INSEEGO MIFI X 3000 PRO INFO & HACKING THREAD

[Rich Hathaway]

This is the new flagship portable hotspot/router device for inseego, its a very nice device imho.
I got one a few days ago and have been at it with this one since then, they made some changes from
the other similar devices they boast.
It has a 30 partitioned qualcomm chipped (SDX65) board with a similar setup to the m, fw, and fg models and is now on a read-only file-system that has adb running as $ (non-super user)upon adb startup, which is notable but not too big of a deal to get su access thru adb after that, as well as a few other snags one will run into when trying to make a firmware build for it.

It still has locked-out ports by default that are enabled by loading modded firmware to it.
(EDIT--NOW CAN BE ENABLED THRU THE HID PORT LIKE OTHER NOVATEL DEVICES)
Re-branding is the same as its predecessors as well as imei, ttl, and other popular mods.

also now ubi0 is a 5-volume block holding chachefs, persist, rfs, systemrw and usrfs parts.
The filesystem is getting rediculous in size (almost 800mb) just for that part, getting as bad as iphone lol.
below is some pertinent info for it


dev: size erasesize name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 00b00000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "xbl_ramdump"
mtd9: 00100000 00040000 "multi_image"
mtd10: 00100000 00040000 "multi_image_qti"
mtd11: 00100000 00040000 "aop"
mtd12: 00100000 00040000 "qhee"
mtd13: 00100000 00040000 "abl"
mtd14: 00280000 00040000 "uefi"
mtd15: 00180000 00040000 "toolsfv"
mtd16: 00180000 00040000 "loader_sti"
mtd17: 01300000 00040000 "boot"
mtd18: 00100000 00040000 "scrub"
mtd19: 00100000 00040000 "logfs"
mtd20: 06b40000 00040000 "modem"
mtd21: 001c0000 00040000 "misc"
mtd22: 00180000 00040000 "devinfo"
mtd23: 024c0000 00040000 "recovery"
mtd24: 001c0000 00040000 "fotacookie"
mtd25: 03000000 00040000 "recoveryfs"
mtd26: 00100000 00040000 "sec"
mtd27: 00100000 00040000 "ipa_fw"
mtd28: 00100000 00040000 "usb_qti"
mtd29: 30140000 00040000 "system"


and here is compiled firmware

my m3000 firm.PNG

I need to find an efs dump from another device if someone else has one and does not mind helping out, pls msg me here or anywhere, I am not hard to find.

Please feel free to add to this thread any info you find about this device

CD95812D-3397-4F2E-8BE0-0A287B4ECB9C.jpg

[kmprwireless]

Any chance you got that efs dump? I’m hoping to get a .qcn backup to get mind fixed.

Thanks!

[Rich Hathaway]

Yes but I do not use qpst so it is not in format of qcn

[kmprwireless]

Would you be willing to share it with me? I’ll gladly take whatever you’ve got.