Verizon MiFi 8800L hot spot mods, hacking
- Thread starter Renate
- Start date
-
- Tags
- verizon mifi
Heard a pop? That's not good.
Do you know how to check diodes with your meter? Check them.
Hadn't you pushed the power button before?
What's the source of 5V?
Did you short or disconnect something on your breadboard?
Didn't you get those buck converters?
Can you connect to the WiFi?
Even if the backlight was gone, it should be detecting the "battery".
There's more wrong here.
How were you connecting to the battery connector? Did it short there?
If you shorted the ~4.3V to either of the resistors, that would be bad.
Do you know how to check diodes with your meter? Check them.
Hadn't you pushed the power button before?
What's the source of 5V?
Did you short or disconnect something on your breadboard?
Didn't you get those buck converters?
Can you connect to the WiFi?
Even if the backlight was gone, it should be detecting the "battery".
There's more wrong here.
How were you connecting to the battery connector? Did it short there?
If you shorted the ~4.3V to either of the resistors, that would be bad.
Last edited:
Diodes are fine. Registering 99.8 for the 100k and 50 for the 51k.
Yep I’ve pushed the power button before but never held it down while it started up.
The source of the 5v is the usb-c power.
After the pop I pulled the power and pulled the battery circuits and powered it back up and that’s when I could barely see the screen.
I was going to use the buck but testing it out I have it at 3.8v but when I test it the output it’s 12v so I’m glad I checked that before hooking it back up to the battery terminals. That would have been a terrible outcome.
Not sure about the wifi. I would have to hook up the battery to it in order for it to stay on long enough to see.
So you didn't kill it completely? That's good news.
I presume that the 7 segment display on the DC converter is working ok and that's just because the camera exposure is too short?
Did you adjust the trimpot for 4V?
Do you have any idea where the pop came from?
There probably is another DC converter just for the backlight, probably an LM3630A, they're in everything.
I took a peek under the metal shield of the display, it looks like the DC converter is on the main board.
If that's what went, you'd have practically no chance to replace it, it's tiny, a few millimeters square with the contacts (BGA) under it.
I presume that the 7 segment display on the DC converter is working ok and that's just because the camera exposure is too short?
Did you adjust the trimpot for 4V?
Do you have any idea where the pop came from?
There probably is another DC converter just for the backlight, probably an LM3630A, they're in everything.
I took a peek under the metal shield of the display, it looks like the DC converter is on the main board.
If that's what went, you'd have practically no chance to replace it, it's tiny, a few millimeters square with the contacts (BGA) under it.
Attachments
Yeah I turned that a few turns clockwise and checked. Still the same voltage. Also did the counter clockwise and that also produces the same output as what I’m feeding to the input.
I was doing 3.8v output and it was outputting 12+ voltes. It must just be a faulty one.
I was doing 3.8v output and it was outputting 12+ voltes. It must just be a faulty one.
So, the current status? With the diode and two resistors is everything working? (Except the display backlight.)
Does holding down the power button permanently cause operational problems, i.e. the shutdown menu always displaying?
There's usually a very subtle click when you turn the trimpot too far in either direction.
There's a 10 turn (or more) range on that, so adjust it some.
OTOH, most of these things (if they're working) come out of the factory set at 5V.
Does holding down the power button permanently cause operational problems, i.e. the shutdown menu always displaying?
There's usually a very subtle click when you turn the trimpot too far in either direction.
There's a 10 turn (or more) range on that, so adjust it some.
OTOH, most of these things (if they're working) come out of the factory set at 5V.
Well only thing I know now is it seems to be overheating and turning off. The left side (Opposite of the power button) is super hot to the touch. I see my wifi name in the list but after a few minutes it goes away. I can imagine it’s staying it’s cooling down due to over heating on the screen - which I can’t see.
Not sure why it’s overheating since I never changed anything on the pcb itself.
I’m curious- What firmware are you running on yours?
Not sure why it’s overheating since I never changed anything on the pcb itself.
I’m curious- What firmware are you running on yours?
Last edited:
I've got the exact same versions as you.
First: Determine where the hot spot is.
Use your infrared camera. Don't have one? Aw.
Is it under the tin cans that are getting hot or the two tiny areas on top that have one IC not under the can.
I can't take off my cans easily. You can. Can you narrow it down?
Can you measure the current? Do you have one of those USB adapter things?
Can you try with the display removed? Does it stay cooler?
I found out, the display uses 12 V for backlight. It gets fed on the FPC mezzanine connector.
Where it comes from, I can't tell.
First: Determine where the hot spot is.
Use your infrared camera. Don't have one? Aw.
Is it under the tin cans that are getting hot or the two tiny areas on top that have one IC not under the can.
I can't take off my cans easily. You can. Can you narrow it down?
Can you measure the current? Do you have one of those USB adapter things?
Can you try with the display removed? Does it stay cooler?
I found out, the display uses 12 V for backlight. It gets fed on the FPC mezzanine connector.
Where it comes from, I can't tell.
Well I’ve seen to have fixed the heating issue. I used a solder wick on the 4 battery springs and tested it and it did not overheat. Must have been touching one (or more) of the pins inside.
Are these 4 areas tiny resistors or are they just the battery pins from the other side of the board. If they are just pins from the battery springs then I may solder the wires here and avoid re-soldering the battery springs to prevent touching.
Are these 4 areas tiny resistors or are they just the battery pins from the other side of the board. If they are just pins from the battery springs then I may solder the wires here and avoid re-soldering the battery springs to prevent touching.
I think that those are capacitors. It's interesting that they match the other side.
Still, don't get your soldering iron anywhere near there or you'll be searching for a capacitor in the drop of solder on the tip of your soldering iron.
I don't know whether I've done wrong encouraging you in this project.
You can't just short things and expect them to survive!
I'm pretty glib about powering things up but I'm darn careful not to short things.
Why?
The two resistor contacts feed into something important, like the processor.
The processor runs on 1.8V (you guessed it, running off another DC converter).
If you feed 4V into any pin of the processor you will run into big trouble.
Inputs have protection diodes or inherent diodes that protect the input from too high voltage.
They do that by routing the excess energy into that 1.8V supply line.
This is not a problem if that excess energy was you walking across the carpet, the 1.8V doesn't jump (much).
OTOH, if you plow 4V from a power supply into the input pin then the 1.8V line will go to ~3.6V
Suddenly your processor is consuming over 4 times (it's squared) the power.
Or even the higher voltage breaking something down.
Edit: Well, that explains that.
The regulated 1.8V is also probably the reference voltage for the 12V DC converter for the backlight.
So double the reference, double the output. The DC converter will try to generate 24V.
But LEDs are not a "soft" (i.e. resistive) load. You increase the voltage 20% the current doubles.
You double the voltage the current goes through the roof.
Edit^2: No, the corners look fine. It's the white in between that is vaporized something or other.
On the back of the display there is a little square hole with a piece of Kapton tape over it.
With the display disconnected measure between K (cathode) and A (anode) and see if it's shorted.
Still, don't get your soldering iron anywhere near there or you'll be searching for a capacitor in the drop of solder on the tip of your soldering iron.
I don't know whether I've done wrong encouraging you in this project.
You can't just short things and expect them to survive!
I'm pretty glib about powering things up but I'm darn careful not to short things.
Why?
The two resistor contacts feed into something important, like the processor.
The processor runs on 1.8V (you guessed it, running off another DC converter).
If you feed 4V into any pin of the processor you will run into big trouble.
Inputs have protection diodes or inherent diodes that protect the input from too high voltage.
They do that by routing the excess energy into that 1.8V supply line.
This is not a problem if that excess energy was you walking across the carpet, the 1.8V doesn't jump (much).
OTOH, if you plow 4V from a power supply into the input pin then the 1.8V line will go to ~3.6V
Suddenly your processor is consuming over 4 times (it's squared) the power.
Or even the higher voltage breaking something down.
Edit: Well, that explains that.
The regulated 1.8V is also probably the reference voltage for the 12V DC converter for the backlight.
So double the reference, double the output. The DC converter will try to generate 24V.
But LEDs are not a "soft" (i.e. resistive) load. You increase the voltage 20% the current doubles.
You double the voltage the current goes through the roof.
Edit^2: No, the corners look fine. It's the white in between that is vaporized something or other.
On the back of the display there is a little square hole with a piece of Kapton tape over it.
With the display disconnected measure between K (cathode) and A (anode) and see if it's shorted.
Attachments
Last edited:
No worries. This only cost me $30 and I can just get another one for that price if needed.
You’ve been a great help and great at me picking at your brain on random things that popped up in all of this - so thank you.
As for soldering it again - not sure as it just boot looped when I had the stuff on it (2 resistors and the diod). I’ll see about uploading the short video of it doing this. It would boot twice then on the third boot that’s when it would do that chime and not display anything.
You’ve been a great help and great at me picking at your brain on random things that popped up in all of this - so thank you.
As for soldering it again - not sure as it just boot looped when I had the stuff on it (2 resistors and the diod). I’ll see about uploading the short video of it doing this. It would boot twice then on the third boot that’s when it would do that chime and not display anything.
Since flash memory relies on charge injection do you think running it on twice the normal voltage might have corrupted something?
Well i went ahead and purchased the Onseego Skyus 300v that's made to be in the car environment. It looks to use the same 8800 but just in a rugged encloser.
The 8800 board in this encloser looks to not have the battery connector on it and only uses the USB for both data and power so there must be somewhere that allows it to run without the battery.
The images above are from the FCC filing for the 300v.
The 8800 board in this encloser looks to not have the battery connector on it and only uses the USB for both data and power so there must be somewhere that allows it to run without the battery.
The images above are from the FCC filing for the 300v.
Last edited:
Wow, I was going to congratulate you on building a professional unit!
I guess that they are tethering from the USB connector through the other circuit board to get ethernet connections?
The Nighthawk (not Verizon capable really) does ethernet with presumably only one processor.
I guess that they are tethering from the USB connector through the other circuit board to get ethernet connections?
The Nighthawk (not Verizon capable really) does ethernet with presumably only one processor.
Correct, these inseego devices can run without the batteries, but if you do that it kills tethering as the USB port will be "busy" now supplying power to itself so it will be a wifi unit only.
Also, it will have to have a high power input, the amp and a half from a USB port or cheap charger will no longer do and cause it to just loop, it needs 4 amp minimum I use a good 65-watt charger and it works just fine. I have been using this battery hack for a long time for some devices I have outside that run my cameras, they get too hot with the battery in them and trip the high temp threshold all summer but run fine with the battery hack and stay on 24/7
EDIT:
So I was curious if it would also be able to use the RNDIS port for ethernet with the
battery bypass using a split USB cable and it does so so it is not limited to wifi only
if you have a cable like this, I was worried about the voltage from the high-power charger
would make its way back thru the USB A part and kill the USB card in my pc but seems to be ok and running fine, here is the cable I used for reference.
I am using the type C for power and type A for data
Last edited:
Hmm, well, that's interesting.
I would have sworn that my unit does nothing on Type C power and no battery.
Now it has the battery resistors so it "looks" like a dead battery with no power connected to the battery side.
I don't know if that makes a difference, but I can't be bothered to unsolder it now to see.
OTOH, the benefit of feeding power in the battery side and using the Type C for tethering is that there is no direct connection between the two supplies.
I would have sworn that my unit does nothing on Type C power and no battery.
Now it has the battery resistors so it "looks" like a dead battery with no power connected to the battery side.
I don't know if that makes a difference, but I can't be bothered to unsolder it now to see.
OTOH, the benefit of feeding power in the battery side and using the Type C for tethering is that there is no direct connection between the two supplies.
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
6Finally got this tool working for the new device's crypted hid port, so now can change modes and enable ports without having to load modified firmware, I have it working on Linux and windows
so far I tested it on these inseego models,
fx20003
fx2000e
fw2000
fw2000e
fw2010e
m3100
m3000
fg2000
I am sad to say that it is not working on m2000, the one I need it to work on the most lol
have to work on it further.
and it does also work on the older models even though its not needed for them, it works on 8800 lol
3I had a question on how I was powering this. Just to clarify:
I'm using a USB cable that I cut up. Normally the color code is to be trusted, but check with a voltmeter if you have it.
Black is ground, green is D+ (unused), white is D- (unused), red is Vbus i.e. +5V.
The photo in the OP shows it all.
From the bottom is the ground connection to black.
Then the 100k resistor for the thermistor to ground (to make the device think that the temperature is reasonable).
Then the 51k resistor to ground to fake the device out to thinking that a battery is connected.
Then the 1 Amp diode (like a 1N4001 to 1N4007) to drop the voltage down a bit to make life easier for the device.
The banded end (i.e. the cathode) goes to the contact, the plain end (i.e. the anode goes to the red wire.
If you don't like murdering your device you could take a block of something (wood, plastic) and put four contacts on it.
Then you could leave your device unmodified. I've made some blocks for cell phones that I have for testing.
Here's a Moto E6 that I was trying to get into EDL mode. The plug has one resistor in it for thermistor.3
I called it a “weekend project”. Here's what you can do with the 8800 for use in another country.
We changed the Spanish language to Ukrainian, now there are two languages in the system, English and Ukrainian.
We use non-Verizon SIM cards, so we remove messages about non-Verizon SIM cards from the system, replace the icon with an unknown SIM with the Ukrainian flag.
Turn on icons in the main menu
The translation was made on the basis of the latest version of 2N, we add the UA index to the version
the pictures for shutdown were also changed, this picture was in English and Spanish either, it built into the executable file
added UA index to the on animation
made translation of the charging screen
Traffic counter and system update were removed from the system, these functions do not work with a non-Verizon SIM card.
A complete translation of the web interface has been made, the help had also been translated.
System backup was made from a modem that was updated on May 17, 2023 in the USA
2I run my hot spots 24/7 and they overcharge the batteries and puff up.
Verizon already did one recall on the Franklin "Ellipse".
I do a direct USB powering since many devices won't run without a battery.
The photo show the one for the MiFi 8800L with a diode, a 51k ID resistor and a 100k thermistor resistor.
It works fine, but I still wasn't happy with how warm the device got even without a battery.
So I threw away the back plate, broke the glass/touch panel off the bezel and removed the OLED display.
Now the tin covers on the processor get direct access to air and it runs a lot cooler.
It seems to work fine.
Still, I wanted to be able to run "top" and make sure that it's not thrashing too badly without the OLED and the I²C touch panel.
I plugged the MiFi into Windows 10 and identified a single HID interface with a 4 byte input record and a 4 byte output record.
I tried to read the input record, nothing was coming out.
So I wrote my 4 bytes of zeroes (in Windows that makes it 5 bytes since you have to add an unused record ID).
And lo and behold, the MiFi reset and came back with 7 interfaces, including the original HID.Code:memset(report, 0, 5); WriteFile(hid, report, 5, &n, NULL);
One of the interfaces was a CDC serial that came up as a virtual com port (VCP).
Any idea what the password could be?Code:mifi login: admin Password: Login incorrect2
