TP-Link Archer MR200 v1

AC750 Wireless Dual Band Router with an integrated LTE 150Mbps modem (similar to TP-Link M7350 V1). Comes with 4 100Mbps ethernet ports, one can be used as WAN.

Generic Information about TFTP Installation >> generic.flashing.tftp |

This is the only way to upload custom firmware to this router, please note that while the process isn't hard, you are still advised to check if your files are properly downloaded as there is no going back. Recovery is possible by using a CH340a Programmer or a Raspberry Pi, SOIC8 connector/adapter is required, refer to Backing Up your Router for more information.

It is recommended to first update to the latest available version to make sure most bugs with the modem are fixed.

Connecting to Router's TFTP Server

• A computer with LAN port is required for this operation
• Set LAN IP configuration manually. Assign IP Address 192.168.0.66 to the computer, set Subnet Mask to 255.255.0.0, set DNS/Gateway to 192.168.1.1
• Install and Run a TFTP Client (Tftpd64/Tftpd32 for Windows is ideal), make sure you have set the directory where the custom firmware with the name of ArcherC2V1_tp_recovery.bin is located (Download required files from the Downloads section)
• Connect computer via LAN to the router while it is powered off, use any of the LAN ports, it is recommended to disconnect all other LAN devices before beginning.

Flashing OpenWrt

• Turn on the device while pushing the WPS button until the WPS indicator lights up. The router is now ready to accept the firmware via the TFTP client set up in the computer. Remember that the file name must exactly be the one mentioned above, since the router is looking specifically for it.
• The router now will flash the file to its chip from address 0x00000000, note that in case you are making your own custom firmware, the file start should be the TP-Link bootloader, process on how to make your own custom firmware is explained below.
• Wait until the router restarts and boots up, change the LAN settings in your computer to DHCP (automatically assign IP), and open 192.168.1.1 IP in your browser, you should see the LuCl Configuration Interface pop up, afterwards, continue the setup of the router using the guidance provided in the web interface.

Upgrading OpenWrt

• Download the latest available release for the router from the links above in this Wiki.
• Open the web console (192.168.1.1 by default)
• Navigate to Firmware Upgrade
• Select the downloaded file and flash

Downloads

• https://drive.google.com/open?id=0B9LBOwJy0I9lUHVmRHllV25UX2s - Prebuilt OpenWrt Firmware (compatible with both unlocked and locked routers), as well as Back to Stock firmware (use only on unlocked routers)

Note that if your router is carrier locked, you will need to use a carrier specific bootloader, more information available at Backing Up your Router section. Otherwise, download the official TP-Link Firmware from https://static.tp-link.com/Archer_MR200(EU)_V1_160905_1476936302791w.zip

Use of dd is required, it is included in Linux, Windows port available.

• Cut the TP-Link Header from the firmware by doing dd if=Firmware.bin of=Firmware_NoHeader.bin bs=512 skip=1
• Extract the bootloader from the no header firmware by doing dd bs=512 obs=512 skip=1 count=256 if=Firmware_NoHeader.bin of=MR200_Bootloader.bin
• Merge the bootloader and your custom firmware by doing cat MR200_Bootloader.bin Custom_Firmware.bin > ArcherC2V1_tp_recovery.bin for Linux, or copy /b MR200_Bootloader.bin + Custom_Firmware.bin ArcherC2V1_tp_recovery.bin for Windows. Note that the custom firmware must be a SysUpgrade compatible file

If your router is carrier locked, it is recommended to make a full dump of the chip of your router which includes the carrier specific bootloader, firmware, configuration, since carrier locked devices require their bootloader to run stock firmware (refer to Unbricking your Router section to learn how to connect to the chip and dumping its contents). However, it has been found that using another carrier's bootloader still works, here is a link to Orange FlyBox Firmware https://drive.google.com/file/d/1uy_lrfCKGLqT6nxSQMoik2_cDwA1OZNu

In case your router is carrier specific, you can unlock the 4G LTE Modem to use with other SIM Cards, note that this only unlocks the modem, you still need to use carrier specific bootloader.

Required Files

• OpenWRT build for Archer MR200 - https://drive.google.com/open?id=0B9LBOwJy0I9lUHVmRHllV25UX2s
• MR200 Unlocked Modem Firmware - https://xwtk.cloud/delivery/MR200_Modem.zip

Process

Refer to Backing Up your Router section to learn how to dump your chip, it is required in case you want to go back to stock.

• Flash OpenWrt firmware
• Connect via WiFi (that is important), and goto 192.168.225.1/login.html, that is the Modem Web Console.
• Goto Settings > Device > Firmware Upgrade
• Click Upgrade from Local Server, and choose MR200_Modem.zip and update, wait for the upload to goto 100%, then wait for about 3 minutes, after which, power cycle the router, and wait for it to boot.

You have successfully unlocked your modem. You can flash your stock firmware back if needed. Don't use MR200_Back_to_stock.bin provided in OpenWrt flashing guide, it will brick your router since it has the stock bootloader and firmware.

If your router is not carrier specific

• Download https://drive.google.com/file/d/0B9LBOwJy0I9lUHVmRHllV25UX2s MR200_Back_to_stock.bin
• Flash via OpenWrt Upgrade Interface

If your router is carrier specific

• Connect to the chip directly via SOIC8 adapter and a programmer (refer to Unbricking your Router section to learn how to connect)

The chip does not need to be de-soldered from the board. SOIC8 Adapter is required.

For Raspberry Pi

• Enable SPI communication by doing sudo raspi-config >> Advanced Options (Interfacing) >> SPI >> Enable
• Install Flashrom by doing apt-get install flashrom
• Run flashrom -p linux_spi:dev=/dev/spidev0.0 multiple times until chip model is recognized

For CH340a Programmer

• Connect using the numbered pads

First prepare the connections between the flash chip and the programmer or Raspberry Pi, refer to Connecting to Flash Chip for more information.

• Read chip contents by doing flashrom -p linux_spi:dev=/dev/spidev0.0 -r MR200_dump.bin
• Export your Router's configuration by doing dd if=MR200_dump.bin of=Configurations.bin bs=64k count=3 skip=125, the configuration file also includes your MAC Address

For non-carrier specific routers

• Download stock firmware from TP-Link by doing wget https://static.tp-link.com/Archer_MR200\(EU\)_V1_160905_1476936302791w.zip, afterwards rename it for convenicence mv Archer_MR200\(EU\)_V1_160905_1476936302791w.zip stock.zip
• Extract the file by doing unzip stock.zip, then rename the firmware for convenience by doing mv Archer\ MR200\(EU\)_V1_160905/Archer\ MR200v1_0.9.1_1.1_up_boot_v004a.0\ Build\ 160905\ Rel.60037n.bin stock.bin
• Afterwards, cleanup unneeded files by doing rm stock.zip
• Cut the header from the firmware by doing dd if=stock.bin of=stock_NoHeader.bin bs=512 skip=1
• Export boot + router firmware from the file by doing dd if=stock_NoHeader.bin of=stock_BootFW_nomodem.bin bs=64k count=125
• Merge boot + router firmware with your Router Configuration by doing cat BootFW_nomodem.bin Configurations.bin > Firmware.bin on Linux, or copy /b BootFW_nomodem.bin + Configurations.bin Firmware.bin for Windows

For carrier specific routers

• If you have dumped your chip already before, there is nothing you need to do in this stage. Otherwise, your only choice would be using another carrier's firmware, one is listed at the Backing Up your Router section, afterwards, follow For non-carrier specific routers guide from Step 2.

For Raspberry Pi

• Write the firmware to the chip by doing flashrom -p linux_spi:dev=/dev/spidev0.0 -w Firmware.bin

For CH340a Programmer

• Use a chip writing software, choose the file you made, make sure to enable Erase before Writing as well as Verify Write parameters

After finishing everything, disconnect the chip safely, assemble everything back and connect to power, wait for first boot to complete.

The included modem in this device is running Android OS and has a hidden (disabled in the stock firmware) web interface. At least in LEDE, the hidden web interface is re-activated again on each boot and can be used to setup the 3g/lte connection after switching to LEDE. Modem's web interface is available at http://192.168.225.1/login.html with the default username/password of admin/admin. If you need to connect to your router through wan or to do wan port forwarding, instead of relying on the LTE modem's internal DHCP server, the router's usb0 IP address must be manually set to 192.168.225.100 (and of course with the default gateway and possibly DNS address of 192.168.225.1).

Front:

Back:

Backside label:

This guide is a mix of research done from different posts, trials and errors. Rewritten/Improved by xwtk, on September 3, 2022. Thank you to everyone who has spent their time researching this device.