TNIT-100 Industrial Tracker

I’ve acquired a TNIT-100 asset tracker from eBay but the seller did not provide the network and app keys.

It looks like Semtech designed the tracker for other OEM’s to base their design from. Mine is from a company called Cox 2M. I’ve followed Semtech’s guide to use a magnet to put it in Bluetooth pairing mode and using their Android configuration app to set new keys but it seems that this unit is running different firmware that does not enable the Bluetooth pairing function.

Has anyone played around with these TNIT-100 asset trackers from other OEMs (Browan, Cox 2M, etc) and figured out a way to recover keys? Maybe connecting serial cable and going into bootloader?