MR6500 device with MR6400 fw?

[guest00x]

Is it possible to use download mode to flash MR6500 unit with Mr6400 fw and enable all lte/NR bands from MR6400 (i do not need mmwave. Just tmobile lte/NR bands)?

Is there a public release spk file for MR6150?

Thank you.

[Rich Hathaway]

If your 6500 is on 12.01 or above then no, it is now fuzed and you cannot even downgrade it with earlier versions of 6500 firmware. enabling bands yes you can still do to it.
there is no public release or leak of mr6150 firm or at least that I know of you will have to make your own.

[guest00x]

My MR6500 on fw: NTGX65_10.0.1.47.00 date: 2022/07/08. How can i enable all the bands from MR6400 or literally all bands. Can i just force download mode with MR6400 firmware? Or add other lte/nr band while keeping mmwave?
What is fuzed?

Thanks.

[Rich Hathaway]

what bands are you wanting on it?

[guest00x]

All the bands for tmobile that a hacked MR6500 is capable of.
Saw that you need tester for the MR6500 fw. Let me know.

[Watson306]

Rich,
I have posted my own question in relation to this.
But is it possible for example to put the 6450 (ideally) or the 6550 FW on a 6500 unit to give it UK bands.
I know the 6550 wont give me full UK bands but i'm on o2 so I need:
4G - 1/3/8/20/40
5G - 77/78

[Rich Hathaway]

That is a question in need of another question, which is, have you looked at the hardware specs to know if the variant you have can even see those bands? and I dont mean to look netgears site because they will only list for
the bands for the carrier it is made for
---------------------------------------------------------------------
for the AT&T varaint (1A1NAS)
Chipset Qualcomm® Snapdragon™ X65 5G Modem-RF System
5G Technology Sub-6GHz + mmWave
5G Bands 2/5/12/14/29/30/66/77
4G Technology LTE CAT20
4G Bands 1/2/3/4/5/7/12/14/29/30/46/48/66
---------------------------------------------------------------------
and the same model but the variant
(100PAS) unlocked
Chipset Qualcomm® Snapdragon™ X65 5G Modem-RF System
5G Technology Sub-6GHz+mmWave
5G Bands 2/5/7/12/14/25/29/30/38/41/48/66/71/77/78/260/261
4G Technology LTE CAT20
4G Bands 1/2/3/4/5/7/12/13/14/25/26/28/29/30/40/41/46/48/66/71
3G Bands N/A
---------------------------------------------------------------------
(100EUS)
Chipset Qualcomm® Snapdragon™ X65 5G Modem-RF System
5G Technology Sub-6GHz
5G Bands 1/2/3/5/7/8/20/28/38/40/41/71/77/78
4G Technology LTE CAT20
4G Bands 1/2/3/4/5/7/8/12/13/14/20/28/38/40/41/42/66
3G Bands 1/2/5/8


As you can see the bands that Netgear shows they can see vary greatly so what you need to do is look at the FCC docs focusing on Antenna hardware if they have the same antenna hardware then obviously the AT&T model can see those other bands that the unlocked one can see so they are just disabled so they just need to be enabled.
I have not done this so I do not know if the ant. hardware is the same or different on the models.
if it's the same then you can just write bands to its empty slots and not have to try to load the wrong platforms firmware to your 6500 and risk borking it, if your device is updated to or beyond 12.01.xx then it is fuzed now and loading the wrong firm on it will almost certainly brick it, and can possibly even damage hardware so be careful and I certainly would not try it unless you have either your 6500 backed up or factory or kind of firm that can recover it if needed.
If you did try this I would highly suggest loading only the system partition via fastboot and if it works then try to load the modem partition from the other model, but please don't take that as me telling you to do it because I highly suggest you do not do it, it is a 700$ plus device that you will likely bork it would be much safer to write bands to it, as long as you don't overwrite the first 2 slots you won't hurt it as it will not accept them unless they have the correct format and bitmask.

[Watson306]

As you can see the bands that Netgear shows they can see vary greatly so what you need to do is look at the FCC docs focusing on Antenna hardware if they have the same antenna hardware then obviously the AT&T model can see those other bands that the unlocked one can see so they are just disabled so they just need to be enabled.
I have not done this so I do not know if the ant. hardware is the same or different on the models.
if it's the same then you can just write bands to its empty slots and not have to try to load the wrong platforms firmware to your 6500 and risk borking it, if your device is updated to or beyond 12.01.xx then it is fuzed now and loading the wrong firm on it will almost certainly brick it, and can possibly even damage hardware so be careful and I certainly would not try it unless you have either your 6500 backed up or factory or kind of firm that can recover it if needed.
If you did try this I would highly suggest loading only the system partition via fastboot and if it works then try to load the modem partition from the other model, but please don't take that as me telling you to do it because I highly suggest you do not do it, it is a 700$ plus device that you will likely bork it would be much safer to write bands to it, as long as you don't overwrite the first 2 slots you won't hurt it as it will not accept them unless they have the correct format and bitmask.

Hi Rich,
Is this what you were thinking?

Each antenna modules 0 & 1 are identical and has 20 ports. Out of these, 10 ports are for 1x5 patch array
antennas for low band n258 (24.25-27.5 GHz) & n257/n261 (26.5-29.50 GHz) and 10 ports are for 1x5
patch array antennas for high band n260 (37-40 GHz) respectively. The device currently only supports
n260 band and simulation analysis is for high band ports only. Out of 10 ports of the patch array, 5 are for
horizontal (Pol 1) and 5 are for vertical (Pol 2) polarization feeding respectively. With the encrypted
QTM simulation model, the magnitude and phase information can be loaded for each port by using “Edit
Sources” in ANSYS Electromagnetics suite 2021R2. Fig.4-7 shows the antenna port excitations.

[Rich Hathaway]

antenna block.PNG

compare what you find in those fcc docs to see if the 2 devices hardware is the same

5665583.rar

[Watson306]

I cant find one for the MR6450 or the MR6550 - only the one you have attached and the screenshot from it above.

[Rich Hathaway]

https://device.report/manual/7840269 <---6550

https://device.report/fccid/py322100558 <----6400
very easy to find with a quick google search

[Watson306]

https://device.report/manual/7840269 <---6550

https://device.report/fccid/py322100558 <----6400
very easy to find with a quick google search

Thank you.
I did find those sites, but I cant find a diagram for the MR6550 or MR6450 like you posted originally for the MR6500.
But from what I can see - there is no mention that the hardware is capable of the UK bands I require.
So seems I have hit a brick wall really.
Thanks for all your help.

[Rich Hathaway]

The 100EUS variant has the bands you need, all of them.

[Watson306]

The 100EUS variant has the bands you need, all of them.

Yeah that is the UK version - which is quite bit more expensive than the US version.
But thanks for all your help.

[Rich Hathaway]

Your missing the point, if that variant can see them and there are no differences in hardware between the variants then they all can see them if enabled
but your welcome

[Watson306]

Your missing the point, if that variant can see them and there are no differences in hardware between the variants then they all can see them if enabled
but your welcome

Oh ok - Sorry I missed your point. I have seen some really cheap MR6500's on the US ebay site.
It might be worth buying one and having a play maybe then.
Would you be able to guide me if I did that? Or could you point me in the direction of any resource sites you are aware of?

[Watson306]

@Rich Hathaway
Is that something you could help on?
I understand it might not work - but sounds like it could be worth the gamble?

[Rich Hathaway]

Yes I can do it

[Watson306]

Yes I can do it

Thanks Rich - i'll get one ordered - I doubt it will be here for a few weeks - i'll let you know.

[Watson306]

@Rich Hathaway
Its on its way - the tracking says it will be here Saturday.
I obviously dont know what FW is on the box, but I think it will be locked to AT&T - so I am guessing that will be my first port of call.
I have unlocked phones before so I think I should have everything.
Will I need anything additional to a laptop, and usb cable?
Anything worth downloading to laptop in preperation?

[AKosterin]

I dumped the firmware MR6500-1A1NAS_23115205_NTGX65_10.04.22.00_ATT_01.20_00 from the corresponding section of the flash drive - https://mega.nz/file/yltUEJhZ#fkX1CHpvA ... b63u4uTrQY. I know how to assemble and disassemble the firmware that is installed in the router, I also know how to assemble a custom NVUP partition with which you can change modem configurations. I will try mod firmware for band extending

Simply rolling the MR6400 firmware onto the MR6500 will not unlock the bands, but if you assemble the correct NVUP, you can build custom firmware with the theoretical ability to work in other bands

[Rich Hathaway]

if you load 6400 on 6500 you will need to not only edit the rfnv but also the efs as it holds the bit masks for service for 4g/5g (lte_bandpref)(5G_bandpref) both are needed for 5g service and spk's do not write these parts so you are left with the 6500 values is why it does not change band support but both of those can be edited via dm command thru the serial dm port which is much safer than changing and writing partitions,

[mikecoz3]

@Rich Hathaway I have a MR6500 with old FW, with the usual Mods, that I would love to see some N41 action on!? You think we could make it work? TeamViewer?

[Rich Hathaway]

No, I do not use teamviewer, the needed tools are on my pc's here not yours.
what you are wanting will require to load some modified firmware to it, so this cannot be done over network it would be mail-in service only, to do this type of load over network would take a couple of days.
I built this into my patched build for 6500 same as others in this thread have used to restore the openmep function/telnet on those devices.
This will also kill updates so you do not get screwed with the dreaded 12.xx update that kills modification of your device.

[mikecoz3]

@Rich Hathaway So what your saying is you've successfully connected to N41 N71 or N25 with the MR6500 modified on T-Mobile? If so can we see a video proof of concept?

[Rich Hathaway]

I do not have this device anymore but I did just do this for someone here in this forum, Ill ask if they can make one and post it

[Watson306]

@Rich Hathaway
Its on its way - the tracking says it will be here Saturday.
I obviously dont know what FW is on the box, but I think it will be locked to AT&T - so I am guessing that will be my first port of call.
I have unlocked phones before so I think I should have everything.
Will I need anything additional to a laptop, and usb cable?
Anything worth downloading to laptop in preperation?

@Rich Hathaway - Its arrived.
First things first - should I unlock it first, and how is it best to do it?

[Rich Hathaway]

check your firm version and to see if openmep and telnet are working or not

[Watson306]

I've managed to unlock it.
And when I was in a town that has just had a brand new 5G mast installed I was getting a 5G signal - albeit not 5G speeds.
But now I am at home I am just getting searching - so I now need to open up the bands.
If it helps I am on NTGX65_10.01.47.00

[Watson306]

I think Rich is pretty busy, and I dont want to harass him.
Does anyone else have any experience of opening up the bands on a MR6500?

Thanks in advance

[Rich Hathaway]

Your device should be set to slot one by default which is "ALL BANDS" you can get on the mobile app and see that, if it is you may not have service there, check to see if you get service at your house with other devices before you go modding it so you know you are not waisting your time.

[Watson306]

Thanks Rich.
There are two options in the mobile app - All, and LTE All. And its curretly set to all.
I have looked at the band my phone is connected to and it is band 8 - which obviously isnt a band set on the MR6500.

[Rich Hathaway]

band locking is simple, just add the band you want to any open slot, by default 3 through 9 are open for lte.
your problem is, your 6500 does not have/know bitmask for the band you want (8)
your 6500 should look like the below snip.
-----------------------------------------------------------------------------------------------
mr6500
AT!BAND=?
Index, Name, GW_Mask LTE_1-64 LTE_65-128 NSA_1-64 NSA_65-128 NSA_257-320 SA_1-64 SA_65-128 SA_257-320 Mode
00, All (4G+5G), 0000000000000000 0000A0003000285F 0000000000000002 0000000030002812 0000000000001002 0000000000000000 0000000000000000 0000000000000000 0000000000000000 1
01, 4G, 0000000000000000 0000A0003000285F 0000000000000002 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 1

0000800000000000 - LTE B48
0000200000000000 - LTE B46
0000000020000000 - LTE B30
0000000010000000 - LTE B29
0000000000002000 - LTE B14
0000000000000800 - LTE B12
0000000000000040 - LTE B7
0000000000000010 - LTE B5
0000000000000008 - LTE B4
0000000000000004 - LTE B3
0000000000000002 - LTE B2
0000000000000001 - LTE B1
0000000000000002 - LTE B66
0000000020000000 - NR5G N30
0000000010000000 - NR5G N29
0000000000002000 - NR5G N14
0000000000000800 - NR5G N12
0000000000000010 - NR5G N5
0000000000000002 - NR5G N2
0000000000001000 - NR5G N77
0000000000000002 - NR5G N66
0000000000000008 - NR5G N260

OK
--------------------------------------------------------------------------------------------------

as you can see there is no value for B8
the proper bitmask for it is

0000000000000080 - LTE B8

so to lock B8 on a device that understands it and put it on slot 3
AT!BAND=03,"LTE B8",0,80
or
AT!BAND=03,"LTE B8",0,0000000000000080

then simply use the mobile app to select it if your device's UI does not show it to you.

to add this bitmask to a device that is not pre-programmed to see it, it needs to be added in several places, at minimum the system, EFS, and the NV, and depending on your modem version prob need to replace the modem also.

it would be a lot easier if one of these variants had B8 by default then it could be either ported over to the 6500 or its firmware made loadable to the 6500
If I remember right I don't think any of these mr6xxx devices can see B8

@ Watson306 these questions belong in the forum where others can benefit from them and not in skype

[Watson306]

The MR6450 should be able to pick up band 8:

5G Technology Sub-6GHz
5G Bands 1/2/3/5/7/8/20/28/38/40/41/71/77/78
4G Technology LTE CAT20
4G Bands 1/2/3/4/5/7/8/12/13/14/20/28/38/40/41/42/66
3G Bands 1/2/5/8

So are you now saying it cant be added?

[Watson306]

Wheras what I need being on the o2 network is:

5G Technology Sub-6GHz
5G Bands 29/77/78
4G Technology LTE CAT20
4G Bands 1/3/8/20/29/40
3G Bands 8

Which looking at what the MR6500 has already I basically need to add:

5G Technology Sub-6GHz + mmWave
5G Bands 78
4G Technology LTE CAT20
4G Bands 8/20/40
3G Bands 8

[Rich Hathaway]

do you have this device (6450)?

[Watson306]

do you have this device (6450)?

No the MR6500

[Rich Hathaway]

well to attempt to make it work in this manor, one would be needed.

[Watson306]

What would we need from it? - I can see if I can get my hands on one somehow.

[Rich Hathaway]

It is a lot, you would prob need someone or me to do it for you, and please do not take that the wrong way, I do not mean to insult you.
I do not know you or your skill level, I am just assuming because you are asking what to do.
But it is entirely too much to try to tell/guide someone remotely through it

[Watson306]

No insult taken.
I have done a fair bit of flashing ROM's etc, but this does seem something a little different.
I am willing to learn, and I was looking forward to giving it a go to be honest.
So could you do it over a remote desktop connection or would you need to have it?
And if you'd need to have it, and I could borrow a MR6450 I assume you'd need that aswell?

[Rich Hathaway]

Yes unfortunately both devices would need to be local to me. It was easier back in the days when these devices were using yaffs2 filestructure, but now they all went to triple layer ubi's with ubi over ubifs over mtd, imo they even ran better using the old yaffs2 builds but they want security and to keep us out so .................

[Watson306]

Yes unfortunately both devices would need to be local to me. It was easier back in the days when these devices were using yaffs2 filestructure, but now they all went to triple layer ubi's with ubi over ubifs over mtd, imo they even ran better using the old yaffs2 builds but they want security and to keep us out so .................

I'm gonna probably struggle then to borrow one and send it off to you.
I'm assuming you're in the states?

[Watson306]

Another option - what equipment would I need to do it myself?
And if I could get whatever equipment I needed and you talk me through it maybe via something where I can share my screen?
We dont have to do it all in one go - its not as if I can use it right now anyway - I have a Netgear M1 which does the job - although i'd like to make use of it.
I would then pay you for your time in the same way if you did it for me?

[Rich Hathaway]

Another option - what equipment would I need to do it myself?
And if I could get whatever equipment I needed and you talk me through it maybe via something where I can share my screen?
We dont have to do it all in one go - its not as if I can use it right now anyway - I have a Netgear M1 which does the job - although i'd like to make use of it.
I would then pay you for your time in the same way if you did it for me?

working like this via screenshare never works because of many things.
Yes, I am in Kansas I briefly looked for one the other day but there are not really any of the European models around here.

[Watson306]

working like this via screenshare never works because of many things.
Yes, I am in Kansas I briefly looked for one the other day but there are not really any of the European models around here.

I'm not sure how we could make it work at the moment - i'm obviously in the UK.