be and already is VERY popular but I need to find just a 6550 board or whole device lol and could use another MR6xxx test subject to load test builds to if anyone wishes to contribute test devices to this project by all means hit me up, my contact info is in this forum and easily found on the web.

most all of the other functions the pro devices have (MR6400 and above) can already be ported over to the non-pro devices (MR6110 and such) like wifi 6

Happy hacking!!!

@Rich Hathaway

As we all appreciate your work, why not post it on github so that others can contribute and help with your work? I definitely would love to help with your work as I have some relevant skills from porting over custom roms and android hacks and stuff. I'm sure others would love to help and would benefit the community greatly.

That would definitely be an ideal scenario. Hopefully Rich will consider this!

Are you guys able to force the MR6500 to use band n71? I used at!band command and it won't do it.

airwalker wrote: Wed Jul 17, 2024 11:10 am That would definitely be an ideal scenario. Hopefully Rich will consider this!

"I have a lot of time in this project and would like to finish it up it"
This is his business making custom mods, don't expect it to be public domain anytime soon, just sayin'.

Rich Hathaway wrote: Thu Jul 11, 2024 2:15 pm For now beta testing is closed, as it stands now everything done is tested fairly well and while work still needs done on this
I do not have a 6550 I can work with at the moment, a few people have allowed me to work with their 6550 devices and
a big thank you to them, I need one I can possibly bork to continue and finish this project.

6550 firm can be loaded to other devices via fastboot/bootloader (this is not for spk or cwe)This project is not for use with fdt or that type of load.

All partition parts are made and loadable across different platforms now and some good features are written into some of the parts such as hard coded comports and adb, debranding, remove apn restrictions, remove the need to complete the security challenge to make some values writeable and restore openmep and openlock challenges on devices that have been "locked-out".
IMEI can be written without the need to complete the security challenge now (soft and hard coding)

As far as adding bands this is where work needs to be finished, while new bands such as N71 N41 N78 N28 etc, bands that are not available in the 6110, 6150, 6400, 6500 and others can be added and seen to verify it, these devices still do not want to stay on them and need further work, I get asked about this alot.

I have alot of time in this project and would like to finish it up it will be and already is VERY popular but I need to find just a 6550 board or whole device lol and could use another MR6xxx test subject to load test builds to if anyone wishes to contribute test dices to this project by all means hit me up, my contact info is in this forum and easily found on the web.

most all of the other functions the pro devices have (MR6400 and above) can already be ported over to the non-pro devices (MR6110 and such) like wifi 6

Happy hacking!!!

MY device mr6500 ATT version was moded by Rich Hathaway, everything works fine except for my country ( Malaysia) only uses n78 band for 5G connection so i could not use this device for 5G connection since it was not supported. This device (MR6500-1A1NAS) only support these 5G bands only (2/5/12/14/29/30/66/77)

so, if there anyone interested to buy my device, please dm or contact me via skype ( syahrul91)
please take note that this item currently is in Malaysia and it will takes 2-3 weeks by courier.

Rich said He created his tools to do everything and will not be releasing it. I emailed him. Seems like his dormat-ness; he's not interested in this anymore.

read my post a few posts above this one dated july 11th it states I do not have a 6550 or 6xx0 now to continue this project,
The ones I had had to be returned to the rightful owners.
thus it is on hold until such a time when I can have these 2 devices in hand again.

This is all I do these days (besides work on the farm here) good progress has been made on this device class and it is close to being finished.

I do not answer every post because it is so redundant in these threads, if the posters would read thru the thread the answers to their questions are right above them most of the time, it just clutters up the forum to have threads with the same questions & answers over and over again and at some point creates alot of work for someone to have to come back and clean the threads up and delete repetitive post as well as makes reading thru them a days long process, if we can try to keep the threads clean by only posting things that are useful the threads will be much more easy to navigate and find things.