Repair IMEI number on Nighthawk M1 Mobile Router MR1100

telnet.sh

# Enable "charge + tether" in Settings -> Setup -> Mobile Router Setup -> Tethering
# Use a usb cable to connect (tethering) to the router on port 5510

# Useful links:
# Verify the IMEI number
# https://en.wikipedia.org/wiki/Luhn_algorithm
# Challenge/Response Generator for Sierra Wireless Cards V1.0 
# https://github.com/bkerler/SierraWirelessGen

ATI
  Manufacturer: Netgear, Incorporated
  Model: MR1100
  Revision: NTG9X50C_12. ...
  IMEI: 987654321098765
  IMEI SV: 99
  FSN: BBBBBBBBBBBBB
  +GCAP: +CGSM 
  OK
  
AT!OPENLOCK?
  AT!OPENLOCK?
  AAAAAAAAAAAAAAAA
  OK

# Compute the response with SierraWirelessGen
# ./sierrakeygen.py -l 'AAAAAAAAAAAAAAAA' -d 'MDM9x50_V1'
# AT!OPENLOCK="0480E46C7E30F561"

AT!OPENLOCK="0480E46C7E30F561"
  AT!OPENLOCK="0480E46C7E30F561"
  OK

AT!NVIMEIUNLOCK
  AT!NVIMEIUNLOCK
  OK
 
AT!NVENCRYPTIMEI=12,34,56,78,90,12,34,52
  AT!NVENCRYPTIMEI=12,34,56,78,90,12,34,52
  OK

AT!RESET
  AT!RESET
  OK

Can AT!NVENCRYPTIMEI be used more then once on a device?

I found the command in older Sierra Wireless AT Command manual pdfs, so the answer is yes. Now that the IMEI repair info is out for the Nighthawk, you can count on newer hotspots for At&t to have telnet completely blocked.

How can i run that command to change my Netgear nighthawk m1 ? Any instructions that i can follow ?

Will it works on Netgear LM1200?

Hi @gedster314 where do you get this from ? AT!NVENCRYPTIMEI=12,34,56,78,90,12,34,52

How is this script used? Would you mind reaching out to me? I’m trying out some things on the MR5100, as most of the commands still work. This would be useful for my MR1100 as well. Thank you and have a great holiday!

Hi @devfalse where do you get this from ? AT!NVENCRYPTIMEI=12,34,56,78,90,12,34,52

@devfalse would be really helpfull if you can answer my question from 17 days ago.

@True-King that is the repair IMEI; TAC, SN, and Check Digit + pad with 0 of the device.

I type AT!OPENLOCK? and it returns with a code of 16 characters. I then type AT!OPENLOCK="XXXXXXXXXXXXXXXX" and get an error. every time i do AT!OPENLOCK? it's a different code. What am i doing wrong?

./sierrakeygen.py -l 'AAAAAAAAAAAAAAAA' -d 'MDM9x50_V1'
Sorry, MDM9x50_V1 not supported....

The IMEI that you use at the end does not seem valid - why is it 16 digits long? I found this other guide https://pastebin.com/DEnGscnd that says to replace with the desired IMEI there, but why is it using 16 digits?

So when I use that, the new IMEI is 123456789012345 - so I think that means, just put the IMEI you want in that format, then add any digit at the end as a pad.

Holy Moly, @devfalse thank you for this! You have no idea how helpful this was!