yashsingh1/xdaforums huggingface dataset:
[Upgrading, Modifying and Unlocking] sydikm:
yes i have try via qcom 9008 method (for 9008 u need testpoint that i have already have ) for flash 9008 u need friehore xml
[Upgrading, Modifying and Unlocking] gshanbhag525:
Firmware from online claiming to unlock jiofi 2

Hi...

I was going through some online tutorial about unlocking the jiofi 2 and that guy posted this firmware to unlock it.

It's a bin file .

I tried to open it and it had different APN no. Codes of all the carriers Vodafone Airtel etc.

Try to open this in word.

Here is the Google drive link

https://drive.google.com/file/d/0BwDmVsTUJYJ2ZFB4OFk1ZUYxdTQ/view?usp=drivesdk
[Upgrading, Modifying and Unlocking] deve678:
Look This

Look this Image

http*s://drive*.google.*com/*open?id=1Dw*VqQ*JIE-F*EY1Yxs4*pR1fMy*t6KiaX*SD*i

---------- Post added at 10:41 AM ---------- Previous post was at 10:40 AM ----------

Remove The * in the link
[Upgrading, Modifying and Unlocking] dipraj:
could you tell me how to put m2s or m2 in 9008 mode ?

I want to change it's NV items, I want to lock it on band 40, which I already did on my oneplus one, if you press power button + wps it open fast boot mode.
[Upgrading, Modifying and Unlocking] Yogi_k:
How To Unlock Jiofi 6 jmr815 ?

how to unlock jiofi for other sim support pls forward link of firmware update that device.
[Upgrading, Modifying and Unlocking] ankitkumarbh:
Please Add latest version of M2S Firmware

Firmware Version	PEG_M2S_B08
[Upgrading, Modifying and Unlocking] thedeamon:
http://www.pegasus-mobile.com/token_en.html
[Upgrading, Modifying and Unlocking] Vismay G S:
little something i figured out

I think if we sign successfully login to https : // macs . oss . jio . com : 8443 / ftacs -d igest/ ACS we might be able to enter engineer mode.

The real problem is that the login process goes through internet.

I used google and searched the above url and i came across a page: idm . jio connect . com

i think only an account holder from the above link can access the engineer mode. the problem is the above link account holders are either jio store executive or a technician or a jio partner.

thats why in the firmware there is no user name and password is **

by the way my device jiofi jmr 540
[Upgrading, Modifying and Unlocking] deve678:
Then can't we redirect the request to a local page and sent a fake authorisation key to jiofi. It think it can be done.
[Upgrading, Modifying and Unlocking] BhejaDry:
Hi everyone,

I am not a hacker but just happened to luckily find something useful which could be far more simple to crack with more knowledge than I possess. Here's what I have done. Refer me as the MadMan

1) Connect to the Jiofi dongle using wifi

2) Open jiofi.local.html/index.html in a browser

3) Login with username/password

4) You are not allowed to right click on any of the page but

5) If you are using Chrome browser, open the Developers toolbar given in the browser

6) Inspect the HTML page in developers toolbar.

7) You will see many fields which have display: none on them, which you have to either remove or turn them into display: block. You need very simple debugging skills to do that.

Since most of you are coders, I am sure this will be helpful. Look for Wifi Settings, Internet Protocol etc.

All the best.

I do not have any further knowledge than this. But the end result of my Jiofi dongle is it no longer detects the jio sim card even after reset.

Please do this at your own risk and help yourselves. Let me know if that works.
[Upgrading, Modifying and Unlocking] shammymz601:
any one found the stock firmware for jiofi m2 device

Hey guys,

looked into the jiofi 520 bin file provided via binwalk.

there is this ACS provided by friendly tech hosted on jio

did any one notice that the pasw.htaccess file in the bin file.

seems the user name and authtoken are embedded there.

also if someone has linux machine try easycwmp client with jiofi as the hotspot and try to create the ACS (https://macs.oss.jio.com:8443/ftacs-digest/ACS) soap request.

can any of you atleast post the pegasus bin file link here??

---------- Post added at 08:35 PM ---------- Previous post was at 08:28 PM ----------

there should be another file above this called pasw.htaccess there is some kind on username and password/authtoken being used.

If we could somehow create an send a request to the tr069 server it should respond us with the link to firmware file hopefully :)

Can you do one this.

with jiofi as the hotspot can you try to login to the ACS url provided. Atleast it should throw some error or redirect to some page ( as its a jio internal server )

Also findout if there is a switch to make firmware upgrade manual i.e. once we click update now it should then go and hit the server.

in this case we can put a breakpoint into the jio webui javascript and try to traceback the original/ upgrade firmware path.

---------- Post added at 08:35 PM ---------- Previous post was at 08:35 PM ----------

there should be another file above this called pasw.htaccess there is some kind on username and password/authtoken being used.

If we could somehow create an send a request to the tr069 server it should respond us with the link to firmware file hopefully :)

Can you do one this.

with jiofi as the hotspot can you try to login to the ACS url provided. Atleast it should throw some error or redirect to some page ( as its a jio internal server )

Also findout if there is a switch to make firmware upgrade manual i.e. once we click update now it should then go and hit the server.

in this case we can put a breakpoint into the jio webui javascript and try to traceback the original/ upgrade firmware path.
[Upgrading, Modifying and Unlocking] shammymz601:
is this firmware file stock one??

I see the following at the end of the bin file. so is this a working stock firmware or something else.It is asking for some password to download file.which should be the legit one.

seems the firmware file is encrypted one?? ideally it should not be as the other JMR520 bin file is not encrypted.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" >
<head><title>
FileDownload
</title><meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" /><meta http-equiv="X-UA-Compatible" content="IE=7" /><meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" /><meta http-equiv="X-UA-Compatible" content="IE=8" /><meta http-equiv="X-UA-Compatible" content="IE=EmulateIE9" /><meta http-equiv="X-UA-Compatible" content="IE=9" /><meta http-equiv="X-UA-Compatible" content="IE=EmulateIE10" /><meta http-equiv="X-UA-Compatible" content="IE=10" /><meta http-equiv="X-UA-Compatible" content="IE=EmulateIE11" /><meta http-equiv="X-UA-Compatible" content="IE=11" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><link type="text/css" rel="Stylesheet" href="../style.css" /><link href="scripts/photogallery.css" rel="stylesheet" type="text/css" /></head>
<body>
<form name="form1" method="post" action="filedownload.aspx?FileId=174193" id="form1">
<div>
<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUJODAxMzY1NzQ2D2QWAgIDD2QWBAIDDw8WAh4HVmlzaWJsZWhkZAIFDw8WAh8AaGRkZB5WHB3EuVXhJFlenLG0hPzh6AwQ" />
</div>

<div>

<input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="72BA71D8" />
<input type="hidden" name="__EVENTVALIDATION" id="__EVENTVALIDATION" value="/wEWAwLNpcbwBAK5wrnPBQLU1smIAuJPy/IavxNF0z+gK4zygpzLHVl7" />
</div>
<div style="width: 484px; height: 389px; top: 1px; left: 4px; position: absolute;" class="font1">
<table>
<tr>
<td><span id="Label1">Enter Password to Download File:</span></td>
<td>
</td>
</tr>
<tr>
<td colspan="2" align="center">

</td>
</tr>
<tr>
<td colspan="2">
<span id="lblmsg"></span>
</td>
</tr>
<tr>
<td colspan="2">
<input type="hidden" name="hdnFilename" id="hdnFilename" value="PEG_M2S_B04.bin" />
<input type="hidden" name="hdnPassword" id="hdnPassword" />
</td>
</tr>
</table>
</div>
</form>
[Upgrading, Modifying and Unlocking] swapnil823:
sudo fastboot oem device-info gives following info

sudo fastboot oem device-info

...

(bootloader)	Device tampered: false

(bootloader)	Device unlocked: false

(bootloader)	Charger screen enabled: false

(bootloader)	Display panel:

OKAY [ 0.005s]

finished. total time: 0.005s
[Upgrading, Modifying and Unlocking] shihabsoft:
What are you trying to impose here?
[Upgrading, Modifying and Unlocking] SiscoSH:
UART on jiofi2

Looks like jiofi have uart out..on it board

we can access seriel communication on TX, RX and GND pin outs using a usb-ttl converter. (FT232RL)

check image... there also a usbboot short pin

https://dl.xda-developers.com/4/2/1/2/5/2/3/xda.jpg?key=F5eQi24mmXEroxJukMW8dw&ts=1545575502

---------- Post added at 03:35 PM ---------- Previous post was at 03:29 PM ----------

SIMILAR DEVICES

andromax m2y

beeline m2

spectranet evo lte

---------- Post added at 03:40 PM ---------- Previous post was at 03:35 PM ----------

I think zte wd670 mifi uses same technolgies qualcom mdm9307.. fastboot and bootloader

also hidden adb access.. (airtel wd670 and reliance wipod).

3 weeks ago dc unlocker team developed unlock for these device
[Upgrading, Modifying and Unlocking] Mohit Pannu:
helpr

hey!

i need your help ,

i also working on get or cracking username and password of jio-fi m2s device. as during that process i found a link :- ( jiofi.local.html/to_engineer_login.html ). In this page asking ( Engineer Key ). after i got this i am working on retrieve the Engineer Key from 2-3 days. so i understood 50 % of code almost but i stuck on this code.

$("#BTN_Login").die().live('click', function() {

var ori_key = hex_md5($("#LOGIN_PWD").val());

ori_key = ori_key.substr(5, 17);

var password = transalte_key(ori_key);

//	password=hex_md5("6ff89c");

var headers = {};

headers["__RequestVerificationToken"] = $("#csrf_token2").val();

$.ajax({

url: '/wxml/eng_login.xml',

type: "Post",

headers: headers,

timeout: 8000,

cache: false,

datatype: "xml",

data: {

password: password

},

success: function(data, status) {

var new_token = $(data).find("token").text();

if(new_token == "-1") {

top.location.reload(true);

return false;

}

$("#csrf_token2").val(new_token);

$('input[type="button"], button').attr("disabled", false);

var result = parseInt($(data).find("eng").text());

if(result == 0) $('#error_info').html("password error");

else top.location.href = 'index.htm';

return true;

},

error: function(x, t, m) {

if(t === "timeout") {

}

}

})

})

});

after understand this code i got the key and username/password success.

these are belongs to each other. (Engineer Key and username/password)

ruffly :- this code is for encode or decode the Engineer Key or username/password of this device.

please help me,

whatsapp me on this number if any one get some clue :- 8683822410
[Upgrading, Modifying and Unlocking] viikaashpandey:
still we are finding Firmware for JioFi and for political someone is hacking EVM... Hahaha... :)
[Upgrading, Modifying and Unlocking] pranavXD:
Bro did you find how to unlock JMR815 ??

If yes Please Post, I too have the same issue
[Upgrading, Modifying and Unlocking] harikatt:
is it failed jiofi m2 version ??

<MFRNAME>Pegasus Telecom(Qingdao)Co.,Ltd</MFRNAME><MODELNO>Router M2</MODELNO><SRNO>RPEMFKC00448846</SRNO><IMEI>/EAN>

all lights display icons glowing on putting usb or power adapter, but after 10 seconds its not working
[Upgrading, Modifying and Unlocking] deve678:
First of all don't share your IMEI address
[Upgrading, Modifying and Unlocking] harikatt:
removed imei
[Upgrading, Modifying and Unlocking] satya1310:
any sucess unlocking jiofi 2???
[Upgrading, Modifying and Unlocking] andkov:
Hi all. jiofi m2 m2s unlock done
[Upgrading, Modifying and Unlocking] Jags89:
will you please provide the link or anything helpful?
[Upgrading, Modifying and Unlocking] -Tushar-:
The hex_md5() function hashes your password into a variable length password from charset- (3@S35F@JmTQt9S#I).

The ori_key then stores the subString of the hashed password.

So the final password that goes to the router server is of length 17 and containing only the above characters.

I'm working on something. I'll let you know if that turns out to be good.
[Upgrading, Modifying and Unlocking] popcorn1122:
any link to download unlocked jiofi m2s or jmr815
[Upgrading, Modifying and Unlocking] huaweitrick02:
We can unlock almost all jiofi models
[Upgrading, Modifying and Unlocking] thomasb892:
Guys, the JioFi 2 is using the Boa Web Server(Google it) to display jiofi.local.html

Server: Boa/0.94.14rc21

We can use vulnerabilities of the web server

Also how did you access adb?
[Upgrading, Modifying and Unlocking] SiscoSH:
thanks man.. how is the procedure??
[Upgrading, Modifying and Unlocking] mido_20:
Help with my jiofi

Unlock my Jiofi m2 router
[Upgrading, Modifying and Unlocking] Nocturnal_Creature_137:
https://www.exploit-db.com/exploits/42290

http://www.ush.it/team/ush/hack_httpd_escape/adv.txt
[Upgrading, Modifying and Unlocking] andkov:
so what? you can not get access to adb or qcom diag
[Upgrading, Modifying and Unlocking] jagannath.jdhv:
Any solution to unlock jiofi m2s
[Upgrading, Modifying and Unlocking] tank_siddharth:
Found MD5 hashig output but not sure how it can be used.

Link:

h t t p s : / / w w w .w3schools.com/code/tryit.asp?filename=GHCHZRWX317C

Here we can try input and output . Not sure how we can use this. Plz give any ideas. I will also continue to look into it.
[Upgrading, Modifying and Unlocking] myapky:
7
[Upgrading, Modifying and Unlocking] huaweitrick02:
Hello everyone please don't try to flash,

Any software in your jiofi, the device will be dead and service centre will not provide any warranty ,

Now a days they have advance tool,

They can check it whether you try to flash it or not, so please don't try to flash anything on your jiofi it will make your device dead and you will also not get warranty from service center,
[Upgrading, Modifying and Unlocking] myapky:
Any person owing any device belongs to him or her is considered his own property. Once he owns the item for which he paid for is legally his own asset and property. then the person has the right to use, throw, burn, destroy whatever he can do with the device or item , warranty remains for 1 year on device and 6 months on the accessories. After 1 year is completed from the purchase date no one can claim warranty on any product in India.

An customer who uses internet has fundamental right for internet freedom, JIO is monopoly of internet in india, it has destroyed the competition, the government company and other telecoms, which is not good for a healthy society, and internet freedom. All foreign country exercise freedom to be specific internet freedom, they use flash software as they wish, we live in a independent society not in JIO World.
[Upgrading, Modifying and Unlocking] kdnsk:
Hello Guys, my m2s device not able to start, however I can able to connect it port qualcomm 9008E. Please let us know, How, I will start it with normal mode.
[Upgrading, Modifying and Unlocking] sourabh.sinha:
Were you able to access shell using (FT232RL) ?as it supports 3v3 and 5v only and as per the uart pins on jiofi 2 the vcc is 1v8 , i am afraid writing on it will burn the rx pin.
[Upgrading, Modifying and Unlocking] Manjunath 462:
Can any one provide complete procedure with required firmware file to unlock jiofi2 m2s. Which is currently running on PEG_M2S_B04. I will be more thankful to you for this help.
[Upgrading, Modifying and Unlocking] mohitkumarhot:
my friend lastest frimware is PEG_M2S_B15

and i m following this thread from last 2 years,jiofi is a amazing device ,i hope some one crack it so that we can use other sim as well

jiofi m2s is the best device jio ever launched,no one can match the speed,m2s is still unbeatable
[Upgrading, Modifying and Unlocking] SumanKaka:
Hey I have an idea.

I'm not a pro reverse engineer and have 0 knowledge in hardware reverse engineering but I'm good in Apk reversing for few days I was researching in hardware hacking basics.

The suggestion :

1) Collect 2 different firmware bins

2) Use binwalk and extract everything possible

3) diff them and ignore the patches but collect how the Version info is stored

4) Unlock existing firmware and change version info to current version+

5) Again compress to firmware bin

6) Flash it

7) It will overcome the unable to downgrade issue

*) You can unlock the existing firmware or you can hook the update check process and grab the latest firmware link and patch them also

*Only work if the firmware flashing doesn't check for signatures (I think they don't).

I came to know about this technique in my research, someone using the technique to patch a device (not for jiofi).

Best of luck !!
[Upgrading, Modifying and Unlocking] shr!pad:
hey brother, please share the link.
[Upgrading, Modifying and Unlocking] satish111:
My version is PEG_M2S_B11......

can you tell step by step(in details) how to upgrade and unlock.
[Upgrading, Modifying and Unlocking] Mbght:
Help me
[Upgrading, Modifying and Unlocking] AIDROOS:
This is not going to work. Since 2017 in 4 years we got no where close to an unlock. Just purchase an unlocked LTE mini router and call it a day. I bricked 2x m2 gadgets just trying out stuff here. I'm not going any further in the bin.
[Upgrading, Modifying and Unlocking] rupeshmaurya35:
4 years and we are on same page, now unlocking m2s seems like an impossible.
[Upgrading, Modifying and Unlocking] myapky:
Kindly provide the unlocked modified firmware when available.
[Upgrading, Modifying and Unlocking] myapky:
@abhimortal6 https://bigbest.in/jio-m2-m2s-wireless-4g-portable-router.html

Any Solution for this ?
[Upgrading, Modifying and Unlocking] hemakumarm72@gmail.com:
hi try unlock jiofi m2s b15

already try it unlock web ui not working fireware update or try another methord dc unlocker tools not working because of port not found

JIO M2S B15 how unlock moderm for using any sim in 4g
[Upgrading, Modifying and Unlocking] SumanKaka:
I can unlock it but need help in getting shell

who got the shell access ? how you got it ?

anybody knows UART or JTAG pins ?
[Upgrading, Modifying and Unlocking] YOURKIN:
im not sure but i saw a video in youtube maybe some pcb points need to short with GND for adb recovery mode for adb shell accesses .
[Upgrading, Modifying and Unlocking] SumanKaka:
Can you send the video
[Upgrading, Modifying and Unlocking] YOURKIN:
but the video for airtel 4g hotspot

search in youtube ( Unlock Airtel 4G Hotspot E5573Cs-609 New Model 2018 100% Working Complete Guide in Hindi ) please inform if you find some solution
[Upgrading, Modifying and Unlocking] SumanKaka:
Yup found it thanks, will look forward
[Upgrading, Modifying and Unlocking] ramesh_yadav:
View attachment 5367089View attachment 5367091

Looking for same
[Upgrading, Modifying and Unlocking] SumanKaka:
I think brute force is the only way
[Upgrading, Modifying and Unlocking] habib.my:
If you found the correct UART just connect it normally boot it. You will get the shell. I tried the same on Jiofi 3 and 6 .
[Upgrading, Modifying and Unlocking] YOURKIN:
if you get any shell access try this user-root password-oelinux1 login shell
[Upgrading, Modifying and Unlocking] SumanKaka:
I know, the ttl pins are hidden for m2

any tips for bruteforce testing
[Upgrading, Modifying and Unlocking] Sauravkumar72:
Hello....can u all tell me?....is it possible to unlock jiofi 2....as i saw u are doing so much hardwork.....please reply....so that i will also be active
[Upgrading, Modifying and Unlocking] YOURKIN:
I'm trying to find uart pins if i found the pines then i post the screenshots
[Upgrading, Modifying and Unlocking] ramesh_yadav:
View attachment 5369501

Must be removed from production boards
[Upgrading, Modifying and Unlocking] YOURKIN:
all yellow round are not identified also doubted maybe uart pines there
[Upgrading, Modifying and Unlocking] YOURKIN:
View attachment 5370087

I found the way for JIOFI M2S Qualcomm mode
[Upgrading, Modifying and Unlocking] ramesh_yadav:
Great.

How you did that?

You should be able to use mount and screen command in Linux/mac
[Upgrading, Modifying and Unlocking] YOURKIN:
please send me the information so i can try and backup firmware
[Upgrading, Modifying and Unlocking] YOURKIN:
i found the uart pines
[Upgrading, Modifying and Unlocking] ramesh_yadav:
Great

Mine looks dead. Device showing it is plugged in but not turning on.

It will be helpful if you share pins location so I can check if it is just a boot issue or the hardware
[Upgrading, Modifying and Unlocking] YOURKIN:
don't try now after success i share every thing pins port driver software every thing with picture
[Upgrading, Modifying and Unlocking] YOURKIN:
i need help who have usb ttl converter and jiofi m2s

and have little knowledge about it .

DM me for helping me

then we backup the firmware. I need help because my jiofi boot is damaged .
[Upgrading, Modifying and Unlocking] YOURKIN:
is your device on normally or what happen , if your device normally working then we can backup your firmware and i can fix my jiofi m2s boot.img , if it's working then i tell you the process to get shell access after that we modify the firmware then i post all processes , with different from i show all port and connation list DM me if your devices is working .

i also searching this devices new or old one if i find then i can fix my old one also
[Upgrading, Modifying and Unlocking] YOURKIN:
this is the pin out i found but no TX pin not found. JioFi 2 m2s modelView attachment 5371853View attachment 5371319
[Upgrading, Modifying and Unlocking] habib.my:
How to connect wires to that pin, I damaged those on my Jiofi 6.
[Upgrading, Modifying and Unlocking] YOURKIN:
this is not for jiofi 6

this for usb to serial converter for ic to pc connection ,

search more about if from internet .
[Upgrading, Modifying and Unlocking] habib.my:
I connected my Jiofi 6 with serial connection using UART. But I don't know how to stick or hold the wires at UART till I turn on ADB.
[Upgrading, Modifying and Unlocking] YOURKIN:
you need to connect using putty then select serial then type your uart converter usb port and type band wide 115200 then click open , all you did after connecting uart device after that you can connect jiofi power cable .View attachment 5374415
[Upgrading, Modifying and Unlocking] subhash_india:
Send your bricked jiofi m2 to @abhimortal6 @ab_hi_j he will able to unlock firmware

You should enter into DIAGNOSTIC Mode to backup firmware,

it should be visible as " Qualcomm HS-USB android DIAG 9008/901D/902D (com X) " in Ports section of Device Manager
[Upgrading, Modifying and Unlocking] SumanKaka:
I have my device working and has a USB to serial converter
[Upgrading, Modifying and Unlocking] ishreyas:
Which UART converter you are using?
[Upgrading, Modifying and Unlocking] subhash_india:
he used aurdino as uart converter
[Upgrading, Modifying and Unlocking] ishreyas:
Thanks should I buy UART converter or buy Arduino UNO (maybe original or clone, depending on availability of local shop). as I've to take backup of another JioFi.

Do you know how to take backup of original firmware using any of these hardwares?

Thanks waiting for reply.
[Upgrading, Modifying and Unlocking] YOURKIN:
that is the main problem now no way we found to backup the firmware because jiofi m2 rx pin not found , so if we input something no respond from jiofi m2 only i found the terminal access .
[Upgrading, Modifying and Unlocking] ishreyas:
yeah I've saw your pin photo in above post. My aunt has this device lying somewhere in house, but she couldn't find that. Once I get that device I can try to find RX pin or any other solution to take fw backup.
[Upgrading, Modifying and Unlocking] subhash_india:
Go for Arduino , I already shared the steps to backup jiofi firmware in my previous post.
[Upgrading, Modifying and Unlocking] ishreyas:
Hello I've purchased Arduino but I couldn't find you backup firmware post. please share post link

Thank you
[Upgrading, Modifying and Unlocking] r0bre:
did anyone do progress on finding the tx pin?
[Upgrading, Modifying and Unlocking] tmr369:
How u got connected via putty reply me on WhatsApp 7569179369 or email 16a91a0552@aec.edu.in