A $50 5G Mobile Hotspot with Modifiable TTL and IMEI

I came across this hotspot, the Inseego M2000, on eBay not long ago. It uses Qualcomm’s X55 modem and seems like an excellent value for the money. The unlocked and T-Mobile-only versions cost almost the same, so I recommend getting the unlocked version.

It supports AX1200 Wi-Fi, USB RNDIS, reverse charging, and the usual basic features. In my testing, I managed to get 600 Mbps on T-Mobile’s $10 plan with this thing (I live right next to a cell tower; most people should expect something closer to 300 Mbps).

After searching around online, I found relatively few guides for tinkering with Inseego devices. They’re a bit obscure in the modding community, so I decided to document what I’ve tried, consolidate some resources I found online, and leave myself a reference for the future.

With the following changes, the device can work with certain tablet data plans:

• Enable ADB and diagnostic (Diag) ports.
• Modify TTL.
• Modify IMEI (optional).

Step 0: Install the Required Tools and Drivers

You’ll need an x64 Windows environment, either physical or virtual. I recommend a virtual machine, since some of the drivers and utilities come from sources that are difficult to verify.

Files

• Modified firmware

Drivers

• Qualcomm Diag driver

Software

• Visual C++ Redistributable runtimes (required by the IMEI-editing utility)
• QFIL
• HxD, or another hex editor

Step 1: Enable ADB and Diag Ports

First, flash the modified firmware from a Russian-language Ukrainian-language site to enable a root ADB shell. Thanks to the original author, OPERATOR_555.

If you have security concerns about this firmware, another option is to exploit a vulnerability in OpenVPN configuration loading to gain a privileged shell and then run a script. That method is substantially more complicated, though, so I’ll leave it for another time.

1.1 Enter Fastboot Mode

Power the hotspot off, remove the back cover, and press and hold the Reset button using a SIM-eject tool. While holding it down, connect the hotspot to your computer over USB.

Release the button after you hear the connection sound and Windows recognizes the device. The hotspot screen should remain black. In Device Manager, you should see an unknown Android device:

Extract the modified firmware package, navigate to its Drivers folder, right-click android_winusb.inf, and choose Install.

Note: The directory path is Unlock_only_20260126_M2000_4G_PUBLIC_Mod_OPERATOR_555\20260126_M2000_4G_PUBLIC_Unlock_only_Mod_OPERATOR_555.

After installing the driver, Device Manager should look like this, indicating that the device has been recognized:

1.2 Flash the Firmware

Run 0_Flash.bat from the modified firmware directory. Once it finishes, the hotspot will automatically reboot once or twice.

1.3 Open an ADB Shell and Modify TTL

Once the hotspot boots, you should see ports like these in Device Manager:

Navigate to the tools folder inside the modified firmware directory. In a Command Prompt window, run adb shell. You should now have a root shell on the hotspot.

Copy the entire block below. Make sure you don’t miss any lines, then paste it into the shell and press Enter. This creates a TTL-modification script and configures it to run at startup.

Edit: Thanks to for spotting an error in the IPv6 hop-limit (HL) settings. The script below has been updated to fix it.

cat << 'EOF' > /etc/init.d/set_ttl && chmod +x /etc/init.d/set_ttl && ln -sf /etc/init.d/set_ttl /etc/rc3.d/S99set_ttl
#!/bin/sh
# chkconfig: 2345 99 10
# description: Set TTL to 64 for IPv4 and HL to 255 for IPv6 on rmnet_data0

INTERFACE="rmnet_data0"
TARGET_TTL=64
TARGET_HL=255

if command -v iptables >/dev/null 2>&1; then
    IPTABLES="iptables"
else
    echo "Error: iptables not found."
    exit 1
fi

start() {
    echo "Starting: Setting IPv4 TTL to $TARGET_TTL and IPv6 HL to $TARGET_HL for $INTERFACE..."

    $IPTABLES -t mangle -C POSTROUTING -o $INTERFACE -j TTL --ttl-set $TARGET_TTL >/dev/null 2>&1
    if [ $? -ne 0 ]; then
        $IPTABLES -t mangle -I POSTROUTING -o $INTERFACE -j TTL --ttl-set $TARGET_TTL
    fi

    if command -v ip6tables >/dev/null 2>&1; then
        ip6tables -t mangle -C POSTROUTING -o $INTERFACE -j HL --hl-set $TARGET_HL >/dev/null 2>&1
        if [ $? -ne 0 ]; then
            ip6tables -t mangle -I POSTROUTING -o $INTERFACE -j HL --hl-set $TARGET_HL
        fi
    fi

    echo "TTL/HL rules applied successfully."
}

stop() {
    echo "Stopping: Removing TTL/HL rules for $INTERFACE..."

    $IPTABLES -t mangle -D POSTROUTING -o $INTERFACE -j TTL --ttl-set $TARGET_TTL >/dev/null 2>&1

    if command -v ip6tables >/dev/null 2>&1; then
        ip6tables -t mangle -D POSTROUTING -o $INTERFACE -j HL --hl-set $TARGET_HL >/dev/null 2>&1
    fi

    echo "TTL/HL rules removed."
}

case "$1" in
    start)
        start
        ;;
    stop)
        stop
        ;;
    restart)
        stop
        start
        ;;
    *)
        echo "Usage: $0 {start|stop|restart}"
        exit 1
esac

exit 0
EOF

Your TTL settings are now in place. After rebooting, you can insert a SIM card, and most plans that check TTL should work directly. For the few carriers that also check IMEI—or if you’d like the device to be less conspicuous—you can modify its IMEI as well.

Step 2: Modify IMEI

Legal notice: The information below about modifying or rewriting an IMEI is intended strictly for academic research, security testing, and lawful internal hardware development or debugging. Altering, spoofing, or cloning a mobile device’s IMEI is illegal in many jurisdictions.

One more warning: Never put two devices with the same IMEI on a cellular network simultaneously. If you use a phone’s IMEI, don’t power on the hotspot and phone at the same time. Don’t use a 4G device’s IMEI on a 5G network. Don’t use IMEI generators; using an identifier from your own hardware is one thing, but using someone else’s is asking for serious trouble.

2.1 Install the Diag Driver

Note: The directory is named Qualcomm_USB_Driver_v1.0.

Just click through the installer, then reboot Windows.

2.2 Back Up the QCN

Note: The directory is named Qualcomm_Flash_Image_Loader_v2.0.3.5.

Power on the hotspot and connect it to your computer. Open qfil.exe, click Select Port, and choose the Diagnostics port.

Next, open Tools → QCN Backup Restore and click Backup QCN to save the original IMEI and other important device data. This can take a while—around ten minutes in my case—so let the progress bar finish.

2.3 Edit the QCN

Make a copy of C:\Temp\00000000.qcn and store it somewhere safe. Then make another copy for editing.

Write down your device’s current IMEI and open the working copy of the QCN in HxD. It should look something like this:

If your current IMEI begins with 9, search for 089A; if it begins with 3, search for 083A. The third character of the hex pattern corresponds to the first digit of your IMEI. Choose the occurrence surrounded by 00 bytes.

That sequence is the IMEI stored in a readable encoded form. To encode a replacement IMEI, suppose the new number is:

3 51 23 45 67 89 01 23

Replace the highlighted bytes with:

08 3A 15 32 54 76 98 10 32

In other words, place the first digit after 08, then rearrange the remaining digits in swapped pairs. Save the file and close the hex editor.

2.4 Erase the efs2 Partition

Warning: This step is risky. The device relies on data in this partition to connect to the cellular network. If you erase it without a valid backup to restore, you may lose your IMEI and NV data, leaving the hotspot unable to connect at all.

Return to the tools folder inside the modified firmware directory. In Command Prompt, enter:

adb reboot bootloader

Wait a moment, then run:

fastboot erase efs2

When it finishes, reboot:

fastboot reboot

The device should now restart into a factory test menu. I didn’t take a picture of it, but the interface looks quite different from the normal one.

2.5 Import and Restore the Edited QCN

Go back to QFIL. Just as you did for the backup, select the Diagnostics port and open QCN Backup Restore. Select the modified QCN and click Restore QCN.

After the progress bar finishes, remove the battery to force a hard restart. Once the device boots again, return to the modified firmware’s tools directory and run adb shell, followed by:

dsm_cli set_persistent_rl

As shown below, enter 1, press Enter, then enter 3 and press Enter again.

Finally, run reboot. Once the hotspot restarts into its normal interface, the IMEI should be changed.