INSEEGO MIFI X 3000 PRO INFO & HACKING THREAD

[Rich Hathaway]

This is the new flagship portable hotspot/router device for inseego, its a very nice device imho.
I got one a few days ago and have been at it with this one since then, they made some changes from
the other similar devices they boast.
It has a 30 partitioned qualcomm chipped (SDX65) board with a similar setup to the m, fw, and fg models and is now on a read-only file-system that has adb running as $ (non-super user)upon adb startup, which is notable but not too big of a deal to get su access thru adb after that, as well as a few other snags one will run into when trying to make a firmware build for it.

It still has locked-out ports by default that are enabled by loading modded firmware to it.
(EDIT--NOW CAN BE ENABLED THRU THE HID PORT LIKE OTHER NOVATEL DEVICES)
Re-branding is the same as its predecessors as well as imei, ttl, and other popular mods.

also now ubi0 is a 5-volume block holding chachefs, persist, rfs, systemrw and usrfs parts.
The filesystem is getting rediculous in size (almost 800mb) just for that part, getting as bad as iphone lol.
below is some pertinent info for it


dev: size erasesize name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 00b00000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "xbl_ramdump"
mtd9: 00100000 00040000 "multi_image"
mtd10: 00100000 00040000 "multi_image_qti"
mtd11: 00100000 00040000 "aop"
mtd12: 00100000 00040000 "qhee"
mtd13: 00100000 00040000 "abl"
mtd14: 00280000 00040000 "uefi"
mtd15: 00180000 00040000 "toolsfv"
mtd16: 00180000 00040000 "loader_sti"
mtd17: 01300000 00040000 "boot"
mtd18: 00100000 00040000 "scrub"
mtd19: 00100000 00040000 "logfs"
mtd20: 06b40000 00040000 "modem"
mtd21: 001c0000 00040000 "misc"
mtd22: 00180000 00040000 "devinfo"
mtd23: 024c0000 00040000 "recovery"
mtd24: 001c0000 00040000 "fotacookie"
mtd25: 03000000 00040000 "recoveryfs"
mtd26: 00100000 00040000 "sec"
mtd27: 00100000 00040000 "ipa_fw"
mtd28: 00100000 00040000 "usb_qti"
mtd29: 30140000 00040000 "system"


and here is compiled firmware

my m3000 firm.PNG

I need to find an efs dump from another device if someone else has one and does not mind helping out, pls msg me here or anywhere, I am not hard to find.

Please feel free to add to this thread any info you find about this device

CD95812D-3397-4F2E-8BE0-0A287B4ECB9C.jpg

[kmprwireless]

Any chance you got that efs dump? I’m hoping to get a .qcn backup to get mind fixed.

Thanks!

[Rich Hathaway]

Yes but I do not use qpst so it is not in format of qcn

[kmprwireless]

Would you be willing to share it with me? I’ll gladly take whatever you’ve got.

[kmprwireless]

Yes but I do not use qpst so it is not in format of qcn

Any chance you’re willing to share what you’ve got? Still have an unusable device here without the efs data

[Rich Hathaway]

you erased the efs or?

[kmprwireless]

you erased the efs or?

A silly move on my part in desperation to get ftm access, yes. was hoping a persist partition might save me but no dice.

[Rich Hathaway]

OK so if you did that it automatically erases the nv also and borks the factory backup part, so just loading the efs will not fix it and if you do get it fixed and do not fix the backup if you use the reset button or function from the menu then you will go back to bootloop.
I can recover it for you if you need it

[kmprwireless]

OK so if you did that it automatically erases the nv also and borks the factory backup part, so just loading the efs will not fix it and if you do get it fixed and do not fix the backup if you use the reset button or function from the menu then you will go back to bootloop.
I can recover it for you if you need it

PM’d you, Rich. Thank you!

[GrandMstrBud]

Is there any guides in how to do this so I can load this firmware?

[Rich Hathaway]

This firmware is not public or posted anywhere.

[jamille81]

Hi Rich,

I'm new to the forum so can't send PM's. Can you please contact me on how to flash your custom firmware?

Thanks

[andrewg87]

I would love to be able to use my m3000 on the T-Mobile tablet plan no cap! Thank you for the instructions! If you are still giving out the tool, I'd love to use it!

[WJUser]

Hey Guys... I've got an M3000 that's stuck in a boot loop. I'm currently out in the middle of nowhere, and only have an M1 Mac with me.
I can get the M3000 into fastboot, but the Mac doesn't see it as a USB device and I don't have any of my serial adapters with me.

Anyone know of any process that forces the factory backup part to do it's thing or have any other ideas to get into it with what I got?

Oh, and I just remembered I have a Raspberry Pi with me, so could possibly get a serial connection going with that.

Thanks for any ideas!

M

[Rich Hathaway]

The factory backup in these inseego devices is not a snapshot of your firmware, it is a file with about 30 or so .dat files amounting to a total of about 80 kilobytes it is nv and efs items is all and cannot reload or restore your firmware.
below is the decompiled factory backup of the m3000

factory backup.PNG

The firmware looks more like this

m3000firmware.PNG

To reload it you will need a windows pc and the firmware.
tell me how do you know or why do you think it needs firmware reloaded, do you know what happened to it
that it is in a loop now?

[WJUser]

Hey Rich - thanks for the reply.

It's just a guess about the firmware.
I was messing around with attaching antennas to the internal connections and while trying to figure out how to hold the battery in without the case on something happened and it went into the boot loop.

I haven't messed with routers for a while. Is this a FTDI thing or straight USB?
I've got a Windows VM here that I've had decent luck with.

I'm getting close to the point that spending any more time on this isn't worth the replacement cost of it. But, I wouldn't mind messing with custom firmware for it in later days, when I have more time.

Thanks again for your help,
M

[Rich Hathaway]

I haven't messed with routers for a while. Is this a FTDI thing or straight USB?

USB

[inimachi]

Hi Rich, did you providing custom menu,band lock, tower lock, VPN (OpenVPN/WIreGuard/Xlite) & magic modem (TTL & IMEI changed) services?

[Rich Hathaway]

I can do custom menus for it, band lock yes,tower lock no I am not sure it can be done on the device, vpn can be done already by the user and ttl and imei yes I can do that.

[drake90001]

Hi Rich,

Looking for this as well. I need IMEI and TTL Spoofing for hotspot bypassing.

Please let me know if thats okay.