Resetting Verizon Orbic Speed RC400L firmware flash Kajeet

[TheTechDude48]

I purchased a used Kajeet branded Orbic Speed RC400L hotspot off eBay which came with a charger, carrying case and Verizon SIM. I went though the Verizon prepaid activate website and it says the device is compatible and the Verizon sim card in it will work, however I noticed when I powered on the hotspot many menu settings were locked out.

I then connected to the hotspot and navigated to 192.168.1.1 and following Verizon's manual for this device I entered in admin as the username and the wifi password as the password and nope, wasn't able to log in. To make matters worse I decided to swap a Verizon prepaid SIM from another device and everything appeared to work, it showed signal however it had no internet, and when I looked into this further I realized this device is programmed with a different APN than the Verizon default for Kajeet's services, and I can't log in to change this.

I then attempted to hold down the reset button on the device for 5 seconds following Verizon's manual for this device while it was powered on and it did not reset, nothing I did would let me factory reset the device.

I then started to look into other options.

If I connect the device powered off to a laptop via USB, press and hold both the power and reset buttons I hear the device connect sound on Windows. I checked Device Manager and see the device as a Qualcomm device on COM10. I opened up QPST which confirms this device is on COM10 and in download mode.

This is good news as this appears to be how I can flash new firmware onto this device, but sadly there is no instructions on how to do this nor the stock Verizon firmware to download for this device.

When connecting the device powered up normally QPST detects it on COM10 but isn't able to read any info about the device at all.


I am stuck now on what to do, part of me wants to activate it on Verizon prepaid and then call Verizon when it has no internet and see if they can remotely reset it or program the right APN settings into the device to see if it'll work, however I don't know if they'll be able to do this.

 

[TheTechDude48]

I’m looking into acquiring a second Orbic Speed hotspot new from Verizon and making a backup of that firmware and then flashing it to this other hotspot using the Qualcomm download mode to recover it as well as uploading it and making instructions here for anyone else who runs into this issue.

That seems to be the only way to do a complete hard reset since the firmware on the one I have is locked and the reset button doesn’t do anything in its regular powered up state.


There are various tutorials for Qualcomm based devices on how to make an entire firmware backup or dump of the device so I’m hoping those will work with this device as well.


I’d like to see if anyone can root this hotspot given it reportedly runs Linux and install a modified OS on it as well as do band unlocking and allow it to work on any carrier too, I’ll see if I can get more info about the hardware and which Qualcomm chipset it uses.

You can obtain one of these hotspots new for a significant discount by purchasing a used Ellipsis MHS900L and exchanging it under the recall that exists for these devices.

 

[Phillip859]

I’m looking into acquiring a second Orbic Speed hotspot new from Verizon and making a backup of that firmware and then flashing it to this other hotspot using the Qualcomm download mode to recover it as well as uploading it and making instructions here for anyone else who runs into this issue. Omegle app

That seems to be the only way to do a complete hard reset since the firmware on the one I have is locked and the reset button doesn’t do anything in its regular powered up state.


There are various tutorials for Qualcomm based devices on how to make an entire firmware backup or dump of the device so I’m hoping those will work with this device as well.


I’d like to see if anyone can root this hotspot given it reportedly runs Linux and install a modified OS on it as well as do band unlocking and allow it to work on any carrier too, I’ll see if I can get more info about the hardware and which Qualcomm chipset it uses.

You can obtain one of these hotspots new for a significant discount by purchasing a used Ellipsis MHS900L and exchanging it under the recall that exists for these devices.

Xposed is incompatible with the ART runtime. That means it won't work on Lollipop.

 

[EdnaDarling]

How can i
Make an backup of a normal orbic hotspot

 

[Renate]

I have an Orbic Speed that I got in exchange for an Ellipse with the battery problem.
I had already wasted more money on the 8800L so I really didn't need the Orbic.

I was playing around trying to get it into EDL mode.
The normal connect is RNDIS.
I tried to find EDL test points, but nothing seemed to work.
I tried beating on it and actually got it into 11f6/900e QHSUSB__BULK, which is certainly strange. (Should be 05c6/9008).
I haven't been able to get there again, it may have just been really corrupted. Also, it didn't respond correctly to Sahara and got wedged.

But... I did find a test point to reliably put it into Fastboot mode! I was surprised. I can getvar and reboot but no reboot-edl or oem edl.
The test point is under the top left corner of the LCD, the first point in the corner. Just ground it during reset.
You have to ease the LCD display up a bit.

Does anyone know any good Orbic OEM commands?

Edit: Lol! That was quick. I just discovered that if you connect the "Fastboot" test point to the test point immediately to the right it goes into EDL.
I haven't got a loader for it, but Sahara gives me HWID: 000480e100000000, MSM: 000480e1, OEM: 0000, Model: 0000, Hash: cc3153a80293939b.
I haven't found a loader yet because my internet is so crappy. Yeah, Verizon.

For Fastboot: Connect Sense to Gnd
For EDL: Connect Sense to 1.8V

If you're timid, use a resistor (I used a 1k).

The loader that you want is:

https://github.com/bkerler/Loaders/qualcomm/patched/mdm9x07/prog_nand_firehose_9x07.mbn

This uses NAND storage.
The partioning is not GPT, it's something else.
Partitions are: sbl, mibib, efs2, dynamic_nv, efs2_bak, tz, rpm, aboot, boot, scrub, modem, misc, recovery, usrdata, recoveryfs, sec, system
The boot image is Red Hat UBI.

Edit: I got tired of this thing sitting around disassembled, so I soldered in a tiny magnetic reed switch and buttoned it up.
Now if I want to get to EDL I just park a magnet in the top of the case and hit reset.
I did this before to my ereader (Onyx Poke3) too.

 

[rich hathaway]

@Renate
Are you still fooling with this device?
I told you I got one a couple weeks ago, I have my workup done for it. I also go the factory for it and patched it so it actually works now lol, it would only work before if you were on I think it was v1.5.1 now I have it set to force load everytime and patched the version check, I have full reloadable firmware made up for it now and can erase the device to 0 and then recover it to fully working.
I never could get that loader to work, i have to find a diff one for this model
here is a few screenshots

imei repair was different for this one than on other similar devices

We were talking about its comports in that 8800 thread, I baked enabled ports into the first firmware build I made for this one but then later found a way to enable them without needing to load firmware, if you need your ports enabled on yours hit me up.
Someone sent me a moxee device a few days ago and while they are basically the same looking device it is a deceiving similarity, cannot use the same firmware or loader and the board layouts are much different, the Verizon orbic model is much better than the moxee device at first glance the only notable diff is the micro USB port but looks can be deceiving lol.
the dumbed-down kernel with almost none of the needed modules makes it live up to its entry-level status.

 

[Renate]

Mmm, I don't need dumber Verizon hot spots, I need a smarter one!
It's too bad that the NetGear NightHawk M1 and M6 don't have the Verizon bands.

 

[rich hathaway]

I have put hundreds of M1's on vzw, it only lacks b13 but most markets have 2, 4 & 66, they work fine on vzw and M6 I have put many on vzw also

 

[mjg59]

Figured out a few things about my RC400L. First, to enable ADB, send a USB control message of type LIBUSB_REQUEST_TYPE_VENDOR, request 0xa0, a value of 0, and no data. The device will now reboot. adb is now enabled, but rndis has been disabled (regardless of what you set USB tethering to). However, it's also exposed the DIAG and AT endpoints, so if you have drivers installed for that you can just connect to the AT port and send AT+SER=9,1 which will switch to a mode that exposes adb, diag, at, and rndis. adb is running as an unprivileged user, but if you connect over the AT interface you can also run AT+SYSCMD= with a Linux command after the equals sign, and it'll run that as root. I was hoping to find a way to reboot into fastboot via software but haven't had any luck on that so far, so I guess I'll have to crack the case open.

 

[mjg59]

Unfortunately it's not possible to configure the Orbic to just boot when plugged into USB - it's actually booting Linux, but simply displaying a charging screen instead of enabling USB or starting the modem stack. This is controlled by the "androidboot.poweronreason=" parameter that's passed on the kernel command line, and several different components parse this. The easiest solution I've found is to dump the bootloader (it's /dev/mtdblock7) and search for the byte sequence "03 02 00 0a 20" and replace the 20 with ff. 20 is the value read from the power management controller that indicates the device powered up because it was plugged into USB - replacing that with ff means the bootloader no longer understands that, and falls back to describing it as a hard reset. This value is interpreted as a legitimate bootup and everything works.

 

[chimchim54321]

Unfortunately it's not possible to configure the Orbic to just boot when plugged into USB - it's actually booting Linux, but simply displaying a charging screen instead of enabling USB or starting the modem stack. This is controlled by the "androidboot.poweronreason=" parameter that's passed on the kernel command line, and several different components parse this. The easiest solution I've found is to dump the bootloader (it's /dev/mtdblock7) and search for the byte sequence "03 02 00 0a 20" and replace the 20 with ff. 20 is the value read from the power management controller that indicates the device powered up because it was plugged into USB - replacing that with ff means the bootloader no longer understands that, and falls back to describing it as a hard reset. This value is interpreted as a legitimate bootup and everything works.

Any chance at getting some 5000 foot guide/direction on how to do this? I haven't messed with ADB in the last 10 or so years . I would love to get my RC400L setup to auto start from a powered off state when the USB power is connected. My use case is a rpi running a remote weather station and camera that posts to twitter every 5 minutes. I have access to the setup, but it's a 15 minute drive each way!

 

[$cronos_]

I have an Orbic Speed that I got in exchange for an Ellipse with the battery problem.
I had already wasted more money on the 8800L so I really didn't need the Orbic.

I was playing around trying to get it into EDL mode.
The normal connect is RNDIS.
I tried to find EDL test points, but nothing seemed to work.
I tried beating on it and actually got it into 11f6/900e QHSUSB__BULK, which is certainly strange. (Should be 05c6/9008).
I haven't been able to get there again, it may have just been really corrupted. Also, it didn't respond correctly to Sahara and got wedged.

But... I did find a test point to reliably put it into Fastboot mode! I was surprised. I can getvar and reboot but no reboot-edl or oem edl.
The test point is under the top left corner of the LCD, the first point in the corner. Just ground it during reset.
You have to ease the LCD display up a bit.

Does anyone know any good Orbic OEM commands?

Edit: Lol! That was quick. I just discovered that if you connect the "Fastboot" test point to the test point immediately to the right it goes into EDL.
I haven't got a loader for it, but Sahara gives me HWID: 000480e100000000, MSM: 000480e1, OEM: 0000, Model: 0000, Hash: cc3153a80293939b.
I haven't found a loader yet because my internet is so crappy. Yeah, Verizon.

For Fastboot: Connect Sense to Gnd
For EDL: Connect Sense to 1.8V

If you're timid, use a resistor (I used a 1k).

The loader that you want is:

https://github.com/bkerler/Loaders/qualcomm/patched/mdm9x07/prog_nand_firehose_9x07.mbn

This uses NAND storage.
The partioning is not GPT, it's something else.
Partitions are: sbl, mibib, efs2, dynamic_nv, efs2_bak, tz, rpm, aboot, boot, scrub, modem, misc, recovery, usrdata, recoveryfs, sec, system
The boot image is Red Hat UBI.

Edit: I got tired of this thing sitting around disassembled, so I soldered in a tiny magnetic reed switch and buttoned it up.
Now if I want to get to EDL I just park a magnet in the top of the case and hit reset.
I did this before to my ereader (Onyx Poke3) too.

magnetic reed switch is so ****ing clever so it doesnt have to be disassembled to use testpoints for edl

 

[mjg59]

Any chance at getting some 5000 foot guide/direction on how to do this? I haven't messed with ADB in the last 10 or so years . I would love to get my RC400L setup to auto start from a powered off state when the USB power is connected. My use case is a rpi running a remote weather station and camera that posts to twitter every 5 minutes. I have access to the setup, but it's a 15 minute drive each way!

Ok, this is extremely at your own risk - I've attached a zip file with a couple of files.

1. Download https://www.verizon.com/support/verizon-orbic-speed-mobile-hotspot-update-instructions/ and install it.
2. Unzip this zip file into the update app directory
3. Download https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html .
4. Plug in your hotspot
5. Run the update app. Hit start. Wait until you hear the Windows device disconnected sound and unplug your hotspot. Quit the update app.
6. Plug your hotspot back in. Device Manager should now show a bunch of com ports that weren't there before.
7. Open a command prompt and go to the update app directory. Run adb push orbic/* /tmp
8. Run Putty and tell it to make a serial connection. Choose the COM port that Device Manager has listed with AT in the name.
9. Type AT. You should get back an "OK" response. Type AT+SYSCMD=cp /tmp/sshell /sbin
10. Type AT+SYSCMD=chown root /sbin/sshell
11. Type AT+SYSCMD=chmod 4755 /sbin/sshell
12. Go back to the command prompt and run adb shell
13. Type sshell
14. This is the dangerous part. If you want to modify your existing bootloader, run dd if=/dev/mtdblock7 of=/tmp/aboot and then use adb pull to copy it back to your computer. Modify it as described above, and then use adb push to copy it back into /tmp on the hotspot. If you're willing to risk bricking your device if the bootloader is somehow incompatible, you can just use the copy that was in the zip file.
15. adb shell back into the device and run sshell again. Run dd if=/tmp/aboot of=/dev/mtdblock7 oflags=sync . The patched bootloader is now installed. Run reboot.

It's probably fine to just use the bootloader I've included, but it does seem to vary between firmware releases, so if you feel up to patching it yourself then I'd recommend that (make sure that your bootloader only contains one copy of the byte sequence I mention - if there's more then let me know and I'll figure out where the patch needs to go.

 

[chimchim54321]

Ok, this is extremely at your own risk - I've attached a zip file with a couple of files.

1. Download https://www.verizon.com/support/verizon-orbic-speed-mobile-hotspot-update-instructions/ and install it.
2. Unzip this zip file into the update app directory
3. Download https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html .
4. Plug in your hotspot
5. Run the update app. Hit start. Wait until you hear the Windows device disconnected sound and unplug your hotspot. Quit the update app.
6. Plug your hotspot back in. Device Manager should now show a bunch of com ports that weren't there before.
7. Open a command prompt and go to the update app directory. Run adb push orbic/* /tmp
8. Run Putty and tell it to make a serial connection. Choose the COM port that Device Manager has listed with AT in the name.
9. Type AT. You should get back an "OK" response. Type AT+SYSCMD=cp /tmp/sshell /sbin
10. Type AT+SYSCMD=chown root /sbin/sshell
11. Type AT+SYSCMD=chmod 4755 /sbin/sshell
12. Go back to the command prompt and run adb shell
13. Type sshell
14. This is the dangerous part. If you want to modify your existing bootloader, run dd if=/dev/mtdblock7 of=/tmp/aboot and then use adb pull to copy it back to your computer. Modify it as described above, and then use adb push to copy it back into /tmp on the hotspot. If you're willing to risk bricking your device if the bootloader is somehow incompatible, you can just use the copy that was in the zip file.
15. adb shell back into the device and run sshell again. Run dd if=/tmp/aboot of=/dev/mtdblock7 oflags=sync . The patched bootloader is now installed. Run reboot.

It's probably fine to just use the bootloader I've included, but it does seem to vary between firmware releases, so if you feel up to patching it yourself then I'd recommend that (make sure that your bootloader only contains one copy of the byte sequence I mention - if there's more then let me know and I'll figure out where the patch needs to go.

Awesome, thanks! What could possibly go wrong!!!!!

 

[chimchim54321]

Ok, this is extremely at your own risk - I've attached a zip file with a couple of files.

1. Download https://www.verizon.com/support/verizon-orbic-speed-mobile-hotspot-update-instructions/ and install it.
2. Unzip this zip file into the update app directory
3. Download https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html .
4. Plug in your hotspot
5. Run the update app. Hit start. Wait until you hear the Windows device disconnected sound and unplug your hotspot. Quit the update app.
6. Plug your hotspot back in. Device Manager should now show a bunch of com ports that weren't there before.
7. Open a command prompt and go to the update app directory. Run adb push orbic/* /tmp
8. Run Putty and tell it to make a serial connection. Choose the COM port that Device Manager has listed with AT in the name.
9. Type AT. You should get back an "OK" response. Type AT+SYSCMD=cp /tmp/sshell /sbin
10. Type AT+SYSCMD=chown root /sbin/sshell
11. Type AT+SYSCMD=chmod 4755 /sbin/sshell
12. Go back to the command prompt and run adb shell
13. Type sshell
14. This is the dangerous part. If you want to modify your existing bootloader, run dd if=/dev/mtdblock7 of=/tmp/aboot and then use adb pull to copy it back to your computer. Modify it as described above, and then use adb push to copy it back into /tmp on the hotspot. If you're willing to risk bricking your device if the bootloader is somehow incompatible, you can just use the copy that was in the zip file.
15. adb shell back into the device and run sshell again. Run dd if=/tmp/aboot of=/dev/mtdblock7 oflags=sync . The patched bootloader is now installed. Run reboot.

It's probably fine to just use the bootloader I've included, but it does seem to vary between firmware releases, so if you feel up to patching it yourself then I'd recommend that (make sure that your bootloader only contains one copy of the byte sequence I mention - if there's more then let me know and I'll figure out where the patch needs to go.

Some of the steps are just a touch off on syntax, but it all worked successfully with my edit of aboot locally on my Windows machine via the HxD app.
Does the battery bypass file work to allow the RC400L to boot without the battery installed? If so, is the file specific to the RC400L?

 

[mjg59]

Some of the steps are just a touch off on syntax, but it all worked successfully with my edit of aboot locally on my Windows machine via the HxD app.
Does the battery bypass file work to allow the RC400L to boot without the battery installed? If so, is the file specific to the RC400L?

Oh, please let me know what I screwed up and I'll fix it in case anyone else follows this! But no, as far as I can tell if the battery is missing the code changes behaviour at an earlier point, and I haven't looked into that (or whether it's even possible for it - some devices insist on the battery because they may instantaneously draw more power than is provided over USB and rely on the battery to make up for it). But this specific patch is very specific to the RC400L bootloader, and the entire process would probably need to be modified for other devices.

 

[Renate]

I have put hundreds of M1's on vzw, it only lacks b13 but most markets have 2, 4 & 66, they work fine on vzw and M6 I have put many on vzw also

B13 at 750 MHz is very important when you're in the sticks.
In contrast, 5G is something that will never make any difference to me.

(A bit off-topic)

I'm currently running PtMP (microwave) internet off a Ubiquiti LTU Mini and a separate router/WiFi.
I'd like to be able to seasonally switch over to a 4G LTE modem with only wired ethernet.
So I don't want a modem with anything (no NAT, no WiFi), only a RJ45.
I see the NetGear LM1200. Is this any good? That 5G is useful to at least discount the 4G equipment.
Also, this is a battery-less device.

I never liked the MiFi 8800L. I found that when the LTE reception was flailing it would disrupt the regular connection between local devices on the WiFi.

 

[chimchim54321]

Ok, this is extremely at your own risk - I've attached a zip file with a couple of files.

1. Download https://www.verizon.com/support/verizon-orbic-speed-mobile-hotspot-update-instructions/ and install it.
2. Unzip this zip file into the update app directory
3. Download https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html .
4. Plug in your hotspot
5. Run the update app. Hit start. Wait until you hear the Windows device disconnected sound and unplug your hotspot. Quit the update app.
6. Plug your hotspot back in. Device Manager should now show a bunch of com ports that weren't there before.
7. Open a command prompt and go to the update app directory. Run adb push orbic/* /tmp

step 7 - my win10 PC didn't care for the orbic/* portion. Either use just "orbic" or use orbic/sshell (unteseted but would likely work)

1. Run Putty and tell it to make a serial connection. Choose the COM port that Device Manager has listed with AT in the name.
2. Type AT. You should get back an "OK" response. Type AT+SYSCMD=cp /tmp/sshell /sbin

second half of step 9, the path is wrong and strangely the terminal responds back with OK. The path should be /tmp/orbic/sshell

1. Type AT+SYSCMD=chown root /sbin/sshell
2. Type AT+SYSCMD=chmod 4755 /sbin/sshell
3. Go back to the command prompt and run adb shell
4. Type sshell
5. This is the dangerous part. If you want to modify your existing bootloader, run dd if=/dev/mtdblock7 of=/tmp/aboot and then use adb pull to copy it back to your computer. Modify it as described above, and then use adb push to copy it back into /tmp on the hotspot. If you're willing to risk bricking your device if the bootloader is somehow incompatible, you can just use the copy that was in the zip file.
6. adb shell back into the device and run sshell again. Run dd if=/tmp/aboot of=/dev/mtdblock7 oflags=sync . The patched bootloader is now installed. Run reboot.

It's probably fine to just use the bootloader I've included, but it does seem to vary between firmware releases, so if you feel up to patching it yourself then I'd recommend that (make sure that your bootloader only contains one copy of the byte sequence I mention - if there's more then let me know and I'll figure out where the patch needs to go.

I think that was it for the issues I had. At least with the directions The adb pull put the file in a weird AppData path location, and perhaps a fully qualified path for the target of the pull would be advisable.

My old modem would often sort of flip out and require a power cycle to get back to normal. I built a relay module that could be operated by one of the gpio pins on the Rpi, and it would cut the external power as well as the internal battery. Was much easier as the internal battery had wires and a plug that I could splice into. For this modem I think I'm going to have to design and print a battery adapter that will allow me to put a set of relay contacts between the battery tabs and the modem battery buttons.

 

[$cronos_]

Ok, this is extremely at your own risk - I've attached a zip file with a couple of files.

1. Download https://www.verizon.com/support/verizon-orbic-speed-mobile-hotspot-update-instructions/ and install it.
2. Unzip this zip file into the update app directory
3. Download https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html .
4. Plug in your hotspot
5. Run the update app. Hit start. Wait until you hear the Windows device disconnected sound and unplug your hotspot. Quit the update app.
6. Plug your hotspot back in. Device Manager should now show a bunch of com ports that weren't there before.
7. Open a command prompt and go to the update app directory. Run adb push orbic/* /tmp
8. Run Putty and tell it to make a serial connection. Choose the COM port that Device Manager has listed with AT in the name.
9. Type AT. You should get back an "OK" response. Type AT+SYSCMD=cp /tmp/sshell /sbin
10. Type AT+SYSCMD=chown root /sbin/sshell
11. Type AT+SYSCMD=chmod 4755 /sbin/sshell
12. Go back to the command prompt and run adb shell
13. Type sshell
14. This is the dangerous part. If you want to modify your existing bootloader, run dd if=/dev/mtdblock7 of=/tmp/aboot and then use adb pull to copy it back to your computer. Modify it as described above, and then use adb push to copy it back into /tmp on the hotspot. If you're willing to risk bricking your device if the bootloader is somehow incompatible, you can just use the copy that was in the zip file.
15. adb shell back into the device and run sshell again. Run dd if=/tmp/aboot of=/dev/mtdblock7 oflags=sync . The patched bootloader is now installed. Run reboot.

It's probably fine to just use the bootloader I've included, but it does seem to vary between firmware releases, so if you feel up to patching it yourself then I'd recommend that (make sure that your bootloader only contains one copy of the byte sequence I mention - if there's more then let me know and I'll figure out where the patch needs to go.

wondering if it has uart testpoints, and if so, please send a pinout

 

[rich hathaway]

B13 at 750 MHz is very important when you're in the sticks.
In contrast, 5G is something that will never make any difference to me.

Yes the lower end of the spectrum is better for penetrating buidings and such, but if you have a tower (line-of-site) or maybe not to far and not to obstructed b13 is not needed to get good service, I have a tower at about 8miles not line of site and b66 works fine for me here on an m1

I'd like to be able to seasonally switch over to a 4G LTE modem with only wired ethernet.
So I don't want a modem with anything (no NAT, no WiFi), only a RJ45.
I see the NetGear LM1200. Is this any good? That 5G is useful to at least discount the 4G equipment.
Also, this is a battery-less device.

I have not had that device before so I am not familiar with it and not sure what it costs but the m2000 is a fine device and can run without a battery with a simple mod, no rj45 coming out but the usb-C can be cheaply adapted over to rj45, and this device can be bought for cheap (35 bucks) on ebay if you look around there are many for 50 bucks out there.
if you need help pulling in signal in your location the FW2000 is an excellent device, its expensive but I can tell you I am using one now and it is a beast with built in high power antennas it really pulls the signal in and is battery - less