Caveats before I go further:
- This probably just voided the warranty on a $400 device
- It's possible that firmware updates or other processes could make this stop working at any time. The IMEI is an identifier on the modem's memory, not the Unifi memory.
- Modification of IMEI may not be legal where you live. You should do your own research before going further.
- If you are doing all of this work you should probably just look at DIY-ing with an M.2 RM551E or similar and a PoE adapter...
- It is entirely possible (and likely) that T-Mobile (already) recognizes this activity for what it is and may take action against your account. IMEI is far from the only metric that networks have for profiling their clients. For what it's worth though, there are a good number of reports of people using 3rd party modems on TMHI for many years now with no issues. YMMV and that can change at any time.
The 5G Max lineup is powered by the Sierra EM9191 modem. This modem exposes an AT interface that you can connect to directly and send raw AT commands. You can find this at /dev/wwan0at0. I did all of this without any SIM inserted.
Connect to the 5G Max via SSH. From there you can use socat in the SSH session to open up an AT connection with the modem:
socat - /dev/wwan0at0,crnl
With socat running you can run AT commands against the modem. I found a list of these commands here for the EM9191.
Note that the AT interface is already in use by the Ubiquiti services that run on the device. This means that when you connect you'll see a loop of output. To disable these services so that you can sanely interact with the AT interface yourself you can run:
. /etc/mbbcfg/modem_cfg.sh
inittab_set_modem_init
kill -HUP 1
Then after you are done with your AT commands, re-enable with:
. /etc/mbbcfg/modem_cfg.sh
inittab_unset_modem_init
kill -HUP 1
Now the trickery: connect to the AT interface and reload the non-volatile memory on the device so that you can run the 'one-time' IMEI write:
AT!ENTERCND="A710";!IMAGE=0,0;!IMAGE=0,1;!IMAGE=0;!NVRESTORE=0
A710 is the standard password to get to the custom functionalities on the modem. You probably even saw it earlier from the Unifi AT command loop. This sequence was taken from this forum post.
Now the doors are off. Write in IMEI of your TMHI gateway (found in the app). The command is zero-padded at the end and separated by commas every 2 characters. See the command doc. IMEIs have a check-digit but since you're copying the existing IMEI you don't need to calculate anything. Just format:
AT!NVENCRYPTIMEI=12,34,56,78,90,12,34,70
You should see the device read back out a confirmation and OK. Run an ATI to quickly check if your new IMEI is set:
ATI
ATI
Manufacturer: Sierra Wireless, Incorporated
Model: EM9291
Revision: SWIX65C_02.17.08.00 944ad5 jenkins 2024/08/01 20:22:05
IMEI: 123456789012347
IMEI SV: 5
Now reset the modem:
AT!RESET
Done. Re-enable the Unifi services with the inittab command, insert your TMHI SIM, and then set your APN in the Unifi settings to fbb.home (though fast.tmobile.com reportedly works as well). You should give everything a reboot for good measure, too.
Happy 5G trails.