[GUIDE][UPDATED] Unlocking JioFi 3 JMR540 & JMR541 for all networks

[YOURKIN]

Root login with UART is disabled on new firmware,so UART access will not help.
No one knows EDL point also.
if any one have latest firmware file (FXN_JMR540_R6.20) please share

I think we can enable EDL mode using ( reset +power button ) , but i don't know about EDL port

1. Select COM Port (Check Device Manager for Quectel QDLoader 9008 port)
2. Set Baudrate:460800

 

[jithinvp4]

Thank you for the pointers but how do I find UART pins on the board? Mine doesn't have 3 exposed contacts near the barcode. Please check the attachment on my original post.

Sorry not sure how to find UART pins for your device ,it might be new version of JMR540

Please try the the method which YOURKIN shared to enabled EDL mode.
If it's works please let me know.

 

[subhash_india]

I think we can enable EDL mode using ( reset +power button ) , but i don't know about EDL port

1. Select COM Port (Check Device Manager for Quectel QDLoader 9008 port)
2. Set Baudrate:460800

pressing Reset+ power button will push the device into fastboot mode !

To push device into edl mode, short 2 pins which are available on jiofi board next to power button!

 

[subhash_india]

For some reason my JMR540 board does not have UART pins. Can someone help me to identify EDL points?

I'm sure TP701 , TP702 ,TP703 or tp704 Pin for RX , TX and GND . please check Ground (GND) pin using multimeter before connecting .

Tp2018 , tp2203 and tp2204 may be edl points but I'm not sure!

 

[jithinvp4]

.

 

[jithinvp4]

For some reason my JMR540 board does not have UART pins. Can someone help me to identify EDL points?

TP 701 ,TP 702, TP 703 (might be ground)
you can check it via multimeter ,few videos are available on youtube

 

[r.prajapat42]

Thanks it's working.

What you have edited in the firmware, I also have a JMR815 that I want to unlock.

Hello bro, can u please guide how to get shell access in jiofi 6 jmr 1040

 

[BloodlessButcher]

Hello

TTL RX is disabled in latest lk, same as JioFi 2 and M2S. Community is aware of it. Please move this conversation to different thread. Non technical people come here for common help.

Helo Abhi

Is there any steps to jailbreak JMR 1040 using similar methods..?
thanks

Also i used UMC tool to create unlock code for my Dongle using my IMEI number... not sure on how to use the codes to unlock the jio-fi device.

 

[r.prajapat42]

Hello


Helo Abhi

Is there any steps to jailbreak JMR 1040 using similar methods..?
thanks

Also i used UMC tool to create unlock code for my Dongle using my IMEI number... not sure on how to use the codes to unlock the jio-fi device.

These code used in DCunlocker tool but in that tool manufacturer of jiofi 1040 not available. Huawei and other available.
Did you find UART pins in board

 

[ai.matters]

Unlocked Firmware for JioFi 3 JMR540 & JMR541

Disclaimer
I am not responsible for any kind of damage to your device.
Use this firmware at your own risk
Post is for educational purpose only.

ONLY FOR JMR 540 & JMR 541

​

I was able to dump and reverse engineer JioFi 3's firmware to see if I can unlock the SIM restrictions. JioFi 3 is designed by Foxconn it uses generic firmware. Unlocking took time though. Tested with Vi, Airtel.

UPDATE 17-10-21: Jio pushed a firmware update which is locking boot loader. If your device is not updated yet it is advised to re-flash your firmware with patched image given below which basically disables auto updates. If you're already locked out, currently there's no easy fix for that.

If you haven't used your device from a long time or you're still on lower or equal version than below it is advised not to use JioFi with SIM, flash this firmware first if you want to test SIM unlock.



Guide

Make sure you're on same or lower firmware version

• JMR 540 - FXN_JMR540_R6.16
• JMR 541 - FXN_JMR541_R3.10

1. Locate your device model and download the respective Firmware and extract it to a known location

• JMR540_unlocked_patched_system.zip​
• JMR541_unlocked_patched_system.zip​

2. Install drivers and tools (skip if already installed)

• Install Fastboot drivers ( google it for mac and linux it's easy to find)​
• Install Fastboot ( google it for mac and linux it's easy to find)​

3. Prepare device

• Remove battery from JioFi 3
• Locate reset pin hole button
• Lay down JioFi 3
• Use Paper Clip / SIM Ejector Tool to press button inside (using sharp object is not recommended)
• Keep pressing button down and insert USB cable
• Release button as soon as all the LEDs in Display turns RED. This means device is in boot loader mode

4. Flashing Unlocked Firmware

• Open adb and fastboot tools terminal
• Enter following to check if device is connected

• fastboot devices

• It will return something like this
• baxxxxx fastboot

• This means device is connected. If your device doesn't show up here please check drivers in Device manager
• Now first erase the system partition

• fastboot erase system

• It will return something like this
• erasing 'system'... OKAY [ 1.104s] finished. total time: 1.105s

• Now flash the firmware
• fastboot flash system "D:\system.img" ( replace path )

• It should return something like this
• sending 'system' (34306 KB)... OKAY [ 1.276s] writing 'system'... OKAY [ 9.462s] finished. total time: 10.741s

• Now send reboot command to device
• fastboot reboot

• You'll notice device will reboot normally now you can unplug the cable.

Congratulations your device is now unlocked and you can reinsert battery and another SIM for testing.

Firmware will take long time than usual to boot do not panic.​

4. Changing APN

• Insert SIM connect with JioFi 3 wait it to intialize
• Open Web UI from browser (http://jiofi.local.html/)
• Now login (default username/pwd is administrator/administrator)
• In Network Tab you'll find setting for changing APN
• Put it on manual and enter "internet" as APN (without quotes)
• Hit apply/save device will reboot again automatically and it'll auto connect
• Just wait patience is the key here it'll connect.

If something goes WRONG or you want to UNDO you can re flash original firmware which is provided in this post.


Original backup

• JMR_540_original_system.zip​
• JMR_541_original_system.zip​

FAQs

1. Q. My device is not visible in fastboot devices
   A. Confirm driver installation a faulty cable can also be the issue.
   .
2. Q. Everything went well but still no changes in dashboard
   A. After successful flash if you still don't see the changes your device is probably booting from recovery partition. Try flashing recovery partition by
   fastboot erase recoveryfs
fastboot flash recoveryfs "D:\system.img"
   .
   
   
3. Q. After resetting device from pin hole button it shows INVALID SIM.
   A. This is supposed to happen just reboot the device it'll work again.
   .
4. Q. Can I undo all this and get back to original firmware
   A. Yes just flash the original firmware provided in post and reset the device.
   .
5. Q. I 'accidentally' flashed my recovery and boot partition
   A. Well accidentally I've backed up recovery and boot download from below
   
   1. JMR540_boot_recovery.rar
   2. JMR541_boot_recovery.rar
   .
6. Q. FAILED: (remote: Image is locked) issue while erasing/flashing image
   A. Jio recently pushed an firmware update which re-locks simlock and bootloader which basically means you can't flash unsigned/custom firmware. Currently there is no fix.

​

Mentions:
Thanks to Karuppusamy for testing it on JMR541.


What about JioFi 2, 4, 5, 6?
Reverse Engineering takes lot of time and coffee. Until I get physical access to device I won't be able to unlock it. I'm constantly searching them on OLX as soon as I get hands on I'll surely try to RE and unlock it. I'll update the same here if there is no update here at the time of your reading then I haven't got the device yet so please don't spam for update hope you understand that I don't get anything by doing these things, I do it for liberation of locked hardware to meet it's real destiny and of course for the people. I also have a day job so no I cannot guide or teach you, hope you understand why.


For Devs:
JMR_540_FLASH_DUMP.rar

​

Its giving me error any fix for this ?

 

[ai.matters]

its giving me this error any fix ?

 

[soul mortel]

I am facing an issue with my jiofi jmr 541
I boot it into boot loader mode but my windows computer cannot find the drivers to install in it, I tried installing fast boot drivers but no luck.
Can someone provide the driver download files.

 

[rawat121]

Can a JioDongle JDR740 be unlocked. There is no guide about that on web. I own one and am totally hopeless. Maybe dev's should this..

 

[shahradheshyam3]

after hacked how can i receive sms of airtel sim inserted in jiofi please ....

 

[Alam06]

Showing me "image is locked" how to solve this , I can't erase system image

 

[Microsoft Office]

Unlocked Firmware for JioFi 3 JMR540 & JMR541

Disclaimer
I am not responsible for any kind of damage to your device.
Use this firmware at your own risk
Post is for educational purpose only.

ONLY FOR JMR 540 & JMR 541

​

I was able to dump and reverse engineer JioFi 3's firmware to see if I can unlock the SIM restrictions. JioFi 3 is designed by Foxconn it uses generic firmware. Unlocking took time though. Tested with Vi, Airtel.

UPDATE 17-10-21: Jio pushed a firmware update which is locking boot loader. If your device is not updated yet it is advised to re-flash your firmware with patched image given below which basically disables auto updates. If you're already locked out, currently there's no easy fix for that.

If you haven't used your device from a long time or you're still on lower or equal version than below it is advised not to use JioFi with SIM, flash this firmware first if you want to test SIM unlock.



Guide

Make sure you're on same or lower firmware version

• JMR 540 - FXN_JMR540_R6.16
• JMR 541 - FXN_JMR541_R3.10

1. Locate your device model and download the respective Firmware and extract it to a known location

• JMR540_unlocked_patched_system.zip​
• JMR541_unlocked_patched_system.zip​

2. Install drivers and tools (skip if already installed)

• Install Fastboot drivers ( google it for mac and linux it's easy to find)​
• Install Fastboot ( google it for mac and linux it's easy to find)​

3. Prepare device

• Remove battery from JioFi 3
• Locate reset pin hole button
• Lay down JioFi 3
• Use Paper Clip / SIM Ejector Tool to press button inside (using sharp object is not recommended)
• Keep pressing button down and insert USB cable
• Release button as soon as all the LEDs in Display turns RED. This means device is in boot loader mode

4. Flashing Unlocked Firmware

• Open adb and fastboot tools terminal
• Enter following to check if device is connected

• fastboot devices

• It will return something like this
• baxxxxx fastboot

• This means device is connected. If your device doesn't show up here please check drivers in Device manager
• Now first erase the system partition

• fastboot erase system

• It will return something like this
• erasing 'system'... OKAY [ 1.104s] finished. total time: 1.105s

• Now flash the firmware
• fastboot flash system "D:\system.img" ( replace path )

• It should return something like this
• sending 'system' (34306 KB)... OKAY [ 1.276s] writing 'system'... OKAY [ 9.462s] finished. total time: 10.741s

• Now send reboot command to device
• fastboot reboot

• You'll notice device will reboot normally now you can unplug the cable.

Congratulations your device is now unlocked and you can reinsert battery and another SIM for testing.

Firmware will take long time than usual to boot do not panic.​

4. Changing APN

• Insert SIM connect with JioFi 3 wait it to intialize
• Open Web UI from browser (http://jiofi.local.html/)
• Now login (default username/pwd is administrator/administrator)
• In Network Tab you'll find setting for changing APN
• Put it on manual and enter "internet" as APN (without quotes)
• Hit apply/save device will reboot again automatically and it'll auto connect
• Just wait patience is the key here it'll connect.

If something goes WRONG or you want to UNDO you can re flash original firmware which is provided in this post.


Original backup

• JMR_540_original_system.zip​
• JMR_541_original_system.zip​

FAQs

1. Q. My device is not visible in fastboot devices
   A. Confirm driver installation a faulty cable can also be the issue.
   .
2. Q. Everything went well but still no changes in dashboard
   A. After successful flash if you still don't see the changes your device is probably booting from recovery partition. Try flashing recovery partition by
   fastboot erase recoveryfs
fastboot flash recoveryfs "D:\system.img"
   .
   
   
3. Q. After resetting device from pin hole button it shows INVALID SIM.
   A. This is supposed to happen just reboot the device it'll work again.
   .
4. Q. Can I undo all this and get back to original firmware
   A. Yes just flash the original firmware provided in post and reset the device.
   .
5. Q. I 'accidentally' flashed my recovery and boot partition
   A. Well accidentally I've backed up recovery and boot download from below
   
   1. JMR540_boot_recovery.rar
   2. JMR541_boot_recovery.rar
   .
6. Q. FAILED: (remote: Image is locked) issue while erasing/flashing image
   A. Jio recently pushed an firmware update which re-locks simlock and bootloader which basically means you can't flash unsigned/custom firmware. Currently there is no fix.

​

Mentions:
Thanks to Karuppusamy for testing it on JMR541.


What about JioFi 2, 4, 5, 6?
Reverse Engineering takes lot of time and coffee. Until I get physical access to device I won't be able to unlock it. I'm constantly searching them on OLX as soon as I get hands on I'll surely try to RE and unlock it. I'll update the same here if there is no update here at the time of your reading then I haven't got the device yet so please don't spam for update hope you understand that I don't get anything by doing these things, I do it for liberation of locked hardware to meet it's real destiny and of course for the people. I also have a day job so no I cannot guide or teach you, hope you understand why.


For Devs:
JMR_540_FLASH_DUMP.rar

​

Hello Abhi Bro, can you please tell me where did you get original jmr 541 original system?
I want to have one for jmr 1040.
And also help if you have the same solution for jmr 1040.

 

[abhishekab.z10]

after hacked how can i receive sms of airtel sim inserted in jiofi please ....

I don't think that's possible

 

[tshrpl]

i have a jiofi 4 i want to jailbreak, i can't find the original firmware Amtel_JMR1140_R12.07

can anybody share this ?

 

[YOURKIN]

i have a jiofi 4 i want to jailbreak, i can't find the original firmware Amtel_JMR1140_R12.07

can anybody share this ?

no one have the firmware they backup the firmware and modified and share with us . if you found the RX TX pin then you can try to backup original firmware if the OEM is unlocked then it possible .

 

[tshrpl]

no one have the firmware they backup the firmware and modified and share with us . if you found the RX TX pin then you can try to backup original firmware if the OEM is unlocked then it possible .

i disassembled my jiofi 4 and it seems there's no uart? there is a set of jtag pins but i don't know if the are permanently disabled, i will try again tomorrow with a proper jtag interface, do you guys think jio would mistakenly leave these open? is there some other way around that i'm missing