Inseego M2000 5G hotspot

[Didneywhorl]

Does anyone have any information for cracking into the Inseego M2000 5G Hotspot?

I want to poke around in the file system.

[Didneywhorl]

Quote to tag Rich:

Have you done any of these?

[Rich Hathaway]

No, I have done m1000 and m2100 but no one has sent me a m2000 yet to play with.

[Didneywhorl]

No, I have done m1000 and m2100 but no one has sent me a m2000 yet to play with.

I can send you this one, but I'm using its SIM and IMEI and using it for tests.

[Rich Hathaway]

will tell you here
1 is your device may get borked, it is likely I will have to direct connect to the chipset and if there are any problems before a recovery file is made, if one can be made for it it will not be recoverable until one is/can be made for it from another working device.
2 is many tmobile devices are secure boot enabled devices and/or are efuzed which makes trying to get into it risky, and an exploit will need to be found to get around it first.
3 is what is your goal, imei, fid & ttl?
if you still want to send it for research and dev. lmk and I will get you the addy to ship to.

I do not need the sim and the imei will have to be repaired for it to work like you want it to anyway so it is yours and will no longer be used on this device.

[Didneywhorl]

Honestly Id like to just get a copy of the system files and see how it runs its firewall and NAT, and see how its scripts handle the modem. I just want the files from the system to poke through.

[Rich Hathaway]

That is to much work to do and give away friend, I worked on the verizon variant for 2 months before I was able to make any notable progress on it.
Tmobile is known for being locked down and I would expect it to be more difficult, I am sure the firmware will be crypted on that one, if I ever get one I will report if it is or not back to this thread.

It doesn't sound like you need the system file/partition, for what you are wanting to look at will prob be in the nwconfig file or if you are able to enable the adb port you can maybe read, (I am sure not write) but start by reading the iptables and ip6tables
normally iptables in these devices do not have any modules loaded to make any ttl adjustments such as mangle and others, so you have to patch them to not decrement instead and then hard code your static value for time to live if it is different from the default value, that is what I assume you are trying to do.
Firewall and nat will be set to persistent and backed up by 2 different files located at
(/factory_backup & /safe/watchdog) and if you can change them they will not stick without some patching first.
dumping firmware(the system partition) and decrypting is much more difficult on a secure boot enabled device.
hope that helps you.
these devices were alot easier to mod before inseego bought nvtl

[Rich Hathaway]

So I finally got an M2000b (T-Mobile) device, I have been working on it and I must say it is a pain in the *ss to work on from
a developer standpoint.
I have managed to get Verizon (M2100) firmware loaded to the M2000b T-Mobile model, thus unlocking it and making
it a Verizon model, I will post a video of it running it below.
It seems to run better on T-Mobile with Verizon firmware after adjusting it back to T-Mobile's settings, I had to drive into town to test it as there is no T-Mobile service here at my home, so it did not get tested very well I only streamed some 4k video to test my patch and ran some speedtests and opened a few webpages, I am sure it still needs work but looks promising now.
I am not blurring out the imei as I have already changed it anyway, but I am sure someone will steal the qr code lol.
@ Didneywhorl Give me an address and I will send you the filesystem for it if you wish to look
https://youtu.be/9uhGBz-oZb8

[Braxx]

I have managed to get Verizon (M2100) firmware loaded to the M2000b T-Mobile model, thus unlocking it and making
it a Verizon model, I will post a video of it running it below.
It seems to run better on T-Mobile with Verizon firmware after adjusting it back to T-Mobile's settings.

Awesome work Rich. Is it safe to assume you can flash an AT&T 5g phone imei to a M2100 to make it think it is a 5g phone.
Also does the M2100 flash to a M2000 still allow the M2000 to function with the original M2000 bands? (Ie band 71).
I'm thinking about a M2100 flashed to 5g phone imei for at&t and a m2000 flashed to Calyx/pcforpeople that uses Sprint and Tmo bands.

[Rich Hathaway]

Awesome work Rich. Is it safe to assume you can flash an AT&T 5g phone imei to a M2100 to make it think it is a 5g phone.
Also does the M2100 flash to a M2000 still allow the M2000 to function with the original M2000 bands? (Ie band 71).
I'm thinking about a M2100 flashed to 5g phone imei for at&t and a m2000 flashed to Calyx/pcforpeople that uses Sprint and Tmo bands.

For the IMEI,
That would only make AT&T think you are scamming the network as they would still be able to see the data jumping from your hotspot to whatever its jumping to, so it would need to get the root pass, change it so then we can have a kernel patch applied that would allow it to have a static TTL value and not decrement anymore no matter how many times the data is jumping. It would also need the FID changed or zerod.
Then it would be safe to use on the network and stay under the radar so to speak.

Many say AT&T does not look at time to live, but it is a fact that they do
that is why so many of the ipad plans were terminated, I still have all of mine up and running fine because I protected them by patching them first, while most others around me lost all of theirs.

I am not excepting any jobs on this model yet besides recovery or just loading Verizon firm on the tmobile model.
This one needs to be tested more first so we are not just loading things and later having issues on these expensive devices.
Also this is not my personal sales thread, this forum does not like that, questions and help are fine here, but business must be conducted away from the forum

[Rich Hathaway]

This device is challenging to say the least, I have made some good progress on it, below are some screenshots with address's and a couple videos showing some of the progress.
Is anyone else working on this device? Post your findings if you are.

*Full Custom firmware
*Enable all ports- DIAGNOSTIC, MODEM, ADB, HID, RNDIS
*Full rebranding
*Manipulate Carrier AG
*Hard code IMEI, FID, MEID, pESN
*Patch Kernel for a static TTL value
*Enable all hidden menu items in web ui
*Unlock sim card
*Enable custom PRI upload function
*Enable Inseego connect function
*Enable full diagnostic menu and logs (IMEI, MEID, ESN, UMTS, 3G, LTE, 5G, 5GUWB)


https://youtu.be/mOnnkyoAXEY


https://www.youtube.com/watch?v=EJen8PkIME8&t=2s

I am leaving the paths/address's for these items so you can see them if you want to find them in the device.

carrier lock.PNG

carrier ag.PNG

carier ag2.PNG

webui debug.PNG

pri.PNG

internet session.PNG

inseego connect.PNG

[JG423]

I watched your video and it's the same SSID as my custom firmware I made almost a year ago.


I know where you got the debug FW from, you shouldn't try to take credit for work you didn't do but that's neither here or there.

2100 wifi.JPG

imei 2100.JPG

[Rich Hathaway]

You should be more careful before you try to flame and accuse someone publicly of theft or whatever you are trying to accuse me of here, I assure you I have made about 50 builds for this device, all boot logos and firmware mods were made by me I do not have any partner or other person I work with.
I have all factory firms for this model and I also have the debug file someone sent me that does not/did not work, but my files I made do work and enables all ports just as you see in the video, if you have the debug file then you know it does not work for any of that, I am not taking any credit for making a debug file that doesn't work lol.
Instead I will take credit for the ubi images I made that 100% work as advertised just like I made them to.
Try to be nice we are all on the same team.
Also if you know who sent me that broken debug file ask them because I fixed it for them and sent it back to them with all ports enabled and all menu Items enabled just like in post, whoever made that file to begin with obviously could not or did not know how to do, it should not have been named debug because it did nothing to enable any debugging anything on it my friend.

[Didneywhorl]

I'm going to lock this and clean it up if this further turns into anything other than an informational and helpful topic for our readers.

[Grandmstrbud1]

First off I'm not sure why I had to register twice and then in the FAQ it says to contact an admin if your having issues but yet there is no contact us anywhere unless my eyes are going bad.

Anyway, I was curious if on this device from T-Mobile if you can change the IMEI like you can on the Franklin T9? I don't like how TMobile just blocks this from working when I put in one of my voice sim cards. Yes I can use my phone hotspot but when camping this would come in handy if I could pop a spare sim card that has the magenta max with 40GB of hotspot data.

[mctwireless]

How would I get the copy of this firmware?

[bidet5g]

Also echoing a strong desire for the ability to flash the M2000B with M2100 firmware since I have been going round and round with T-Mobile techs for a month on the unlocking issue. Some on their team say that this device was NEVER designed to be unlocked (which I interpret as they disabled that ability in the T-Mobile firmware) and the others on the are convinced that it is "sold unlocked" and that my inability to use a 3rd party SIM is user error. The ability to unlock the device would be incredibly helpful since I've given up on any resolution from T-Mobile directly...

[Rich Hathaway]

The tmo firm is not unlocked, if it were the apn would change and you would get service when you put in a verizon sim card which does not happen.
I can load vzw firm on it for you that will unlock it. there is no public version of the firmware or leak of it that I have seen.
I have Verizon, T-Mobile, AT&T, Bell, generic, and some custom builds made up for that one.

[rico67tx]

I paid online for a person who said they could t flash my TMO 2000 to verizon FW and he failed. Seems you figured it out. Do you sell your FW and instructions? Do you know if TMO throttles the FW TTL settings as well?

[Rich Hathaway]

Sorry to hear that, does your device not boot up now?
Either way I can load/repair it for you.

[GrandMstrBud]

How would I go about flashing the Verizon firmware to a T-Mobile M2000? I purchased it on Amazon but TMobile says they can't unlock it because it's not their device and Sprint won't because I don't have the account information. I'd love for it to work similar to the Franklin T9 so I could use the 40GB of hotspot on this device. I believe that you could change the IMEI.

[Rich Hathaway]

I can help you with it.

[GrandMstrBud]

Can you message me?

[keesak]

I can help you with it.

Hi, could you please message me to help do this?

[nestali67]

who can i load this firmware to my hotspot

[guest00x]

I can help you with it.

Can you PM me regard flash m2000b and pricing?

[backspac3]

I can help you with it.

I would like to discuss in private.
Thank you

[Rich Hathaway]

Guys this is not my personal sales thread, if it turns into that this thread will likely be closed or removed, my contact info is on my profile page or on mifis.us
pls don't clutter this thread up with contact requests

[CardinS2U]

I just found this topic. I would like help to flash my T-Mobile M2000 to the Verizon Variant. I’m willing to pay for it. How can I reach you?

[GrandMstrBud]

Seems to work good with a M2000 flashed to Verizon however TMO firmware has some issues.

[blackjmyntrn]

oh, I can't wait! thank you, sir!

[Didneywhorl]

Completely and totally off topic posts were removed. This is not a forum for complaints between two private parties.

If I see one single comment about the topic that was deleted I will ban that person. If I find out improper private messages are happening, I'm banning the offender(s).

Topic locked