Wireless Joint

Hi people of Wireless Joint,
I am Rich Hathaway.
I just made this account for one purpose which is to warn people here about some idiots that are scamming people that have been reading this and other threads about kernel patching to achieve a static value for time to live in their hotspots and other ...

HI your welcome
So many people scamming these days, beware of them.
Nice forum here, I will try to find some time to thumb thru some threads today.

Ok, I see that is a MTK device and not qualcomm, I wont be to much help with MediaTek, I mostly work with QC

@armysarge21
patching a kernel is not something that is a static operation, meaning its different on most every device and I would say a fairly complicated endeavor. I do not know where to tell you to read up on it maybe xda or some of the Russian forums I am not sure maybe google around, but its ...

Jailbreak it then install tetherme from the app store, there is a crack for that app that is free if you can find it, look in the big boss repo.

Bricked usually means dead, this modem is not dead if it is powered up and lights on, logged into the UI and have a look at the diagnostic page to see what info is there or better yet if it will give you a port demsg it and you will be able to see whats going on with it, I have full firmware for it ...

I am not familiar with that device but that usually means the apn is set to ip only you can try to run
AT+CGDCONT?
if your device excepts it you will see what its set to.
ip=ipv4
or ipv4v6 is obviously both
if it is set to ipv4v6 you are good there, most devices use pdp profile 1 or 3 for data so ...

@wherman
3G maxes out at about 3.3mbps so if you were getting 8mbps you were not using 3G.
I believe that is a MediaTek device so there are not alot of PST'S out there for those type of devices.
you should log in to t he devices admin panel, most are located at 192.168.1.1 or 192.168.0.1
if you ...

I can modify most hotspots and many router models and hard code new IMEI and FID also TTL kernel patching and modification on novatel, inseego, sierra/netgear, zte, alcatel and others, models such as 6620,7000/7730, 8000/8800/m2000/m2100/m3000/m3100/fw2000/fg2000/fx2000, usb800,usb730,usb620, any ...

Jayhawks659 wrote: Fri Aug 27, 2021 6:30 am is there any way to use a device to find out the TTL and HL number in your current location instead of just using trial and error?

Simply just connect to the device you are wanting to check and ping it, it will return your outgoing ttl

If its blank, its not connected to an active ssh session.Atleast I believe so

putty will not open its cli if it is not connected.

Type AT and press enter and you should see the black screen populate with OK if you are logged on, putty's settings are prob set to clear font, this happens by ...

@ michaeljcallahan
There is a much easier way to get root on these devices, you do not need to reload the firmware and go thru all of that,
just use the challenge response generator that is on the web and either unlock the MEP or use the openlock command/query and then change the advance command ...

Devices have a pre-determined timeout for specific runtime environments, so whether its written in your module or the containing device has it one of them does and you can adjust it on most platforms, below I just took from 8800L hotspot but will be similar in your software as well.
timeouts.PNG ...

Edge is a slower fallback service, think of it like fallback from LTE to 3g they just call it Edge for when solid service on the normal platform is very weak it will fallback to the next best service it can authenticate on.

So I finally got an M2000b (T-Mobile) device, I have been working on it and I must say it is a pain in the *ss to work on from
a developer standpoint.
I have managed to get Verizon (M2100) firmware loaded to the M2000b T-Mobile model, thus unlocking it and making
it a Verizon model, I will post a ...

That sierra module in it is qualcomm, so ipv6 is master controlled by the nv item 1896 or 0x0768 so set the first 2 bytes to 01 for enable ipv6 or 00 for disable. it cannot use ipv6 if that nv is set to 00, now if you set it to 00 you will not have data services if that apn is set to ipv6 so to ...

Awesome work Rich. Is it safe to assume you can flash an AT&T 5g phone imei to a M2100 to make it think it is a 5g phone.
Also does the M2100 flash to a M2000 still allow the M2000 to function with the original M2000 bands? (Ie band 71).
I'm thinking about a M2100 flashed to 5g phone imei for at&t ...

I don't know when this regression was introduced, but all hotspot features of Android 10.3.12 seem to rewrite the TTL of packets so you are out of luck tethering

It still works fine without the need for any router or vpn on visible os 10.x thru 11
Your phone is subject to the same rules as you ...

I am looking for recommendations for a router that can hide tethering from AT&T in the US. I have an unlimited account but tethering is limited to a certain amount of data per month. Here are my requirements:

1. That the router be able to hide tethering from AT&T.

2. That doing so is easy. This ...

Any luck on the info on how to change the TTL?

To do that on the M1 takes a bit of work, personally I use a kernel patch as it is permanent, that device has
a watchdog file and a factory backup file that will revert ttl rules upon every reboot so what works for other devices will not/does not ...

The MR5100 is an AT&T branded hog-spot and doesn't have all the T-Mobile bands. n41 is T-Mobile's fastest s 5G, n71 second fastest. The M5 has nether.

5G MiFi M5100 Cat 22
Sub-6GHz 5G: n2, n5, n66
mmWave 5G: n260
4G/LTE: 1, 2, 3, 4, 5, 7, 12, 14, 17, 29, 30, 46, 66
3G: UMTS 850/900/1900/2100 MHz ...

They block it after it catches their eye, you need to make it look like a phone using phone data and not a hotpot, specifically a M1, then it can run on the network undetected.

FID = Factory ID, it can be changed thru the raw filesystem.
You will also need to change the IMEI.
The rest is not any userland level process.
TTL for this model requires you to get read/write at the baseband level, then make and apply a kernel patch, before you ask, I cannot just tell you how to ...

check your ttl by pinging the mofi this will tell you the outgoing ttl, only worry about postrouting you need not worry about prerouting for ttl, you should set it on the device and not so much on the connected pc. I think the mofi's have a setting for it in their admin panel.
The IMEI you will have ...

That means you do not have it set up right, for visible you need to repair the IMEI, FID, MEID, pESN, TTL for v4 and v6 or your device/account will get flagged everytime.

This device is challenging to say the least, I have made some good progress on it, below are some screenshots with address's and a couple videos showing some of the progress.
Is anyone else working on this device? Post your findings if you are.

*Full Custom firmware
*Enable all ports- DIAGNOSTIC ...

Delete your cache, that may help.

you can get them by query the modem for them

does anyone know the coding to lock band2+ band66 +5G (including N260 mmwave "5G+")?

Just make a new slot for your config and use the mobile app to set your M5 to that slot and it will be locked to the bands you have in that slot.

m5 below
AT ...

You cannot touch the device in-between the time you query the challenge and the time you input the response or it will fail every time, so after you send the openlock query do not send another at cmd or do not unplug the device or repower it or touch the cli screen you are using or query will change ...

Just reading over this thread again I told you wrong, I did not realize you were using a live cd and not working with a full python library installed. So what you should do is run the help command and see if it returns the help info so you can know that you are calling it up correctly and it is ...

copy and paste the commands into the client you are using to send modem AT commands to either the modem port or the AT port if your device has an AT port.
Put your apn in-between them, so if you are using say vzw it would look like this
AT+CGDCONT=1,"IPV4V6","VZWINTERNET"
that command would set ...

I just want to make sure that on AT&T's end it just looks like I'm browsing directly on my "phone" all day and not hotspotting it

That has nothing to do with the apn, to keep them from seeing you are sharing data with other devices you need to adjust the time to live value not the apn, and then ...

@Ozark
you marked out the mac-id and the imei in your photo, but you left the barcodes, kind of defeats the purpose of marking them out don't you think.

Pretty much all devices have pinouts these days, they just are not labeled like the pic above, see the pic below, it is mifi 8800L

FID is factory ID it is an nv item in qualcomm devices,it resides here 60001 (0xEA61) also at 60111 (0xEACF)
Vendor ID is different from it

You can use most any driver for that stick, the correct class of course, and I meant windows, the first thing a guy should do is disable driver signing check and put your os into test mode, that will help to alleviate some of the driver issues. Windows 7 was a fantastic os for developers as far as ...

That does not work on this model I already tried it a long time ago.

Any device can update if on a carrier that supports the particular device and the device passes the carriers integrity check, and they can full update both sides of the device (OS2 and linux)
it depends on what the carrier is sending to that model at that time, having said that full updates are not ...

Why don't you use the old $5 a month data flash for vzw service? it had voice and text on it, I think it still works, have not tried it in a long time but the last time I did it still worked.

Hi man, I will answer your pm here.
I am surprised you dont know about this, I flashed and sold mifis with this for about 10 years, it kept my stores alive during hard retial times.
It is only a 3g product as there was no such thing as 4g way back then, so I am not sure if it will work for you since ...

I can help you with it.

Guys this is not my personal sales thread, if it turns into that this thread will likely be closed or removed, my contact info is on my profile page or on mifis.us
pls don't clutter this thread up with contact requests

Look in your device manager for the adb port with a yellow ! but you have to have the diagnostic mode enabled first or the device will not give the port, do you know if you have enabled diag mode on it yet?
The hdwr id for it is
adb
USB\VID_1410&PID_B023&REV_0318&MI_04
USB\VID_1410&PID_B023&MI_04

Some specifics would be good like which generator are you using, lock, cnd or mep
AT!OPENLOCK="54D5E3060C0A72D5"
AT!OPENCND="54D5E3060C0A72D5"
AT!OPENMEP="C4F9A0E0A3FADDF0"

AT!OPENLOCK="9986D27C2F53443B"
With AT commands, you will either get an OK or ERROR, if you get OK then whatever you were doing
is completed, error of course means it did not work for whatever reason, you don't need to do any AT!RESET for
completed commands sent to work, OK means your device ...

adb is available on this device and is very easy to use, telnet is closed but you can also get root access from the consol port but you will have to clear the root password to get in like I have here

root usb800.PNG

but there is no need to do all of that when adb is open and waiting for you with ...

So doing some work yesterday and came upon this ssid on this LVR1 5G-Home-router (VERIZON)
I have come across some funny ones in the past but truly at a loss for words on this one.
You would think big red would have an engineer/programmer code a simple script in that server that generates the ssid's ...

You do not have to load different firmware to manipulate the bands on this device, I won't go into it here but there is plenty on the web about band configuration and calculating the proper bitmasks for them for this model, all you need is putty or a command line to the modem to change them

ALL THE OLD BUILDS ON THIS DEVICE HAVE LOCKED OUT APN, THE NEWEST BUILD HAS IT UNLOCKED BUT THE PROBLEM
IS AFTER YOU FLASH YOUR DEVICE YOU WON'T GET THE NEW BUILD AND MAYBE NOT EVEN IF YOU DONT FLASH IT.
ANYWAY, I MADE AN APN UNLOCK TOOL YESTERDAY WHICH I AM GIVING TO THE COMMUNITY TO USE TO FIX ...

unfortunately it would be too expensive for me to mail it from where i am. any solutions to sudden shut downs " its running the latest firmware" ?

To know what to do to fix this one needs to know what the reason is that it is doing it. I would suggest to pull the logs and
have a look at them ...

Unfortunately, there is no leaked firmware for it or patched loader for SDX55 yet.
I can restore it, you can msg me about it if you wish.

You can send them to the modem port to re-enable telnet on port 5510

Thanks for the kind words, not sure how true they are though, lol.
for one, you need to quickly send the !boothold cmd and then send !QPSTDLOAD cmd in succession and quickly or they wont work, another way you can keep fdt from aborting for whatever reason it is, in your case the 82 code is modem not ...

Another question - if TMobile M2000 flashed to Verizon firmware - will it work with TMobile specific bands, like n71?

Yes, it can and only can use the same bands its hardware will allow it to see, I put them on the verizon and tmobile builds to work on the tmobile tab plans both work fine on ...

It is set in non-printables so to the naked eye it looks like this

apn throttle params1.PNG

You can view it as hex and see it

apn throttle params2.PNG

I did not see this thread anywhere so here it is, a general thread for the MR6400
Please add to this anything about this device you wish.

I just got to have a look at this device today (remotely) it is similar to the M5.
Here are the hardware id's for it

modem
USB\VID_0846&PID_68E2&REV_0504&MI_03 ...

MR6400 Partitions by name

mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 01680000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 ...

You can use the below command to set N66 only for slot 5
I don't think your mr5100 can see N60
AT!BAND=05,"5G_N66",0,0,0,0000000000000002,0,0

You don't have to have all the 0 in front of the 2 but it will load either way.
This is likely the same cmd dc is running

You should send your response back to it as soon as you get it and try not to wait, if you wait to return it to the device then just recalc the challenge first again and discard the first (the old) one.
you generated it correctly.

those 2 commands generate the same response but you still need to ...

So you understand, this tool does not network unlock the device, it only unlocks the apn so where it was greyed out before you can edit it now after you run it, some cases may need to be factory reset before the changes can take place(after you run my tool), but it does need a sim in it to be able ...

Try the M5 by itself and not hiding behind the mesh you have in place and see if it still does it if it doesn't then you know to look at whats in front of the m5, if it does then you know to look at the M5 and or the service, it would be super easy to write a script that would reboot it every so ...

If you are using FDT you do not need to send that AT command or do anything with putty at all, just simply remove the battery then hold power and plug the usb in and keep holding power about 8 seconds or until the device goes into Factory download mode then simply execute FDT, also it does not ...

your screen should be purple after loading the generic build and not blue anymore, sounds to me like it did not load or maybe got sent by fdt but did not unpack and install properly, or maybe did not pass the integrity check.

thank you for the info Rich Hathaway would swicwe work in converting Netgear Nighthawk Mobile router firmwares from CWE to SPK? and would it be safe to use this converted file to do manual updates?

You would have to just try it, but tell me why would you wish to do that there is no need, I mean ...

Do the factory reset and see if that changes it although I don't think those WebUI images are backed up but not for sure without looking, Its been a while since I fooled with an m1.
But those generic builds do not have ATT branding

Yes if you have firmware for it in the proper form

The FG cannot be done yet, I have one here and have been working on it some but for right now it is not able to be done.
Need to start a FG thread here, I see when I made this thread I typo'd and labeled it fg2000 it should have been FW, I will change it.

Yes you can load the backup from another device to it, it will take it.

no, comports are usbendpoints that allow interaction with certian parts of the device, those wwan fields that are greyed out have nothing to do with them.

IMEI, MEID, ESN, and FID repairs working now
TTL repair working
I have compiled a working system and modem firmware now.
working to make the other partitions now.

Version: chimay-insg-1.0

Screenshot from 2023-01-11 12-17-49.png

I have firmware for it, I did not make it, a friend put it together and I was asked by them not to make it public, custom firmware for this one will be difficult until an sdx55 loader can be patched successfully or the broken boot chain can be repaired that is caused by loading a binary file.

Unlocking is working now on this one.

here is a stock config from it, not convinced it will do what you want it to but here it is.

config.tar.gz

If you take this file please don't forget to hit thank you

In this case it needs to be re-loaded from emergency (9008) mode, this will recover it.

Hold power while you are plugging it in and keep holding power until your pc dings, about 5 seconds, you will need a patched loader and firmware other than a .spk
Send the loader then erase your device back to 0 then it can be loaded with this type of image (byte by byte) when finished your device ...

Search found 140 matches