INSEEGO MIFI X 3000 PRO INFO & HACKING THREAD

Topics related to Inseego routers and hotspots
Post Reply
User avatar
Rich Hathaway
Posts: 542
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 8 times
Been thanked: 186 times

INSEEGO MIFI X 3000 PRO INFO & HACKING THREAD

Post by Rich Hathaway »

This is the new flagship portable hotspot/router device for inseego, its a very nice device imho.
I got one a few days ago and have been at it with this one since then, they made some changes from
the other similar devices they boast.
It has a 30 partitioned qualcomm chipped (SDX65) board with a similar setup to the m, fw, and fg models and is now on a read-only file-system that has adb running as $ (non-super user)upon adb startup, which is notable but not too big of a deal to get su access thru adb after that, as well as a few other snags one will run into when trying to make a firmware build for it.

It still has locked-out ports by default that are enabled by loading modded firmware to it.
(EDIT--NOW CAN BE ENABLED THRU THE HID PORT LIKE OTHER NOVATEL DEVICES)
Re-branding is the same as its predecessors as well as imei, ttl, and other popular mods.

also now ubi0 is a 5-volume block holding chachefs, persist, rfs, systemrw and usrfs parts.
The filesystem is getting rediculous in size (almost 800mb) just for that part, getting as bad as iphone lol.
below is some pertinent info for it


dev: size erasesize name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 00b00000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "xbl_ramdump"
mtd9: 00100000 00040000 "multi_image"
mtd10: 00100000 00040000 "multi_image_qti"
mtd11: 00100000 00040000 "aop"
mtd12: 00100000 00040000 "qhee"
mtd13: 00100000 00040000 "abl"
mtd14: 00280000 00040000 "uefi"
mtd15: 00180000 00040000 "toolsfv"
mtd16: 00180000 00040000 "loader_sti"
mtd17: 01300000 00040000 "boot"
mtd18: 00100000 00040000 "scrub"
mtd19: 00100000 00040000 "logfs"
mtd20: 06b40000 00040000 "modem"
mtd21: 001c0000 00040000 "misc"
mtd22: 00180000 00040000 "devinfo"
mtd23: 024c0000 00040000 "recovery"
mtd24: 001c0000 00040000 "fotacookie"
mtd25: 03000000 00040000 "recoveryfs"
mtd26: 00100000 00040000 "sec"
mtd27: 00100000 00040000 "ipa_fw"
mtd28: 00100000 00040000 "usb_qti"
mtd29: 30140000 00040000 "system"


and here is compiled firmware
my m3000 firm.PNG
I need to find an efs dump from another device if someone else has one and does not mind helping out, pls msg me here or anywhere, I am not hard to find.

Please feel free to add to this thread any info you find about this device
CD95812D-3397-4F2E-8BE0-0A287B4ECB9C.jpg
You do not have the required permissions to view the files attached to this post.
kmprwireless
Posts: 5
Joined: Tue Oct 24, 2023 4:37 am
Has thanked: 3 times
Been thanked: 0

Re: INSEEGO MIFI X 3000 PRO INFO & HACKING THREAD

Post by kmprwireless »

Any chance you got that efs dump? I’m hoping to get a .qcn backup to get mind fixed.

Thanks!
User avatar
Rich Hathaway
Posts: 542
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 8 times
Been thanked: 186 times

Re: INSEEGO MIFI X 3000 PRO INFO & HACKING THREAD

Post by Rich Hathaway »

Yes but I do not use qpst so it is not in format of qcn
kmprwireless
Posts: 5
Joined: Tue Oct 24, 2023 4:37 am
Has thanked: 3 times
Been thanked: 0

Re: INSEEGO MIFI X 3000 PRO INFO & HACKING THREAD

Post by kmprwireless »

Would you be willing to share it with me? I’ll gladly take whatever you’ve got.
kmprwireless
Posts: 5
Joined: Tue Oct 24, 2023 4:37 am
Has thanked: 3 times
Been thanked: 0

Re: INSEEGO MIFI X 3000 PRO INFO & HACKING THREAD

Post by kmprwireless »

Rich Hathaway wrote: Tue Oct 24, 2023 10:39 am Yes but I do not use qpst so it is not in format of qcn
Any chance you’re willing to share what you’ve got? Still have an unusable device here without the efs data 😣
User avatar
Rich Hathaway
Posts: 542
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 8 times
Been thanked: 186 times

Re: INSEEGO MIFI X 3000 PRO INFO & HACKING THREAD

Post by Rich Hathaway »

you erased the efs or?
kmprwireless
Posts: 5
Joined: Tue Oct 24, 2023 4:37 am
Has thanked: 3 times
Been thanked: 0

Re: INSEEGO MIFI X 3000 PRO INFO & HACKING THREAD

Post by kmprwireless »

Rich Hathaway wrote: Fri Dec 22, 2023 4:53 pm you erased the efs or?
A silly move on my part in desperation to get ftm access, yes. was hoping a persist partition might save me but no dice.
User avatar
Rich Hathaway
Posts: 542
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 8 times
Been thanked: 186 times

Re: INSEEGO MIFI X 3000 PRO INFO & HACKING THREAD

Post by Rich Hathaway »

OK so if you did that it automatically erases the nv also and borks the factory backup part, so just loading the efs will not fix it and if you do get it fixed and do not fix the backup if you use the reset button or function from the menu then you will go back to bootloop.
I can recover it for you if you need it
kmprwireless
Posts: 5
Joined: Tue Oct 24, 2023 4:37 am
Has thanked: 3 times
Been thanked: 0

Re: INSEEGO MIFI X 3000 PRO INFO & HACKING THREAD

Post by kmprwireless »

Rich Hathaway wrote: Mon Dec 25, 2023 9:16 am OK so if you did that it automatically erases the nv also and borks the factory backup part, so just loading the efs will not fix it and if you do get it fixed and do not fix the backup if you use the reset button or function from the menu then you will go back to bootloop.
I can recover it for you if you need it
PM’d you, Rich. Thank you!
GrandMstrBud
Posts: 4
Joined: Wed Mar 16, 2022 10:18 pm
Has thanked: 0
Been thanked: 0

Re: INSEEGO MIFI X 3000 PRO INFO & HACKING THREAD

Post by GrandMstrBud »

Is there any guides in how to do this so I can load this firmware?
User avatar
Rich Hathaway
Posts: 542
Joined: Mon Mar 08, 2021 2:41 pm
Has thanked: 8 times
Been thanked: 186 times

Re: INSEEGO MIFI X 3000 PRO INFO & HACKING THREAD

Post by Rich Hathaway »

This firmware is not public or posted anywhere.
Post Reply

Return to “Inseego”