Inseego mifi x 3000/3100 pro info & hacking thread

[rich hathaway]

INSEEGO MIFI X 3000 PRO INFO & HACKING THREAD
Post by Rich Hathaway » Sat Mar 18, 2023 5:12 pm

This is the new flagship portable hotspot/router device for inseego, its a very nice device imho.
I got one a few days ago and have been at it with this one since then, they made some changes from
the other similar devices they boast.
It has a 30 partitioned qualcomm chipped (SDX65) board with a similar setup to the m, fw, and fg models and is now on a read-only file-system that has adb running as $ (non-super user)upon adb startup, which is notable but not too big of a deal to get su access thru adb after that, as well as a few other snags one will run into when trying to make a firmware build for it.

It still has locked-out ports by default that are enabled by loading modded firmware to it.
Re-branding is the same as its predecessors as well as imei, ttl, and other popular mods.

also now ubi0 is a 5-volume block holding chachefs, persist, rfs, systemrw and usrfs parts.
The filesystem is getting rediculous in size (almost 800mb) just for that part, getting as bad as iphone lol.
below is some pertinent info for it


dev: size erasesize name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 00b00000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "xbl_ramdump"
mtd9: 00100000 00040000 "multi_image"
mtd10: 00100000 00040000 "multi_image_qti"
mtd11: 00100000 00040000 "aop"
mtd12: 00100000 00040000 "qhee"
mtd13: 00100000 00040000 "abl"
mtd14: 00280000 00040000 "uefi"
mtd15: 00180000 00040000 "toolsfv"
mtd16: 00180000 00040000 "loader_sti"
mtd17: 01300000 00040000 "boot"
mtd18: 00100000 00040000 "scrub"
mtd19: 00100000 00040000 "logfs"
mtd20: 06b40000 00040000 "modem"
mtd21: 001c0000 00040000 "misc"
mtd22: 00180000 00040000 "devinfo"
mtd23: 024c0000 00040000 "recovery"
mtd24: 001c0000 00040000 "fotacookie"
mtd25: 03000000 00040000 "recoveryfs"
mtd26: 00100000 00040000 "sec"
mtd27: 00100000 00040000 "ipa_fw"
mtd28: 00100000 00040000 "usb_qti"
mtd29: 30140000 00040000 "system"


and here is compiled firmware
[Only registered and activated users can see links] ([Only registered and activated users can see links])





Please feel free to add to this thread any info you find about this device



[Only registered and activated users can see links] ([Only registered and activated users can see links])

[rich hathaway]

The M3100 is the same layout as far as partitions and such.
I have successfully loaded M3100 firmware onto the M3000 and vise-versa

[Revskills]

here is qcn backup from inseego m3000a
[Only registered and activated users can see links]

[rich hathaway]

Thanks man, I have yet to even see a m3000a variant or the d also.

[Revskills]

soon, i will upload the all section (MTD) in raw format and raw+oob format .i collected the all required parameter's for build system image through dmesg .

[vhchlorine]

soon, i will upload the all section (MTD) in raw format and raw+oob format .i collected the all required parameter's for build system image through dmesg .
Have you finished it yet, I've been waiting for this for a long time.

[rich hathaway]

A long time lol its a new device :)

[rich hathaway]

Finally got diagnostic mode tool working for the new devices crypted hid port


[Only registered and activated users can see links]

[usfox88]

This is really difficult. Can you share the firmware?
I've been unable to find the corresponding firmware for the M3100.
Thank you very much!