[GUIDE][UPDATED] Unlocking JioFi 3 JMR540 & JMR541 for all networks

[MKSXDA]

.

 

[MKSXDA]

.

 

[Mr_Trojan]

Hello folks, will this firmware work on jiofi5 jmr814 ?

 

[jithinvp4]

I have enabled band1 using qxdm ,but BSNL 4g network not detecting . I think jmr540 hardware don't support band1 .
Later enabled band3 and band 40 alone to avoid connecting band5 which have less speed

 

[saber73]

I have enabled band1 using qxdm ,but BSNL 4g network not detecting . I think jmr540 hardware don't support band1 .
Later enabled band3 and band 40 alone to avoid connecting band5 which have less speed

Hello, how did you receive the diagnostic port from the modem? I tried through uart, but I don't have the login password. Have you found the boot pin of the modem on the modem board to take the modem to 9008 mode?
I tried this name and password, but it didn't work!
User : root
Password: oelinux1

 

[jithinvp4]

Hello, how did you receive the diagnostic port from the modem? I tried through uart, but I don't have the login password. Have you found the boot pin of the modem on the modem board to take the modem to 9008 mode?
I tried this name and password, but it didn't work!
User : root
Password: oelinux1

password you are using will be work only on FXN_JMR540_R6.16 firmware . I have enabled adb and booted to edl . If your modem is in latest firmware version ,there is no option to enable EDL without boot pin.

 

[saber73]

password you are using will be work only on FXN_JMR540_R6.16 firmware . I have enabled adb and booted to edl . If your modem is in latest firmware version ,there is no option to enable EDL without boot pin.

Thank you very much for your response. my modem permanently unlocking it and its firmware version:
3.10 and the modem model is JMR541. There is no way now I can take the modem to Edl mode? The same port 9008? Or get MDM diag port and ADB ?

 

[avirus]

Thanks bro for ur hard work, I had one question, after unlocking, I m able to use Airtel sim...just wanted confirm that is there any way jio can push their update on unlocked version and lock the device???

 

[Arjit0004]

Unlocked Firmware for JioFi 3 JMR540 & JMR541

Disclaimer
I am not responsible for any kind of damage to your device.
Use this firmware at your own risk
Post is for educational purpose only.

ONLY FOR JMR 540 & JMR 541

​

I was able to dump and reverse engineer JioFi 3's firmware to see if I can unlock the SIM restrictions. JioFi 3 is designed by Foxconn it uses generic firmware. Unlocking took time though. Tested with Vi, Airtel.

UPDATE 17-10-21: Jio pushed a firmware update which is locking boot loader. If your device is not updated yet it is advised to re-flash your firmware with patched image given below which basically disables auto updates. If you're already locked out, currently there's no easy fix for that.

If you haven't used your device from a long time or you're still on lower or equal version than below it is advised not to use JioFi with SIM, flash this firmware first if you want to test SIM unlock.



Guide

Make sure you're on same or lower firmware version

• JMR 540 - FXN_JMR540_R6.16
• JMR 541 - FXN_JMR541_R3.10

1. Locate your device model and download the respective Firmware and extract it to a known location

• JMR540_unlocked_patched_system.zip​
• JMR541_unlocked_patched_system.zip​

2. Install drivers and tools (skip if already installed)

• Install Fastboot drivers ( google it for mac and linux it's easy to find)​
• Install Fastboot ( google it for mac and linux it's easy to find)​

3. Prepare device

• Remove battery from JioFi 3
• Locate reset pin hole button
• Lay down JioFi 3
• Use Paper Clip / SIM Ejector Tool to press button inside (using sharp object is not recommended)
• Keep pressing button down and insert USB cable
• Release button as soon as all the LEDs in Display turns RED. This means device is in boot loader mode

4. Flashing Unlocked Firmware

• Open adb and fastboot tools terminal
• Enter following to check if device is connected

• fastboot devices

• It will return something like this
• baxxxxx fastboot

• This means device is connected. If your device doesn't show up here please check drivers in Device manager
• Now first erase the system partition

• fastboot erase system

• It will return something like this
• erasing 'system'... OKAY [ 1.104s] finished. total time: 1.105s

• Now flash the firmware
• fastboot flash system "D:\system.img" ( replace path )

• It should return something like this
• sending 'system' (34306 KB)... OKAY [ 1.276s] writing 'system'... OKAY [ 9.462s] finished. total time: 10.741s

• Now send reboot command to device
• fastboot reboot

• You'll notice device will reboot normally now you can unplug the cable.

Congratulations your device is now unlocked and you can reinsert battery and another SIM for testing.

Firmware will take long time than usual to boot do not panic.​

4. Changing APN

• Insert SIM connect with JioFi 3 wait it to intialize
• Open Web UI from browser (http://jiofi.local.html/)
• Now login (default username/pwd is administrator/administrator)
• In Network Tab you'll find setting for changing APN
• Put it on manual and enter "internet" as APN (without quotes)
• Hit apply/save device will reboot again automatically and it'll auto connect
• Just wait patience is the key here it'll connect.

If something goes WRONG or you want to UNDO you can re flash original firmware which is provided in this post.


Original backup

• JMR_540_original_system.zip​
• JMR_541_original_system.zip​

FAQs

1. Q. My device is not visible in fastboot devices
   A. Confirm driver installation a faulty cable can also be the issue.
   .
2. Q. Everything went well but still no changes in dashboard
   A. After successful flash if you still don't see the changes your device is probably booting from recovery partition. Try flashing recovery partition by
   fastboot erase recoveryfs
fastboot flash recoveryfs "D:\system.img"
   .
   
   
3. Q. After resetting device from pin hole button it shows INVALID SIM.
   A. This is supposed to happen just reboot the device it'll work again.
   .
4. Q. Can I undo all this and get back to original firmware
   A. Yes just flash the original firmware provided in post and reset the device.
   .
5. Q. I 'accidentally' flashed my recovery and boot partition
   A. Well accidentally I've backed up recovery and boot download from below
   
   1. JMR540_boot_recovery.rar
   2. JMR541_boot_recovery.rar
   .
6. Q. FAILED: (remote: Image is locked) issue while erasing/flashing image
   A. Jio recently pushed an firmware update which re-locks simlock and bootloader which basically means you can't flash unsigned/custom firmware. Currently there is no fix.

​

Mentions:
Thanks to Karuppusamy for testing it on JMR541.


What about JioFi 2, 4, 5, 6?
Reverse Engineering takes lot of time and coffee. Until I get physical access to device I won't be able to unlock it. I'm constantly searching them on OLX as soon as I get hands on I'll surely try to RE and unlock it. I'll update the same here if there is no update here at the time of your reading then I haven't got the device yet so please don't spam for update hope you understand that I don't get anything by doing these things, I do it for liberation of locked hardware to meet it's real destiny and of course for the people. I also have a day job so no I cannot guide or teach you, hope you understand why.


For Devs:
JMR_540_FLASH_DUMP.rar

​

Is there any way to unlock jiofi 2 M2S??

 

[saber73]

Thanks bro for ur hard work, I had one question, after unlocking, I m able to use Airtel sim...just wanted confirm that is there any way jio can push their update on unlocked version and lock the device???

The modem must be unlocked in principle, that is, the plmn lock must be removed and acs or tr069 must be closed. In this case, the operator of the modem can no longer send updates and lock the modem. In order to unlock it with an airtel SIM card, refer to bands. which the modem supports and the bands on which your operator provides internet and network

 

[blksith0]

Sure - but are there any important features that we lose out on by not updating to the latest firmware?

 

[Shabirmir]

Sir, i been one of you who own jiofi 3. after reading all this entire thread i found myself in a bit confusion. my jiofi 3 is running on
FXN_JMR540_R6.20 firmware version
am i eligible for flashing this jiofi with your modified firmware?

 

[ayyaj]

I have enabled band1 using qxdm ,but BSNL 4g network not detecting . I think jmr540 hardware don't support band1 .
Later enabled band3 and band 40 alone to avoid connecting band5 which have less speed

i want to unlock band 1.. can you help me? show me the procedure..

 

[Freddthink]

Hi bro, please how can I read/write the data stored in the .img files on ubuntu?

 

[Literally_Saksham]

This is Great my Airtel SIM works but I was wondering how can I call using it?
If I had Jio SIM I could've used JioCall but with airtel sim it's not working.

 

[saek0]

For some reason my JMR540 board does not have UART pins. Can someone help me to identify EDL points?

 

[jithinvp4]

For some reason my JMR540 board does not have UART pins. Can someone help me to identify EDL points?

Root login with UART is disabled on new firmware,so UART access will not help.
No one knows EDL point also.
if any one have latest firmware file (FXN_JMR540_R6.20) please share

 

[saek0]

Root login with UART is disabled on new firmware,so UART access will not help.
No one knows EDL point also.
if any one have latest firmware file (FXN_JMR540_R6.20) please share

I am on FXN_JMR540_R6.16, already unlocked and patched. Just looking for a way to lock specific band. How do I do it?

 

[jithinvp4]

I am on FXN_JMR540_R6.16, already unlocked and patched. Just looking for a way to lock specific band. How do I do it?

i could enable BAND 1 on software level ,but since hardware JMR540 not supports BAND 1 it didn't worked.
so there is no hope

if you really want to try , get root shell using TTL to UART converter -> start adb service -> boot to EDL from adb -> use qxdm to enable band

 

[saek0]

i could enable BAND 1 on software level ,but since hardware JMR540 not supports BAND 1 it didn't worked.
so there is no hope

if you really want to try , get root shell using TTL to UART converter -> start adb service -> boot to EDL from adb -> use qxdm to enable band

Thank you for the pointers but how do I find UART pins on the board? Mine doesn't have 3 exposed contacts near the barcode. Please check the attachment on my original post.

For some reason my JMR540 board does not have UART pins. Can someone help me to identify EDL points?