Verizon MiFi 8800L hot spot mods, hacking, pwd needed

Search This thread

stealthrt

Senior Member
Sep 28, 2011
68
6
E3D7FCF6-58A2-4A2A-AC52-0F36ACFE9553.jpeg
You can barely see the no battery graphic on the screen.
 

Renate

Recognized Contributor / Inactive Recognized Dev
Feb 3, 2012
3,231
1,437
Boston
www.temblast.com
Nexus 7 (2013)
Moto E5
Heard a pop? That's not good.
Do you know how to check diodes with your meter? Check them.
Hadn't you pushed the power button before?
What's the source of 5V?

Did you short or disconnect something on your breadboard?

Didn't you get those buck converters?

Can you connect to the WiFi?

Even if the backlight was gone, it should be detecting the "battery".
There's more wrong here.

How were you connecting to the battery connector? Did it short there?

If you shorted the ~4.3V to either of the resistors, that would be bad.
 
Last edited:

stealthrt

Senior Member
Sep 28, 2011
68
6
Heard a pop? That's not good.
Do you know how to check diodes with your meter? Check them.
Hadn't you pushed the power button before?
What's the source of 5V?

Did you short or disconnect something on your breadboard?

Didn't you get those buck converters?

Can you connect to the WiFi?
Diodes are fine. Registering 99.8 for the 100k and 50 for the 51k.

Yep I’ve pushed the power button before but never held it down while it started up.

The source of the 5v is the usb-c power.

After the pop I pulled the power and pulled the battery circuits and powered it back up and that’s when I could barely see the screen.

I was going to use the buck but testing it out I have it at 3.8v but when I test it the output it’s 12v so I’m glad I checked that before hooking it back up to the battery terminals. That would have been a terrible outcome.

F10C11C1-8963-4830-86B9-87CEB3E07192.jpeg


Not sure about the wifi. I would have to hook up the battery to it in order for it to stay on long enough to see.
 

Renate

Recognized Contributor / Inactive Recognized Dev
Feb 3, 2012
3,231
1,437
Boston
www.temblast.com
Nexus 7 (2013)
Moto E5
So you didn't kill it completely? That's good news.

I presume that the 7 segment display on the DC converter is working ok and that's just because the camera exposure is too short?
Did you adjust the trimpot for 4V?

Do you have any idea where the pop came from?
There probably is another DC converter just for the backlight, probably an LM3630A, they're in everything.
I took a peek under the metal shield of the display, it looks like the DC converter is on the main board.
If that's what went, you'd have practically no chance to replace it, it's tiny, a few millimeters square with the contacts (BGA) under it.
 

Attachments

  • trimpot.jpg
    trimpot.jpg
    19.1 KB · Views: 2

stealthrt

Senior Member
Sep 28, 2011
68
6
Yeah I turned that a few turns clockwise and checked. Still the same voltage. Also did the counter clockwise and that also produces the same output as what I’m feeding to the input.

I was doing 3.8v output and it was outputting 12+ voltes. It must just be a faulty one.
 

Renate

Recognized Contributor / Inactive Recognized Dev
Feb 3, 2012
3,231
1,437
Boston
www.temblast.com
Nexus 7 (2013)
Moto E5
So, the current status? With the diode and two resistors is everything working? (Except the display backlight.)
Does holding down the power button permanently cause operational problems, i.e. the shutdown menu always displaying?

There's usually a very subtle click when you turn the trimpot too far in either direction.
There's a 10 turn (or more) range on that, so adjust it some.
OTOH, most of these things (if they're working) come out of the factory set at 5V.
 

stealthrt

Senior Member
Sep 28, 2011
68
6
Well only thing I know now is it seems to be overheating and turning off. The left side (Opposite of the power button) is super hot to the touch. I see my wifi name in the list but after a few minutes it goes away. I can imagine it’s staying it’s cooling down due to over heating on the screen - which I can’t see.

Not sure why it’s overheating since I never changed anything on the pcb itself.

I’m curious- What firmware are you running on yours?

2D8174EC-A8A4-4006-B798-04813A1488A4.jpeg
 
Last edited:

Renate

Recognized Contributor / Inactive Recognized Dev
Feb 3, 2012
3,231
1,437
Boston
www.temblast.com
Nexus 7 (2013)
Moto E5
I've got the exact same versions as you.

First: Determine where the hot spot is.
Use your infrared camera. Don't have one? Aw.
Is it under the tin cans that are getting hot or the two tiny areas on top that have one IC not under the can.
I can't take off my cans easily. You can. Can you narrow it down?

Can you measure the current? Do you have one of those USB adapter things?
Can you try with the display removed? Does it stay cooler?

I found out, the display uses 12 V for backlight. It gets fed on the FPC mezzanine connector.
Where it comes from, I can't tell.
 

stealthrt

Senior Member
Sep 28, 2011
68
6
Well I’ve seen to have fixed the heating issue. I used a solder wick on the 4 battery springs and tested it and it did not overheat. Must have been touching one (or more) of the pins inside.

Are these 4 areas tiny resistors or are they just the battery pins from the other side of the board. If they are just pins from the battery springs then I may solder the wires here and avoid re-soldering the battery springs to prevent touching.

9DEFA354-9A17-48B4-A8AB-6D7E891B7BA3.jpeg
 

stealthrt

Senior Member
Sep 28, 2011
68
6
Oh and it does work without the lcd hooked to it.

Do these left/right corners look like your left/right corners on your lcd? Kinda looks like something blew in those areas.

0E30C204-04F7-4BFD-9152-2439C0A1FF20.jpeg
 
Last edited:

Renate

Recognized Contributor / Inactive Recognized Dev
Feb 3, 2012
3,231
1,437
Boston
www.temblast.com
Nexus 7 (2013)
Moto E5
I think that those are capacitors. It's interesting that they match the other side.
Still, don't get your soldering iron anywhere near there or you'll be searching for a capacitor in the drop of solder on the tip of your soldering iron.

I don't know whether I've done wrong encouraging you in this project.
You can't just short things and expect them to survive!
I'm pretty glib about powering things up but I'm darn careful not to short things.

Why?
The two resistor contacts feed into something important, like the processor.
The processor runs on 1.8V (you guessed it, running off another DC converter).
If you feed 4V into any pin of the processor you will run into big trouble.
Inputs have protection diodes or inherent diodes that protect the input from too high voltage.
They do that by routing the excess energy into that 1.8V supply line.
This is not a problem if that excess energy was you walking across the carpet, the 1.8V doesn't jump (much).
OTOH, if you plow 4V from a power supply into the input pin then the 1.8V line will go to ~3.6V
Suddenly your processor is consuming over 4 times (it's squared) the power.
Or even the higher voltage breaking something down.

Edit: Well, that explains that.
The regulated 1.8V is also probably the reference voltage for the 12V DC converter for the backlight.
So double the reference, double the output. The DC converter will try to generate 24V.
But LEDs are not a "soft" (i.e. resistive) load. You increase the voltage 20% the current doubles.
You double the voltage the current goes through the roof.

Edit^2: No, the corners look fine. It's the white in between that is vaporized something or other.
On the back of the display there is a little square hole with a piece of Kapton tape over it.
With the display disconnected measure between K (cathode) and A (anode) and see if it's shorted.
 

Attachments

  • snap0056.jpg
    snap0056.jpg
    527 KB · Views: 2
Last edited:

stealthrt

Senior Member
Sep 28, 2011
68
6
No worries. This only cost me $30 and I can just get another one for that price if needed.

You’ve been a great help and great at me picking at your brain on random things that popped up in all of this - so thank you.

As for soldering it again - not sure as it just boot looped when I had the stuff on it (2 resistors and the diod). I’ll see about uploading the short video of it doing this. It would boot twice then on the third boot that’s when it would do that chime and not display anything.
 

stealthrt

Senior Member
Sep 28, 2011
68
6
Edit^2: No, the corners look fine. It's the white in between that is vaporized something or other.
On the back of the display there is a little square hole with a piece of Kapton tape over it.
With the display disconnected measure between K (cathode) and A (anode) and see if it's shorted.

I'll have to do that at a later time. I already put it all back together.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    There was a question on firmware updatting the 8000/8800
    I tried a bit to find EDL test points on my 8800. Since this is my main connection that was in use I didn't try too hard at the time.
    I had an Orbic Speed that I got under warranty and don't use so I could attack it at my leisure.
    I found the EDL test points. It uses Red Hat Linux. Since I'm more Android and don't need to do anything I dropped the matter there.
    This is all related here: https://forum.xda-developers.com/t/...-firmware-flash-kajeet.4334899/#post-86616269

    (My main device, an Onyx Boox Poke3 ereader is also modified with a reed switch as I do a lot of slinging partitions around.)

    There's three test pads on upper right of the 8800 board (the same side as the battery). Shorting the left pad to the middle pad and plugging in a USB cable results in it booting in EDL mode.
  • 2
    I had a question on how I was powering this. Just to clarify:

    I'm using a USB cable that I cut up. Normally the color code is to be trusted, but check with a voltmeter if you have it.
    Black is ground, green is D+ (unused), white is D- (unused), red is Vbus i.e. +5V.
    The photo in the OP shows it all.
    From the bottom is the ground connection to black.
    Then the 100k resistor for the thermistor to ground (to make the device think that the temperature is reasonable).
    Then the 51k resistor to ground to fake the device out to thinking that a battery is connected.
    Then the 1 Amp diode (like a 1N4001 to 1N4007) to drop the voltage down a bit to make life easier for the device.
    The banded end (i.e. the cathode) goes to the contact, the plain end (i.e. the anode goes to the red wire.

    If you don't like murdering your device you could take a block of something (wood, plastic) and put four contacts on it.
    Then you could leave your device unmodified. I've made some blocks for cell phones that I have for testing.

    Here's a Moto E6 that I was trying to get into EDL mode. The plug has one resistor in it for thermistor.
    1
    I run my hot spots 24/7 and they overcharge the batteries and puff up.
    Verizon already did one recall on the Franklin "Ellipse".
    I do a direct USB powering since many devices won't run without a battery.
    The photo show the one for the MiFi 8800L with a diode, a 51k ID resistor and a 100k thermistor resistor.
    It works fine, but I still wasn't happy with how warm the device got even without a battery.
    So I threw away the back plate, broke the glass/touch panel off the bezel and removed the OLED display.
    Now the tin covers on the processor get direct access to air and it runs a lot cooler.
    It seems to work fine.

    Still, I wanted to be able to run "top" and make sure that it's not thrashing too badly without the OLED and the I²C touch panel.
    I plugged the MiFi into Windows 10 and identified a single HID interface with a 4 byte input record and a 4 byte output record.
    I tried to read the input record, nothing was coming out.
    So I wrote my 4 bytes of zeroes (in Windows that makes it 5 bytes since you have to add an unused record ID).
    Code:
    memset(report, 0, 5);
    WriteFile(hid, report, 5, &n, NULL);
    And lo and behold, the MiFi reset and came back with 7 interfaces, including the original HID.
    One of the interfaces was a CDC serial that came up as a virtual com port (VCP).
    Code:
    mifi login: admin
    Password:
    Login incorrect
    Any idea what the password could be?
    1
    There was a question on firmware updatting the 8000/8800
    I tried a bit to find EDL test points on my 8800. Since this is my main connection that was in use I didn't try too hard at the time.
    I had an Orbic Speed that I got under warranty and don't use so I could attack it at my leisure.
    I found the EDL test points. It uses Red Hat Linux. Since I'm more Android and don't need to do anything I dropped the matter there.
    This is all related here: https://forum.xda-developers.com/t/...-firmware-flash-kajeet.4334899/#post-86616269

    (My main device, an Onyx Boox Poke3 ereader is also modified with a reed switch as I do a lot of slinging partitions around.)

    There's three test pads on upper right of the 8800 board (the same side as the battery). Shorting the left pad to the middle pad and plugging in a USB cable results in it booting in EDL mode.