Resetting.....

Upcoming fresh hacks

Non-Technical Hacks that works - Have Fun! (Status: in progress..)

Hacking network based biometric time-attendance system - Be your own boss! (Status: Done!)
Milestone Xprotect License Bypass hack - Replace a camera without license re-activation (Status: Done!)

Thursday, August 25, 2011

MenaTelecom WiMAX: Free Internet hack (Cloning Motorola CPEi 35775)


Testing speed of cloned Motorola CPEi 35775.................

Cloning Motorola CPEi35775:
BootLoader 0x90000000,0x90020000
Bootloader Config 0x90020000,0x90040000
Device Certificates 0x90CA0000,0x90CC0000

Copy these partitions from a motorola cpe to another cpe..

To change Wimax MAC just edit the HWA_0 to your desired MAC in bootloader / bootloader config

Note: Wimax mac from Bootloader / Bootloader Config must match Device certificate in-order to get connected to the network.

To Do: Bypass Certificate verification....

PSPboot Log (with console_state unlocked):

B2 Bootloader 01.01.08

Basic POST completed... Success.
Last reset cause: Hardware reset (Power-on reset)

PSPBoot1.5 rev: 1.5.0.6
(c) Copyright 2002-2006 Texas Instruments, Inc. All Rights Reserved.

BLADE2 3.5G
Press ESC for monitor... 3
(psbl) help
reboot version info fa
printenv setenv setpermenv unsetenv
defragenv fmt boot dm
oclk help tftp testram
testflash flash testled
(psbl) printenv

TOOLS_USER 0
BOOTLOADER 0x90000000,0x90020000
IMAGE_A 0x90040000,0x90C40000
CONFIG_A 0x90C40000,0x90C60000
CONFIG_B 0x90C60000,0x90C80000
IMAGE_B 0x90CE0000,0x918E0000
FNE_CERTS 0x90C80000,0x90CA0000
DEV_CERTS 0x90CA0000,0x90CC0000
FACTORY_DEF 0x90CC0000,0x90CE0000
JFFS2 0x918E0000,0x92000000
RESET_CAUSE 0
PartNumber SGDNXXXXBA
ProductID CPEi35775
HWRevision REV.D
SerialNumber TS19XXXXXX
HWA_1 00:23:XX:XX:XX:3D
GATEWAY_MAC_ADDRESS 00:23:XX:XX:XX:3E
WIFI_MAC_ADDRESS 00:23:XX:XX:XX:3F
FingerPrint ~removed~
HWA_0 00:24:XX:XX:XX:75
FactoryProvision Complete
CONSOLE_STATE unlocked
BOOTCFG m:f:"IMAGE_B"
BUILD_OPS 0xd41
MEMSZ 0x04000000
FLASHSZ 0x02000000
MODETTY0 115200,n,8,1,hw
MODETTY1 115200,n,8,1,hw
CPUFREQ 212992000
MIPSFREQ 212992000
SYSFREQ 150000000
bootloaderVersion 01.01.08
PROMPT (psbl)

P.S. MAC address & serial hidden.


END!

19 comments:

freakazoid said...

is it possible to port openwrt onto this router

ariasd said...

it works with CPEi25725??
or only with CPEi35775?

Dental Lord said...

Dear Users,
i need firmware of CPEi35775. I want to replace current firmware of wateen telecom with original Motorola. for use device with any network

jefferson said...

i have cpei 35775. please give me the step by step to get the free internet.

montera92gmail.com email me on facebook.
i really appreciated.

Cassiano Ceglio said...

i have cpei 35775. please give me the step by step to get the free internet.

cassianoceglio@gmail.com email me.
i really appreciated.

Guno Koningsbloem said...

gunoan@gmail.com

i have cpei 35775. please give me the step by step to get the mac address change do i need to jtag i have copied cpe 35775 to cpe 35750 thank you.

Ervis Mellani said...

hello, does this work with the CPEi25725? can you please email me at ervisthegreat at g mail dot com????

KAL-EL RODRIGUEZ said...

Please need firmware 775 i have 02.00.23.06.13

nashtyblue said...

any update for this on 25725

Marco Paulo Jamero said...

can you send me a step by step tutorial please.... badboympaulo@gmail.com

Luu Lerma* said...
This comment has been removed by the author.
Lulú Lerma said...

Can you please send me a step by step to change the mac address. I can gladly donate if it is necessary :)

startroom317@hotmail.com

ibarra isleta said...

Do you have a tutorial how to hack CPEi 25725 can you email me if you have one may email add is gappot27@yahoo.com

Jesús David Ocegueda Rivera said...

can you send me a tutorial please.
tmb767@gmail.com

Thank you so much in advance

Jorge Luis Cruz Duarte Duarte said...

Could you give me a more detailed tutorial'm newbie and do not understand how to do the procedures entered.

Jorge Luis Cruz Duarte Duarte said...

can you send me a tutorial please:
jorgelcd315@gmail.com

ANGELO said...

Whats Step to change Mac please help from Chile

ANGELO said...

Whats Step to change Mac please help from Chile

Aryan Zijlstra said...

Nice! But HOW do you change the boat loader? I see no way to download it nor to upload one. SSH or telnet do not respond...

Post a Comment